https://threatlandscape.io/blog Insights, updates, and tactical analysis on the evolving threat landscape. en-us Copyright 2026 ThreatLandscape.io Wed, 16 Sep 2026 00:00:00 GMT https://threatlandscape.io/blog/real-cost-of-threat-intelligence-managed-cti-vs-diy https://threatlandscape.io/blog/real-cost-of-threat-intelligence-managed-cti-vs-diy Wed, 16 Sep 2026 00:00:00 GMT Open-source feeds look free, but analyst time is the real cost. See how managed CTI turns fragmented data into structured, contextual intelligence. Threat Intelligence CTI Managed CTI Threat Intelligence OSINT STIX MITRE ATT&CK SOC https://threatlandscape.io/blog/threat-landscape-intelligence-now-powers-ecliptica-replay https://threatlandscape.io/blog/threat-landscape-intelligence-now-powers-ecliptica-replay Tue, 15 Sep 2026 00:00:00 GMT Threat Landscape threat intelligence is now integrated with Ecliptica Replay, the local-first AI Detection and Response platform from Ecliptica Labs. Correlate live AI agent activity against infrastructure already known to be hostile. Product News Ecliptica Replay AIDR AI Agents Integrations Threat Intelligence STIX Product News https://threatlandscape.io/blog/cve-2026-35029-litellm-read-only-keys-take-over-the-ai-gateway https://threatlandscape.io/blog/cve-2026-35029-litellm-read-only-keys-take-over-the-ai-gateway Thu, 03 Sep 2026 00:00:00 GMT CVE-2026-35029 (CVSS 8.7) lets authenticated LiteLLM users rewrite /config/update, read files via /get_image, and take over the AI gateway. Patch 1.83.0+. Threat Advisory CVE-2026-35029 LiteLLM privilege escalation AI gateway broken access control zero-day CVSS threat advisory https://threatlandscape.io/blog/dissecting-recruittrap-browser-in-the-browser-phishing-adapts-to-enterprise-mobile-endpoints https://threatlandscape.io/blog/dissecting-recruittrap-browser-in-the-browser-phishing-adapts-to-enterprise-mobile-endpoints Thu, 03 Sep 2026 00:00:00 GMT Analysis of the RecruitTrap campaign using Browser-in-the-Browser and mobile flows to harvest corporate credentials and bypass MFA. Threat Intelligence Phishing Browser-in-the-Browser RecruitTrap OAuth MFA Bypass Social Engineering https://threatlandscape.io/blog/sality-p2p-botnet-disruption-peer-list-sinkholing-ends-a-23-year-operation https://threatlandscape.io/blog/sality-p2p-botnet-disruption-peer-list-sinkholing-ends-a-23-year-operation Thu, 03 Sep 2026 00:00:00 GMT How defenders dismantled the 23-year Sality P2P botnet: peer-list poisoning, URL pack seizures, EggJagger clipjacking, and IOCs for SALTY SPIDER. Threat Intelligence Sality botnet disruption P2P botnet EggJagger SALTY SPIDER sinkhole clipjacking threat intelligence https://threatlandscape.io/blog/fire-ant-apt-evolving-from-hypervisors-to-trusted-network-infrastructure https://threatlandscape.io/blog/fire-ant-apt-evolving-from-hypervisors-to-trusted-network-infrastructure Mon, 31 Aug 2026 00:00:00 GMT Deep dive into Fire Ant's infrastructure-focused espionage tactics, compromising Cisco IOS XR routers, TACACS servers, and Linux hosts for lateral movement. Threat Advisory Fire Ant UNC3886 Cisco IOS XR TACACS Medusa Rootkit APT Group Lateral Movement https://threatlandscape.io/blog/servicenow-cvss-10-unauth-rce-sqli-privilege-escalation https://threatlandscape.io/blog/servicenow-cvss-10-unauth-rce-sqli-privilege-escalation Fri, 28 Aug 2026 00:00:00 GMT ServiceNow patches four CVEs including three CVSS 4.0 10.0 flaws, allowing unauthenticated RCE, SQL injection, and privilege escalation. Full TTP and patching guidance inside. Threat Advisory ServiceNow CVE-2026-18885 CVE-2026-18886 CVE-2026-74820 CVE-2026-6876 RCE SQL injection privilege-escalation sandbox-escape