Cybersecurity threat intelligence
and research

Real attacks. Real analysis. Zero fluff.

Check out the latest

View all articles
Patch Tuesday: March 2026 (Expel’s version)
March 10, 2026  |  Ben Nahorney

Patch Tuesday: March 2026 (Expel’s version)

We're highlighting three critical CVEs, and we're also sharing some thoughts around the Kaswara WordPress plugin.
alt=
March 6, 2026  |  James Shank

What security teams need to know about Iran’s cyber threat right now

After US and Israeli strikes against Iran in February 2026, security teams face a period of heightened cyber risk. Here's what's to do and know right now.
alt=
February 11, 2026  |  Ben Nahorney

Patch Tuesday: February 2026 (Expel’s version)

We're highlighting three critical CVEs, and we're also sharing some thoughts around the deprecation timeline of NTLM.
alt=
February 2, 2026  |  Aaron Walton

Notepad++ supply chain incident

The developer of Notepad++ disclosed an incident where actors identified a means to tamper with the delivery of automatic updates.
alt=
January 30, 2026  |  Aaron Walton

Security alert: Critical unauthenticated RCE vulnerabilities in Ivanti EPMM

Two zero-day command injection vulnerabilities affecting Ivanti EPMM are currently being actively exploited: CVE-2026-1281 and CVE-2026-1340.

Worth your time

featured thumbnail for Expel 2026 Annual Threat Report
Annual Report

2026 Threat Report

Expel’s Annual Threat Report 2026 takes real-life cybersecurity lessons learned and transforms them into actionable insights for security operators.

Read the report
The history of AppSuite: the certs of the BaoLoader developer
Threat Research

The history of AppSuite

We're tracking BaoLoader's code-signing certificate abuse—26 certs over seven years. This is how they stayed under the radar while pushing malware disguised as PDF editors.

Read now
Observing Atlas Lion (part 1): Why take control when you can enroll?
Threat Research

Observing Atlas Lion

Atlas Lion doesn't bother with persistence exploits. They just enroll their own VM into your domain and walk through the front door like they own the place.

Read now