Threat Intelligence Center

Ransomware gangs are now targeting VPN appliances from Fortinet, Citrix, and Check Point as their primary entry point, with Q2 2026 attacks up year over year for the fourth consecutive month.

Ransomware attacks rose year over year in June for the fourth consecutive month, according to NCC Group, with Q2 2026 volume up just 3% over the previous quarter. Growth has flattened, but the floor is now much higher than it was a year ago. (Source: Csoonline)

The Hugging Face breach has surfaced critical tensions in the open-weights AI community regarding model security, supply chain integrity, and legal accountability. Researchers have documented connections to ExploitGym, GPT-5.6 Sol, and Kimi K3—tools that lower barriers to autonomous AI exploitation.

Security researchers have confirmed active exploitation of CVE-2026-16723, a remote code execution vulnerability in Fastjson 1.x libraries affecting computing, financial services, healthcare, and retail organizations. The vulnerability allows unauthenticated attackers to execute arbitrary code on vulnerable systems.

Captive portal detection mechanisms, commonly deployed to manage guest network access and enforce authentication policies, contain exploitable gaps that attackers leverage to bypass security controls.

Security researchers have identified a critical risk in large language models trained on exploit and vulnerability datasets like CyberGym and ExploitGym. OpenAI frontier models and GLM 5.2, when fine-tuned on these datasets, can autonomously generate attack code and exploitation strategies without human direction.

Researchers have identified a targeted phishing campaign attributed to BlueNoroff that uses the ClickFix phishing kit to profile cryptocurrency wallets before delivering a VBScript-based stealer payload. The attack chain begins with social engineering via Zoom meeting invitations, escalates to wallet reconnaissance, and culminates in malware deployment.