Threat
alerts

As secure email gateways (SEGs) and automated identity filters have increased in sophistication, advanced threat actors have adapted by migrating initial access operations directly into cloud-native Software-as-a-Service (SaaS) collaboration environments. Microsoft Teams has emerged as a primary target for social engineering, voice phishing (vishing), and administrative helpdesk impersonation campaigns.

On July 29, 2026, Broadcom published security advisory VMSA-2026-0006, documenting vulnerabilities spanning across multiple structural layers of the vSphere ecosystem, divided primarily between centralised management daemons running on vCenter Server and kernel-level device emulation drivers executing within the ESXi hypervisor.

Within hours of Microsoft releasing its monthly security updates on July 15, 2026, a critical zero-day vulnerability dubbed "LegacyHive" was publicly disclosed. The exploit takes advantage of a logic flaw in the Windows User Profile Service (profsvc), enabling a low-privileged standard user to deceive the SYSTEM-level service into mounting another user's registry hive with read privileges.

Threat actors have been observed by researchers using a highly effective, stealthy mechanism for mass credential validation known as OAuth Client ID Spoofing. By manipulating the globally unique identifier (client_id) within legacy OAuth 2.0 authentication flows, adversaries can silently enumerate Microsoft Entra ID accounts, validate stolen credentials, and bypass standard security monitoring.

On June 30, 2026, Citrix released security bulletin CTX696604, addressing a suite of high-severity vulnerabilities affecting customer-managed Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway appliances.

Ransomware cartel known as DragonForce, has been observed successfully weaponising Microsoft Teams' network relay infrastructure to mask command-and-control communications. By routing malicious operations through official Microsoft infrastructure, the threat actors rendered their activities virtually indistinguishable from legitimate business collaborations, evading traditional detection mechanisms.

Threat actors have officially moved beyond basic "nuisance" typosquatting through deploying sophisticated, automated, and self-propagating worms targeting trusted namespaces. By subverting continuous integration (CI/CD) pipelines and developer IDEs, they have turned the very systems designed to build and secure our code into automated distribution nodes. Recent threat landscape is dominated by TeamPCP and the Shai-Hulud worm, a self-propagating payload is engineered to steal publishing credentials, enumerate every package accessible to those credentials, inject malicious logic, and republish backdoor versions automatically.

In May 2026, a security researcher operating under the pseudonym "Nightmare-Eclipse" disclosed two new zero-day vulnerabilities targeting the Microsoft Windows ecosystem: GreenPlasma and YellowKey. This follows the researcher's previous zero-days (BlueHammer and RedSun) which were actively weaponised shortly after release.

CVE-2026-0300 is a critical zero-day vulnerability affecting Palo Alto Networks PAN-OS firewalls. The flaw exists within the User-ID™ Authentication Portal and allows an unauthenticated, remote attacker to execute arbitrary code with root privileges via specially crafted network packets.