Week of Unexpired Threats: How Ten-Year-Old Flaws and Fresh Zero-Days Fueled New Attacks

Attackers spent the week exploiting both brand-new zero-days and decade-old flaws, showing that no vulnerability is too old to be dangerous once it sits unpatched. From VPN gateways and email security appliances to backup servers and e-commerce plugins, few layers of the enterprise attack surface escaped attention.  

CISA expanded its Known Exploited Vulnerabilities (KEV) catalog with flaws in Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, Microsoft Windows and Ivanti Connect Secure, along with two chained AhsayCBS vulnerabilities that remained unpatched until a vendor hotfix arrived on October 12, 2026. The catalog also gained a batch of long-standing flaws, including a three-year-old Strapi cleartext storage vulnerability, a five-year-old ONLYOFFICE Docs Server path traversal flaw, and vulnerabilities more than ten years old in Apache Struts, ProFTPD and ISC BIND. CISA added these older entries after a joint advisory confirmed that Chinese government-linked threat actors enabled by Integrity Technology Group had successfully exploited them.

Active exploitation also hit the Bricksforge plugin for WordPress, where automated attacks abused an unauthenticated file upload flaw to plant PHP payloads. The EC-CUBE AmazonPay Plugin was also targeted, with attackers redirecting online shoppers to phishing pages during checkout.

On the malware front, attackers chained AhsayCBS flaws to deploy a malicious XMRig cryptominer disguised as Microsoft Edge, while CL-STA-0954 exploited FortiManager and FortiOS flaws to deploy PEERSTITCH, a stealthy memory-resident implant hidden inside FortiGate daemons. Meanwhile, UTA0576 chained three Ivanti Connect Secure zero-days to gain root access without leaving a web shell or backdoor, then turned the foothold into a credential theft and reconnaissance operation.

Key highlights of the week:

• CISA added zero-day flaws in Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, Microsoft Windows and Ivanti Connect Secure to its KEV catalog.
• Flaws up to ten years old in Apache Struts, ProFTPD, ISC BIND, ONLYOFFICE and Strapi joined the KEV catalog after confirmed exploitation by Chinese government-linked actors. UTA0576 chained three Ivanti Connect Secure zero-days to gain root access and steal credentials without leaving a web shell.
• CL-STA-0954 exploited FortiManager and FortiOS flaws to deploy PEERSTITCH, a stealthy memory-resident FortiGate implant.
• Automated attacks exploited the Bricksforge WordPress plugin to plant PHP payloads through GIF/PHP polyglot files.
• Attackers abused the EC-CUBE AmazonPay Plugin to redirect online shoppers to phishing pages during checkout.

Several high-impact vulnerabilities are currently trending across the cybersecurity community, demanding immediate attention and patch prioritization. Monitoring these emerging and widely discussed threats provides valuable insights, enabling organizations to make informed security decisions and strengthen their overall defense posture.

CVE-2026-0322 - Code Injection vulnerability in Palo Alto Networks PAN-OS

A Code Injection vulnerability in Palo Alto Networks PAN-OS allowed an authenticated attacker with network access to the web management interface to execute arbitrary code with root privileges on PA-Series, VM-Series and Panorama appliances, the devices organizations rely on to enforce perimeter and internal segmentation policies. The flaw stemmed from improper control of code generation in the management interface, required no special configuration to be exploitable, and affected PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 branches along with older unsupported versions, while Cloud NGFW and Prisma Access remained unaffected. Palo Alto Networks reported very limited exploitation targeting the management interface and assigned its highest urgency rating (Red), warning that the risk was greatest when the interface was reachable from internet-facing IP addresses, although no public proof-of-concept had been confirmed. With no workarounds available, administrators were advised to restrict management access to trusted internal jump boxes, and Threat Prevention subscribers could enable Threat IDs 510046 and 510047 (content version 9159-10287 or later) for traffic routed through a data plane port with SSL decryption. Palo Alto Networks addressed the vulnerability in PAN-OS versions 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3 and 10.2.18-h12, along with additional hotfix releases for earlier maintenance versions, and CISA added the vulnerability to its KEV catalog.

