Cyber Watch
The story behind the alert—and what to do next.
Cyber Watch follows hacking, confirmed breaches, ransomware, security threats and scams, and AI security. Stories are organized by topic and preserved in a browsable archive.
How to read Cyber Watch
Facts first. Impact second. Action always.
01
What happened
Confirmed facts from advisories, affected organizations, regulators, researchers, and reputable reporting.
02
Why it matters
Who is actually exposed, what remains unknown, and what the event changes for individuals or organizations.
03
What to do
Concrete protection, verification, patching, monitoring, or recovery steps matched to the evidence.
Newsroom
Threats & Scams
Every story links to original reporting or advisories and separates confirmed facts from analysis.
EvilTokens: How AI Turned Stolen Email Access Into Targeted Fraud
Microsoft announced on September 22, 2026 that it disrupted EvilTokens, a cybercrime platform combining email account theft with AI-assisted fraud planning.What changedAccording to Microsoft, the service was linked to more…
Read the storyCISA and FBI: Keep Vendor Access Visible and Limited
CISA and the FBI released guidance on September 23, 2026 for critical infrastructure organizations working with third-party industrial control systems integrators.What changedThe fact sheet recommends limited privileges, monitored access routes,…
Read the storyCISA Adds Four Exploited Flaws in Security Gateways and Management Tools
CISA lists exploited flaws in Check Point, Arista VeloCloud, and F5 BIG-IP APM. Check exposure, apply vendor fixes, and look for earlier compromise.
Read the storyWeekly Cyber Brief — September 19, 2026
Actively exploited flaws, AI testing safeguards, and consumer protection alerts—with practical next steps.
Read the storyCISA Ditches Weekly Vulnerability Roundups for Risk-Based Focus
CISA is moving away from weekly vulnerability lists and toward exploitability, exposure, asset importance, and real-world risk.
Read the storyMicrosoft Issues Emergency Fixes After Massive Patch Tuesday
Out-of-band fixes for Remote Desktop, Hyper-V, USB audio, and Windows Update reinforce the need for staged patch rings and verified rollback paths.
Read the storyArchive
Story list
- EvilTokens: How AI Turned Stolen Email Access Into Targeted FraudThreats & Scams · AI Security
- CISA and FBI: Keep Vendor Access Visible and LimitedThreats & Scams · Panther Notes
- CISA Adds Four Exploited Flaws in Security Gateways and Management ToolsThreats & Scams
- Weekly Cyber Brief — September 19, 2026Threats & Scams · AI Security · Panther Notes
- CISA Ditches Weekly Vulnerability Roundups for Risk-Based FocusThreats & Scams
- Microsoft Issues Emergency Fixes After Massive Patch TuesdayThreats & Scams
Panther Notes
Analysis from the field
Panther Notes holds practical observations, lessons learned, and evidence-based security thinking. The tone stays direct: no fear marketing and no pretending certainty where it does not exist.
Start at the source
Critical claims should lead back to the original advisory, disclosure, filing, or regulator notice.
CISA Alerts & AdvisoriesBreach source desk
Where Cyber Watch checks the claim
A social post or criminal claim can be a lead, but it is not confirmation. These sources help establish what happened, who may be affected, and what action is actually supported by the evidence.
First source
The affected organization
Look for a dated incident notice, customer letter, regulator filing, or status update from the organization itself. Treat missing details as unknown—not as proof that nothing happened.
Government record
HHS breach reports
The U.S. Department of Health and Human Services publishes reported breaches of unsecured health information affecting 500 or more people.
Search the HHS portalCompany filing
SEC EDGAR
Public companies may disclose material cybersecurity incidents in Form 8-K filings. Read the filing before relying on a headline.
Search SEC filingsConsumer notices
State breach notices
State attorney general sites often preserve the notice letter sent to affected people, including dates, exposed data types, and offered protection.
Search California noticesExposure check
Have I Been Pwned
Check whether an email address appears in a known breach. A listing is a warning to change reused passwords—not proof of identity theft.
Check an email addressIndependent reporting
Reuters cybersecurity
Use reputable reporting to add context, then follow its links and named sources back to the original evidence whenever possible.
Read Reuters coverageResearch desk
Comparitech
Use Comparitech for breach research, practical security reporting, and its continually updated ransomware datasets. Verify important claims against the affected organization or official record.
Read Comparitech newsEditorial standard
Review first. Publish second.
New briefings are saved as drafts for human review. Nothing is automatically published. Material corrections are identified when the evidence changes.