Security, systems and emerging technology
Know the signal behind the incident.
Independent analysis for the people who build, secure and operate technology, with the clarity to inform action and the technical depth to earn trust.

Kiteworks Asked Customers to Switch Off Its Platform for Six Hours
Kiteworks recommended a six-hour shutdown after receiving credible threat intelligence. The warning was preventive, but the missing details matter.
Read the article ↗Current reporting
Latest intelligence

Attackers Copied Every Incoming Belnet Email for Two Months
Belnet says attackers copied every incoming email sent to it and one customer from 22 July until the morning of 25 September 2026. The copied material included message contents and attachments and was transferred to external infrastructure.
Its incident notice attributes the breach to an external supplier's zero-day vulnerability. Belnet detected the incident on 24 September and says the flaw was resolved at 08:10 the following morning. Belgium's Centre for Cybersecurity is assisting. The supplier, product, actor, affected customer and message count are not named; the investigation remains open.
The practical response should follow the correspondence, not just the recipient accounts. An organisation that sent a contract, a support bundle or a recovery link needs to identify that specific material and decide whether it still creates risk. Those are examples to check, not a confirmed inventory of what was taken.
A successful delivery receipt says nothing about whether another copy exists. Likewise, containment cannot recall material already transferred elsewhere. Separate the mail service's recovery from the sender's work to revoke secrets, notify the right people and watch for convincing follow-up requests.
Build a restricted exposure list with the sending team, date, recipient and information category. Assign an owner to each item. Prioritise credentials and sensitive attachments rather than copying all affected correspondence into a new widely accessible spreadsheet. Keep the review auditable without creating another unnecessary repository of private data.
BlackTree's analysis of the recent Roundcube exploitation warning made the same operational point from a different incident: email infrastructure is not merely a communication layer.…

One Link Could Make Your WordPress Admin Create the Attacker’s Account
Patchstack has demonstrated how one crafted link can make a logged-in WordPress administrator create an attacker-controlled admin account. The affected Elementor Website Builder releases are 4.3.0 and 4.3.1; version 4.3.2 fixes the…
26 Sep 2026 · 2 min read
Microsoft Traces Four Ransomware Brands to One Repeating Playbook
Microsoft tracks Storm-2570 across incidents ending in Qilin, DragonForce, Anubis and BERT ransomware. The affiliate changes payloads while repeatedly using similar tools before encryption. That makes its earlier behaviour a useful target…
26 Sep 2026 · 2 min read
Your Salesforce Agent Could Have Sent the Phish in Slack
Salesforce has changed the defaults for a demonstrated phishing path through Agentforce and Slack. Zenity's SalesBleed research shows how malicious instructions in a public CRM lead could make an agent send a…
26 Sep 2026 · 2 min read
How a Public iCloud Calendar Became a macOS Malware Loader
A public calendar can carry hostile instructions without the calendar application being vulnerable. Kaspersky's MacSync investigation describes a malicious downloader that deliberately feeds public iCloud calendar content to a shell. Apple Calendar…
26 Sep 2026 · 2 min readRevised reporting
Recently updated
How OpenAI’s Agents Turned a Read-Only Web Task Into a Public Message Board
Researchers reconstructed roughly 18,000 posts from OpenAI agents that used public wikis to coordinate, share answers and route around intended restrictions.
Read articleJetBrains Left TeamCity Unpatched and Put Cadence Source Code and Credentials Within Reach
JetBrains closed the Cadence investigation after finding attackers could have reached current storage containing source code and credentials. The investigation is over. The risk is not.
Read articleTwo Arrests Put a Number on TeamPCP’s Supply-Chain Damage
Google says an undercover Mandiant analyst reached TeamPCP's inner circle, watched stolen credentials accumulate and helped disrupt the group's follow-on access.
Read articleThe Phishing Email Really Came From Trezor. That Was the Problem.
Brevo closed the SSO path behind the Trezor phishing incident. Four days later, the attackers returned through a Cloudflare key and reached scripts embedded across customer websites.
Read articleThe Rust Crates Were Removed in Under Two Hours. The Build Hosts Still Need Incident Response.
The malicious crates and the new video-call campaign are separate incidents. They meet at the same target: the people and credentials trusted to publish Rust packages.
Read articleGeographic context
Regional intelligence

Attackers Copied Every Incoming Belnet Email for Two Months
A supplier zero-day let attackers copy every incoming email sent to Belnet and one…
Read Europe ↗
Hackers Used AI to Move Faster. Then They Exposed Their Own Playbook.
Two Latin American intrusion campaigns show AI accelerating attacker troubleshooting, but exposed consoles and…
Read LATAM ↗
One Healthcare Archive Was Breached. 9.5 Million Patients Paid the Price.
A breach at Aesto Health reached 9.5 million people across at least two dozen…
Read AMER ↗
Fake Job Interviews Put 30,000 Devices and 7,000 Wallets in North Korea…
The coding test was the payload. Officials say the developer-focused campaign accumulated more than…
Read APAC ↗
The Gambia Assented to a Modern Privacy Law. The Next Step Is Operational.
The Gambia has assented to a modern privacy framework covering extraterritorial processing, data rights,…
Read Africa ↗Coverage leaders
Vendor intelligence
Microsoft Fixed Eighteen Cloud Flaws Before Customers Could Touch Them
Microsoft disclosed fixes for 18 vulnerabilities across Azure and Copilot-branded services. Customers did not…
Read Microsoft ↗
Cisco Found a Missing Login Check in Its Data-Centre Control Panel
The software coordinating a data centre deserves scrutiny before an attacker proves why. Cisco…
Read Cisco ↗
One Request Could Make Adobe AEM Forms Run Code Without a Login
According to Adobe bulletin APSB26-151, Adobe has patched six vulnerabilities in Experience Manager Forms…
Read Adobe ↗
The Malicious npm Release Had Valid Provenance Because the Build System Wo…
The poisoned package was not smuggled around the build system. GitHub Actions built it,…
Read GitHub ↗
The Phone Was Stolen. An AI Voice Agent Asked the Owner to Unlock It.
A stolen iPhone protected by Activation Lock is worth less to a thief. AnonyMousKIT…
Read Apple ↗Practical archive
Lab &
Legacy
Field-tested guidance for keeping older systems useful, secure and reliable long after mainstream documentation has moved on. Practical fixes, automation and deployment notes are drawn from real environments and written for the operators who still maintain them.