CVE-2026-76519 - Relative Path Traversal vulnerability in Cisco Secure Email Gateway

A Relative Path Traversal vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway allowed unauthenticated remote attackers to write arbitrary files and execute commands with root privileges on the underlying operating system, simply by sending an email with a crafted attachment through an affected device. The flaw, tracked as Cisco Bug ID CSCwu56223, stemmed from improper handling of email attachments when the file reputation service was enabled, and affected physical and virtual appliances with the AMP File Reputation service assigned to a mail policy and Content Scanner Tools versions earlier than 25.3.0.5525 across AsyncOS branches 13.0 through 16.5. Cisco PSIRT became aware of active exploitation in October 2026 and contacted affected Secure Email Cloud customers directly, warning that root access let attackers erase local logs and steal private SSH keys shared across clusters, so a single compromised node could expose an entire cluster, although no public proof-of-concept was confirmed. With no workarounds available, administrators were advised to check for compromise with grep “System Security” system_logs, review external firewall logs and rebuild any compromised virtual or clustered appliances. Cisco addressed the vulnerability in Content Scanner Tools version 25.3.0.5525, applied through the contentscannerupdate command without a restart, and in AsyncOS releases 15.5.5-014 and 16.5.0-780, with Secure Email Cloud Gateway instances already patched, and CISA added the vulnerability to its KEV catalog.

CVE-2026-85097 - Unauthenticated Arbitrary File upload vulnerability in Bricksforge plugin for WordPress

An Unauthenticated Arbitrary File Upload vulnerability in the Bricksforge plugin for WordPress, an add-on for the Bricks visual website builder, allowed attackers to plant and execute PHP code on vulnerable sites, resulting in remote code execution. The flaw stemmed from Bricksforge validating a file’s MIME type only at the initial upload stage while trusting client-supplied metadata at form submission, so attackers obtained a nonce from the unauthenticated bricksforge_regenerate_nonce AJAX endpoint, uploaded a GIF/PHP polyglot that passed MIME checks, and submitted a form whose temporaryFileUploads url field ended in a PHP extension to place the embedded code at an executable location. Patchstack detected active exploitation from October 7, 2026, at 9:47 p.m. UTC, with attacks hitting the /wp-json/bricksforge/v1/form_submit and /wp-admin/admin-ajax.php endpoints and evading extension filters through alternate extensions such as .phtml, case manipulation such as .pHp, and encoded variants such as %2ephp, all from 63 unique IP addresses that pointed to automated exploitation over distributed infrastructure. Publicly documented exploitation details further lowered the barrier for attackers, and site owners were advised to audit form submissions carrying a temporaryFileUploads parameter and check /wp-content/uploads/bricksforge/tmp/ for unexpected PHP files. Bricksforge addressed the vulnerability in version 3.1.8.10, with all versions up to and including 3.1.8.9 affected.

CVE-2026-96951 - Command Injection vulnerability in Microsoft Windows

A Command Injection vulnerability in Microsoft Windows Shell, the interface layer that controls how files and shortcuts open in Windows, allowed unauthorized attackers to bypass a security feature over the network by slipping past Mark of the Web (MOTW) protections. With MOTW defenses silenced, malicious files downloaded from the internet opened without the security warnings and restrictions Windows normally applied to untrusted content, removing a key barrier between users and attacker-controlled payloads. Exploitation relied on social engineering, as attackers delivered specially crafted files through email or instant messaging, or lured targets into clicking links to attacker-controlled websites, and needed the victim to take the final step of opening the content. Threat actors exploited the flaw as a zero-day, though Microsoft revealed no technical details of the attacks or the identity of those behind them. Microsoft closed the gap in its October 2026 Patch Tuesday update, and CISA added the vulnerability to its KEV catalog.

CVE-2026-103671 - External Control of Assumed Immutable Web Parameter vulnerability in EC-CUBE Plugin

An External Control of Assumed-Immutable Web Parameter vulnerability in the EC-CUBE AmazonPay Plugin, a payment extension for one of Japan’s most widely used e-commerce platforms, allowed unauthenticated remote attackers to tamper with checkout parameters that the server assumed client browsers could not alter. Because the payment module failed to validate these sensitive values, attackers could manipulate checkout requests with low complexity and redirect shoppers to arbitrary websites during the ordering process, where phishing pages harvested login credentials and personal data. JPCERT/CC, IPA and EC-CUBE CO., LTD. warned of active exploitation in the wild, putting customer payment workflows at immediate risk despite the flaw’s medium severity rating, although no public proof-of-concept was confirmed. The vulnerability affected AmazonPay V2 Plugin versions v1.0.0 through v1.1.12 for the 4.0 and 4.1 series and v4.2.0 through v4.3.1, including the Bundle Edition, for the 4.2 and 4.3 series, along with AmazonPay Plugin CV1 v1.3.0 and earlier for the 4.0 series, and administrators were advised to review web server logs for suspicious checkout redirects. EC-CUBE released a patch and code diff for the affected plugin versions through its official security announcement.

