How the level is set · The level is relative, not absolute: today's signals compared with their own trailing 84-day baseline (standard deviations above normal, summed), then ranked against past days. A high level means 'unusually busy versus recent weeks', not a fixed danger threshold.
TODAY
Eight actively exploited flaws in GitLab, Atlassian, Ivanti, Citrix and Cisco need patching
AI-written summary of the ranked list. The ranking, scores and NUMBERS are computed from the graph; the prose is model-generated.
Today's top 3 vulnerabilities to patch
What: If you run your own GitLab, an attacker with no account could run code on the server by sending a crafted CI/CD configuration. That would expose your source code and any secrets stored there. CISA added this to its exploited list 12 days ago, and the exploit-probability score is 65%.
Why it moved: Actively exploited · Widely deployed · Critical severity · 65% exploit odds
Who is exploiting: No named group yet — CISA confirms active attacks
Action · Update self-hosted GitLab to the fixed version immediately.
What: Several Atlassian Data Center products (Confluence, Jira, Bitbucket and others) expose files or directories to outsiders. That can leak internal documents and credentials. The exploit-probability score is about 100%, and CISA added it 26 days ago.
Why it moved: Actively exploited · Widely deployed · Critical severity · 100% exploit odds
Who is exploiting: No named group yet — CISA confirms active attacks
Action · Apply Atlassian's patch to all affected Data Center products.
What: Ivanti Connect Secure is a VPN gateway. A remote attacker with no login can bypass authentication and run commands, which gives them a way into your internal network. CISA added it 28 days ago, and the exploit-probability score is 89%.
Why it moved: Actively exploited · Widely deployed · 89% exploit odds
Who is exploiting: No named group yet — CISA confirms active attacks
Action · Patch Ivanti Connect Secure and check it for signs of compromise.
How today's threats connect
No cross-feed connection surfaced in today's graph. That's the honest reading — we don't invent one.
NUMBERS
- Sourced threat entities
- 1.1M
- Links between them
- 689k
- Threat actors (reviewed)
- 218
- New indicators (30 days)
- 142k
- Feeds live (new data)
- 15
- Sources with data
- 21
What moved the level (vs its 84-day baseline)
- Named ransomware victims claimed in the last 7 days: 254 · 0.8 std-dev above its norm
Entities = threat actors, ransomware crews, malware and tools, CVEs, ATT&CK techniques, campaigns, indicators and infrastructure that carry a feed source. Not a 24-hour count.
Get tomorrow's brief in your inbox
07:15 UK. One email. One link. Nothing else.
Daily · one email · unsubscribe in one click · UK GDPR double opt-in.