CVSS-10.0 https://threatlandscape.io/blog/supply-chain-surveillance-darklantern-speakingstone-backdoors-zbt-routers https://threatlandscape.io/blog/supply-chain-surveillance-darklantern-speakingstone-backdoors-zbt-routers Thu, 27 Aug 2026 00:00:00 GMT VulnCheck uncovers DARKLANTERN and SPEAKINGSTONE, unauthenticated Nim backdoors pre-installed in ZBT (Zbtlink) OEM router firmware. TTPs and IoCs inside. Threat Advisory ZBT Zbtlink backdoor supply-chain router DARKLANTERN SPEAKINGSTONE hardware ICS IoT Nim https://threatlandscape.io/blog/threat-landscape-opencti-connector-merged https://threatlandscape.io/blog/threat-landscape-opencti-connector-merged Tue, 18 Aug 2026 00:00:00 GMT Our official OpenCTI connector has been merged into the OpenCTI Platform. Streamline automated ingestion of high-fidelity Threat Landscape intelligence directly into your OpenCTI instance — no custom code required. Product News OpenCTI Integrations Connector STIX CTI Product News https://threatlandscape.io/blog/threat-landscape-is-now-free-to-explore https://threatlandscape.io/blog/threat-landscape-is-now-free-to-explore Wed, 12 Aug 2026 00:00:00 GMT Threat Landscape now offers a Free Tier — $0, no credit card required. Start exploring global OSINT and darknet-derived threat intelligence today. Threat Intelligence Threat Intelligence Free Tier OSINT Darknet Monitoring CTI https://threatlandscape.io/blog/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware https://threatlandscape.io/blog/gigawiper-anatomy-of-a-destructive-backdoor-assembled-from-multiple-malware Fri, 10 Jul 2026 00:00:00 GMT Microsoft dissects GigaWiper, a Golang backdoor fusing Crucio ransomware, FlockWiper, and a raw-disk wiper into one implant with RabbitMQ/Redis C2. Threat Intelligence GigaWiper wiper Golang Crucio FlockWiper backdoor Microsoft Threat Intelligence malware disk wipe https://threatlandscape.io/blog/gitlost-tricking-github-ai-agent-leaking-private-repositories https://threatlandscape.io/blog/gitlost-tricking-github-ai-agent-leaking-private-repositories Tue, 07 Jul 2026 00:00:00 GMT Noma Security discloses GitLost, a prompt injection vulnerability that tricks GitHub's Agentic Workflows into leaking private repository data. Analysis and mitigation guidance. Threat Advisory AI Prompt Injection GitHub Agentic Workflows LLM Security Supply Chain https://threatlandscape.io/blog/cve-2026-46331-pedit-cow-linux-privilege-escalation https://threatlandscape.io/blog/cve-2026-46331-pedit-cow-linux-privilege-escalation Fri, 26 Jun 2026 00:00:00 GMT CVE-2026-46331 'pedit COW' grants root via the kernel's traffic control subsystem. An out-of-bounds write corrupts the shared page cache—no files touched on disk. Threat Advisory CVE-2026-46331 Linux privilege-escalation kernel-security pedit-COW page-cache https://threatlandscape.io/blog/dora-compliance-for-financial-entities-operational-resilience-through-threat-intelligence https://threatlandscape.io/blog/dora-compliance-for-financial-entities-operational-resilience-through-threat-intelligence Thu, 18 Jun 2026 00:00:00 GMT DORA requires financial entities to adopt threat-led ICT risk management. Learn how Threat Landscape enables TLPT, TIBER-EU, and third-party vendor monitoring. Industry Analysis DORA EU 2022/2554 Digital Operational Resilience Act TLPT TIBER-EU ICT Risk Management Threat Intelligence financial cybersecurity https://threatlandscape.io/blog/nis2-is-here-securing-your-supply-chain-and-incident-handling-with-threat-intelligence https://threatlandscape.io/blog/nis2-is-here-securing-your-supply-chain-and-incident-handling-with-threat-intelligence Thu, 04 Jun 2026 00:00:00 GMT The EU's NIS2 Directive demands