🕵️ RESEARCH & DEEP DIVES
Microsoft Digital Defense Report 2026: US, Israel, Ukraine most targeted; ransomware surges in Europe
Microsoft's 2026 Digital Defense Report finds the US, Israel and Ukraine are the most-attacked countries and that AI is accelerating attacks.- Applies to Microsoft customers worldwide; report draws on over 165 trillion daily security signals for the first half of 2026.
- US leads with 25.5% of observed attacks, followed by Israel (7.6%), Ukraine (4.8%), Taiwan (3.9%) and the UK (3.8%); Germany is the only EU country in the top 10 (1.7%).
- Ransomware is growing fastest in Europe: German cases rose 276% (59 to 222), Italy nearly tripled, Switzerland more than doubled; Qilin and Akira are the most active families.
- AI is compressing attack timelines: median time from vulnerability discovery to weaponization is under 24 hours, and nearly 40,000 CVEs were published in H1 2026.
- Other findings: data was stolen in 63% of intrusions, exposed cloud workloads were attacked within 5.3 hours on average, and a malicious browser extension with 600,000+ installs harvested ChatGPT and DeepSeek histories from nearly 10,000 organizations.
WordPress plugins relying on .htaccess files expose data on non-Apache servers
Research found WordPress plugins that rely on .htaccess files for protection leave sensitive files exposed when installed on non-Apache servers like Nginx.- Affects WordPress sites running plugins on non-Apache web servers (Nginx, IIS, Caddy), which ignore .htaccess files; only LiteSpeed supports them among non-Apache servers.
- Everest Backup's .PROCSTAT status file, protected only by .htaccess, can be downloaded unauthenticated on non-Apache servers, revealing backup filenames that allow unauthenticated download of full site backups including the database.
- BackWPup was also identified as relying on .htaccess for protection, exposing backup files on non-Apache servers.
- Attack works by a remote unauthenticated attacker polling the predictable .PROCSTAT file during a backup operation to learn the backup filename, then downloading the backup.
- Everest Backup's vendor claimed a fix in v2.3.13 but retesting showed the vulnerability remains unpatched as of publication (October 1, 2026).
🔓 CVEs & KEV
CVE-2026-96658 — Red Hat Satellite 6.19 for RHEL 9 — CVSS 9.9 — Foreman: safemode bypass leading to rceA flaw was found in Foreman. An authen...
CVE-2026-103922 — ionic-team capacitor — CVSS 9.3 — Capacitor Android and iOS: remote content can be loaded at the app origin via...
CVE-2026-96659 — Red Hat Satellite 6.19 for RHEL 9 — CVSS 9.1 — Foreman: excessive permissions for viewer role on previewA flaw was found in ...
CVE-2026-79898 — Fortra BoKS Manager — CVSS 9.1 — Fortra BoKS Manager Command Injection Enables Root Privilege Escalation
CVE-2026-12541 — Red Hat Satellite 6.19 for RHEL 9 — CVSS 8.2 — Foreman: command injection in foreman-rake database tasksA flaw was found in ...
CVE-2026-12540 — Red Hat Satellite 6.19 for RHEL 9 — CVSS 8.2 — Foreman: command injection in foreman-rake errors:fetch_log via request_id pa...
CVE-2026-12544 — Red Hat Satellite 6.19 for RHEL 9 — CVSS 7.7 — Foreman: ssti and insecure deserialization in foreman-rake configurationA fla...
CVE-2026-12423 — Red Hat Satellite 6.19 for RHEL 9 — CVSS 7.5 — Foreman: unauthenticated information disclosure via provisioning token valida...
CVE-2026-12545 — Red Hat Satellite 6.19 for RHEL 9 — CVSS 6.7 — Rubygem-hammer_cli: command injection via insecure editor invocationA flaw wa...
CVE-2026-103884 — Red Hat Build of Keycloak — CVSS 6.5 — Keycloak-services: keycloak-services: path traversal in x.509 crl distributio...