Honey @uniqueHM2021

THREAT ALERT: Russia-linked #APT28 is weaponizing a critical MS Office flaw (CVE-2026-21509) in "Operation Neusploit." Targeting Eastern Europe via Word docs using: 🔹 Outlook macros for silent email theft 🔹 Steganography in PNGs 🔹 Filen API to hide traffic Patch now! 👇

The headline for May? No sector is too niche, no platform too obscure, and no patch too old to exploit. The attackers are organized, opportunistic, and showing no signs of slowing down. 𝗜𝗻 𝘁𝗵𝗶𝘀 𝗿𝗲𝗽𝗼𝗿𝘁, 𝘆𝗼𝘂'𝗹𝗹 𝗹𝗲𝗮𝗿𝗻 𝗮𝗯𝗼𝘂𝘁: 🔹Vulnerabilities added to the CISA KEV catalog in May 2026 🔹Actively exploited vulnerabilities in May 2026 🔹Ransomware insights for May 2026 Stay ahead with Loginsoft Vulnerability Intelligence (LOVI) - tracking real-world exploitation before it becomes your next incident. Full report here: loginsoft.com/reports/monthl… #Cybersecurity #Loginsoft #LOVI #Vulnerability #Intelligence #InfoSec #May2026 #ThreatIntel #CISAKEV #ActiveExploitations #Ransomware #Malware #Microsoft #PaloAltoNetworks #Ivanti #Cisco #ThreatResearch #CyberThreats #VulnerabilityManagement

This week’s threat activity once again demonstrated how modern cyber operations increasingly blended supply-chain compromise, cloud infrastructure abuse, AI-platform exploitation, and internet-facing application attacks into scalable multi-stage intrusion campaigns. 𝗞𝗲𝘆 𝗵𝗶𝗴𝗵𝗹𝗶𝗴𝗵𝘁𝘀 𝗼𝗳 𝘁𝗵𝗲 𝘄𝗲𝗲𝗸: 🔹7 vulnerabilities added to the CISA KEV catalog 🔹Active exploitation detected in GhostCMS and KnowledgeDeliver deployments 🔹KnowledgeDeliver vulnerability exploited to deploy BLUEBEAM Web Shell 🔹Fortinet uncovers persistent P2Pinfect activity Know more: loginsoft.com/reports/weekly… Stay ahead with LOGINSOFT VULNERABILITY INTELLIGENCE #Cybersecurity #Loginsoft #VulnerabilityIntelligence #VulnerabiltyManagement #ThreatIntelligence #CISAKEV #TanStack #Drupal #KnowledgeDeliver #Langflow #DaemonToolsLite #GhostCMS #TrendMicro #NxConsole #LiteSpeed

Attackers no longer wait weeks to weaponize vulnerabilities - exploitation now begins within hours, often targeting cloud infrastructure, AI ecosystems, hosting platforms, and software supply chains simultaneously. This week’s threat activity clearly demonstrated how credential theft, authentication bypasses, and cloud-native malware operations continued to evolve into highly coordinated intrusion campaigns. 𝗞𝗲𝘆 𝗼𝗯𝘀𝗲𝗿𝘃𝗮𝘁𝗶𝗼𝗻𝘀 𝗼𝗳 𝘁𝗵𝗲 𝘄𝗲𝗲𝗸: 🔹2 vulnerabilities added to the CISA KEV catalog 🔹Active exploitations observed in Burst Statistics plugin for WordPress, GUARDIANWALL MailSuite, and Linux Kernel vulnerabilities 🔹Threat actors leveraging cPanel and WebHost Manager (WHM) instances to deploy backdoor 🔹TeamPCP actively abused a critical supply chain vulnerability affecting the TanStack ecosystem 🔹PCPJack Malware Exploits Cloud Infrastructure vulnerabilities Stay ahead with LOGINSOFT VULNERABILITY INTELLIGENCE Know more: loginsoft.com/reports/weekly… #Cybersecurity #Loginsoft #VulnerabilityIntelligence #VulnerabiltyManagement #ThreatIntelligence #CISAKEV #AI #TeamPCP #Ivanti #cPanel #PCPJack #WordPress #Backdoor