proactive risk analysis and supply chain security. Discover how Threat Landscape's darknet monitoring ensures NIS2 compliance. Industry Analysis NIS2 Directive compliance EU 2022/2555 Supply chain security Article 21 Darknet monitoring Threat Landscape Incident Handling https://threatlandscape.io/blog/navigating-iso-iec-27001-2022-master-annex-a-5-7-threat-intelligence https://threatlandscape.io/blog/navigating-iso-iec-27001-2022-master-annex-a-5-7-threat-intelligence Thu, 28 May 2026 00:00:00 GMT ISO 27001:2022 introduced Annex A 5.7, making Threat Intelligence a mandatory control. Learn how Threat Landscape helps you easily achieve and prove compliance. Industry Analysis ISO 27001:2022 Annex A 5.7 Threat Intelligence control Information Security Risk Assessment Threat Landscape CVSS enrichment https://threatlandscape.io/blog/beyond-the-checkbox-continuous-threat-intelligence-nis2-dora-iso-27001-compliance https://threatlandscape.io/blog/beyond-the-checkbox-continuous-threat-intelligence-nis2-dora-iso-27001-compliance Thu, 21 May 2026 00:00:00 GMT Static compliance is dead. Learn how integrating continuous threat intelligence helps your organization meet ISO 27001:2022, NIS2, and DORA requirements. Industry Analysis Cybersecurity compliance NIS2 DORA ISO 27001:2022 Threat Intelligence SOC teams regulatory requirements https://threatlandscape.io/blog/nginx-rift-cve-2026-42945-critical-rce-vulnerability https://threatlandscape.io/blog/nginx-rift-cve-2026-42945-critical-rce-vulnerability Thu, 14 May 2026 00:00:00 GMT Critical NGINX heap buffer overflow (CVE-2026-42945, CVSS 9.2) enables unauthenticated RCE. Technical breakdown, exploit chain analysis, and mitigation steps. Threat Advisory CVE-2026-42945 NGINX RCE heap-buffer-overflow vulnerability exploit patch-now https://threatlandscape.io/blog/threat-intel-dilemma-bridging-context-and-action-with-our-new-api https://threatlandscape.io/blog/threat-intel-dilemma-bridging-context-and-action-with-our-new-api Tue, 12 May 2026 00:00:00 GMT Announcing our new dual-stream API: a Context API for rich STIX 2.1 intel and a Detection API for curated, auto-expiring IOCs—delivered via REST and TAXII 2.1. Threat Intelligence Threat Intelligence CTI API TAXII STIX IOC Detection Engineering SIEM https://threatlandscape.io/blog/zero-day-cve-2026-0300-palo-alto-panos-rce-active-exploitation https://threatlandscape.io/blog/zero-day-cve-2026-0300-palo-alto-panos-rce-active-exploitation Wed, 06 May 2026 00:00:00 GMT Critical PAN-OS zero-day CVE-2026-0300 enables unauthenticated RCE with root privileges. No patch yet—apply workarounds immediately. Threat Advisory CVE-2026-0300 Palo Alto PAN-OS zero-day RCE firewall vulnerability active exploitation https://threatlandscape.io/blog/cloudz-rat-pheno-plugin-microsoft-phone-link-otp-theft https://threatlandscape.io/blog/cloudz-rat-pheno-plugin-microsoft-phone-link-otp-theft Tue, 05 May 2026 00:00:00 GMT CloudZ RAT deploys Pheno plugin to intercept OTPs by hijacking Microsoft Phone Link SQLite databases—no mobile malware required. Threat Intelligence RAT CloudZ MFA bypass OTP theft Phone Link Cisco Talos malware Windows https://threatlandscape.io/blog/copy-fail-cve-2026-31431-linux-privilege-escalation https://threatlandscape.io/blog/copy-fail-cve-2026-31431-linux-privilege-escalation Fri, 01 May 2026 00:00:00 GMT CVE-2026-31431 'Copy Fail' lets unprivileged users gain root on nearly every Linux distro since 2017 via a 732-byte Python script. Patch and mitigate now. Threat Advisory CVE-2026-31431 Linux privilege-escalation container-escape kernel-security vulnerability https://threatlandscape.io/blog/lovable-dev-data-breach-bola-vulnerability-vibe-coding