Threat Field Notes3 Nov 2026
Payment server incident
BTCPay Warns Older Servers Need a New Wallet and Host
Defender takeaway
Find older instances, preserve evidence, move funds using a new seed and rebuild on a clean host.
Independent cyber intelligence
Context. Clarity.Stronger defenses.
Curated threat intelligence, practitioner insights, field notes, and the ideas that help defenders stay ahead of attackers.
Signal over noise. Curated by a practitioner. Updated regularly
Threat landscape
Global activity, distilled for defenders
Threat radar
What defenders should know today
Known exploited
CVE-2026-119977: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
CISA KEVNov 3, 2026
Open briefing Known exploited
CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
CISA KEVOct 30, 2026
Open briefing Known exploited
CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
CISA KEVOct 30, 2026
Open briefing Known exploited
CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
CISA KEVOct 29, 2026
Open briefing Cybersecurity news
Latest analysis and reporting
Read analysis
Threat Field Notes3 Nov 2026
Active exploitation
Node-RED Exploitation Raises the Priority for Siemens IoT2050
Defender takeaway
Inventory Node-RED admin interfaces, update affected Siemens devices and inspect unexpected flows.
Threat Field Notes3 Nov 2026
Critical patch status
Linux TCP Flaw: Check the Kernel Running on Each Host
Defender takeaway
Map inbound TCP exposure, follow vendor-specific fixes, reboot and verify the live kernel.
Threat Field Notes3 Nov 2026
Operational technology
European Store Refrigeration Incidents Put Remote Controls in Focus
Defender takeaway
Find internet-exposed controllers, review configuration changes and coordinate secure access with facilities teams.
Threat Field Notes3 Nov 2026
Mobile patching
The November Android Patch Deserves a Real Device Check
Defender takeaway
Find managed devices still below the applicable November patch level, prioritize privileged users, and verify installation on the device.
Threat Field Notes3 Nov 2026
Ransomware investigation
In the 3AM School Attack, the Domain Changes Tell the Story
Defender takeaway
Watch for new cross-domain trusts, unexpected privileged accounts and backup-server credential access in one incident timeline.
Threat Field Notes1 Nov 2026
Web supply chain
Polymarket’s Script Compromise Is a Warning for Signed-In Pages
Defender takeaway
Map scripts on sensitive pages, preserve the exact delivered bytes during an incident, and check what embedded code can ask a signed-in user to do.
Threat Field Notes1 Nov 2026
Cloud credential exposure
Java Kinesis Producer Library Could Expose AWS Credentials
Defender takeaway
Find the Java client library, upgrade it, and investigate old logs and exposed credentials rather than treating the upgrade as the whole response.
Threat Field Notes31 Oct 2026
Targeted intrusion
VAPOR PANDA Used ARTEX Against More Than 200 Organisations
Defender takeaway
Hunt the reported ARTEX and BLOODALCHEMY behaviours, check gaps in endpoint coverage, and review old exposed credentials and keys.
Threat Field Notes31 Oct 2026
Threat research
Agentic Offensive Frameworks Are Crossing Into Real Intrusions
Defender takeaway
Shorten the time from unusual machine-identity activity to containment, and constrain credentials before automated tooling finds them.
Threat Field Notes31 Oct 2026
Developer supply chain
A Malicious Claude Code Extension Reached Cursor Users
Defender takeaway
Find affected installations, use Cursor’s indicators, investigate execution and rotate credentials based on host evidence.
Threat Field Notes31 Oct 2026
Active exploitation
Drupal Commerce Core: An Order Access Flaw Is Being Exploited
Defender takeaway
Upgrade affected branches and review orders for unexpected access or changes.
Threat Field Notes31 Oct 2026
Post-compromise research
KeyDrift Turns a Cisco SD-WAN Flaw Into a Keying-Material Investigation
Defender takeaway
Patch the controller, inspect Talos indicators and assess whether trust material needs replacement.
Threat Field Notes31 Oct 2026
Known exploitation
Cisco ASA and FTD SSL VPN: A Narrow Condition, a Real Outage Risk
Defender takeaway
Verify the exact tunnel-group condition, install the vendor fix and review reloads against network logs.