𝗡𝗜𝗦𝗧 𝗷𝘂𝘀𝘁 𝗰𝗵𝗮𝗻𝗴𝗲𝗱 𝘁𝗵𝗲 𝗿𝘂𝗹𝗲𝘀 𝗼𝗻 𝗡𝗩𝗗 𝗲𝗻𝗿𝗶𝗰𝗵𝗺𝗲𝗻𝘁. Here's what it means for your vulnerability management. As of April 15, NIST will only fully enrich CVEs in three categories: CISA KEV entries, federal government software, and critical software under EO 14028. 𝗘𝘃𝗲𝗿𝘆𝘁𝗵𝗶𝗻𝗴 𝗲𝗹𝘀𝗲? 𝗠𝗮𝗿𝗸𝗲𝗱 "𝗡𝗼𝘁 𝗦𝗰𝗵𝗲𝗱𝘂𝗹𝗲𝗱." Including the 𝗲𝗻𝘁𝗶𝗿𝗲 𝗽𝗿𝗲-𝗠𝗮𝗿𝗰𝗵 𝟮𝟬𝟮𝟲 𝗯𝗮𝗰𝗸𝗹𝗼𝗴. The numbers tell the story: → 𝗖𝗩𝗘 𝘀𝘂𝗯𝗺𝗶𝘀𝘀𝗶𝗼𝗻𝘀 𝘂𝗽 𝟮𝟲𝟯% since 2020 → 𝟰𝟮,𝟬𝟬𝟬 𝗖𝗩𝗘𝘀 𝗲𝗻𝗿𝗶𝗰𝗵𝗲𝗱 𝗹𝗮𝘀𝘁 𝘆𝗲𝗮𝗿 a record and still not enough → 𝗤𝟭 𝟮𝟬𝟮𝟲 𝗮𝗹𝗿𝗲𝗮𝗱𝘆 𝗿𝘂𝗻𝗻𝗶𝗻𝗴 𝟯𝟯% 𝗮𝗵𝗲𝗮𝗱 of last year If your vulnerability management was built assuming comprehensive NVD enrichment, you now have a blind spot. An unenriched CVE is just a number with 𝗻𝗼 𝗖𝗩𝗦𝗦 𝘀𝗰𝗼𝗿𝗲, 𝗻𝗼 𝗖𝗣𝗘 𝗺𝗮𝗽𝗽𝗶𝗻𝗴, 𝗮𝗻𝗱 𝗻𝗼 𝘄𝗮𝘆 𝘁𝗼 𝗮𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗰𝗮𝗹𝗹𝘆 𝗮𝘀𝘀𝗲𝘀𝘀 𝗿𝗶𝘀𝗸. At 𝗟𝗼𝗴𝗶𝗻𝘀𝗼𝗳𝘁, we've spent 18 years building deep cybersecurity expertise and proprietary vulnerability intelligence from first principles. 𝗟𝗢𝗩𝗜 𝗲𝗻𝗿𝗶𝗰𝗵𝗲𝘀 𝗖𝗩𝗘 𝗱𝗮𝘁𝗮 𝘄𝗶𝘁𝗵 𝗔𝗜-𝗽𝗼𝘄𝗲𝗿𝗲𝗱 𝘁𝗵𝗿𝗲𝗮𝘁 𝘀𝗰𝗼𝗿𝗲𝘀, 𝗘𝗣𝗦𝗦 𝗰𝗼𝗿𝗿𝗲𝗹𝗮𝘁𝗶𝗼𝗻, 𝗲𝘅𝗽𝗹𝗼𝗶𝘁 𝗺𝗮𝘁𝘂𝗿𝗶𝘁𝘆 𝗮𝗻𝗮𝗹𝘆𝘀𝗶𝘀, 𝗮𝗻𝗱 𝗽𝗿𝗲-𝗡𝗩𝗗 𝗶𝗻𝘀𝗶𝗴𝗵𝘁𝘀 independent of whether NIST gets to it or not. The era of relying on a single source of truth is over. Your security stack shouldn't have to wait for enrichment that may never come. 𝗦𝘁𝗮𝗿𝘁 𝘆𝗼𝘂𝗿 𝗙𝗿𝗲𝗲 𝗧𝗿𝗶𝗮𝗹 𝗡𝗼𝘄: vi.loginsoft.com/sign-up #Cybersecurity #NVD #NIST #CVE #NVDEnrichment #CVEBacklog #NVD2026 #CISAKEV #LOVI #VulnerabilityManagement #Loginsoft #VulnerabilityIntelligence #CVSSScore #PatchPrioritization #NotScheduled #CVEEnrichment