CVE-2026-104935 - Authentication Bypass by Spoofing vulnerability in Ivanti Connect Secure

An Authentication Bypass by Spoofing vulnerability in Ivanti Connect Secure, an enterprise SSL VPN appliance, allowed remote unauthenticated attackers to execute arbitrary commands, and a previously unknown threat actor tracked by Volexity as UTA0576 exploited this flaw as a zero-day against fully patched appliances from October 3, 2026. The attack abused a routing mismatch in which requests aimed at the public welcome.cgi login page carried an X-DSCGI-PATH header that quietly redirected them to the protected wu.cgi script, then exploited a race condition in the upload handler to run a Perl script disguised as a ZIP archive before the handler could delete it. The Perl script triggered a chain of Bash and in-memory Python payloads that gave the attackers code execution as the cgi-server user, which UTA0576 then extended to root by chaining a separate, still-unpatched privilege escalation flaw. Re-running the full chain for every command and returning results through HTTP responses, without any web shell or backdoor, let the intrusions slip past the Ivanti Integrity Checker Tool entirely. Ivanti fixed the vulnerability in Connect Secure versions 25.1.3.0 and 22.8R2.5, and CISA added the vulnerability to its KEV catalog.

CVE-2026-105133 - Improper Authentication vulnerability in Ahsay AhsayCBS

An Improper Authentication vulnerability in the checkSysPwd() function of the com/ahsay/obs/api/ApiStructsAction.java component in AhsayCBS, a backup and recovery platform widely used by managed service providers, allowed remote attackers to bypass authentication by manipulating the random parameter in the API component. Threat actors chained the flaw with a separate OS command injection vulnerability in AhsayCBS to achieve unauthenticated remote code execution against the externally accessible web application service, with exploitation beginning on October 7, 2026, at 11:20 p.m. UTC, just days after CVE identifiers were published on October 4, 2026. Huntress estimated that five organizations were affected by October 8, 2026, with one additional incident observed later, as attackers dropped web shells, deployed XMRig cryptominers disguised as edge.exe, and ran an AI-assisted PowerShell script (Taskgmr.ps1) that paused mining whenever Windows Task Manager was opened. A public proof-of-concept was also available, raising the risk for internet-exposed management interfaces. Although the flaw was initially reported as fixed in AhsayCBS 10.3.2, Huntress found that it still affected version 10.3.4, the latest release, leaving the vulnerability unpatched, and CISA added it to its KEV catalog.

CVE-2026-105134 - Command Injection vulnerability in Ahsay AhsayCBS

An OS Command Injection vulnerability in the Replication Receiver component of AhsayCBS, a backup and recovery platform widely used by managed service providers, allowed remote attackers to execute operating system commands by manipulating the random parameter in the /rps/api/json/UpdateReceivers.do endpoint. Threat actors paired the flaw with a separate authentication bypass vulnerability in AhsayCBS, turning the command injection into unauthenticated remote code execution against the externally accessible web application service, with attacks beginning on October 7, 2026, at 11:20 p.m. UTC. Huntress linked the activity to five affected organizations by October 8, 2026, plus one later incident, where attackers carried out reconnaissance, dropped web shells, ran XMRig cryptominers masquerading as edge.exe, and abused certutil.exe to fetch the vulnerable WinRing0x64.sys driver, likely to gain kernel-level hardware access for mining. Huntress advised restricting management interface access to trusted IP addresses or VPN connections and hunting for signs of compromise. Although the flaw was initially reported as fixed in AhsayCBS 10.3.2, Huntress found that it still affected version 10.3.4, the latest release, leaving the vulnerability unpatched, and CISA added it to its KEV catalog.

