Updated continuously

The signal that matters.

Cutting through advisories, vendor PSIRTs, researcher write-ups, and the underground — correlated, deduped, and ranked so your team only sees what moves the needle.

Get the daily digest

Free · one email each morning

Updated 3h ago

Embedded Device Vuln…Perimeter Device Exp…Widely Deployed Prod…+2

Six MikroTik RouterOS Flaws Enable Unauthenticated SSH Access and File Disclosure

MikroTik patched six vulnerabilities in RouterOS releases earlier than 6.49.21, 7.23.4, and 7.24.2. CERT Polska reported flaws affecting SSH authentication and RSA signature validation, WebFig file access, the btest service, and SSH login privilege handling. The issues can permit unauthenticated remote SSH command execution, disclosure of root-owned files that may contain credentials, kernel restarts, privilege escalation, and TLS server impersonation.

Timeline

Technical details published for RouterOS btest memory-disclosure flaw
Technical details published for RouterOS SSH key-authentication bypass

Attack Surface Exposure·10sources·Updated 2h ago

Latest

Actively Exploited V…Internet Facing Serv…+3

StyleSmuggler Zero-Day Enables Unauthenticated RCE in Magento Stores

Attackers are actively exploiting StyleSmuggler, an unpatched unauthenticated remote-code-execution chain in Magento Open Source that may also affect Adobe Commerce. The attack injects malicious PHP through Magento template style properties, poisoning a log or report file before triggering its execution through the Payment Transaction Failed Reminder email-rendering path. Sansec reproduced the chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9 systems, while a confirmed victim ran fully patched 2.4.6-p15.

Active Exploitation

2·Updated 3h ago

Persistence MethodDefense Evasion Method+1

Windows PE TLS Callbacks Execute Code Before the Program Entry Point

A Windows PE demonstration shows that Thread Local Storage (TLS) callbacks execute during process initialization before the executable entry point and C main. MinGW-w64 callback pointers placed in .CRT$XLB and .CRT$XLBB invoke two callbacks in order, producing 12 when both return normally. The first example ran raw x64 MessageBox payload through EnumDesktopsA, but its thread-exit behavior could end the initializing thread before the second callback and main executed; a revised payload restored the stack and returned normally, allowing initialization to complete.

Attack Tradecraft

4·Updated 13h ago

Mass Credential Expo…Enforcement Action+3

French Police Arrest ZeroBytes Suspect Over Taxpayer Data Theft

French police arrested an 18-year-old suspected member of the ZeroBytes hacking collective, known online as “ChatNoir,” in connection with the compromise of France’s Directorate General of Public Finances (DGFiP). Prosecutors said the suspect was arrested on August 18, formally placed under investigation on August 20, and remanded in pretrial detention. A second suspect, younger than 16, was questioned and released; investigators retained that person’s computer equipment for forensic examination.

Breach & Incident Intelligence

2·Updated 5h ago

12 sections hidden

Find out if you're exposed

Don't read about it. Know when it affects you.

Mallory correlates every story on this page with your attack surface (assets, vendors, identities, subsidiaries) and surfaces a small set of evidence-based cases instead of 10,000 alerts.