INC Ransomware Chains Two SonicWall SMA Zero-Days (CVE-2026-15409, CVE-2026-15410)
INC affiliates are weaponizing an SSRF and a post-authentication code injection in SonicWall SMA 1000 to reach internal networks. Exploitation started weeks before the July 14 patch — here is how to hunt and triage.
Cl0p Is Exploiting PTC Windchill (CVE-2026-12569) to Steal Engineering Data
A Cl0p affiliate is chaining a FlexPLM information disclosure with an unauthenticated RCE in PTC Windchill to plant JSP web shells and run double-extortion data theft. Here are the detection signals and the triage workflow.
Ransomware Revenue Is Rising: Initial Access Brokers Make Threat Intelligence Urgent
Q1 2026 ransomware revenue reporting points to a mature access market. Defenders need ransomware intelligence, domain monitoring, blocklists, and API enrichment before encryption begins.
BlueHammer Defender Exploitation: July 2026 Patch SLA For Windows Fleets
BlueHammer coverage shows why endpoint patching, CISA KEV context, CVE Watch, and IOC enrichment have to work together when local privilege escalation becomes ransomware tradecraft.
Oracle PeopleSoft Zero-Day: CVE-2026-35273 Shows Why CVE Watch Needs IOC Enrichment
The PeopleSoft CVE-2026-35273 exploitation reports show how vulnerability response, ransomware intelligence, IP enrichment, and incident response must work together.
Cyber Extortion Now Includes Physical Threats: What Incident Response Teams Must Change
Cyber incidents are no longer always contained to systems and data. As extortion crews add physical threats, responders need ransomware intelligence, safety escalation, IOC enrichment, and executive-ready evidence.