Clik here to view.
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Welcome to this week’s edition of the Threat Source newsletter. I've been following a lot of (sometimes heated) threads and discussions lately about the current vulnerability landscape. I learned new...
View ArticleClik here to view.
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government...
This research was conducted jointly with Julian-Ferdinand Vögele of Recorded Future’s Insikt Group. Details of the joint research and presentation are available here.Cisco Talos identified UAT-6275...
View ArticleClik here to view.
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent...
Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical."Microsoft notes...
View ArticleClik here to view.
Making sure the checks get printed
Welcome to this week’s edition of the Threat Source newsletter. My name is Pierre Cadieux, and I’ll be helping contribute to these newsletters. A little about me: I’ve been working in the cybersecurity...
View ArticleClik here to view.
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event...
View ArticleClik here to view.
Ignore all instructions and read this blog: The state of AI-analysis evasion...
“AI-analysis evasion” encapsulates the real-world techniques malware authors are developing in attempt to obstruct or defeat any layers of automated AI analysis. This technique is cheap to add but...
View ArticleClik here to view.
Microsoft, Adobe, Apple, and Foxit vulnerabilities
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft.The vulnerabilities mentioned in this blog post have been...
View ArticleClik here to view.
One breach, please, and make no mistakes
For some time now, the cybersecurity community has seen examples of autonomous agents, built inside AI labs, attacking public infrastructure (to name a few, Hugging Face, DSEWiki, and RubyGems). Of...
View ArticleClik here to view.
Give yourself room to be human
Welcome to this week’s edition of the Threat Source newsletter. Fall is officially here in Maryland, and I can’t be more relieved. I flourish in 50 degree weather, where it feels natural to burrow...
View ArticleClik here to view.
The Fine Art of Frustrating the Adversary
For Cybersecurity Awareness Month, eight Cisco Talos researchers share practical ways defenders can frustrate adversaries at different stages of an operation.Deception techniques such as honeypot...
View ArticleClik here to view.
China-nexus UAT-11587 targets government and policy organizations across Asia...
Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a...
View ArticleClik here to view.
Securing the keys to the kingdom: Announcing Executive Threat Detection
Attackers are using greater sophistication to gain access to high-yield targets like executives, and company-wide security measures can easily miss these subtle, personal attacks.Executive Threat...
View ArticleClik here to view.
Trust and the enticing consultancy offer
Welcome to this week’s edition of the Threat Source newsletter. In the cybersecurity industry, trust is the invisible currency. Every practitioner carries the implicit trust not to abuse privileged...
View ArticleClik here to view.
The Closed Quorum: Inside the first reported autonomous AI C2 implant
CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). While we do not have confirmation of in-the-wild deployment, artifacts...
View ArticleClik here to view.
Introducing CAIRN: Frontier tracking for AI-integrated malware
A cairn is a marker left behind on a trail, a deliberately placed stack of stones that helps hikers find their way when the path is unclear. Attackers building AI-integrated malware unintentionally...
View ArticleClik here to view.
Should you care about an “AI slowdown?”
Welcome to this week’s edition of the Threat Source newsletter. There’s been a lot of talk recently about slowing down the pace of AI development. And yes, there are legitimate moral, ethical,...
View ArticleClik here to view.
Ransomware incidents in Japan in the first half of 2026: Investigation of The...
Compared with the same period last year, ransomware incidents in Japan increased slightly by approximately 4.7%, indicating that ransomware continues to pose a significant threat.In Japan, The...
View ArticleClik here to view.
Securing the unpatchable in an age of AI-driven vulnerabilities
AI is accelerating vulnerability discovery, leaving unpatchable operational technology (OT) systems at risk. Hoping for the best is not a viable anti-exploitation strategy. Deploying next-generation...
View ArticleClik here to view.
We've got one word for it, and it's usually the wrong one
Welcome to this week’s edition of the Threat Source newsletter. Ask anybody in this industry what the work does to the health of the people who do it and you get one word back: burnout. It's a fine...
View ArticleClik here to view.
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. First, CVE-2026-20079 is an authentication bypass vulnerability in...
View Article
