Company
Huntress is a cybersecurity company offering managed detection and response (MDR), threat hunting, and SOC services mainly for small and midsize businesses.
New Zealand's NCSC says a North Korean operative hired as a remote IT contractor threatened to leak a large business's sensitive data once exposed. Coder Trove counts five of the 10 steps in a fake remote hire as running through HR.
Reality
Attackers began exploiting a CVSS 10.0 AhsayCBS chain on October 7, three days after the CVEs published, per a DEV Community analysis. Teams with internet-reachable servers should confirm the exact build number now, because it decides whether they are exposed.
Reality
CISA added four exploited flaws in PAN-OS, Cisco Secure Email Gateway and AhsayCBS to KEV with an October 17 federal deadline. We would take the Cisco gateway first, then AhsayCBS servers already patched once, then PAN-OS.
Perspective Coverage
3 publishersReality
Horizon3 detailed how two AhsayCBS backup-server flaws chain into unauthenticated code execution as SYSTEM and root. Attackers were already planting webshells through the chain before Ahsay issued hotfixes on 12 October 2026.
Reality
Huntress traced an MSP administrator's October 7 Bing search to watchguard-vpn[.]net, a WatchGuard lookalike that served a genuine signed installer. The domain was offline by October 13, and earlier WatchGuard and Microsoft reports had described fake clients.
Reality
North Korean fake IT workers are submitting as many as 60 job applications a day, ITPro reported from new research. Interviews are where these candidates succeed, so identity checks at hiring belong on the security team's list.
Reality
Attackers are chaining two unpatched AhsayCBS flaws to run code as SYSTEM and plant webshells and XMRig miners, according to Huntress. Managed service providers are the main users of the console, so the hosts being hit are the ones that manage backup users and policies for clients.
Perspective Coverage
6 publishersReality
A memorandum signed on 12 August lets contracted US firms attack foreign criminal networks. It excludes state-directed groups and is silent on prosecution abroad.
Perspective Coverage
6 publishersReality
Denmark says hackers used a Danish company's search access to the Central Person Register to reach names, addresses and ID numbers of 8.8 million people. Because that access is a service offered to businesses by design, every partner account with search rights is part of the register's security perimeter.
Perspective Coverage
15 publishersReality
Federal agencies now have three separate patch deadlines inside twelve days. The lowest-scoring pair of the five flaws added to KEV is the one with a documented 24-day intrusion campaign behind it.
Reality
Huntress tied one rogue ScreenConnect configuration from a Power BI phishing campaign to 22 more endpoints across separate incidents. For defenders, the thing to hunt is a ScreenConnect client their own IT never deployed.
Reality
CISA added two JFrog Artifactory access-control flaws and one ConnectWise ScreenConnect privilege flaw to the Known Exploited Vulnerabilities catalog on 11 September, and by the catalog's own criteria published mitigation guidance already exists for each.
Perspective Coverage
13 publishersReality
Huntress's agent, installed after an Akira ransomware attack, flagged a GOST tunnel on a domain controller set up about four hours after encryption began. The evidence that the ransomware ran came from Registry entries, event logs and Akira's own log files left on disk.
Reality
Huntress found legitimate remote management software abused in 45% of the endpoint incidents it logged in the first quarter of 2026. A rogue copy can behave like IT's approved one, so defenders have to know which tools are sanctioned and how each install arrived.
Reality
Huntress details four ways attackers who already hold administrator rights add Microsoft Defender exclusions to keep malicious files out of every scan. A registry value can also hide those exclusions from any admin who checks for them.
Reality
Huntress says a threat actor turned member-account file uploads into webshells on three web servers of a shared recreation-management platform. The same upload path served every tenant, and the attacker returned after one server was cleaned but not locked down.
Reality
Huntress traced a RAT campaign that hides its first-stage lure in a ChatGPT Custom GPT on the real chatgpt.com, across at least 40 incidents. Because the page sits on a trusted domain, blocking the ClickFix PowerShell paste is the control that works.
Perspective Coverage
8 publishersReality
Huntress traced at least two of more than 40 ClickFix malware incidents to fake custom GPTs on OpenAI's chatgpt.com. On that route every hop before the PowerShell command sat on a Google or OpenAI address, so staff taught to trust familiar domains would click through each one.
Reality
ShinyHunters says the two to three terabytes it took from the FBI include psychiatric and medical evaluations of bureau staff. Beside a Reuters sample tying named staff to counterintelligence jobs, those files are exposure no password reset can fix.
Reality
An affiliate entered through an MFA-less SonicWall VPN, then used Safe Mode with Networking to kill endpoint controls. The encryptor ran out of virtual memory instead of running.
Perspective Coverage
3 publishersReality
Security · August 19, 2026 · Confirmed2 publishers
Security · August 23, 2026 · Confirmed4 publishers
Security · August 28, 2026 · Confirmed10 publishers
Security · September 7, 2026 · Confirmed3 publishers
Security · September 7, 2026 · Confirmed7 publishers
Security · September 12, 2026 · Confirmed7 publishers
Security · September 18, 2026 · Confirmed2 publishers
Security · September 23, 2026 · Confirmed2 publishers
Security · August 20, 2026 · Confirmed2 publishers