CVE-2023-22894 - Storage of Sensitive Information vulnerability in Strapi Cleartext

A Cleartext Storage of Sensitive Information vulnerability in Strapi, an open-source, Node.js-based headless content management system, allowed attackers to extract private user data such as password hashes and password reset tokens by abusing query filters that still accepted private fields even though those fields were stripped from query results. Using the $startsWith filter operator, attackers brute-forced sensitive values character by character based on changes in the number of returned entries, similar to blind SQL injection, and because Strapi automatically created createdBy and updatedBy relations to administrator accounts for every entry, even unauthenticated attackers could leak administrator credentials through any publicly accessible collection. Chaining the flaw with CVE-2023-22621, a server-side template injection vulnerability, enabled a full takeover sequence in which attackers leaked a Super Administrator’s email, triggered a password reset, extracted the reset token, hijacked the account and injected a malicious email template to achieve unauthenticated remote code execution. A public proof-of-concept made the technique readily available, while exploitation attempts left clear traces in request logs through GET requests carrying filter parameters that referenced password, reset_password_token, resetPasswordToken or email fields. Strapi addressed the vulnerability in version 4.8.0, and CISA added the vulnerability to its KEV catalog.

CVE-2021-3199 - Path Traversal vulnerability in ONLYOFFICE Docs Server

A Server Path Traversal vulnerability in ONLYOFFICE Docs, an open-source online office suite, allowed attackers to overwrite arbitrary files on servers with JWT enabled by injecting /.. sequences into an image upload parameter, opening a path to remote code execution. The flaw resided in the uploadImageFile function of the fileuploaderservice.js server module, which built the image save path by concatenating strings that included the attacker-controlled formatStr value, so a request body prefixed with “ENCRYPTED;” and followed by traversal sequences, a target path and attacker-supplied contents escaped the /var/lib/onlyoffice/documentserver/App_Data/cache/files/<docId>/media/ directory and wrote files with the privileges of the service account. A public Python proof-of-concept (poc_uploadImageFile.py) weaponized the flaw by sending an HS256-signed JWT POST request to the /upload/<docId>/<userId>/<index> endpoint to overwrite the docbuilder executable with a Python reverse shell, then triggering execution through a second signed request to the /docbuilder endpoint. Because the proof-of-concept relied on a default signing secret, deployments using default or weak JWT secrets faced the greatest risk, while overwriting a service binary without a working replacement also caused denial of service. ONLYOFFICE addressed the vulnerability in Document Server version 5.6.3, and CISA added the vulnerability to its KEV catalog.

CVE-2016-3081 - Command Injection vulnerability in Apache Struts

A Command Injection vulnerability in Apache Struts, an open-source Java EE web application framework, allowed remote attackers to execute arbitrary code by passing malicious Object-Graph Navigation Language (OGNL) expressions through the method: prefix whenever Dynamic Method Invocation (DMI) was enabled. The flaw stemmed from the framework’s ActionMapper evaluating attacker-supplied method names as OGNL expressions without adequate restriction, and although the DMI requirement raised attack complexity, exploitation needed no authentication. Public proof-of-concept exploits on Exploit-DB and Packet Storm, along with a Metasploit module, crafted payloads that overrode OGNL member access restrictions, wrote attacker-supplied binaries to disk, and launched them through java -jar, /bin/sh -c or cmd.exe /c depending on the target platform. Despite dating back to 2016, the flaw continued to offer attackers a reliable path into unpatched Struts applications a decade later.  Apache addressed the vulnerability in Struts versions 2.3.20.3, 2.3.24.3 and 2.3.28.1, and CISA added the vulnerability to its KEV catalog.

CVE-2015-3306 - Improper Access Control vulnerability in ProFTPD

An Improper Access Control vulnerability in ProFTPD, a widely deployed open-source FTP server for Unix and Linux systems, allowed unauthenticated remote attackers to read and write arbitrary files through the SITE CPFR (copy from) and SITE CPTO (copy to) commands of the mod_copy module, with operations running under the privileges of the ProFTPD service, the “nobody” user by default. Attackers turned this file copy primitive into remote code execution by copying /proc/self/cmdline into a file whose name embedded PHP code such as <?php passthru($_GET['cmd']);?>, moving it into a writable web directory such as /var/www with a .php extension, and triggering it through an HTTP request on hosts that also ran a PHP-capable web server. Vulnerable servers were easily fingerprinted through an unauthenticated SITE CPFR /etc/passwd command that returned a 350 response code, and a public proof-of-concept and a Metasploit module rated Excellent for reliability kept this more than 10-year-old vulnerability stable, repeatable and attractive to attackers. ProFTPD addressed the vulnerability in versions 1.3.5a and 1.3.6rc1, and CISA added the vulnerability to its KEV catalog.

