Somebody calling themselves AMOZIHEV took a run at Colibri Group, and they did not do any of the things a ransomware crew is supposed to do. There is no leak site. There is no onion address. There is no countdown timer on a dark-web portal that four hundred threat-intel analysts screenshot and nobody else ever sees. There is no post on a breach forum. What there is, instead, is a notice addressed to Colibri Group, published on Colibri Group's own production websites, in front

On July 30 we published a piece about CVE-2026-63077, an unauthenticated remote code execution bug in the protocol JetBrains TeamCity build agents use to phone home. CVSS 9.8. We had searched GitHub that night and found no public proof-of-concept; our exploit harvester held nothing either. The advice was to patch immediately, on the grounds that the quiet week before someone publishes an exploit is the cheapest time a defender ever gets. The quiet week lasted six days. On Aug

On August 6, OpenSourceMalware published a campaign of nearly 800 malicious npm packages delivering a cross-platform RAT and infostealer through a downloader they named WEL1DROPPER. Sonatype tracks the wider wave as sonatype-2026-005660 and counts 846 components. The Hacker News and SC Media picked it up the following day. The reporting gives defenders a list of package names. Lists of package names are the least durable thing you can be handed, because the next campaign uses

On 25 July we published a post about attackers compromising the captive-portal appliances that run guest Wi-Fi at hotels, poisoning DNS at the gateway, and taking Microsoft 365 accounts from travellers who never received a phishing email. The technique description was right. The indicators were right. We named APT28 — Russian military intelligence, the GRU. On 31 July, Microsoft published its own analysis of the same campaign and attributed it to Midnight Blizzard, specifical

The Police National Legal Database confirmed today that names, organisations and work email addresses belonging to UK police officers, police staff, criminal justice professionals and government partners are on a dark web leak site. A crew calling itself ExfilSquad posted samples on 26 July, claiming 135,000 PNLD records alongside roughly 607,000 from the Department for Education. If you read that as a UK policing story you will take the wrong lesson from it. PNLD is one name

If you run N-able N-central, stop reading and go patch to build 2026.3.1.7. It is being exploited right now, Huntress has confirmed it in a customer environment, and the version you are probably on was itself the fix for the last one. That is the useful sentence. The rest of this is about why three different vendors shipped three fixes in six days and not one of them means what the word "fixed" is supposed to mean. The patch that patched the patch N-able disclosed CVE-2026-18