Palo Alto Networks is acquiring identity security leader CyberArk for nearly $25B. The deal marks Palo Alto's strategic entry into identity security, a critical pillar for the AI era.

A new backdoor, Plague, disguised as a Linux PAM component, evaded detection for over a year. It grants attackers persistent SSH access and leaves no forensic trail.

Devolutions patched two flaws in Devolutions Server: A Critical (CVSS 9.4) Auth Bypass allows user impersonation via pre-MFA cookie replay, and another flaw leaks plaintext passwords to view-only users.

U.S. Immigration and Customs Enforcement (ICE) has long been distinguished by its multibillion-dollar budget dedicated to surveillance technologies.

Critical BeyondTrust flaw CVE-2026-1731 (CVSS 9.9) allows unauthenticated RCE on Remote Support & PRA appliances. Update to v25.3.2 immediately.

Flare unmasks PamDOORa: a $1,600 Linux backdoor that hijacks the PAM stack to harvest credentials and manipulate authentication logs to evade detection.

New research by Intezer reveals the OrBit Linux rootkit is actually a fork of the open-source Medusa kit, actively weaponized across multiple APTs.

Sygnia exposes Operation Highland: China-linked Velvet Ant persisted for nearly 10 years in an air-gapped network by backdooring PAM and OpenSSH.

A critical Fortra BoKS vulnerability (CVE-2026-9862) enables remote OS command injection via the autoregistration service. Mitigate now.

A China-nexus threat group known as Velvet Ant hid inside one organization’s network for nearly a decade. Sygnia’s incident response team uncovered the campaign and named it Operation …

At a glance Field Detail Malware family Modified XMRig 6.25.0 botnet implant (marked “PRIVATE VERSION FOR BOTNET”), cross-compiled with musl libc Threat actor Unidentified; campaign tr…