CVE-2015-5477 - Data Processing Errors vulnerability in ISC BIND

A Data Processing Error vulnerability in ISC BIND, the most widely deployed open-source DNS server software, allowed unauthenticated remote attackers to crash the named daemon with a single specially crafted TKEY query, the DNS record type used for transaction key exchange. The flaw resided in the TKEY processing logic, where a query carrying a non-TKEY record of the same name in the additional section caused the message-parsing routine to reuse an already-populated name pointer, triggering a REQUIRE assertion failure that forced the server to exit. Because TKEY queries were processed before access control lists took effect, both authoritative and recursive servers were exposed with no configuration-based workaround, and public exploit code, including a GitHub proof-of-concept tool supporting IPv4 and IPv6 and a Metasploit auxiliary module capable of source address spoofing over UDP port 53, made it possible to knock DNS servers offline with a single packet while hiding the true origin of the attack. Despite being more than 10 years old, the vulnerability remained a viable denial-of-service weapon against unpatched DNS infrastructure.  Although ISC addressed the vulnerability in BIND versions 9.9.7-P2 and 9.10.2-P3 in July 2015, CISA only recently added the flaw to its KEV catalog.

Cytellite telemetry captured active exploit attempts and mass scanning campaigns against exposed services globally. The data highlights which vulnerabilities are under attack and provides source IPs and payloads to authorized teams for detailed threat analysis and validation.

Active malware campaigns exploited specific vulnerabilities to deliver payloads and carry out post-exploitation actions. Each targeted vulnerability is proactively monitored, manually analysed, and mapped to MITRE ATT&CK tactics and techniques. Insights are derived from the LOVI vulnerability intelligence platform, which aggregates and curates data from multiple sources, OSINT groups, blogs, and data leak sites.

UTA0576’s Stealthy Exploitation of Ivanti Connect Secure Zero-Days

According to Volexity, a previously unknown threat actor tracked as UTA0576 exploited a chain of three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances from October 3, 2026, compromising a fully patched device at a Volexity customer and gaining unauthenticated root-level access. The chain combined an authentication bypass and a remote code execution flaw, tracked together as CVE-2026-104935, which tricked the appliance into routing requests from its public login page to a protected upload script and then exploited a brief timing gap to run an uploaded script before the system deleted it, followed by a separate privilege escalation flaw, with no CVE identifier assigned, that abused a trusted maintenance service to execute commands as root. Rather than installing a web shell or backdoor, UTA0576 re-ran the entire chain for every command and received the results through normal web responses, while restoring modified settings and erasing log entries so that Ivanti’s own integrity checking tool detected nothing. Once inside, the attackers focused on credential theft and reconnaissance, extracting stored domain credentials, querying Active Directory for local administrator passwords and BitLocker recovery keys, capturing LDAP traffic to harvest plaintext logins, and running password-spraying attacks against user accounts. Volexity assessed with low confidence that UTA0576 had criminal rather than espionage motives, and with medium confidence that the group used large language models to help build its exploits and post-exploitation scripts, with the activity likely laying the groundwork for lateral movement across the victim network.

Chained AhsayCBS flaws exploited to deploy malicious XMRig Cryptominer

According to Huntress, unidentified threat actors chained CVE-2026-105133, an authentication bypass in the checkSysPwd function of AhsayCBS, with CVE-2026-105134, a remote code execution flaw in the Replication Receiver’s /rps/api/json/UpdateReceivers.do endpoint, to gain unauthenticated code execution as NT AUTHORITY\SYSTEM on internet-exposed backup servers, with exploitation beginning on October 7, 2026, and reaching five organizations by October 8. After compromise, the attackers configured a malicious replication receiver, dropped JSP webshells, and used curl and certutil.exe to pull payloads from Alibaba Cloud storage, including a malicious XMRig cryptominer disguised as edge.exe, which hijacked system resources to mine Monero through a mining pool over port 8029. Persistence came from a renamed NSSM utility posing as msedge.exe, running under a fake MicrosoftEdgeUpdateSvc service with SYSTEM privileges to keep the cryptojacking malware alive after crashes or reboots. An AI-assisted PowerShell script, Taskgmr.ps1, hid the operation by stopping the mining service whenever Task Manager opened, while the vulnerable WinRing0x64.sys driver gave the miner kernel-level hardware access to maximize mining performance.

