Updated continuously

Today in threat intelligence.

Mallory correlates thousands of sources: vendor security advisories, government alerts, researcher write-ups, and underground reporting. We extract the facts that matter, so you can act on them right now.

sources monitoredcontinuously: 6,802
reports analyzedlast 24 hours: 2,838
stories surfacedlast 24 hours: 12

Free daily digest

Your morning threat briefing.

Top stories, newly exploited vulnerabilities, and CISA KEV additions. One email each morning.

Get the daily digest

Free · Unsubscribe anytime

Updated 8min ago

Government Vulnerabi…Actively Exploited V…Perimeter Device Exp…+2

Citrix Patches Actively Exploited NetScaler SAML Flaw; CISA Orders Urgent Remediation

Citrix released emergency updates for CVE-2026-88779, an actively exploited memory-buffer bounds vulnerability affecting NetScaler ADC and NetScaler Gateway appliances configured for SAML authentication with Gateway or AAA functionality. The flaw has a reported CVSS score of 8.7 and can cause denial of service through repeated process crashes and appliance reboots. Administrators observed shell commands embedded in authentication usernames, while researcher Kevin Beaumont reported a downloaded malware binary running on a patched honeypot; remote code execution through this specific vulnerability remains under investigation.

Timeline

Norway's NSM updates NetScaler advisory to acknowledge denial-of-service impact
watchTowr Labs reports reproducing CVE-2026-88779

Active Exploitation·5sources·Updated 2min ago

Latest

Education Sector Thr…Ransomware Group Ope…

Slate Valley School District Rejects Ransom Demand as Kairos Threatens Data Exposure

Slate Valley Unified School District in Fair Haven, Vermont, voted not to pay a ransom demand after responding to a security incident that began September 3, according to an October 4 DataBreaches report highlighted by Malware News. The report indicated that the Kairos threat actors were likely to leak data following the district’s refusal to pay.

Sector Threat Intelligence

2·Updated 7h ago

Cloud Service Vulner…Zero Day Acquisition+2

Vercel Confirms KVM Zero-Day VM Escape and Awards Researcher $50,000

Vercel confirmed a KVM zero-day after security researcher Paulos Yibelo reported a full virtual machine escape through its Vercel Sandbox bug bounty program. Yibelo said code running inside a guest could obtain root access on the host, and Vercel awarded him its maximum single-report bounty of $50,000. Vercel Sandbox runs untrusted workloads, including AI-agent code, in Firecracker microVMs on bare-metal Amazon EC2 hosts; the reported escape crosses the service’s primary isolation boundary.

Attack Tradecraft

2·Updated yesterday

Enforcement ActionPrivacy Surveillance…+1

Italy Fines IQVIA €7 Million for Unlawful Processing of One Million Patients’ Health Data

Italy’s Data Protection Authority fined IQVIA Solutions Italy Srl €7 million for unlawfully processing health information concerning approximately one million patients of 800 general practitioners. The authority found that data described as anonymous allowed patients to be tracked and potentially re-identified, while the database contained explicit identifying information for more than 3,300 patients. The investigation followed inspections in April 2025 and included proceedings concerning a personal data breach reported by IQVIA.

Regulatory & Policy

3·Updated yesterday

12 sections hidden

Find out if you're exposed

Don't read about it. Know when it affects you.

Mallory correlates every story on this page with your attack surface (assets, vendors, identities, subsidiaries) and surfaces a small set of evidence-based cases instead of 10,000 alerts.