blackglass security
+1 (415) 555-0142 Get an assessment
Threat intelligence

What changed this week, and what to do about it.

Our operations team publishes short, actionable advisories: what is being exploited, who is affected, and the specific control that stops it.

Updated daily Curated by the SOC
Critical · CVSS 9.8

Edge gateway authentication bypass under active exploitation

Attackers are chaining a header parsing flaw with default administrative routes to gain unauthenticated access. Internet-facing appliances are the primary target.

  • Affected: Edge gateways on firmware 8.2.x through 8.4.1
  • Action: Patch to 8.4.2 or restrict management planes immediately
Read the advisory
High · Ransomware

Silent Ledger shifts to logistics and freight brokers

The group is buying access from initial-access brokers, then spending days in identity systems before deploying encryption. Backups are targeted first.

  • Affected: Transportation, warehousing, and customs brokers
  • Action: Enforce phishing-resistant MFA and offline backup copies
Read the advisory
Medium · Phishing

OAuth consent phishing impersonates payroll providers

Employees receive convincing benefit-enrollment emails that request tenant-wide consent for a malicious application. Token theft follows within minutes.

  • Affected: Microsoft 365 and Google Workspace tenants
  • Action: Restrict user consent and review new enterprise apps weekly
Read the advisory
Advisory feed

Filter the current register.

Ten recent advisories, ordered by publication date. Severity reflects exploitability in the wild, not just CVSS.

10 of 10 advisories
Recent security advisories published by Blackglass Security
Advisory Severity Affected Published Status
Edge gateway authentication bypassBG-2026-0417 · CVE-2026-21894 Critical Firmware 8.2.x – 8.4.1 14 Nov 2026 Actively exploited
Silent Ledger ransomware campaignBG-2026-0416 · Tracking High Logistics & freight 13 Nov 2026 Ongoing
OAuth consent phishing waveBG-2026-0415 · Tracking Medium M365, Workspace 12 Nov 2026 Monitoring
VPN appliance pre-auth command injectionBG-2026-0412 · CVE-2026-21740 Critical Appliance OS 12.x 09 Nov 2026 Patch available
Infostealer abuses accessibility APIsBG-2026-0411 · Malware High Windows 10 / 11 08 Nov 2026 Active
Cloud storage misconfiguration sweepBG-2026-0409 · Research Medium Multi-cloud 06 Nov 2026 Ongoing
Business email compromise via MFA fatigueBG-2026-0407 · Tracking High Entra ID, Okta 04 Nov 2026 Ongoing
Malicious browser extension distributionBG-2026-0405 · Malware Medium Chromium browsers 02 Nov 2026 Reduced
Self-hosted CI runner secret exposureBG-2026-0402 · Research Low GitHub Actions 30 Oct 2026 Guidance updated
Credential stuffing against retail loyalty portalsBG-2026-0399 · Tracking Low Retail apps 28 Oct 2026 Monitoring

This register is a demonstration of our intelligence format. Live advisories, indicators, and detection rules are delivered to retainer clients and intelligence subscribers.

Quarterly trends

Ransomware is still an identity problem.

Across the incidents we contained this quarter, initial access came from stolen credentials or session tokens far more often than from software exploits. The implication is straightforward: controls that assume a trusted network are no longer enough.

Median dwell time in the cases we handled was 6 days. Most victims had endpoint protection deployed and functioning.
68% of intrusions began with valid credentials rather than malware
3.2× more likely to see encryption when offline backups were untested
41 min average time from execution to lateral movement in ransomware cases
Detection coverage

Mapped to behavior, not vendor alerts.

Request a coverage review

What we validate continuously

  • Initial access through phishing, valid accounts, and exposed services
  • Privilege escalation and credential dumping on endpoints
  • Cloud control-plane changes outside approved pipelines
  • Lateral movement across identity and remote access paths
  • Collection and staging activity before exfiltration
  • Impact behaviors, including backup deletion and encryption

How coverage is measured

Every quarter we replay a library of safe attack emulations against your live telemetry. A technique counts as covered only when it produces a high-fidelity alert that an analyst can act on within the SLA.

Tested, not assumed

Coverage claims are backed by emulation results you can review.

Trended over time

Gaps are tracked quarter over quarter with named remediation owners.

Stay ahead

Get the brief before the incident review.

Join security leaders who receive our Tuesday intelligence summary and quarterly trend report.

Subscribe to the brief Read the guides