CVE-2026-17482 — Critical vulnerability brief
CVSS 9.8IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.
Live cyber intelligence board
Track CVEs, attack groups, malware, vendors and training in one place.
CybersecurityBoard.com brings together vulnerability intelligence, security news, MITRE ATT&CK group profiles, cyber events, certifications, training, products, companies and service providers.
Latest Critical CVEs
All CVEs →Apple’s Private Cloud Compute Flaw CVE-2026-20685
Apple paid a $150,000 bounty for a path traversal vulnerability in darwin-init, tracked as CVE-2026-20685, which could allow privileged network attackers to…
Unpatched GeoServer Zero-Day Actively Exploited, Could Lead to Remote Code Execution
A newly disclosed zero-day vulnerability in GeoServer is being actively exploited in the wild, according to threat intelligence firm watchTowr. The flaw,…
CVE-2026-73533 — Critical vulnerability brief
CVSS 9.3Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server.…
CVE-2024-6387: OpenSSH Vulnerability Exploited in APT36 Campaign
CVE-2024-6387 is a critical vulnerability in OpenSSH that was exploited by APT36 in their campaign targeting Afghan telecom and Indian critical infrastructure.…
CVE-2026-53791 — Critical vulnerability brief
CVSS 9.1rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending…
Latest Cyber News
All news →Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware
Threat actors are increasingly acquiring expired domains—known as "dropcatch domains"—to inherit their reputation and traffic, redirecting victims to scams and malware. According…
IAM Compliance Requirements and Best Practices: From Policy to Verified Enforcement
Identity and Access Management (IAM) compliance is the practice of proving that access controls are not just documented but actively enforced across…
Apple Warns Users in 110 Countries of Mercenary Spyware Targeting
Apple has issued a fresh batch of threat notifications to customers in 110 countries, warning that they may be targeted by mercenary…
CTM360 Uncovers 3,000+ Recruitment Phishing URLs Using Browser-in-the-Browser Credential Traps
Cybersecurity researchers at CTM360 have exposed a large-scale, global recruitment-themed phishing campaign that leverages Browser-in-the-Browser (BitB) windows to steal Google and Facebook…
Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers
Cybersecurity researchers at SpecterOps have detailed a post-exploitation technique that enables the Chrome DevTools Protocol (CDP) inside a running Google Chrome or…
Trump Memo Authorizes U.S. Firms to Hack and Disrupt Foreign Crime Groups
A new White House memo signed by U.S. President Donald Trump directs the National Coordination Center (NCC) to establish a program allowing…
Latest Attack Groups
MITRE groups →Swiping Squirrel: Zero-Click Advertising Traffic Scavenger
Swiping Squirrel is a financially motivated threat actor active since at least 2022, controlling over 3,000 domains. It sends fraudulent traffic to…
SocGholish: Malware Campaign Regaining Access via Expired Domains
SocGholish is a malware campaign that regained access to thousands of compromised sites by teaming up with Shady Squirrel shortly after its…
Sable Squirrel: Expired Domain Empire for Streaming, Gambling, and Malware
Sable Squirrel is a Vietnam-based threat actor that has spent nearly $7 million acquiring expired domains to build a criminal enterprise. It…
Stuffy Squirrel: Traffic Scavenger Using Expired Domains
Stuffy Squirrel is a financially motivated threat actor active since at least 2020, controlling over 500 domains. It operates a traffic distribution…
Latest Malware
Malware →NanoCore: Remote Access Trojan Used by Sable Squirrel
NanoCore is a remote access trojan that has been identified in malware samples communicating with Sable Squirrel's infrastructure, highlighting its role in…
njRAT: Malware Family Found in Sable Squirrel Infrastructure
njRAT is a remote access trojan that has been detected in malware samples communicating with Sable Squirrel's infrastructure, contributing to the threat…
HiddenTear: Ransomware Signatures Found in Sable Squirrel Campaigns
HiddenTear is a ransomware family whose signatures have been found in artifacts communicating with Sable Squirrel's infrastructure, indicating potential ransomware activity within…
Mustang Panda Deploys Signed Windows Rootkit in Updated CoolClient Backdoor
Mustang Panda (aka HoneyMyte) has been observed deploying an updated version of the CoolClient backdoor that includes a signed Windows kernel-mode rootkit,…
Events, Certifications & Training
Explore →Microsoft August 2026 Patch Tuesday Addresses 421 Flaws
Microsoft's August 2026 Patch Tuesday included patches for 421 security flaws, including 236 in Windows, and addressed critical vulnerabilities such as CVE-2026-50656,…
USENIX WOOT Conference
USENIX WOOT is a security conference where the research on SIM card attacks was presented. The paper highlights the attack surface of…
ISO/IEC 27001:2022 Annex A Access Control and Identity Management
ISO/IEC 27001:2022 is an international information security management standard. Its Annex A includes access control and identity management controls that organizations can…
GIAC Certified Incident Handler (GCIH)
The GCIH certification demonstrates proficiency in incident handling and response, often pursued after SANS SEC504 training.
