Microsoft Attributes ConnectWise Cloud Backup Compromise to China-Aligned Storm-0940
Microsoft assesses that Storm-0940 used the open-source agentic AI framework ARTEX against downstream tenants after the ConnectWise Cloud Backup credentials were compromised, with privileged access in under three hours in multiple instances. Most targeting failed.
Flash Briefings
All briefings →Microsoft Attributes ConnectWise Cloud Backup Compromise to China-Aligned Storm-0940
Microsoft assesses that Storm-0940 used the open-source agentic AI framework ARTEX against downstream tenants after the ConnectWise Cloud Backup credentials were compromised, with privileged access in under three hours in multiple instances. Most targeting failed.
PHP2Shell: Two Critical PHP Flaws Give Unauthenticated Attackers Code Execution on the Web Server
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619. Researchers demonstrated unauthenticated RCE against WordPress, Drupal and Joomla images; no in-the-wild exploitation has been reported.
CISA, FBI and UK NCA Issue Joint #StopRansomware Advisory on SafePay, Citing 600+ Victims
A joint advisory from US, German and UK agencies details SafePay's initial access, tooling and exfiltration methods, and lists five edge-device and backup vulnerabilities the group exploits.
Ahold Delhaize Confirms 'Malicious Actions' Behind Week-Long Outage Across US and European Grocery Brands
The multinational grocery operator has confirmed a cyberattack forced it to take systems offline across most of its US and European retail banners, disrupting e-commerce and deliveries for over a week with no evidence yet of stolen customer data.
Deep Analysis
All analysis →Harvest Now, Decrypt Later: The Quantum Threat That's Already a Present-Tense Breach
Nation-state actors are reportedly stockpiling encrypted traffic today against the day a quantum computer can read it. With qubit estimates for breaking RSA-2048 collapsing and enterprise migration stuck at roughly 5% readiness, the exposure window is a threat-intel problem now, not a 2030s compliance deadline.
Microsoft named Void Blizzard in May 2025; Dutch intelligence had already been tracking the same actor as LAUNDRY BEAR. An FBI complaint unsealed in June 2026 accuses a Russian national of running the VPS infrastructure behind it — while the group itself keeps going.
Play Ransomware Doesn't Negotiate Like Anyone Else — and It's Still Running
No ransom amount in the note, no negotiation chat portal, just a Gmail-style address and a deadline. Play has stayed active since mid-2022 with no confirmed law enforcement disruption, and its operating model is still disputed among the researchers tracking it.
Commentary
All commentary →Free OT Defence for 500 Small Utilities: What the New Foundation Fixes and What It Leaves Open
Accenture, Dragos and SANS say a new $10 million foundation will fund OT monitoring and training for up to 500 under-resourced US utilities. The money helps, but the model has limits that boards and regulators should price in.
APT33 Went Quiet After Tickler. That Probably Doesn't Mean What You'd Hope
Microsoft's Peach Sandstorm (APT33) was last seen running a custom backdoor through fraudulent Azure subscriptions against US and UAE targets in mid-2024. The trail goes cold after a late-2025 forecast report — and a similarly-named 2026 CISA advisory about Iranian hackers is a different group entirely.
APT39 Was Never About Sabotage. That's Exactly Why It's Easy to Forget About
Iran's APT39/Chafer hacks people, not headlines — bulk telecom and travel data theft in service of tracking individuals, run through a sanctioned front company. Six years after the US named it, no new victim has ever been publicly confirmed.