https://threatlandscape.io/blog/lovable-dev-data-breach-bola-vulnerability-vibe-coding Wed, 22 Apr 2026 00:00:00 GMT A textbook BOLA flaw in Lovable.dev exposed source code, hardcoded API keys, and AI chat histories for projects created before Nov 2025. Full incident breakdown. Threat Advisory BOLA API security data breach vibe coding AI tools supply chain credentials https://threatlandscape.io/blog/vercel-breach-april-2026-rotate-credentials https://threatlandscape.io/blog/vercel-breach-april-2026-rotate-credentials Sun, 19 Apr 2026 00:00:00 GMT Vercel confirmed a security incident on April 19, 2026. The attack originated from a compromised Google Workspace OAuth app. Rotate non-sensitive environment variables now and check for the published IOC. Threat Advisory vercel breach credentials supply chain security incident ShinyHunters OAuth Google Workspace IOC https://threatlandscape.io/blog/from-consumption-to-interrogation-rethinking-threat-intelligence https://threatlandscape.io/blog/from-consumption-to-interrogation-rethinking-threat-intelligence Sun, 12 Apr 2026 00:00:00 GMT Discover how the Threat Landscape AI Assistant, built into the Threat Landscape Platform, transforms threat data into actionable insights through conversational AI and role-specific analysis. Industry Analysis Threat Intelligence AI SecOps Tech Launch https://threatlandscape.io/blog/healthcare-threat-landscape-2026-ai-poisoning-state-backed-raas https://threatlandscape.io/blog/healthcare-threat-landscape-2026-ai-poisoning-state-backed-raas Thu, 09 Apr 2026 00:00:00 GMT Analysis of the 2026 healthcare threat landscape, featuring the disruptive cyberattack on Signature Healthcare, state-backed ransomware trends, and memory poisoning in clinical AI. Threat Intelligence healthcare ransomware incident-response ai-security lazarus threat-intelligence https://threatlandscape.io/blog/axios-npm-supply-chain-attack-open-source-security https://threatlandscape.io/blog/axios-npm-supply-chain-attack-open-source-security Tue, 31 Mar 2026 00:00:00 GMT Threat actors compromised the Axios npm package (40M+ weekly downloads), injecting a multi-platform RAT via stolen maintainer credentials. Full TTP breakdown inside. Threat Intelligence supply chain npm axios RAT open source security malware https://threatlandscape.io/blog/supply-chain-attack-litellm-pypi-credential-stealer https://threatlandscape.io/blog/supply-chain-attack-litellm-pypi-credential-stealer Wed, 25 Mar 2026 00:00:00 GMT Versions 1.82.7 and 1.82.8 of the litellm PyPI package contain a double base64-encoded credential stealer. Rotate all secrets immediately if affected. Threat Intelligence supply chain PyPI malware python credential theft AI security https://threatlandscape.io/blog/telnet-cve-2026-32746-gnu-inetutils-preauth-buffer-overflow https://threatlandscape.io/blog/telnet-cve-2026-32746-gnu-inetutils-preauth-buffer-overflow Wed, 18 Mar 2026 00:00:00 GMT CVE-2026-32746: A critical pre-authentication buffer overflow in GNU Inetutils telnetd enables unauthenticated RCE on OT, ICS, and legacy devices. Patch and mitigate now. Threat Advisory CVE-2026-32746 GNU Inetutils telnet buffer-overflow RCE OT ICS pre-auth https://threatlandscape.io/blog/clickfix-evolves-macsync-macos-infostealer-fake-ai-tools-malvertising https://threatlandscape.io/blog/clickfix-evolves-macsync-macos-infostealer-fake-ai-tools-malvertising Mon, 16 Mar 2026 00:00:00 GMT Three ClickFix campaigns push MacSync infostealer to macOS users via Google ads, fake AI tools, and ChatGPT lures. No exploits, pure social engineering. Threat Intelligence macOS infostealer ClickFix MacSync malvertising social-engineering