This week’s threat landscape reveals a dangerous pattern, attackers are no longer choosing between new or old vulnerabilities. They’re exploiting both simultaneously, across enterprise systems and IoT environments. 𝗞𝗲𝘆 𝗵𝗶𝗴𝗵𝗹𝗶𝗴𝗵𝘁𝘀 𝗼𝗳 𝘁𝗵𝗲 𝘄𝗲𝗲𝗸: 🔹7 vulnerabilities added to the CISA KEV catalog 🔹Active exploitations observed in Qinglong, cPanel and LiteLLM vulnerabilities 🔹APT28 exploited a recently patched Microsoft vulnerability 🔹Mirai-Based Nexcorium and Tuxnokill Botnets Leveraged DVR and Legacy Router Vulnerabilities Patch delays are no longer just a risk - they’re an entry point. If you're tracking threat activity or managing exposure at scale, now is the time to move from reactive patching to proactive intelligence-driven defense. Stay ahead with LOGINSOFT VULNERABILITY INTELLIGENCE Know more: loginsoft.com/reports/weekly… #Cybersecurity #Loginsoft #VulnerabilityIntelligence #VulnerabiltyManagement #ThreatIntelligence #CISAKEV #Microsoft #IoTSecurity #APT28 #InfoSec #Mirai #Nexcorium #Tuxnokill

Recent activity highlighted how attackers are strategically exploiting gaps across enterprise systems and connected devices, accelerating intrusion timelines and expanding their reach at scale. 𝗞𝗲𝘆 𝗛𝗶𝗴𝗵𝗹𝗶𝗴𝗵𝘁𝘀 𝗼𝗳 𝘁𝗵𝗲 𝘄𝗲𝗲𝗸: 🔹10 vulnerabilities added to the CISA KEV catalog, impacting critical platforms like Cisco Catalyst SD-WAN Manager, Microsoft Defender, JetBrains TeamCity, Kentico Xperience, Zimbra, PaperCut, and more 🔹Rapid exploitation observed in application-layer technologies such as Breeze Cache (WordPress) and LMDeploy, showing how quickly vulnerabilities are weaponized post-disclosure 🔹Mirai botnet evolution continues, with campaigns like tuxnokill (D-Link routers) and Nexcorium (TBK DVR devices) leveraging unpatched and legacy IoT infrastructure Stay ahead with proactive intelligence. Stay secure with LOVI. Know more: loginsoft.com/reports/weekly… #Cybersecurity #LOVI #Loginsoft #Vulnerability #Intelligence #CISAKEV #Microsoft #Cisco #JetBrains #Zimbra #PaperCut #Kentico #Mirai #Tuxnokill #Nexcorium #DLink #TBKDVR

The latest threat activity reveals a clear pattern the most trusted systems are now the most targeted. This week’s developments show attackers focusing on enterprise platforms that sit at the core of business operations endpoint management systems, remote access solutions, collaboration tools, and even developer workflows. 𝗞𝗲𝘆 𝗱𝗲𝘃𝗲𝗹𝗼𝗽𝗺𝗲𝗻𝘁𝘀 𝗼𝗳 𝘄𝗲𝗲𝗸: 🔹3 vulnerabilities added to the CISA KEV catalog 🔹Active exploitation detected in Tianxin Internet Behavior Management System, Flowise AI, Ninja Forms - File Upload WordPress plugin 🔹Microsoft Warns of high-velocity Medusa Ransomware attacks targeting global sectors 🔹NCSC Warns of Router Exploitation and Credential Theft via Malicious DNS Infrastructure Know more : loginsoft.com/reports/weekly… Stay safe and secured with Loginsoft Vulnerability Intelligence #Cybersecurity #Loginsoft #LOVI #Vulnerability #Intelligence #InfoSec #CISAKEV #ActiveExploits #ThreatIntel #Tianxin #NinjaForms #Microsoft #Medusa #Ransomware #Storm_1175 #FlowiseAI #Fortinet #TrueConf