CL-STA-0954 Exploited FortiManager and FortiOS Flaws to Deploy Stealthy PEERSTITCH Implant

According to Unit 42, a threat cluster tracked as CL-STA-0954 (also known as UNC5820) exploited CVE-2024-47575, a missing authentication flaw in FortiManager, to breach a telecommunications managed service provider in September 2024, registering a rogue FortiGate device and exfiltrating configurations, credentials and cryptographic material for more than 500 managed firewalls. Using the stolen credentials, the attackers later exploited CVE-2025-61624, a path traversal flaw in the FortiOS CLI auto-script engine, to escalate to root and deploy PEERSTITCH, a novel memory-resident ARM64 implant that injected code into the miglogd and iked daemons through ptrace. PEERSTITCH left no persistent binary on disk, opened no listening ports and made no outbound connections, instead building a covert inter-process communication bridge between the two daemons and hiding in traffic generated by legitimate processes to evade endpoint and network detection. The same auto-script flaw also let the attackers abuse the Apache mod_md module to establish a persistent SSH reverse shell, while log tampering and configuration rollbacks erased traces of the activity.

Open-Source Software (OSS) vulnerabilities are security weaknesses discovered in publicly available codebases that can be exploited across widely used libraries, frameworks, and tools, often impacting thousands of downstream applications.

PRE-NVD vulnerabilities refer to security flaws that are discovered, discussed, or even exploited in the wild before their official inclusion in the National Vulnerability Database (NVD). These early-stage vulnerabilities often emerge through threat actor chatter, exploit proof-of-concepts, and technical disclosures shared across social media platforms and underground forums, signaling potential exploitation risks before public awareness.

The week made it clear that attackers didn’t distinguish between fresh zero-days and long-forgotten flaws, treating any unpatched system as an open opportunity. Stealthy techniques such as memory-resident implants, in-memory exploit chains and disguised cryptominers showed that compromise can go unnoticed long after the initial breach, even on fully updated devices. Defending against this pace requires more than routine patching: organizations need accurate asset inventories, restricted management interfaces and proactive threat hunting to catch what security tools miss. Loginsoft Vulnerability Intelligence (LOVI) continues to deliver timely, actionable insight into actively exploited vulnerabilities and emerging threats, helping security teams prioritize what matters most and stay ahead of adversaries.

FAQs

Q1. What is PEERSTITCH malware?

PEERSTITCH is a stealthy, memory-resident implant that targets FortiGate firewalls by injecting code into the miglogd and iked daemons. It leaves no persistent file on disk, opens no listening ports and makes no outbound connections. Instead, it hides commands inside traffic handled by legitimate processes, which makes it extremely difficult to detect.

Q2. What should organizations do when a vulnerability has no patch available?

When no patch exists, organizations should reduce exposure by restricting access to affected management interfaces through trusted IP allowlists or VPN connections. Security teams should actively hunt for signs of compromise, such as unexpected files, suspicious processes or unusual outbound traffic. Once the vendor releases a fix, it should be applied immediately and its effectiveness verified.

Q3. Does inclusion in the CISA KEV catalog mean exploitation is widespread?

Not necessarily widespread - but confirmed. KEV inclusion indicates verified in-the-wild exploitation. While the scale may vary, the operational reality is that threat actors possess working exploits, making patch prioritization urgent regardless of observed targeting volume.

Q4. How does LOVI help organizations manage vulnerabilities effectively?

Loginsoft Vulnerability Intelligence empowers you to efficiently prioritize and respond to potential vulnerabilities by focusing on those actively exploited in the wild. LOVI correlates vulnerability data with real-world threat activity to reduce noise and improve decision-making. This approach enables faster remediation and stronger security posture.

Q5. What is Cytellite?

Cytellite is a Loginsoft security intelligence platform that provides real-time visibility into emerging threats through a global sensor network. It delivers actionable IP intelligence to help organizations detect, analyze, and respond to attacks quickly. By correlating threat data with live activity, Cytellite strengthens resilience across dynamic threat landscapes.