Sign in Subscribe
Threat Intelligence & Security News

Threat Intelligence & Security News

CyberDesserts covers the threat landscape as it happens, ransomware campaigns, vulnerability disclosures, and emerging attack techniques. Written for security practitioners who need to understand what's happening, why it matters, and what to do about it. No vendor noise. No recycled press releases. Just analysis grounded in 20+ years of defending real organisations.
12
Mar
SOC Analyst Role is changing ?

Will AI Replace SOC Analysts?

March 2026 LinkedIn Post Copy Link Large language models cannot yet be trusted to make autonomous security decisions. That is
10 min read
01
Mar
AI Agent Attack Surface

AI Agent Security Risks in 2026: The Incident Landscape and Hardening Framework

In February 2026, the supply chain threat model arrived in AI agent infrastructure all at once. The Model Context Protocol is the connective tissue across every major incident. Here's what practitioners need to know.
16 min read
01
Mar
Government Attack Surface Reduction

How the UK Government Slashed Cyber Fix Times by 84%

Published March 2026 The UK government has slashed cyber vulnerability fix times by 84%. Through a new nationwide scanning service,
7 min read
12
Feb
Notepad CVE-2026-20841

Two Notepad Attacks in One Week: Your Tools Are the Target

Software supply chain attacks more than doubled in 2025, with developer workstations identified as high-value targets across multiple industry reports
5 min read
05
Feb
OpenClaw security risks concept showing hidden keyboard under torn paper, representing malicious skills, exposed instances, and system-level vulnerabilities in AI agents.

OpenClaw Security Risks: Malicious Skills, Exposed Instances and Real Exploits

Latest updates (March 2026): NemoClaw announced, CVE count now 60+, and independent analysis using Censys identified 63,070 live instances
20 min read
04
Feb
Notepad++ update server compromise

Notepad++ Compromised for 6 Months: Check Your Version Now

Updated May 2026 Notepad++ update servers were compromised from June through December 2025 by a Chinese state-sponsored threat group. The
4 min read
29
Jan
Fortinet critical SSP bypass

CVE-2026-24858: The Fortinet Patch That Wasn't

Organisations running the latest FortiOS firmware, fully patched against December's critical SSO bypass, still got compromised in January.
5 min read
01
Jan
Feature image for the article: the word "ClickFix" beside a stylised cursor selecting a dotted-outline UI element, representing the click-driven nature of the attack technique.

ClickFix in 2026: Trust-Flow Patterns, Named Variants, and What Stops Them

Updated April 2026 - The trust-flow patterns behind ClickFix, the variants and vectors carrying it, and the defences that work
31 min read
27
Dec
MongoBleed Exploit CVE-2025-14847

MongoBleed Exploit: The MongoDB Memory Leak Hitting 87,000 Servers

Updated January 10, 2026: CISA's remediation deadline for federal agencies is January 19. Ubuntu has retracted its claim
10 min read
04
Dec
React2Shell vulnerability concept showing React Server Components leaking into a remote shell execution (CVE-2025-55182)

CVE-2025-55182: React2Shell Detection and Fix Guide

UPDATE (Jan 1, 2026): RondoDox botnet now weaponizing React2Shell. Shadowserver reports 90,300 instances still vulnerable. Multiple nation-state actors actively
19 min read