Threat Intel

Active threats, clearly explained.

Time-sensitive security advisories from our engineers - active outbreaks, zero-days, and exploitation trends that matter for SMBs across the MENA region.

Latest Advisories

Oct 21, 20269 min read

CVE-2026-109618CVE-2026-109619

PHP2Shell Vulnerabilities Require Urgent PHP Runtime Patching

PHP2Shell vulnerabilities can expose PHP web servers to RCE. Learn affected versions, temporary mitigations, and urgent patching steps with Cyberactics now.

Read advisory

Sep 27, 20266 min read

CVE-2026-88771CVE-2026-88772

Actively Exploited NetScaler Zero-Days - Urgent Response Priorities

Actively exploited NetScaler zero-days expose perimeter appliances to risk. Cyberactics outlines urgent patching, compromise checks, and monitoring steps now.

Read advisory

Sep 19, 20267 min read

CVE-2026-53266

CVE-2026-53266 Linux Kernel Flaw - Patch Bridge Hosts

CVE-2026-53266 affects Linux bridge Netfilter hosts with specific ebtables SNAT rules. Cyberactics helps teams assess exposure, patch, mitigate, and investigate.

Read advisory

Sep 18, 20268 min read

CVE-2026-76460

Cisco ISE CVE-2026-76460 Exploitation and Response Guide

Cisco ISE CVE-2026-76460 is actively exploited. Learn patching, compromise assessment, and investigation priorities for affected systems with Cyberactics.

Read advisory

Sep 10, 202610 min read

CVE-2025-25249

CVE-2025-25249 PivotC2 Exploitation Targets FortiGate Firewalls

CVE-2025-25249 PivotC2 exploitation targets FortiGate firewalls for credential theft and internal access. Cyberactics covers patching and threat hunting.

Read advisory

Sep 2, 20269 min read

CVE-2026-0768

CVE-2026-0768 Exploitation Targets AWS and OpenAI Credentials

CVE-2026-0768 exploitation targets Langflow systems for AWS and OpenAI credentials. Cyberactics explains the RCE risk, investigation, and response steps.

Read advisory

Aug 29, 202610 min read

CVE-2026-81578CVE-2026-82078

PaperCut Zero-Day RCE Chain - Release 2 Patch and Response Guide

PaperCut zero-day RCE chain is actively exploited. Learn how to deploy Emergency Patch Release 2, investigate compromise, and respond with Cyberactics.

Read advisory

Aug 21, 20269 min read

Rust crates.io Supply-Chain Attack - How to Investigate Malware Builds

Rust crates.io supply-chain attack abused Cargo builds to execute malware. We explain affected crates, indicators, exposure checks, and response.

Read advisory

Aug 21, 20267 min read

CVE-2026-69836

CVE-2026-69836 Microsoft Entra ID RCE Risk and Defensive Priorities

CVE-2026-69836 is a critical Microsoft Entra ID RCE flaw. We examine confirmed risks, unknowns, mitigation status, and defensive priorities.

Read advisory

Aug 15, 202610 min read

RingCentral Breach Data Exposure - What Organizations Should Do

RingCentral breach data included email addresses, names, phone numbers and physical addresses, creating potential phishing and impersonation risks.

Read advisory

Aug 14, 202610 min read

CVE-2026-22572

FortiManager Authentication Bypass CVE-2026-22572 Response Guide

CVE-2026-22572 is a FortiManager MFA bypass requiring a known administrator password. Verify affected versions, patch, restrict access, and review logs.

Read advisory

Jul 31, 20269 min read

CVE-2026-20316

Cisco Secure Firewall Management Center Zero Day Exploited - Protect the Management Plane

Cisco Secure Firewall Management Center zero day exploitation (CVE-2026-20316) highlights why protecting the management plane is essential alongside rapid patching.

Read advisory

Jul 28, 20268 min read

CVE-2026-16812

Arista VeloCloud Orchestrator Zero-Day Under Active Exploitation and Why SD-WAN Management Security Cannot Wait

A critical, actively exploited zero-day (CVE-2026-16812, CVSS 10.0) affects on-premises Arista VeloCloud Orchestrator. Patch immediately, investigate for pre-patch compromise, and verify the management environment.

Read advisory

Talk to an engineer

Need help responding to an active threat? Let's talk.

Our engineers help SMBs across Jordan, Saudi Arabia, Oman, and the UAE triage advisories, validate exposure, and run post-patch investigation.

Request a briefing Read the blog