Ryan Dewhurst

Previdian Virtual Patches are now autonomously generated and updated from real attacker traffic hitting our global honeypot network. When the exploitation patterns we observe change, the rules available to our Enterprise users can change with them. We’ve had virtual patches in Previdian for a while. What’s new is

Cisco has disclosed CVE-2026-76504, a critical unauthenticated authentication bypass affecting Cisco Catalyst SD-WAN Manager, formerly known as Cisco vManage. The vulnerability carries a CVSS v3.1 score of 9.8, requires no authentication or user interaction, and can give a remote attacker API access with administrator privileges.

Update September 25th, 2026: The exploitation creates a webshell backdoor named: "/_layouts/15/sphealth.aspx" Binaries include: wt3k3sij.dll, 391,680 bytes, SHA-256 d3faa4b443d98f272363f3484a5e6a9bab90979086aa2d31a1694c1dc8178742 24e5mo4s.dll, 4,096 bytes, SHA-256 a151a8fc193a96aac480fa749547b57c0f33116cf2cb8c82b6aa716c3c47f4b1 Both are PE32 x86 images (.text, .rsrc, .reloc) with a CLR header. On 24 September

Last updated: September 8, 2026 StyleSmuggler is a critical remote code execution vulnerability affecting Magento Open Source and Adobe Commerce. Tracked as CVE-2026-75650, the vulnerability has a CVSS score of 10.0 and is being actively exploited in the wild. The vulnerability is particularly serious because exploitation does

KEVIntel first observed remote code execution attempts against Langflow’s code-validation endpoint on 27 June 2026, 24 days before CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog. Between 27 June and 21 July, KEVIntel sensors retained 137 exploitation attempts from 46 unique source IP addresses. The

Two critical vulnerabilities in WordPress Core, tracked as CVE-2026-63030 and CVE-2026-60137, can be chained to achieve unauthenticated remote code execution. The vulnerability chain, publicly referred to as wp2shell, affects WordPress Core rather than a third-party plugin. An attacker does not require a valid WordPress account,

At KEVIntel, a known exploited vulnerability, commonly shortened to KEV, is a vulnerability for which there is credible evidence of real-world exploitation attempts. A CVE identifies a publicly documented vulnerability. KEV intelligence shows that attackers are trying to exploit a vulnerability, sometimes before a CVE has been assigned or