March 2026 highlighted a rapidly evolving cybersecurity landscape marked by active exploitation of critical vulnerabilities and sustained ransomware activity across sectors. 𝗜𝗻 𝘁𝗵𝗶𝘀 𝗿𝗲𝗽𝗼𝗿𝘁, 𝘆𝗼𝘂'𝗹𝗹 𝗹𝗲𝗮𝗿𝗻 𝗮𝗯𝗼𝘂𝘁: 🔹Vulnerabilities added to the CISA KEV catalog in March 2026 🔹Actively exploited vulnerabilities in March 2026 🔹Ransomware insights for March 2026 Stay ahead with Loginsoft Vulnerability Intelligence (LOVI) - tracking real-world exploitation before it becomes your next incident. Full report here: loginsoft.com/reports/monthl… #Cybersecurity #Loginsoft #Vulnerability #Intelligence #LOVI #March2026 #InfoSec #ThreatIntel #CISAKEV #ActiveExploitations #Ransomware #Malware #Apple #Google #Microsoft

February 2026 was not just another month of vulnerability disclosures - it was a month defined by acceleration across the entire threat landscape. A notable rise in CISA KEV additions, coupled with in-the-wild exploitation across enterprise platforms, network infrastructure, and endpoint software, characterized February’s threat landscape. 𝗜𝗻 𝘁𝗵𝗶𝘀 𝗿𝗲𝗽𝗼𝗿𝘁, 𝘆𝗼𝘂'𝗹𝗹 𝗹𝗲𝗮𝗿𝗻 𝗮𝗯𝗼𝘂𝘁: 🔹Vulnerabilities added to the CISA KEV catalog in February 2026 🔹Actively exploited vulnerabilities in February 2026 🔹Ransomware insights for February 2026 Stay ahead with Loginsoft Vulnerability Intelligence (LOVI) - tracking real-world exploitation before it becomes your next incident. Full report here: loginsoft.com/reports/monthl… #Cybersecurity #Loginsoft #Vulnerability #Intelligence #LOVI #February2026 #InfoSec #ThreatIntel #ActiveExploitations #Ransomware #Microsoft #Google #Dell #CISAKEV #Malware #Botnet

𝗬𝗼𝘂𝗿 𝗦𝗢𝗖 𝘀𝗲𝗲𝘀 𝘁𝗵𝗲 𝗮𝘁𝘁𝗮𝗰𝗸. 𝗜𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 𝗜𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝗰𝗲 𝘀𝗲𝗲𝘀 𝗶𝘁 𝗰𝗼𝗺𝗶𝗻𝗴. Attackers reuse domains, IPs, TLS certs, and hosting patterns, and that's exactly how you catch them early. Infrastructure Intelligence helps you: 🔹Cluster attacker infrastructure 🔹Block C2 beaconing before execution 🔹Automate enrichment across SIEM, SOAR & TIP 🔹Slash false positives with contextual risk scoring Stop chasing IOCs. Start hunting infrastructure. 📖 Dive into the full breakdown here: loginsoft.com/post/infrastru… #ThreatIntelligence #SOC #CyberThreatIntelligence #InfrastructureIntelligence #ThreatHunting #SIEM #SOAR #BlueTeam #CTI #Cybersecurity #Loginsoft

2026 opened with a sharp escalation in real-world exploitation, underscoring how quickly both newly disclosed and long-standing vulnerabilities can be operationalized by threat actors. 𝗜𝗻 𝘁𝗵𝗶𝘀 𝗿𝗲𝗽𝗼𝗿𝘁, 𝘆𝗼𝘂'𝗹𝗹 𝗹𝗲𝗮𝗿𝗻 𝗮𝗯𝗼𝘂𝘁: 🔹Vulnerabilities added to the CISA KEV catalog in January 2026 🔹Actively exploited vulnerabilities in January 2026 🔹Ransomware insights for January 2026 Stay ahead with Loginsoft Vulnerability Intelligence (LOVI) - tracking real-world exploitation before it becomes your next incident. Full report here: loginsoft.com/reports/monthl… Check out our Annual Vulnerability Intelligence Report 2025 for deeper insights - Read here: loginsoft.com/reports/annual… #Cybersecurity #Loginsoft #VulnerabilityIntelligence #LOVI #January2026 #Infosec #Microsoft #Fortinet #SmarterTools #Malware #Ransomware #Qilin #Akira #Sinobi

