From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab
Executive summary An MDR alert recently led our team to an exposed server that was doing more than hosting payloads. It was functioning as a fully operationa...
vendor
20 articles
Beyond the Model: Harnessing Frontier AI for Stronger Cyber Defense
PSA: WordPress Core Patched Unauthenticated Remote Code Execution Vulnerability Chain
On July 17, 2026, the WordPress Security Team released updates to WordPress core addressing two security vulnerabilities. The first is an unauthenticated SQL...
CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core
Overview On July 17, 2026, a GitHub Security Advisory was published for CVE-2026-63030, a critical unauthenticated remote code execution vulnerability affect...
Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities
Cloudflare has deployed two WAF rules in response to high-severity vulnerabilities disclosed to us by the WordPress security team.
Metasploit Wrap Up: An HTTP to SMB relay plus Payload Improvements
Metasploit Wrap Up Housekeeping While the Metasploit Framework will be continuing its weekly release cadence, bringing you dear reader our latest content, th...
CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild
Overview On July 14, 2026, Microsoft published a security advisory addressing CVE-2026-58644, a critical remote code execution (RCE) vulnerability affecting ...
Microsoft at Black Hat USA 2026: Defending trust in the age of AI and supply chain attacks
Join Microsoft Security at Black Hat USA 2026 for supply chain research, hands-on security experiences, expert conversations, and our reception. The post Mic...
ACR Stealer: Two observed intrusion chains amid increased threat activity
From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are s...
Wordfence Intelligence Weekly WordPress Vulnerability Report (July 6, 2026 to July 12, 2026)
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPres...
CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities
Four Microsoft SharePoint Server vulnerabilities are under active exploitation, prompting CISA to issue a hardening alert. An additional high-severity flaw r...
Least privilege for AI agents: Identity, access, and tool binding
As AI agents become more autonomous, strong identity, access, and auditing controls are critical to keeping them secure. The post Least privilege for AI agen...
Announcing the General Availability of Prisma AIRS AI Gateway
Every modern enterprise is moving from an organization run by software to one orchestrated by AI, creating a tension between velocity and control. To resolve...
Palo Alto Networks and AT&T - Delivering Quantum-Resilient SASE Fabric
By Yogesh Ranade from Palo Alto Networks, and Senthil Ramakrishnan from AT&T The digital world is currently navigating a dual-speed revolution. Acceleration ...
The best defenders build AI agents together: Join Tenable for SWARM at Black Hat ’26
Agentic AI use is exploding, yet most security teams are building agents in isolation. Tenable is hosting SWARM, a build event at Black Hat 2026, for securit...
Sunsetting the Public AttackerKB Platform
What’s changing, where AttackerKB-style analysis will live, and how users can continue finding Rapid7 vulnerability intelligence. On August 18, Rapid7 will s...
The TTF Trap: A Global Campaign of a Low-Detection Lua Loader
FortiGuard Labs analyzes a global phishing campaign using obfuscated JScript, disguised .ttf files, and Lua loaders to deliver RATs and infostealers.
Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery
Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This analysis breaks down the attack ch...
CVE-2026-15409, CVE-2026-15410: SonicWall SMA 1000 zero-day vulnerabilities exploited in the wild
SonicWall patched two recently exploited zero-day vulnerabilities in its SMA 1000 Series secure remote access appliances which may have been chained for unau...
Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)
Overview On July 14, 2026, SonicWall published a security advisory addressing two vulnerabilities affecting SMA1000 Series remote access appliances, includin...