Security insights, vulnerability roundups, and updates from the Agent Breach team.
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.
A new modular malware framework called Avalon has been discovered, featuring multi-stage phishing delivery and built-in ransomware deployment. It combines credential theft, lateral movement, and remote access capabilities.
Read moreA new Linux kernel vulnerability allows unprivileged users to gain root access. The flaw impacts desktops, servers, and Android devices.
Read moreSeven vulnerabilities discovered in FatFs, a filesystem used in millions of embedded devices. These flaws could allow attackers to compromise firmware in security cameras, drones, and more.
Read moreThis week's threat landscape reveals a recurring vulnerability pattern: small permission gaps and insufficient validation checks across browsers, AI systems, email, and sandboxes. Security teams must audit permission models and access controls to prevent exploitation of seemingly minor oversights.
Read moreUbuntu has released multiple security advisories addressing dozens of Linux kernel vulnerabilities affecting networking, cryptography, and core subsystems. Several flaws enable local privilege escalation and container escape, requiring immediate patching across affected systems.
Read moreUbuntu security update USN-8500-1 addresses five vulnerabilities in Vim affecting path traversal, denial of service, and arbitrary code execution. Multiple Ubuntu LTS versions require immediate patching to mitigate risks from malicious files and plugins.
Read moreAnubis ransomware operators are leveraging the Citrix Bleed 2 vulnerability (CVE-2025-5777) combined with legitimate RMM tools and supply chain credentials to breach enterprise networks. Security teams must prioritize patching and monitoring for these converging attack vectors.
Read moreGoogle's Threat Intelligence Group, working with the FBI and Lumen, has significantly degraded NetNut, a major residential proxy network that compromised millions of home devices. The coordinated action demonstrates how threat actors abuse consumer infrastructure to facilitate malicious traffic and bypass security controls.
Read moreThreat actors are exploiting search engine optimization techniques to direct users to fake software download sites hosting malicious installers. The campaign deploys AsyncRAT through ScreenConnect, targeting popular applications like OBS Studio and Bandicam across multiple languages and domains.
Read moreA 19-year-old dual U.S.-Estonian citizen has been extradited from Finland to face federal charges related to his alleged involvement with the Scattered Spider hacking group. The case highlights law enforcement's growing focus on dismantling organized cybercriminal networks targeting enterprise systems.
Read more