Real-time global intelligence

© 2026 OpenWatch. All rights reserved.

Proudly using no third-party tracking

Illustrative, not investment advice. OpenWatch aggregates public signals for research and information only — it is not personalized financial, legal, or tax advice, and nothing here is a recommendation to buy or sell any security.

Platform

Brief
Signals
Cascade
Trajectories
Wagers
Track Record
Countries
Companies
Industries
Themes
Rankings

Tools

Globe
Analytics
Crises
Clusters
Supply Chain
Alliances
Screener
Watchlist
Portfolio

Developer

Status

Sources

View all sources →

1,000+ tracked sources

Signals updated every 15 minutes

Not investment advice. OpenWatch is provided for informational and entertainment purposes only. While we strive for accuracy, precision, and source attribution in all intelligence assessments, geopolitical analysis involves inherent uncertainty and our conclusions may be incomplete, delayed, or incorrect. Nothing on this platform constitutes financial, investment, legal, or professional advice of any kind. Forward-looking scenarios and probability estimates are analytical hypotheses — not independently validated forecasts. Any actions taken based on information found here are solely your responsibility. Always consult a qualified financial advisor before making investment decisions. Past signal patterns do not guarantee future outcomes.

Methodology
Privacy Policy
Terms of Use

openwatch.io

v·eed287a

Search

Congressional trades, bills, prediction markets, hearings, and intelligence signals. Signal search supports: AND OR "exact phrase" -exclude

Keywords

Threat Layer

Military Cyber Economic Disaster Political Criminal Health Supply Chain

Signal Type

Any Crisis Update Resolution

Region

Country

Min. Severity

Any ≥ 3 ≥ 5 ≥ 7 ≥ 9

Date Range

Clear all filters

Sort by

Severity Newest

↓Export CSV (requires API key)

Themes:🧠AI Chip Bottleneck 🛡US Defense Surge 🔌Taiwan Semiconductor Risk 🏦EM CB Pivot

468 signals for Cyber · United States

Page 5 of 19

CyberUpdate🇺🇸United States40d ago

Microsoft has released patches for exploited zero-day vulnerabilities in UnDefend and RedSun Defender security products that could enable privilege escalation to System level or trigger denial-of-service conditions.

5.0/10·SecurityWeek

Primary Source ↗Details →

CyberUpdate🇺🇸United States40d ago

Microsoft began rolling out security patches on Wednesday to address two Defender vulnerabilities that have been actively exploited in zero-day attacks.

5.0/10·Bleeping Computer

Primary Source ↗Details →

CyberUpdate🇺🇸United States40d ago

Drupal released security updates addressing CVE-2026-9082, a critical vulnerability in Drupal Core's database abstraction API that could allow attackers to achieve remote code execution, privilege escalation, or information disclosure. The vulnerability carries a CVSS score of 6.5.

5.0/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇺🇸United States40d ago

Threat actors have successfully compromised SonicWall Gen6 SSL-VPN appliances by brute-forcing VPN credentials and defeating multi-factor authentication (MFA) to implant ransomware deployment tools, potentially affecting multiple organizations using these devices.

5.0/10·Bleeping Computer

Primary Source ↗Details →

CyberUpdate🇺🇸United States 🇲🇱Mali46d ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft Exchange Server cross-site scripting vulnerability (CVE-2026-42897) to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. Federal agencies are required to remediate the flaw under existing binding directive 22-01, and CISA urges all organizations to prioritize patching as part of standard vulnerability management.

5.0/10·CISA Current Activity·Washington, District of Columbia

Primary Source ↗Details →

CyberUpdate🇺🇸United States 🇲🇱Mali47d ago

The US Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Catalyst SD-WAN Controller authentication bypass vulnerability (CVE-2026-20182) to its Known Exploited Vulnerabilities catalog, citing evidence of active attacks in the wild. Federal agencies must remediate the flaw under binding operational directive BOD 22-01, and CISA recommends all organizations prioritize patching to prevent exploitation of this frequently-used network infrastructure.

5.0/10·CISA Current Activity

Primary Source ↗Details →

CyberUpdate🇺🇸United States 🇲🇱Mali53d ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a SQL injection vulnerability in BerriAI's LiteLLM software to its catalog of known exploited vulnerabilities, signaling active-use attacks in the wild. Federal civilian agencies are required to patch the flaw by a set deadline; CISA is urging all organizations to prioritize remediation as part of routine vulnerability management.

5.0/10·CISA Current Activity·Mali

Primary Source ↗Details →

CyberCrisis🇺🇸United States54d ago

Security researchers have disclosed a dozen critical vulnerabilities in vm2, an open-source Node.js library designed to safely execute untrusted JavaScript code in isolation. The flaws could allow attackers to break out of the sandbox and run arbitrary code on vulnerable systems.

5.0/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇺🇸United States54d ago

Developers behind the VoidStealer Trojan have identified a new technique to circumvent Google's App-Bound Encryption, a Chrome security feature, potentially enabling a new wave of credential-stealing malware to harvest sensitive browser data from users worldwide.

5.0/10·Dark Reading

Primary Source ↗Details →

CyberCrisis🇺🇸United States54d ago

The hacking group ShinyHunters has attacked Instructure, the company behind the Canvas learning management system used by millions of students and educators, raising concerns about how well edtech vendors protect sensitive institutional data.

