Expanding Visibility Into Chinese Government-linked Cyber Threat Actors
VulnCheck Canary Intelligence was used to investigate the October 2026 joint advisory on Chinese government-linked threat actors enabled by Integrity Technology Group (Flax Typhoon), revealing that several of the advisory's IP indicators remain active well past their last-seen dates and have been repurposed against newer vulnerabilities. By analyzing the captured exploitation payloads, the research separates hands-on XWiki attacks from commodity botnet activity and pivots on exposed C2 infrastructure to surface net-new indicators the advisory never listed.
Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504)
Cisco Catalyst SD-WAN vManager's login module and application server disagree about whether a request path has been URL-decoded yet. That single percent-encoded character gives us CVE-2026-76504. One unauthenticated POST with an arbitrary password triggers a critical authentication bypass that gives an attacker admin-level access to the entire SD-WAN fabric.
JCTables for Joomla: When "Already Escaped" Means Injectable
VulnCheck's Initial Access Intelligence team details an unauthenticated JSON CRUD API in the JCTables component for Joomla whose escape helper trusts any value already wrapped in single quotes, turning one URL into arbitrary SQL read and write and, through a borrowed admin session, into remote code execution.