CISA, the FBI, the U.S. Secret Service and international partners issued a joint advisory on SafePay ransomware. The group has been highly active since August 2024 and has compromised roughly 600 organizations across multiple critical infrastructure sectors in the Americas, Europe and Australia. The FBI describes it as one of 2026's most …
Multiple ransomware groups, including Qilin and INC, are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portals and gateways. Unit 42 has been investigating intrusions since early June across many sectors, including finance, healthcare and manufacturing. The flaw was patched on May 13 and ini…
A joint StopRansomware advisory (AA26-293A) from CISA, the FBI, the USSS, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit details SafePay ransomware activity observed through August 2026 (cisa.gov). The group has been active since August 2024 and has compromised …
Ivanti released its October 2026 security update on 13 October 2026. It fixes the actively exploited Connect Secure zero-day CVE-2026-104935, a spoofing-based authentication bypass that lets remote, unauthenticated attackers execute arbitrary commands (cert.ssi.gouv.fr, darkwebinformer.com). The flaw was discovered by Volexity, which trac…