Threat intelligence editor

Alex Kim

Articles: 235
Desks: 7

Focuses on cloud identity, incident response, and exploitation trends.

CloudIncident responseIdentity

Coverage by Alex Kim

Data graphic: a huge red 61 over a halftone field, for the 61 days Check Point management servers were exploited through CVE-2026-93616 before a fix. First attacks 23 Jul; fix and CISA KEV listing of both CVEs 22 Sep; CVSS 9.8.

criticalExploits Cve 2026 93616

Check Point Management Servers Were a Zero-Day for Two Months Before the Fix

Attackers exploited Check Point CVE-2026-93616 for root on management servers from 23 July; the fix came 22 September, alongside gateway VPN bug CVE-2026-85102.

Oct 2 · 6 min

Data graphic: poster 'FortiMail patched: check for compromise', CVSS 9.8; fixed builds 8.0.2, 7.6.7 and 7.4.9; FortiMail 7.2 gets no fix; still exploited and on the CISA KEV catalog.

criticalExploits Cve 2026 104286

Exploited FortiMail Flaw Now Patched: Check for Compromise First

Fortinet released FortiMail 8.0.2, 7.6.7 and 7.4.9 for exploited CVE-2026-104286 (CVSS 9.8). Check for compromise before upgrading; 7.2 gets no fix.

Oct 2 · 6 min

Data graphic: NetScaler zero-days, patch then hunt. Both flaws score CVSS 4.0 9.5 and are stamped exploited CISA KEV, 27 Sep ; 50,277 exposed instances; CISA KEV deadline 30 Sep.

criticalExploits Cve 2026 88771

Citrix NetScaler Zero-Days Planted Webshells Weeks Before the Patch

Two pre-auth NetScaler ADC and Gateway flaws, CVE-2026-88771 and CVE-2026-88772, were exploited for weeks before the fix. Patch, then hunt for webshells.

Oct 2 · 10 min

Data graphic: a timeline of 23 September 2026 UTC headlined "MemTensor's own CI shipped a worm". After an attacker branch was pushed and deleted five times between 00:48 and 02:03, malicious npm releases 0.1.21 02:23 , 0.1.23 03:49 and 0.1.25 04:36 alternate with clean 0.1.22 03:45 and 0.1.24 04:33 , issue #173 opens at 04:17, and PyPI MemoryOS 2.0.34 follows at 05:25: four poisoned releases, all carrying the sckit worm. Pin 0.1.20 and 2.0.33.

highSupply Chain Supply Chain Attack

MemTensor's OpenClaw Plugin and MemoryOS Shipped the sckit Credential Worm

Pushed commits made MemTensor's own GitHub Actions jobs leak npm and PyPI tokens. Four releases then shipped sckit, a Go worm that steals developer secrets.

Oct 2 · 8 min

Data graphic: 358 of 482 big firms had a stolen ChatGPT or OpenAI login or session in infostealer logs; 80,000+ corporate domains, 295 firms seen in the last 90 days, 1,500 corporate emails exposed.

elevatedAI Security Llmjacking

Stolen ChatGPT Logins Turned Up at 358 of 482 Big Companies

SOCRadar tied over a million infostealer records to AI services. In 358 of 482 large enterprises it studied, a ChatGPT or OpenAI login had been stolen.

Oct 2 · 5 min

Data graphic: Xing4.0-29B-A4B, Qwen3.6-35B-A3B and Gemma4-26B-A4B on four vendor-reported benchmarks. Xing4.0 scores 75.00 on SWE-bench Verified against Qwen3.6's 76.00, and leads Terminal-Bench 2.1 with 57.50 to Qwen's 51.50, a 6-point gap.

watchResearch Open Weight Coding Models

Xing4.0-29B-A4B: China Telecom's Open Coding Model Claims SWE-bench 75 on One GPU

China Telecom's Apache 2.0 MoE, trained on Huawei Ascend, scores 75.00 on SWE-bench Verified in its own table, a point behind Qwen3.6, and its 4-bit file is ~18 GB.

Oct 2 · 6 min

Data graphic: OpenAI's account of a Moonshot-linked campaign that replayed its encrypted reasoning, on a timeline. It starts on 1 Jul, peaks on 24–25 Jul at 16,000 attempted requests from 4,000+ users, is disrupted on 28 Jul and disclosed on 30 Sep, 64 days later; related activity covered 15,000+ users and Moonshot has not responded.

elevatedAI Security Moonshot Ai

OpenAI Says Moonshot-Linked Accounts Replayed Encrypted Reasoning to Distill Its Models

OpenAI says a campaign tied to Moonshot AI associates replayed encrypted reasoning to other model paths to decrypt it: 16,000 requests at the July peak.

Oct 2 · 5 min

Data graphic: the CARBONATO botnet installs an AI agent as its implant, and the agent's persona puts the API keys of 14 AI providers, from OpenAI and Anthropic to self-hosted Ollama and vLLM, at the top of its loot list "loot #1" . It gets in through the unauthenticated Docker API on port 2375, uses a 39-line SOUL.md persona and takes orders over Telegram.

highAI Security Hermes Agent

CARBONATO Botnet Turns Exposed Docker Hosts Into Hermes Agent Bots That Hunt AI Keys

CARBONATO hijacks open Docker APIs and installs Hermes Agent with a GH0ST persona that hunts API keys for 14 AI providers. How it works and what to check.

Oct 2 · 6 min