DefendEdge Cyber Security Blog
PolinRider: npm Supply Chain Attacks Meet Blockchain C2
Attackers hijacked ten npm packages and hid command-and-control on the Ethereum blockchain. Inside the PolinRider supply chain campaign.
The Gentlemen Ransomware Surge: Tracked Attacks Nearly Tripled in One Week
Tracked attacks tied to The Gentlemen ransomware operation nearly tripled in one week – a 197% surge concentrated in healthcare and finance.
Healthcare Under Attack: Ransomware’s Renewed Assault on Patient Data
Healthcare topped this week’s attack charts with 72 tracked incidents as ransomware crews surged. See what BlackBeam data shows and how to prepare.
Critical Vulnerabilities in PHP Require Immediate Patching
CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA…
#StopRansomware: SafePay Ransomware
Advisory at a Glance Title #StopRansomware: SafePay Ransomware Original Publication October 20, 2026 Executive Summary This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by…
What Microsoft’s SMS and Voice Retirement Means for Your Organization
The deadline for Entra ID authentication changes is approaching and will affect many organizations. Passkeys became the default option for eligible users in September 2026, and Microsoft-provided text and phone-call verification is scheduled to end in 2027. If businesses are still relying on SMS or voice for multifactor authentication (MFA), it is now time to…
The ConnectWise Breach: When Your Trusted Tools Become the Attack Path
ConnectWise suspended cloud services after stolen credentials reached Microsoft 365 tenants. What happened – and how to shrink your blast radius.
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally.…
CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration.…
Cyberattacks Went Physical: 50°C Freezers and a Ransomware Surge
French supermarkets lost food stock after attackers pushed freezers toward 50°C. Inside a 902-incident week: surging ransomware crews and the OT lesson.