Security Watchtower
Advisories and incident analysis.
Page 5 of 61
CVE Analysis Center
CVE-2026-106016: Path Traversal Mitigation Bypass in @fastify/static File Handling (Node.js) – Analysis, Impact, and Remediation
CVE Analysis Center
Critical CVE-2026-21589 Vulnerability Exposes Atlassian Data Center Products to Unauthenticated File Disclosure
CVE Analysis Center
Critical CVE-2026-18397: Remote Code Execution Vulnerability in Thales SConnect Threatens SWIFT Banking and Government Authentication Systems
Cybersecurity Incident Analysis
ASOS Snowflake Cloud Breach: Cybersecurity Incident Analysis of Push Notification Extortion Attack
Cybersecurity Incident Analysis
AI-Powered Cyber Attacks Target Major South Korean Banks: October 2026 Data Breach Analysis and Response
Cybersecurity Incident Analysis
2026 Healthcare Data Breaches: AngMar Management Services and Clover Health Incidents Expose 250,000 Patient Records in New Jersey and Texas
CVE Analysis Center
Zammad Helpdesk Zero-Day Chain: Session Hijack to RCE, Then Root (CVE-2026-102489 / CVE-2026-102490, CISA KEV)
Blog posts
Your vendor patched. Their MSP didn’t: fourth-party risk after a KEV week
Cybersecurity Incident Analysis
Frontline Education Data Breach 2026: Third-Party Software Vulnerability Exposes K-12 School District Employee Data
Cybersecurity Incident Analysis
DTUBasen Data Breach at Technical University of Denmark (DTU) Exposes Sensitive Information of 200,000 Users
CVE Analysis Center
CVE-2026-9862: Critical OS Command Injection Vulnerability in Fortra BoKS Core Privileged Access Manager Threatens System Security
CVE Analysis Center
CVE-2026-90970: Critical GitLab AI Gateway Vulnerability Enables Command Execution on Self-Hosted Deployments
CVE Analysis Center
Critical Dell Container Storage Modules (CSM) Vulnerabilities Expose Kubernetes Environments to Remote Admin Compromise – CVE Analysis and Patch Guidance
Cybersecurity Incident Analysis
Bitget Cryptocurrency Exchange Breach: $387.5M Stolen via Zero-Day Exploit in Third-Party Security Products
Active Exploitation Alert
Active Exploitation Alert: Storm-3168 (JADEPUFFER) Agentic Attack Targets Azure via Compromised Service Principals
Active Exploitation Alert
Active Exploitation Alert: Critical Fortinet FortiMail Zero-Day (CVE-2026-104286) Enables Unauthenticated Arbitrary File Writes
Active Exploitation Alert
Active Exploitation Alert: China-Nexus UAT-11587 Deploys Antino Backdoor Leveraging Microsoft 365 Outlook and OneDrive for Stealthy Cyber-Espionage in Asia and Middle East
CVE Analysis Center
BigCommerce Merchants Hit via Compromised Ribon / Ribon 1.5 Marketplace App Credentials (Fastr / Be A Part Of)
Blog posts
Remediation theater: the ticket closed, the exposure didn’t
CVE Analysis Center
SolarWinds Observability Self-Hosted: Unauthenticated RCE (CVE-2026-28324) and Related Deserialization Flaw (CVE-2026-28325)
Blog posts
The vendor left. Your data didn’t. Post-engagement risk as a TPRM blind spot
Blog posts
Green questionnaires, live exposure: why TPRM owners still get surprised after a KEV week
CVE Analysis Center
Active Exploitation Alert: Orkes Conductor Unauthenticated RCE via GraalVM Script Evaluators — CVE-2026-58138
CVE Analysis Center