Here is our Annual Vulnerability Intelligence Report - 2025, powered by LOVI and enriched with intelligence from a wide range of trusted open sources, delivering a comprehensive, year-long view of the global cyber threat landscape as it evolved throughout 2025 𝗞𝗲𝘆 𝗼𝗯𝘀𝗲𝗿𝘃𝗮𝘁𝗶𝗼𝗻𝘀 𝘁𝗵𝗿𝗼𝘂𝗴𝗵𝗼𝘂𝘁 𝘁𝗵𝗲 𝘆𝗲𝗮𝗿: 🔹 Over 300 actively exploited vulnerabilities tracked across the enterprise and OSS ecosystem 🔹 Ransomware trends highlighting newly identified families, the top 10 most active groups, and the key vulnerabilities they exploited in real-world campaigns. 🔹 Identified actively exploited vulnerabilities tied to 50+ new malware strains and threat actors, highlighting how the latest and trending vulnerabilities were abused in real-world attacks during 2025 🔹 Month-by-month analysis of actively exploited vulnerabilities Explore how 2025 shaped the future of cyber defense and how to stay ahead in 2026. Know more: loginsoft.com/reports/annual… Stay updated with Loginsoft Vulnerability Intelligence #Loginsoft #Vulnerability #Intelligence #LOVI #CybersecurityRecap #Vulnerabilities #VulnerabilityReport2025 #InfoSec #Threats #Ransomware #CISAKEV #OSSIntel #Raas #Microsoft #Apple #Google #Linux #Android #ActiveExploitations #ZeroDay #PoC #DOYOUKNOWCVE

The React2Shell Crisis: Technical Deep Dive into CVE-2025-55182 and Widespread Exploitation Activity Here is our detailed breakdown of React2Shell - the critical vulnerability in React Server Components. 𝗧𝗵𝗶𝘀 𝗯𝗹𝗼𝗴 𝗰𝗼𝘃𝗲𝗿𝘀: 🔹 The root cause behind the React2Shell flaw 🔹 How attackers are exploiting it 🔹 Indicators to identify exposure in your environment 🔹 A practical defense checklist teams can act on now Stay ahead and secure with LOVI Read more: loginsoft.com/post/the-react… #Cybersecurity #Loginsoft #Vulnerability #Intelligence #LOVI #React2Shell #Log4Shell #InfoSec #ReactServerComponents

Shai-Hulud 2.0: Inside the Most Sophisticated Supply-Chain Attack The Shai-Hulud campaign has evolved from a September worm into a fully automated, ecosystem-wide breach compromising npm packages, harvesting cloud & CI/CD secrets, and embedding persistence through GitHub workflows. In this breakdown, we have covered: • What Shai-Hulud is and how it first appeared • How the 2.0 variant executed a stealthier, faster supply-chain attack • How to identify impacted libraries and repos • A complete attack timeline + key defensive takeaways Read the full analysis here: loginsoft.com/post/shai-hulu… #Cybersecurity #Loginsoft #Vulnerability #Intelligence #LOVI #ShaiHulud #SupplyChain #Attack #npmpackages

Threat actors demonstrated increased agility this week, rapidly adapting exploits across enterprise, application, and IoT ecosystems. 𝗞𝗲𝘆 𝗵𝗶𝗴𝗵𝗹𝗶𝗴𝗵𝘁𝘀 𝗼𝗳 𝘁𝗵𝗲 𝘄𝗲𝗲𝗸: 🔹 One vulnerability added to the CISA KEV catalog 🔹 Botnet campaigns intensified across cloud and router environments 🔹 ShadowPad malware leveraged a Microsoft Vulnerability 🔹 ShadowV2 botnet exploited IoT devices during the AWS outage Know more: loginsoft.com/reports/weekly… Stay ahead with Loginsoft Vulnerability Intelligence (LOVI). #Cybersecurity #LOVI #Loginsoft #Mirai #AWSOutage #VulnerabilityIntelligence #CISAKEV #Oracle #Botnet #FusionMiddleware #WordPress #SneeitPlugin #Fortinet #ShadowPad #Malware #ShadowV2

