Immediate priority must be given to patching Fastjson, ServiceNow, and PTC Windchill/FlexPLM due to confirmed active exploitation of unauthenticated RCEs. We are also seeing a shift toward AI-automated post-exploitation and sophisticated browser-based malware assembly that bypasses traditional file scanning. Ensure Active Directory auditing is tightened against the Certighost impersonation technique.
This legacy edition is awaiting expanded Slugnet analysis and is not yet indexed.
Audio briefing
A spoken version of today’s prioritized cybersecurity briefing.
The audio edition is not available yet.
Attackers are actively exploiting CVE-2026-16723, a critical unauthenticated remote code execution flaw in Alibaba's Fastjson library for Java. In affected Spring Boot applications, malicious JSON requests can execute code with the privileges of the Java process.
This legacy edition predates Slugnet’s expanded analytical assessment.
Cl0p ransomware affiliates are exploiting a chain of vulnerabilities in internet-exposed PTC Windchill and FlexPLM deployments. The attack combines an information disclosure flaw in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet to achieve unauthenticated remote code execution.
This legacy edition predates Slugnet’s expanded analytical assessment.
Reports confirm active exploitation of a pre-authentication remote code execution vulnerability in ServiceNow. Additionally, the AI model repository Hugging Face has suffered a breach.
This legacy edition predates Slugnet’s expanded analytical assessment.
The Certighost exploit allows low-privileged Active Directory users to obtain a certificate for a Domain Controller and authenticate as that machine. This enables attackers to retrieve the krbtgt secret through DCSync, leading to full domain compromise.
This legacy edition predates Slugnet’s expanded analytical assessment.
Working exploit code has been released for a GitLab vulnerability that allows authenticated users to execute commands as the git user on unpatched self-managed 18.11.3 servers. The attack involves committing a crafted Jupyter notebook to leak heap memory.
This legacy edition predates Slugnet’s expanded analytical assessment.
Threat actors utilized the open-source Hermes AI agent in unattended mode to automate post-exploitation activities during a breach of Thailand's Ministry of Finance. This demonstrates the operational use of AI agents to accelerate lateral movement and data collection.
This legacy edition predates Slugnet’s expanded analytical assessment.
The SourTrade malvertising campaign uses a legitimate Bun runtime to instruct browsers to assemble Windows executables directly in memory. By avoiding the delivery of a complete malicious file from a single URL, the operation bypasses traditional file-based detection.
This legacy edition predates Slugnet’s expanded analytical assessment.
North Korean actors are using a phishing kit that impersonates Zoom and Microsoft Teams to deliver malware via social engineering. The kit profiles victims' cryptocurrency wallets before deploying the final payload.
This legacy edition predates Slugnet’s expanded analytical assessment.
The DevMan ransomware-as-a-service operation uses a centralized web portal to manage affiliate payouts and automate payload generation. This infrastructure allows the group to scale its operations through a streamlined management interface.
This legacy edition predates Slugnet’s expanded analytical assessment.
Attackers are modifying DNS settings on Wi-Fi devices at hotels and conference centers to redirect users to fraudulent Microsoft 365 login pages. This technique allows for the theft of corporate credentials from traveling employees.
This legacy edition predates Slugnet’s expanded analytical assessment.