https://threatlandscape.io/blog/sweden-egovernment-source-code-leak-cgi-sverige-bytetobreach https://threatlandscape.io/blog/sweden-egovernment-source-code-leak-cgi-sverige-bytetobreach Thu, 12 Mar 2026 00:00:00 GMT ByteToBreach leaks Sweden's E-Gov source code after compromising CGI Sverige AB via Jenkins misconfiguration and Docker escape. Citizen PII for sale. Threat Advisory data breach e-government supply chain Sweden CGI Jenkins insider threat threat intelligence https://threatlandscape.io/blog/your-soc-has-a-threat-intelligence-problem-its-not-a-lack-of-data https://threatlandscape.io/blog/your-soc-has-a-threat-intelligence-problem-its-not-a-lack-of-data Thu, 12 Mar 2026 00:00:00 GMT Discover how the purpose-built Threat Landscape AI Assistant — part of the Threat Landscape Platform — queries live STIX 2.1 data to give SOC analysts fast, accurate, role-aware answers — not AI guesswork. Threat Intelligence AI Threat Intelligence SOC STIX 2.1 MITRE ATT&CK AI Assistant CTI https://threatlandscape.io/blog/darknet-monitoring-for-modern-threat-intelligence-programs https://threatlandscape.io/blog/darknet-monitoring-for-modern-threat-intelligence-programs Wed, 11 Mar 2026 00:00:00 GMT Why darknet monitoring belongs in modern CTI workflows, what teams should watch first, and how structured analysis turns underground signals into action. Product & Strategy darknet monitoring threat intelligence ransomware exposure monitoring cti https://threatlandscape.io/blog/why-your-threat-intelligence-platform-is-giving-you-data-not-intelligence https://threatlandscape.io/blog/why-your-threat-intelligence-platform-is-giving-you-data-not-intelligence Wed, 11 Mar 2026 00:00:00 GMT Discover how automated threat intelligence platforms convert OSINT into structured STIX 2.1 intelligence, cutting analyst research time by 50–70%. Industry Analysis Threat Intelligence STIX 2.1 MITRE ATT&CK SOC Automation CTI https://threatlandscape.io/blog/hackerbot-claw-ai-bot-github-actions-supply-chain-attack https://threatlandscape.io/blog/hackerbot-claw-ai-bot-github-actions-supply-chain-attack Fri, 06 Mar 2026 00:00:00 GMT An AI-powered bot exploited GitHub Actions misconfigurations to compromise Microsoft, DataDog, Trivy and others. No zero-day needed—just a pull request. Threat Intelligence supply chain github actions ci/cd AI threats open source security https://threatlandscape.io/blog/critical-cve-2026-20127-cisco-sd-wan-active-exploitation https://threatlandscape.io/blog/critical-cve-2026-20127-cisco-sd-wan-active-exploitation Thu, 26 Feb 2026 00:00:00 GMT Critical alert: UAT-8616 actively exploiting CVE-2026-20127 in Cisco Catalyst SD-WAN for authentication bypass and root escalation. Mitigation steps inside. Threat Advisory CVE-2026-20127 Cisco SD-WAN authentication-bypass privilege-escalation threat-actor FCEB https://threatlandscape.io/blog/analyzing-cve-2025-59536-cve-2026-21852-agent-configuration-risks https://threatlandscape.io/blog/analyzing-cve-2025-59536-cve-2026-21852-agent-configuration-risks Wed, 25 Feb 2026 00:00:00 GMT Deep dive into the recent RCE and credential exfiltration vulnerabilities (CVE-2025-59536 & CVE-2026-21852) affecting Claude Code agentic CLI tools. Threat Advisory CVE-2025-59536 CVE-2026-21852 Claude Code Agentic AI Supply Chain Security https://threatlandscape.io/blog/the-barrier-has-fallen-what-the-mexican-government-breach-tells-us-about-agentic-cyber-threats https://threatlandscape.io/blog/the-barrier-has-fallen-what-the-mexican-government-breach-tells-us-about-agentic-cyber-threats Wed, 25 Feb 2026 00:00:00 GMT Analysis of the Mexican government data breach and what it reveals about AI-orchestrated cyberattacks, kill-chain