The Implant Survives the Upgrade: NetScaler Root Access and Three Million Defense Records

by: Craig WoodPublished on: 05/10/2026

Mandiant found root-level implants on exploited NetScaler appliances and says upgrading alone will not evict them. Six KEV additions, one hacked tanker.

Threat IntelligenceCISA KEVCitrix NetScalerFortiMailCMMCDIBMaritime CybersecurityPSYber360
The Implant Survives the Upgrade: NetScaler Root Access and Three Million Defense Records

PSYber360 Threat Intelligence Briefing - Sept. 21, 2026

by: Craig WoodPublished on: 21/09/2026

Three actor clusters took root on Cisco firewall management consoles. An MSP platform burned four hotfixes in five weeks. The management plane is the target.

threat intelligence briefing
PSYber360 Threat Intelligence Briefing - Sept. 21, 2026

GitLab Hits CVSS 10.0, ScreenConnect Joins KEV Same Week

by: Craig WoodPublished on: 14/09/2026

GitLab's CVSS 10.0 path-traversal flaw and a ConnectWise ScreenConnect KEV addition landed the same week — one hits source code, the other hits every client an MSP touches.

threat intelligenceCISA KEVGitLab vulnerabilityConnectWise ScreenConnectCMMCDIB cybersecurityvCISOmaritime cybersecurity
GitLab Hits CVSS 10.0, ScreenConnect Joins KEV Same Week

Weekly Threat Intelligence Briefing — September 07, 2026

by: Craig WoodPublished on: 07/09/2026

Three unrelated product categories, three actively exploited chains, one week. Whatever sector you're in — defense, maritime, aviation, healthcare …

Threat IntelligenceCybersecurityInfo SecPSYLogisticsDIBCMMCCUICISA
Weekly Threat Intelligence Briefing — September 07, 2026