NATHANIELPETTUSCYBER INTELLIGENCE
NEW POST DAILY
DAILY CYBER BLOG · FACTS + OPINION

Know what happened.
Know where I stand.

I explain cybersecurity news, active attacks, privacy, surveillance technology, vulnerabilities, and OSINT in plain English, then give my independent analysis.

READ TODAY'S BLOGNEW TO CYBER? START HERE
GLOBAL THREAT ACTIVITYPREVIEW
World map preview with representative activity markersNorth AmericaEuropeMiddle EastEast AsiaOceania
Representative preview—not live observations. Open the Live Threat Center for sourced data and map limitations.
LIVE THREAT FEED

Actively exploited vulnerabilities

Current entries from CISA’s official Known Exploited Vulnerabilities catalog. These are confirmed weaknesses attackers have used, not simulated attack-map traffic.

REFRESHES EVERY 15 MINUTES
ACTIVE EXPLOITATION

CVE-2026-109618: PHP Group PHP

PHP Memory Corruption Vulnerability

PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
ACTIVE EXPLOITATION

CVE-2026-109619: PHP Group PHP

PHP Stale Internal Request-State Vulnerability

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
ACTIVE EXPLOITATION

CVE-2026-114625: Arista VeloCloud Orchestrator

Arista VeloCloud Orchestrator SQL Injection Vulnerability

Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
ACTIVE EXPLOITATION

CVE-2026-110447: Collabora Collabora Online – Built-in CODE Server

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
ACTIVE EXPLOITATION

CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition

EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
ACTIVE EXPLOITATION

CVE-2026-96656: Plex Media Server

Plex Media Server External Control of File Name or Path Vulnerability

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
VIEW THE OFFICIAL CISA CATALOG

“Live” means the feed updates from current public reporting. It does not identify every attack or prove the physical location of an attacker.

CHOOSE WHAT YOU NEED

You do not need a cybersecurity background.

Each section answers a different question. Start with the one that sounds most useful to you.

01

What is happening?

Read the daily blog for verified facts, technical context, and independent opinion.

BLOG & ANALYSIS 02

What should I update?

Understand important security updates and which ones matter first.

PATCH TUESDAY 03

How can I investigate?

Use trusted public tools to research threats, breaches, and exposure.

OSINT TOOLS 04

What does this mean?

Learn common cybersecurity terms without technical jargon.

LEARN CYBER
LATEST BLOG POST

The newest story, explained and analyzed.

IMPORTANT UPDATE

October 26, 2026 · Financial Security

GMO cyberattack triggers unauthorized FX trades and customer compensation

GMO Internet says attackers installed malicious programs in Onamae.com Desktop Cloud environments, potentially obtained trading-account credentials, and may have used them for unauthorized transactions. The company will compensate verified losses and pay every current customer ¥5,000 while the investigation continues.

READ THE FULL POST & OPINION
HOW POSTS ARE ORGANIZED

Every post separates reporting from opinion.

  1. 1What happened?A clear summary of confirmed facts.
  2. 2How does it work?Technical context without unnecessary jargon.
  3. 3My analysisA direct opinion, clearly labeled.
  4. 4What should happen next?Practical action and accountability.