#DoYouKnowAdversary Ransomware Alert! The Gentlemen ransomware campaign, first observed in the summer of 2025, has disrupted multiple organizations across diverse industries. The operation demonstrates a sophisticated blend of persistence and precision, using tailored evasion mechanisms, adjusting its behavior around existing security controls, and abusing both trusted and vulnerable system components to slip past multi-layered defenses. The ransomware also forcefully terminates essential backup, database, and security services to amplify operational impact and ensure maximum damage. Leverage our #ThreatIntelligence to anticipate attack patterns, strengthen defenses, and refine response strategies. 🔗 For more information, Visit #LOVI: vi.loginsoft.com/threat-profile… #CyberThreatIntelligence #MalwareCampaign #MitreAttack #TTPs #CyberSecurity #VulnerabilityIntelligence #Infosec #OSINT #ThreatInformedDefense #CTI #Ransomware

#DoYouKnowAdversary Ransomware Alert! #Anubis ransomware, first identified in November 2024, has impacted multiple victims across diverse sectors. Anubis is a Ransomware-as-a-Service (RaaS) operation distributed via spearphishing, featuring both file encryption and an optional wipe mode that enables permanent data destruction. Leverage our #ThreatIntelligence to anticipate attack patterns, strengthen defenses, and refine response strategies. 🔗 For more information, Visit #LOVI: vi.loginsoft.com/threat-profile… #CyberThreatIntelligence #MalwareCampaign #MitreAttack #TTPs #CyberSecurity #VulnerabilityIntelligence #Infosec #OSINT #ThreatInformedDefense #CTI #Ransomware

As Cybersecurity Awareness Month wraps up, one thing is crystal clear - threat actors aren’t taking a break. Exploitation is rising, targeting is sharpening, and patching urgency has never been greater. 𝗜𝗻 𝘁𝗵𝗶𝘀 𝗿𝗲𝗽𝗼𝗿𝘁, 𝘆𝗼𝘂’𝗹𝗹 𝗸𝗻𝗼𝘄: • CISA KEV additions & actively exploited vulnerabilities in October • Ransomware activity highlights Patch fast, monitor smarter Stay ahead with Loginsoft Vulnerability Intelligence (LOVI). Full report here: loginsoft.com/reports/monthl… #Cybersecurity #Loginsoft #Vulnerability #Intelligence #LOVI #CISAKEV #Microsoft #Apple #Kentico #Adobe #DassaultSystemes #Samsung #Jenkins #Juniper #Oracle #Mozilla #Linux #Synacor #SKYSEA #GrafanaLabs #Rapid7 #Ransomware #Qilin #Akira #Sinobi

This week brought a wave of active exploits and critical updates, as both old and new vulnerabilities drew the attention of threat actors worldwide. 𝗞𝗲𝘆 𝗼𝗯𝘀𝗲𝗿𝘃𝗮𝘁𝗶𝗼𝗻𝘀 𝗼𝗳 𝘁𝗵𝗲 𝘄𝗲𝗲𝗸: 🔹 CISA added 9 vulnerabilities to KEV catalog 🔹 Active exploitations were observed in WordPress plugins, Milesight industrial routers. 🔹 EnemyBot, Sysrv-k, Andoryu, and Androxgh0st exploited flaws in GitLab, cloud gateways, and PHP apps. 🔹 IoT botnets Mirai, Bashlite, Tsunami, and BrickerBot ramped up attacks on EirD1000 routers. 🔹 Storm-1175 exploited GoAnywhere MFT, linked to Medusa ransomware activity. 🔹 CrowdStrike reported zero-day attacks on Oracle E-Business Suite targeting enterprise systems. Update, detect, defend - stay protected. Full report here: loginsoft.com/reports/weekly… #Cybersecurity #LOVI #Loginsoft #Vulnerability #Intelligence #CISAKEV #Microsoft #Windows #InternetExplorer #WordPress #Milesight #Grafana #Botnet #EnemyBot #Andoryu #Androxghost #BrickerBot #Tsunami #Storm1175 #Medusa #Ransomware #Cl0P #GracefulSpider