Daily Top
cPGuard ran as root. 5.88.26 is not the hashes.
OPSSHIELD confirmed a 70-minute poisoned update on 2 November. About 2,950 Linux hosting servers executed it. The clean agent removes the shell. It does not change /etc/shadow.
Read →RWP Ventures // Cyber intelligence
Intelligence for the threats that matter.
Daily and weekly analysis of enterprise cybersecurity, identity, cloud, AI, vulnerabilities, ransomware, nation-state activity, and operational technology.
Today's top intelligence · Daily Top
Five agencies named the freezer. A factory reset is not the close.
CISA, FBI, HHS, USDA and DOT published 5 November. Actors force internet-reachable refrigeration controllers into continuous heat and defrost. EFS caught three blood-bank rooms. Grocery already lost stock. No CVE in the fact sheet.
CONFIRMED On 5 November 2026 CISA, FBI, HHS, USDA and DOT published a joint fact sheet. The sentence is not a CVE. It is that malicious cyber actors are targeting industrial refrigeration and cold-chain monitoring systems globally, including electronic temperature controllers and
Latest intelligence
Recent Daily Top
Daily Top
WordPress is on KEV. The last unpack is the race. Thursday is the clock.
CISA added CVE-2026-119977 on 3 November. Due 6 November. Forensic triage Yes. Catalog 2026.11.03 / 1767. 7.1.4 is the close. The update that installs it still unpacks through the old path.
Read →Daily Top
The IoT2050 Node-RED has no login. The canary got the bot. This is not a PLC write.
VulnCheck 2 November. CVE-2026-58115, CVSS 10, SIMATIC IoT2050 Advanced. Unauthenticated Node-RED HTTP. First canary hit 30 October. Linux bot to /dev/shm/.b, then a /cmd that survives reboot. Not CISA KEV. Not a process write.
Read →Daily Top
The LLM is on the C2. The implant still dumps LSASS.
Kaspersky 2 November. Education orgs in Africa and Latin America. CyberStrikeAI’s model planned the domain from the attacker server. The host ran Kerberoast, comsvcs MiniDump, DCSync. Not a new technique. Not a nation-state claim.
Read →Daily Top
The root CVE is on KEV. 22.8R2.5 is not the close.
CISA added CVE-2026-111357 and CVE-2026-118527 on 30 October. 111357 due 2 November, forensic triage Yes. Catalog 2026.10.30 / 1766. The 13 October 104935 build is still affected.
Read →Daily Top
GitLab is on KEV. A version bump is not the Ruby.
CISA added CVE-2026-97229 on 29 October. Due 1 November. Forensic triage Yes. Catalog 2026.10.29 / 1764. Omnibus patches Onigmo. Source installs do not.
Read →Weekly products
Weekly intelligence
IT threat intelligence
- Enterprise
- Identity
- Cloud
- Vulnerabilities
- Ransomware
- Nation-state activity
Latest
The IT week was the runtime. PHP2Shell is in the interpreter; Plex’s 1.43.3 label is not the build; LiteLLM’s Git tag is clean; Gheist already printed the private secrets.
19–26 October 2026. Eight new KEVs, catalog 2026.10.23 / 1,756. PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 — neither CVE is on KEV. Plex assume-compromise. Collabora 110447 and Arista 114625 due today. Storm-0940 named on last week’s SkyKick.
OT / ICS threat intelligence
- ICS / SCADA
- Industrial control
- Critical infrastructure
- CPS
- Industrial ransomware
Latest
CISA scored ICONICS 9.1. MC Works64 has no fix. The exploited box this week is a VeloCloud, not a historian.
23–30 October 2026. CISA 27 Oct — ICSA-26-300-02 ICONICS/GENESIS header 9.1 (CVE-2026-16438 DCOM); the unlock challenge is one fixed response for every user (CVE-2026-16436). 10.98 / 11.04 close most trains; MC Works64, GENESIS32 and BizViz have no patch. Same day: EPICS Base 9.8 unauth integer overflow, 7.0.11. 29 Oct: Hitachi TRO600 9.2.2.1, CoreTec5 5.0.0, Mendix SAML 4.2.4. KEV this window is Arista VCO 23 Oct and Cisco ASA SSL-VPN DoS 29 Oct, not a PLC.
Intelligence domains
Browse by domain
RWP Ventures
Intelligence informs execution.
RWP Intelligence publishes defensive analysis. RWP Ventures helps organizations assess, architect, implement, and operate cybersecurity and technology programs — principal-led, threat-informed, documented against the frameworks boards and auditors expect.
OT Atlas
Open OT knowledge
Open, vendor-neutral defensive knowledge for operational technology and cyber-physical systems, supporting the OT practice at RWP Ventures.
Explore OT Atlas ↗