SEC660 Course Update Integrates AI Automation with Manual Exploit Skills
The SEC660 course at SANS Network Security 2026 teaches how to leverage AI for automating tasks while maintaining deep manual understanding of…
SANS SEC504: Hacker Tools, Techniques, and Incident Handling
SANS SEC504 is a training course covering hacker tools, techniques, and incident handling, leading to GCIH certification.
Products, Services & Companies
Browse market →Orchid Security Platform: Continuous IAM Compliance Verification
The Orchid Security platform operates in the identity observability category, discovering identities from applications and infrastructure, verifying how access is actually used,…
iPhone Security Alerts for Spyware Targeting
Apple's iPhone displays threat notifications on the Lock Screen and in Settings to alert users who may be targeted by mercenary spyware.…
Lockdown Mode: Apple’s Defense Against Spyware
Lockdown Mode is an Apple security feature that provides an extreme level of protection against sophisticated cyberattacks, including mercenary spyware. Apple recommends…
CDP-Enable-BOF: Post-Exploitation Tool for CDP Activation
CDP-Enable-BOF is a Beacon Object File (BOF) developed by SpecterOps that activates the Chrome DevTools Protocol inside an already running Chrome or…
Albertsons: Company Behind krogeralbertsons.com Domain
Albertsons was part of the proposed merger with Kroger, which used the domain krogeralbertsons.com. The domain was later acquired by Sable Squirrel…
DropCatch.com: Custom Drop Catching Service for Expired Domains
DropCatch.com is a custom drop catching service that tracks domains approaching deletion and automatically attempts to register them on behalf of customers.…
Dynabot: Registrar Used by Sable Squirrel for Domain Acquisitions
Dynabot is a domain registrar that has been used by Sable Squirrel to purchase expired domains at auctions, contributing to the threat…
General Electric: Former Owner of healthymagination.com Domain
General Electric launched the health initiative healthymagination.com in 2009. The domain was later acquired by Sable Squirrel for illegal sports-streaming operations.
AstrillVPN: VPN Service Used by Suspected DPRK Operatives
AstrillVPN is a VPN service whose exit nodes were identified in the investigation as part of the infrastructure used by suspected DPRK…
Vultr: Cloud Infrastructure Provider
Vultr is a cloud infrastructure provider that was used to host the fake crypto startup's infrastructure in the undercover operation. The researchers…
Gorilla Servers: Hosting Provider Used in Undercover Operation
Gorilla Servers is a hosting provider that was used in the undercover operation to host infrastructure. The researchers noted that the operatives'…
Bugcrowd: Crowdsourced Security Platform
Bugcrowd is a crowdsourced security platform that facilitated the disclosure of the RovoBlast vulnerability in Atlassian Rovo. The platform rated the issue…