Category desk

Research

Technical deep dives, reproducible tests, and tool evaluations.

On-premises SharePoint Server farm under active incident response for a zero-day privilege-escalation exploit

Microsoft SharePoint Zero-Day CVE-2026-56164 Under Active Attack: On-Prem Farms Face Unauthenticated Privilege Escalation

Microsoft and CISA confirmed exploitation on 14 July 2026 and shipped same-day patches. SharePoint Online is unaffected; self-hosted farms need action now.

Illustration of enterprise DHCP server infrastructure under elevated risk during Microsoft July 2026 Patch Tuesday

Cloud Security Research

Microsoft July 2026 Patch Tuesday Hits Record 622 CVEs With Critical DHCP Server RCEs

Roughly triple June's previous record, the release is led by CVE-2026-50518, an unauthenticated Windows DHCP Server RCE rated Exploitation More Likely.

Illustration of an on-premises Dynamics NAV and Business Central ERP server under unauthenticated remote code execution risk via a crafted login path

Cloud Security Research

CVE-2026-55944: Critical Unauthenticated RCE Hits Microsoft Dynamics NAV and Business Central On Premises

Patched in the record July 2026 Patch Tuesday, the flaw puts finance, supply-chain and operations systems at risk wherever ERP login endpoints remain reachable.

Editorial illustration of an AD FS server with a forged SAML assertion hovering above it in a data center

Golden Saml Research

Why Golden SAML Still Haunts Hybrid Identity: Hardening AD FS Token-Signing Keys and DKM Access

Golden SAML still threatens hybrid identity via AD FS token-signing keys. Learn how to harden DKM access, detect key theft, and lock down federation servers.

Illustration of chained SonicWall SMA1000 zero-days CVE-2026-15409 SSRF and CVE-2026-15410 code injection from internet exposure to full appliance compromise.

Cloud Security Research

SonicWall SMA1000 Zero-Days CVE-2026-15409 and CVE-2026-15410 Actively Exploited; Patch Alone Is Not Enough

CISA set a July 17 remediation deadline, but patching alone leaves an already-compromised appliance in place — credential rotation and hunting are mandatory.

Technician performing urgent integrity checks and remediation on an internet-facing Ivanti Connect Secure remote-access gateway after CISA KEV listing of CVE-2025-22457

Cloud Security Research

CISA Adds Actively Exploited Ivanti Connect Secure Flaw CVE-2025-22457 to KEV Catalog

A critical stack-based buffer overflow in Ivanti Connect Secure has been exploited since mid-March 2025, turning perimeter VPN gateways into footholds.