// THREAT INTELLIGENCE CENTER

Turn threat signals into defensive action.

Live cyber update intelligence, KEV-style prioritization, mitigation guidance, and SOC-ready action cards.

Export JSON Export CSV

Tracked items

Critical CVEs

High risks

Live

Feed status

Intel feed

low

Hackers breach govt webmail while running parallel crypto fraud

The Jewelbug hacker group has been carrying out espionage operations targeting governments and militaries while also engaging in cryptocurrency fraud. [...]

Mitigation: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

critical

Microsoft patches LegacyHive Windows zero-day vulnerability

Microsoft has released security patches to address a Windows zero-day vulnerability known as "LegacyHive," disclosed after the July 2026 Patch Tuesday. [...]

Mitigation: Confirm exposure, apply vendor patches, add temporary WAF/IPS rules, and run post-patch vulnerability validation.

low

AI 'watermark removers' flood the web. Almost none can prove they work.

Multiple 'watermark removers' have surfaced days after Anthropic began watermarking text generated by Claude, including an open source project with over 4,500 GitHub stars and paid AI detection evasion services. None of the tools' claims about defeating the text watermark can be verified, as Anthropic has not released a detector. [...]

Mitigation: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

high

Critical VMware vCenter RCE flaw exploited for reverse SSH access

A recently patched critical vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being exploited in an active campaign to deploy a reverse SSH tool for persistence and remote access. [...]

Mitigation: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

high

Trezor discloses data breach affecting nearly 14,000 customers

Hardware wallet manufacturer Trezor disclosed a data breach affecting nearly 14,000 of its customers after ShipMonk, its shipping and logistics provider, was hacked [...]

Mitigation: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

high

Siemens Parasolid

View CSAF Summary Parasolid is affected by an out of bounds read vulnerability that could be triggered when the application reads files in X_T format. This could allow an attacker to crash the application or execute arbitrary code. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Parasolid are affected: Parasolid V38.0 vers:

Mitigation: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

medium

Siemens License Server (SLS)

View CSAF Summary Siemens License Server is affected by multiple vulnerabilities which could allow an attacker to elevate its privileges and read arbitrary files on the system. Siemens has released a new version for Siemens License Server (SLS) and recommends to update to the latest version. The following versions of Siemens License Server (SLS) are affected: Siemens License Server (SLS) vers:intdot/<5.1, vers:int

Mitigation: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

medium

Siemens Desigo DXR and PXC Controllers

View CSAF Summary A vulnerability in Desigo DXR and PXC controllers has been identified that could allow an attacker to cause denial of service conditions by sending malformed BACnet packets. Recovery requires a device reset or reboot to restore normal functionality. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Desigo DX

Mitigation: Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.

Open full cyber update stream →

How to use Threat Intelligence Manual & worked example — inputs, output, limits, what it does not do, and a worked example. Open the reference →