Threat Field NotesUpdated Oct 31, 2026
Active exploitation
Ivanti Connect Secure: The VPN Was Only the First Stop
Defender takeaway
Verify the latest vendor build, investigate the October exposure window, and do not rely on an integrity check alone.
Threat Field NotesUpdated Oct 31, 2026
Known exploitation
GitLab’s Emergency Patch: An Unauthenticated Route to Server Code Execution
Defender takeaway
Patch self-managed GitLab, investigate the exposure window and verify dependent runtime fixes in custom images.
Cybersecurity DiveNov 3, 2026
Incidents
European authorities probe ongoing attacks targeting grocery refrigerators
Why it matters
This is worth comparing with your own exposure and incident assumptions. Pay particular attention to the initial access path, identity controls, segmentation, and the telemetry that would have revealed similar activity earlier.
Cybersecurity DiveNov 3, 2026
AI & security
AI threats create ‘urgent’ need to renew cybersecurity information-sharing law, businesses tell Congress
Why it matters
The practical impact depends on how this change alters reporting, procurement, governance, or response obligations. Security leaders should translate the announcement into specific owners, deadlines, and evidence requirements.
SecurityWeekNov 3, 2026
Vulnerabilities
Frontline Education Data Breach Impacts Over 1.3 Million
Why it matters
Defenders should first confirm whether the affected technology exists in their environment, then prioritize exposed and high-value systems. Treat reported exploitation as a prompt to review telemetry and vendor guidance—not only as a patching reminder.
Voices from the field
Insights from podcasts and practitioners
SANS Stormcast · Johannes B. Ullrich
PNG payloads, npm malware, and Pi-hole
Three stories from the 22 September episode, with the main risk in each and a defender check to make next.
Episode field noteRead analysis
Blue team notes
Latest practical guides for defenders
AI assurance · Red teaming
Turn OWASP’s GenAI Red Teaming Manual Into a Defender Test Plan
A practical reading of the manual: map an AI system’s permissions and data flows, test realistic failures, and keep evidence the repair can be checked against.
Read guide View all notesFrom my reading
Latest notes and useful references
Anthropic · Threat research
One Stolen Credential, Many Doors
A reading note on the AI-assisted credential-harvesting lifecycle in Anthropic’s September 2026 threat report.
Read note View bookshelfAttack library
Scattered Spider
A financially motivated threat group known for high-pressure social engineering, identity compromise, SIM swapping, and cloud-focused intrusion.
Initial accessIdentitySocial engineeringCloud
Aug 30Targeted airline helpdesk with fake Okta login page
Aug 27Breached retail chain through SIM swapping
Aug 24New phishing toolkit observed in the wild
Latest intel feed
Curated from trusted sources
CISA KEVCVE-2026-119977: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition VulnerabilityNov 3, 2026CISA KEVCVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function VulnerabilityOct 30, 2026CISA KEVCVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityOct 30, 2026CISA KEVCVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference VulnerabilityOct 29, 2026CISA KEVCVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound VulnerabilityOct 29, 2026
People worth following
Researchers, presenters, and defenders
WD
Will Dormann
Vulnerability research
A longtime software-vulnerability analyst known for practical testing, careful disclosure analysis, and explaining real exploitation conditions.
Read profileFR
Florian Roth
Detection engineering
A threat researcher and detection engineer associated with Sigma, THOR, YARA-based scanning, and widely used open-source defensive tooling.
Read profileJR
Johanna Rothman
Technical leadership
An author and consultant who writes about product development, management, organizational systems, risk, and decision-making under uncertainty.
Read profileAC
Alex Campbell
Critical infrastructure
A cybersecurity adviser whose work focuses on digital trust, resilience, and cyber risk in energy and critical-infrastructure organizations.
Read profileAbout Threat Field Notes
Built by a defender, for defenders.
I’m Sukarn. This is my space to share what I learn, what I find interesting, and the field notes that help turn threat information into useful defensive action.
Threat Field Notes Dispatch
The field note worth keeping.
Each week: the security stories that matter, investigation ideas and a practical checklist for defenders.
Double opt-in. No purchased lists. Unsubscribe in one click.