The Critical Stack

A maximum-severity Cisco Identity Services Engine zero-day is being exploited in the wild and is already on the k-e-v catalog — patch it today. Plus ShinyHunters' extortion spree lands on healthcare giant McKesson, the e-u's Cyber Resilience Act reporting clock starts ticking, and Kevin Mandia raises a record one hundred eighty-nine point nine million dollars to build a-i red teamers.

A root-level, unauthenticated flaw in Cisco Secure Email Gateway has been exploited for nearly a year — and the federal patch deadline lands today. Plus: how hardcoded credentials in public JavaScript gave extortionists two months inside Novo Nordisk, the seventy-two-hour reporting clock arriving with SEE-suh's final CIRCIA rule, and Palo Alto's five-hundred-million-dollar bet on agentic security operations.

Microsoft ships the largest Patch Tuesday on record — 974 CVEs, two of them already exploited — while a dark-web service peddles searchable access to 153 million driver's licenses. Plus: why a 155x surge in password spraying means your MFA policy probably has a hole in it.

A CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center is being worked by three separate threat clusters at once — including Sandworm and the Qilin ransomware crew. Plus Rhysida dumps Berlin's emergency plans, Anthropic catches Midnight Blizzard using Claude to tune malware evasion, and CrowdStrike goes hunting for rogue AI agents.

A maximum-severity GitLab path traversal is under active exploitation with today's federal patch deadline already here -- and it's only one line in a brutal patch queue. Plus: Medusa ransomware crosses 500 critical-infrastructure victims, Anthropic documents AI-run intrusions finishing in two hours, and a public exploit turns CrowdStrike Falcon's own remediation feature into a privilege escalation.