Skip to content

AUREONINTELLIGENCE

Insights from the front line.

Vulnerability alerts, threat landscape analysis, regulatory guidance, cyber insurance perspectives and assurance guides, written by the analysts and responders who deal with these issues every day. Sources are cited in every article.

Threat Landscape2 October 20264 min read

ClickFix inside ChatGPT: Malicious Custom GPTs used to deliver a remote access trojan

Attackers bought search ads for the word chatgpt, published fake Custom GPTs on the real ChatGPT domain and sent users to a counterfeit Cloudflare check that ends with a PowerShell command. The domain is no longer the signal. The instruction is.

Threat Landscape2 October 20265 min read

TerminalFix: The ClickFix lure moves to Windows Terminal and ends in a covert tunnel

Sophos links a campaign it tracks as STAC4924 to the group behind Vice Society and Rhysida. The chain hides shellcode as English words, fetches its servers from a forum profile and leaves a Python tunnel on the host. No encryption has been seen yet, which is exactly the point.

Vulnerability Alerts2 October 20265 min read

Zimbra CVE-2026-73570: What intruders did on compromised mail servers, and what to check on yours

An unauthenticated command injection in the SNMP notification path of Zimbra Collaboration was probed before public disclosure and exploited at scale afterwards. Microsoft's reconstruction shows web shells, a route to root through PAM, credential dumps and a cloud exfiltration attempt. The fix is 10.1.20. The work starts after the patch.

Vulnerability Alerts1 October 20264 min read

Cisco Catalyst SD-WAN Manager CVE-2026-76504: an unauthenticated path to the management API

A CVSS 9.8 authentication bypass in the SD-WAN control plane is being exploited in the wild. If the manager is reachable from the internet, treat it as a breach investigation, not a patch ticket.

Threat Landscape30 September 20263 min read

Supply-chain ransomware, one year after the European airports outage

In September 2025 a single supplier's passenger handling system went down and three of Europe's busiest airports fell back to pen and paper. A year on, September 2026 brought a state government leak, a hypervisor exploit in ransomware hands and a transport group knocked offline. The pattern holds.

Vulnerability Alerts28 September 20263 min read

Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772: patch today, then assume compromise

Two critical remote code execution flaws in NetScaler ADC and Gateway were exploited a week before disclosure. Patching closes the door; it does not evict anyone who already walked through it.

Cyber Insurance23 September 20263 min read

The claims data behind the headlines: what the 2026 cyber claims reports mean for insurers and insureds

Ransom demands rose sharply, yet most victims refused to pay and average losses fell. Social engineering, not malware, still drives the majority of claims. What the numbers mean for underwriting, incident response and the forensic record.

Vulnerability Alerts21 September 20263 min read

Three Linux kernel flaws in CISA's KEV: privilege escalation is the quiet half of every intrusion

Local kernel vulnerabilities rarely make headlines, but they are what turn a foothold into root. CISA's addition of three Linux kernel issues, with Red Hat confirming public exploits, is a prompt to look at how servers are patched and monitored.

Assurance Guides18 September 20263 min read

vCenter under siege: CVE-2026-59310 and why ransomware crews go straight for the hypervisor

An unauthenticated directory traversal in the vCenter Syslog server has moved from APT tooling to ransomware playbooks. Here is how to assure the virtualisation layer that everything else depends on.

Vulnerability Alerts16 September 20262 min read

One email to root: CVE-2026-76461 in Cisco Secure Email Gateway

A SQL injection in the email parsing logic of Cisco AsyncOS lets an unauthenticated attacker execute commands as root by sending a crafted message. The gateway that protects your mail became the way in.

Regulation14 September 20263 min read

The Cyber Resilience Act reporting clock started on 11 September 2026. What NIS2, DORA and the CRA now require of boards

Vulnerability and incident reporting duties for products with digital elements are live, NIS2 registration is lagging in major Member States and DORA supervision is maturing. A practical map of the obligations that now overlap.

Vulnerability Alerts11 September 20263 min read

September 2026 Patch Tuesday: a record 972 CVEs, two exploited zero-days, and what to fix first

Volume is not the story. Unauthenticated remote code execution in Netlogon, DNS, DHCP and SSTP, preview-pane Office exploits and Hyper-V guest escapes are. A prioritisation guide for a month that overwhelmed most patch teams.

Assurance Guides9 September 20263 min read

From CI/CD to cloud takeover: lessons from TeamCity CVE-2026-63077 and the Cadence breach

A critical deserialisation flaw in TeamCity On-Premises let attackers into a vendor's own cloud service, where backups full of credentials were waiting. Build systems deserve the same assurance as domain controllers.

Regulation7 September 20263 min read

UAE cyber regulation in 2026: the National Cyber Security Strategy, the new Central Bank law and the PDPL in practice

The UAE is moving from frameworks to accreditation, liability and supply-chain transparency. A guide for organisations operating in or serving the Emirates.

Threat Landscape4 September 20263 min read

AI gateways and developer tooling join the exploited list: CISA's early-September KEV batch

Seven newly exploited vulnerabilities span a VPN appliance, a telephony platform, an artifact repository, a workflow orchestrator, an LLM proxy and a Python web framework. The common thread is credentials and compute.

Want this intelligence applied to your environment?

Our threat intelligence and advisory teams turn public alerts into prioritised actions for your technology stack and your sector.

Speak with an analyst Threat intelligence services