Cybersecurity

Zero-day in a widely deployed VPN gateway exploited three weeks before the vendor patch

Telemetry suggests a small number of operators used the flaw quietly against government and defence suppliers.

Tomas Berg

Vulnerability Reporter • 26 Jul 2026 • 5 min read

Dark data centre corridor with blue indicator lights — Edge appliances remain the most reliable route into enterprise networks. Photo: Unsplash

An authentication bypass in the appliance's session handler allowed unauthenticated attackers to mint valid tokens for any user. This story is developing and will be updated as our newsroom confirms further detail with affected organisations and responders.

#Zero-day
#VPN
#Exploitation

Abstract padlock rendered over dark blue server hardware

Cybersecurity

StormVeil ransomware crew pivots to ERP backup appliances in coordinated European campaign

At least 41 manufacturers across Germany, Poland and the Netherlands have been hit since 2 July, with the operators abusing legitimate backup agent credentials.

Mara Ellison29 Jul 20268 min read

Night-time view of illuminated office towers and data cables

Cybersecurity

Infostealer logs are quietly fuelling a wave of helpdesk social engineering

Three large retailers were compromised in July through MFA resets granted over the phone to convincing callers.

Mara Ellison23 Jul 20267 min read

Analytics dashboard with charts on a dark screen

Cybersecurity

Detection engineering teams move to pipeline-first telemetry to cut SIEM spend

The trade-off is a new operational burden: the pipeline itself now needs testing, versioning and on-call ownership.

Helena Vasquez16 Jul 20266 min read

Zero-day in a widely deployed VPN gateway exploited three weeks before the vendor patch

Related Stories

StormVeil ransomware crew pivots to ERP backup appliances in coordinated European campaign

Infostealer logs are quietly fuelling a wave of helpdesk social engineering

Detection engineering teams move to pipeline-first telemetry to cut SIEM spend