5.0/10·Dark Reading

Primary Source ↗Details →

CyberUpdate🇺🇸United States56d ago

The Apache Software Foundation has issued security updates to address multiple vulnerabilities in its HTTP Server, with particular concern around CVE-2026-23918, a critical flaw in HTTP/2 protocol handling that could enable remote code execution. The vulnerability carries a CVSS score of 8.8.

5.0/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇺🇸United States56d ago

Threat actors are actively exploiting a critical code injection vulnerability in MetInfo CMS, an open-source content management system. Versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection flaw (CVE-2026-29014, CVSS 9.8) that allows arbitrary code execution and is currently being weaponized in the field.

5.0/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇺🇸United States56d ago

Cisco Talos researchers uncovered an active intrusion campaign, running since at least January 2026, in which an unidentified attacker deployed the CloudZ remote access trojan alongside a newly discovered plugin called 'Pheno' — a tool not previously documented by the security community.

5.0/10·Cisco Talos Intelligence

Primary Source ↗Details →

CyberResolution🇺🇸United States 🇬🇧United Kingdom70d ago

Tyler Robert Buchanan, a 24-year-old British national and senior Scattered Spider member, pleaded guilty to wire fraud conspiracy and aggravated identity theft for his role in a 2022 SMS phishing campaign that breached at least a dozen major tech companies and stole tens of millions of dollars in cryptocurrency.

5.0/10·Krebs on Security

Primary Source ↗Details →

CyberUpdate🇺🇸United States76d ago

Microsoft released patches for 167 vulnerabilities across Windows and related software on a single day, including a SharePoint Server zero-day and a Windows Defender flaw called BlueHammer. Separately, Google Chrome fixed its fourth zero-day of 2026, and Adobe pushed an emergency update to address an actively exploited vulnerability in Adobe Reader that enables remote code execution.

5.0/10·Krebs on Security

Primary Source ↗Details →

CyberCrisis🇺🇸United States 🇲🇱Mali83d ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has cataloged a newly exploited vulnerability in Ivanti's Endpoint Manager Mobile platform as a known active threat, requiring federal agencies to patch systems by a specified deadline to defend against ongoing attacks.

5.0/10·CISA Current Activity·Mali

Primary Source ↗Details →

CyberCrisis🇺🇸United States 🇲🇱Mali89d ago

The U.S. Cybersecurity and Infrastructure Security Agency has added a TrueConf Client vulnerability to its catalog of known exploited vulnerabilities, following evidence of active attacks in the wild. The flaw allows unauthenticated download of code without integrity verification, creating a high-risk vector for malicious actors targeting federal networks and other organizations.

5.0/10·CISA Current Activity·Mali

Primary Source ↗Details →

CyberUpdate🇺🇸United States21h ago

The National Association of Insurance Commissioners (NAIC) says the ShinyHunters extortion group stole only publicly available data, outdated logs, and configuration files after breaching its systems by exploiting a zero-day vulnerability in an Oracle PeopleSoft server. [...]

4.9/10·Bleeping Computer

Primary Source ↗Details →

CyberUpdate🇺🇸United States 🇷🇺Russiayesterday

Business email compromise attacks increasingly rely on convincing impersonation rather than malware, making them harder for employees and traditional email defenses to detect. This webinar explores how behavioral AI can help identify sophisticated email threats and automate response workflows. [...]

4.9/10·Bleeping Computer

Primary Source ↗Details →

CyberCrisis🇺🇸United States3d ago

Rising threats from third-party actors are forcing institutions to play defense to protect student data from ransomware and other attacks.

4.9/10·Dark Reading

Primary Source ↗Details →

CyberUpdate🇺🇸United States5d ago

The exploited flaw, CVE-2025-67038, is one of the vulnerabilities disclosed in April as part of the BRIDGE:BREAK research project. The post Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning appeared first on SecurityWeek .

4.9/10·SecurityWeek

Primary Source ↗Details →

CyberCrisis🇺🇸United States8d ago

Ransomware case reveals two parallel threat actors, blending tactics and evasion—showing why isolated signals can often miss modern, overlapping cyberattacks. The post One intrusion, two cyberattackers: Uncovering parallel threat activity appeared first on Microsoft Security Blog .

4.9/10·Microsoft Security Blog

Primary Source ↗Details →

CyberCrisis🇺🇸United States11d ago

The Gentlemen ransomware-as-a-service (RaaS) is actively developing and maintaining a suite of endpoint detection and response (EDR) killers to help affiliates evade detection in attacks. [...]

4.9/10·Bleeping Computer

Primary Source ↗Details →

CyberCrisis🇺🇸United States19d ago

A new analysis of The Gentlemen operation has revealed that the financially motivated threat group initially operated as an affiliate responsible for conducting double extortion attacks, while leveraging resources from various ransomware-as-a-service (RaaS) schemes like LockBit (aka Tenacious Mantis), Qilin (aka Pestilent Mantis), and Medusa (aka Venomous Mantis). According to a detailed report

4.9/10·The Hacker News

Primary Source ↗Details →

CyberUpdate🇺🇸United States34d ago

Hackers exploited a critical zero-day vulnerability in a server running the KnowledgeDeliver learning management system (LMS) to deploy the Godzilla web shell. [...]

4.9/10·Bleeping Computer

Primary Source ↗Details →