Weekly IT
IT threat intelligence
Weekly analysis of enterprise cybersecurity, identity, cloud, vulnerabilities, ransomware, infrastructure, and adversary activity.
Latest
The IT week was the broker. SkyKick’s publisher secret minted Graph tokens; ARMORY CASTLE used BeyondTrust as a zero-day; UTA0576 was already root on patched Connect Secure.
12–19 October 2026. Nine new KEVs. Huntress counted 300+ successful Entra sign-ins from a ConnectWise Cloud Backup credential. Mandiant named ARMORY CASTLE on Remote Support. Volexity named UTA0576 on 22.8R2.4. Cisco split 76519 out of September. BeyondTrust 102764 and Fortinet 61624 due today.
Previous assessments
- The IT week was the session kill. FortiBleed is locking admins out without a CVE; ReliaQuest named Settra on the GlobalProtect cookie; Ahsay walked back 10.3.4; last week’s NetScaler SAML floor is still in.
- The IT week was the second ISO. Last week’s NetScaler floor is still in for SAML; Mandiant named WHIPSHOT; FortiMail’s clock expired with firmware still upcoming.
- The IT week was the box on the internet. Two NetScaler RCEs on KEV; last week’s Check Point “imminent” is exploited; SharePoint was recast from spoofing.
- The IT week was who gets on the network. Cisco TAC found ISE and the mail gateway; vCenter is ransomware Known.
- The IT week was the control plane. Sandworm overlap and Qilin on Cisco FMC; PaperCut’s agents; GitLab’s file-read.
- The IT week was RMM, session theft, and a sixth Chrome 0-day — not a quiet Labor Day
- Late August closed with TerminalFix, fake installers, and ASCII that mail filters could not see
- The week after Patch Tuesday was stolen tax files, Zimbra, and a VPN that was Sandworm
- August Patch Tuesday was Lazarus on AFD.sys — and Storm-1175 was already on N-central
- Early August was npm worms, ClickFix on Mac, and N-central measured in hours