compression, and modern defense priorities. Threat Intelligence threat-intelligence ai-security government-breach agentic-ai https://threatlandscape.io/blog/supply-chain-fragility-conduent-safepay-ransomware-crisis https://threatlandscape.io/blog/supply-chain-fragility-conduent-safepay-ransomware-crisis Tue, 24 Feb 2026 00:00:00 GMT 8.5 TB exfiltrated, 26M+ victims, 90-day dwell time. A deep-dive into the Conduent/SafePay breach and strategic takeaways for security executives. Threat Advisory ransomware supply chain third-party risk SafePay Conduent data breach PHI https://threatlandscape.io/blog/analyst-advisory-critical-zero-day-cve-2026-22769-dell-recoverpoint https://threatlandscape.io/blog/analyst-advisory-critical-zero-day-cve-2026-22769-dell-recoverpoint Wed, 18 Feb 2026 00:00:00 GMT Critical unauthenticated hardcoded-credential vulnerability in Dell RecoverPoint is under active exploitation. CVE-2026-22769 Immediate patching and network isolation recommended. Threat Advisory cve-2026-22769 dell recoverpoint zero-day intrusion unc6201 https://threatlandscape.io/blog/vulnerability-spotlight-cve-2026-20841 https://threatlandscape.io/blog/vulnerability-spotlight-cve-2026-20841 Thu, 12 Feb 2026 00:00:00 GMT Discover the details of CVE-2026-20841, a remote code execution flaw in Notepad's Markdown handling, and learn how to protect your systems. Threat Advisory CVE-2026-20841 Windows Notepad Remote Code Execution Markdown Vulnerability https://threatlandscape.io/blog/abuse-of-cve-2025-8088-enables-stealthy-loader-deployment-in-targeted-intrusions https://threatlandscape.io/blog/abuse-of-cve-2025-8088-enables-stealthy-loader-deployment-in-targeted-intrusions Thu, 05 Feb 2026 00:00:00 GMT Analysis of active CVE-2025-8088 exploitation campaigns leveraging malicious RAR archives, custom loaders, and evasive C2 infrastructure. Threat Intelligence CVE-2025-8088 Amaranth Dragon Loader Malware WinRAR https://threatlandscape.io/blog/critical-n8n-vulnerabilities-cve-2025-68613-and-cve-2026-25049-analysis https://threatlandscape.io/blog/critical-n8n-vulnerabilities-cve-2025-68613-and-cve-2026-25049-analysis Thu, 05 Feb 2026 00:00:00 GMT Detailed analysis of n8n workflow automation platform vulnerabilities allowing remote code execution and credential theft. Threat Intelligence n8n CVE-2025-68613 CVE-2026-25049 RCE workflow automation https://threatlandscape.io/blog/manufacturing-sector-threat-landscape-ransomware-and-supply-chain-risks-in-2026 https://threatlandscape.io/blog/manufacturing-sector-threat-landscape-ransomware-and-supply-chain-risks-in-2026 Thu, 05 Feb 2026 00:00:00 GMT Latest threat intelligence on manufacturing sector risks, including RaaS, supply chain pre-positioning, and critical CVEs. Threat Intelligence ransomware manufacturing supply chain CVE threat intelligence https://threatlandscape.io/blog/beyond-the-feed-feedly-threat-intelligence-alternative https://threatlandscape.io/blog/beyond-the-feed-feedly-threat-intelligence-alternative Wed, 04 Feb 2026 00:00:00 GMT Looking for a Feedly threat intelligence alternative? Discover how switching from RSS aggregation to structured threat monitoring saves analysts hours per week. Industry Analysis Threat Intelligence CTI Feedly Alternative Security Operations Workflow https://threatlandscape.io/blog/active-emerging-threats-targeting-european-banking-january-2026 https://threatlandscape.io/blog/active-emerging-threats-targeting-european-banking-january-2026 Tue, 20 Jan 2026 00:00:00 GMT Discover the latest active and emerging threats targeting European banking institutions in January 2026. Threat Intelligence threat intelligence banking malware Europe Klopatra