Threat intelligence editor

Alex Kim

Articles: 235
Desks: 7

Focuses on cloud identity, incident response, and exploitation trends.

CloudIncident responseIdentity

Coverage by Alex Kim

Data graphic: a Known exploited seal over Fortinet CVE-2025-61624, rated CVSS 6.0 Medium and admin-only, yet used to go from FortiOS admin to root.

highExploits Cve 2025 61624

Admin-Only Fortinet Flaw CVE-2025-61624 Used to Gain Root, Now on CISA KEV

Unit 42 says attackers used Fortinet's admin-only CLI path traversal CVE-2025-61624 to reach root. CISA added it to KEV on 16 October 2026.

Oct 27 · 4 min

Data graphic: the CVE-2026-110936 attack chain, from a ClickFix lure to msiexec running AllMyBasic.msi, to a genuine signed Siemens Software Center 3.5.8.7, which sideloads a malicious archive.dll. Siemens scores the flaw 8.4 under CVSS v4.0; the fix is V4.0.9.8.

highExploits Cve 2026 110936

Siemens Software Center DLL flaw CVE-2026-110936 exploited in ClickFix attacks

Attackers paired a genuine signed Siemens Software Center 3.5.8.7 with a malicious archive.dll. CISA set a 3 November KEV deadline; the fix is V4.0.9.8.

Oct 27 · 4 min

Data graphic: CVE-2026-111497 in the Node.js Brotli decoder, stamped CVSS 9.2, with fixed versions 22.23.4, 24.22.1 and 26.12.1

highExploits Cve 2026 111497

Node.js patches Brotli decoder out-of-bounds write CVE-2026-111497

Malformed Brotli input can overflow an 8-byte buffer in Node.js's node:zlib decoder. Node.js 22.23.4, 24.22.1 and 26.12.1 fix CVE-2026-111497.

Oct 27 · 3 min

Data graphic: GlobalProtect, a ransomware door. CVE-2026-0257 scores CVSS 9.1 at NVD and 7.8 at Palo Alto; Qilin and Inc use it in seven steps: forged override cookie, MFA skipped, VPN session, RMM, RDP and SMB, vCenter, ESXi controls off, DC credentials dumped. It is ransomware-used, on CISA KEV since 29 May, and patched since 13 May.

criticalExploits Cve 2026 0257

Qilin and Inc Ransomware Walk Through a Patched GlobalProtect Hole, CVE-2026-0257, Straight Past MFA

Unit 42 ties Qilin and Inc ransomware to GlobalProtect auth bypass CVE-2026-0257: forged cookies skip MFA, then attackers pivot to vCenter and ESXi.

Oct 24 · 5 min

Data graphic: Cisco Expressway clusters hand out root. CVE-2026-76466 is rated CVSS 9.8 critical unauthenticated root code execution through a hard-coded credential flaw , stamped "No workaround". The only fix is X15.5.20, and X14 and earlier have no fix and must migrate.

highExploits Cve 2026 76466

Cisco Expressway Clusters Carry a Hard-Coded Credential Flaw: Unauthenticated Root RCE, No Workaround

CVE-2026-76466 (CVSS 9.8) gives unauthenticated root on clustered Expressway-C and -E. There is no workaround: upgrade to X15.5.20; X14 must migrate.

Oct 24 · 4 min

Data graphic: Cover for the Nextcloud Collabora backdoor story, with a giant 9.2 CVSS v4.0 score for an unauthenticated command injection, a CISA KEV CVE-2026-110447 stamp, and three facts: fixed in 26.4.303, KEV due 26 Oct, first logged attack 10 Sep.

criticalExploits Cve 2026 110447

Nextcloud's Built-in Collabora Server Is Being Used to Plant Webshells, and Disabling the App Does Not Fix It

Attackers have used a proxy.php command injection in Nextcloud's built-in Collabora CODE server to plant webshells since 10 Sep. Patch to 26.4.303, then hunt.

Oct 24 · 5 min

Data graphic: a 2026 timeline of the four Arista advisories that say a flaw is exploited 5 May, 27 Jul, 22 Sep and 22 Oct , ending in orange at CVE-2026-114625, a VCO SQL injection Arista scores CVSS 9.9 that any logged-in user can exploit, even read-only. The fix is VCO On-Prem 5.2.3.18, 6.1.3.10 or 6.4.2.12.

criticalExploits Cve 2026 114625

Arista VeloCloud Orchestrator SQL Injection CVE-2026-114625 Is Under Active Attack, and Any Read-Only Login Is Enough

Arista says CVE-2026-114625, a CVSS 9.9 SQL injection in VeloCloud Orchestrator On-Prem, is exploited. Any login, even read-only, reaches superuser.

Oct 22 · 5 min

Data graphic: editorial cover for PHP2Shell, two unauthenticated PHP core remote code execution bugs rated CVSS v4.0 9.2 critical , shown as a giant 9.2 with a CRITICAL stamp. PHP has patched four branches, but PAN-OS and Panorama have no fix, and the first exploit attempt was seen on 17 Oct by Amazon MadPot.

criticalExploits Cve 2026 109618

PHP2Shell: Two Pre-Auth PHP RCEs Are Patched, but PAN-OS, Panorama and Cisco Expressway Still Wait

CVE-2026-109618 and CVE-2026-109619 give unauthenticated RCE in PHP core. Fixes shipped 21 Oct, attempts began 17 Oct, and PAN-OS has no fix yet.

Oct 22 · 9 min