Real-time global intelligence

© 2026 OpenWatch. All rights reserved.

Proudly using no third-party tracking

Illustrative, not investment advice. OpenWatch aggregates public signals for research and information only — it is not personalized financial, legal, or tax advice, and nothing here is a recommendation to buy or sell any security.

Platform

Brief
Signals
Cascade
Trajectories
Prediction Markets
Track Record
Forecast Ledger
Play Crowd Prophet
Countries
Companies
Industries
Themes
Rankings
Activity
Compare

Tools

Globe
Analytics
Crises
Clusters
Supply Chain
Alliances
Screener
Watchlist
Portfolio
Status

Sources

View all sources →

1,000+ tracked sources

Signals updated every 15 minutes

Data & Map Attribution

Data providers: GDELT · ACLED · USGS · WHO · SEC EDGAR · HKEX · UK Companies House · Japan EDINET · UN OCHA · Reuters · FRED · IMF · World Bank · OpenStreetMap / Nominatim · GDACS · IODA · Mapbox · Databento.

Maps © Mapbox © OpenStreetMap contributors — map and place-name data licensed under ODbL.

Not investment advice. OpenWatch is provided for informational and entertainment purposes only. While we strive for accuracy, precision, and source attribution in all intelligence assessments, geopolitical analysis involves inherent uncertainty and our conclusions may be incomplete, delayed, or incorrect. Nothing on this platform constitutes financial, investment, legal, or professional advice of any kind. Forward-looking scenarios and probability estimates are analytical hypotheses — not independently validated forecasts. Any actions taken based on information found here are solely your responsibility. Always consult a qualified financial advisor before making investment decisions. Past signal patterns do not guarantee future outcomes.

Methodology
Privacy Policy
Terms of Use

openwatch.io

v·224a609

Search

Congressional trades, bills, prediction markets, hearings, and intelligence signals. Signal search supports: AND OR "exact phrase" -exclude

Keywords

Threat Layer

Military Cyber Economic Disaster Political Criminal Health Supply Chain

Signal Type

Any Crisis Update Resolution

Region

Country

Min. Severity

Any ≥ 3 ≥ 5 ≥ 7 ≥ 9

Date Range

Clear all filters

Sort by

Severity Newest

↓Export CSV (requires API key)

Themes:🧠AI Chip Bottleneck 🛡US Defense Surge 🔌Taiwan Semiconductor Risk

1,277 signals for Cyber · Update

Page 4 of 52

CyberUpdate🇸🇪Sweden 🇫🇮Finland 🇱🇻Latvia+462d ago

Police have arrested four suspects connected to the deliberate sabotage of two subsea telecommunications cables in the Baltic Sea late last year, with three facing travel bans as prosecutors determine next steps.

5.5/10·DW World News·Baltic Sea

Primary Source ↗Details →

CyberUpdate🇳🇿New Zealand 🇨🇳China 🇺🇸United States+363d ago

New Zealand's intelligence agency and its Five Eyes partners have disclosed that the Chinese military is using professional networking sites like LinkedIn to identify and target people with access to classified information, indicating a coordinated social engineering and espionage campaign.

5.5/10·Radio New Zealand

Primary Source ↗Details →

CyberUpdate🇺🇸United States 🇲🇱Mali70d ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-0257, a Palo Alto Networks PAN-OS authentication bypass flaw, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation in the wild. Federal agencies are required to remediate the vulnerability by a deadline set under binding directive BOD 22-01, while CISA recommends all organizations prioritize patching to protect against ongoing attacks.

5.5/10·CISA Current Activity

Primary Source ↗Details →

CyberUpdate🇮🇷Iran71d ago

Iran's communication infrastructure remains severely degraded following an 88-day total internet blackout. Even after the blockade was partially lifted, connectivity remains difficult, with significant documented economic and social consequences.

5.5/10·DW World News

Primary Source ↗Details →

CyberUpdate🇮🇷Iran71d ago

An 88-day total internet blockade in Iran has been partially lifted, though external communication remains severely restricted. The extended outage has caused significant economic disruption and social harm across the nation.

5.5/10·Deutsche Welle (DW) English

Primary Source ↗Details →

CyberUpdate🇺🇸United States 🇲🇱Mali73d ago

CISA added CVE-2026-48172, a privilege escalation flaw in the LiteSpeed cPanel plugin, to its Known Exploited Vulnerabilities catalog after detecting active exploitation. Federal agencies are required to patch the vulnerability under Binding Operational Directive 22-01; CISA recommends all organizations prioritize remediation as part of their vulnerability management.

5.5/10·CISA Current Activity

Primary Source ↗Details →

CyberUpdate🇺🇸United States91d ago

A new report analyzing over 25 million security alerts across live enterprise environments has found that security teams are systematically ignoring or failing to investigate informational and low-severity alerts—a practice the researchers describe as institutionalized 'not looking.' The dataset includes monitoring of 10 million endpoints, suggesting the problem is endemic to how major organizations handle security signal triage.

5.5/10·The Hacker News

Primary Source ↗Details →

CyberUpdate🇺🇸United States93d ago

Gartner's inaugural Market Guide for Guardian Agents has confirmed what security teams suspected: enterprises are deploying AI agents at a pace that outstrips their ability to govern them. The research highlights a growing gap between adoption velocity and the maturity of enterprise policy controls around these systems.

5.5/10·The Hacker News

Primary Source ↗Details →

CyberUpdate98d ago

The intelligence reports a proof-of-concept exploit that is concise and potentially easy to reproduce. A security patch has already been released to address the vulnerability, which reduces the threat window if organizations apply updates promptly.

5.5/10·Dark Reading

Primary Source ↗Details →

CyberUpdate🇺🇸United States100d ago

Cybersecurity researchers have analyzed destructive malware employing advanced living-off-the-land techniques—methods that abuse legitimate system tools to evade detection—alongside detailed operational strategies for large-scale data deletion.

5.5/10·Dark Reading

Primary Source ↗Details →

CyberUpdate🇺🇸United States 🇲🇱Mali116d ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added seven newly exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, including flaws in Microsoft Windows, Exchange Server, and Adobe Acrobat. Federal agencies are required to patch these vulnerabilities under Binding Operational Directive 22-01, though CISA is urging all organizations to prioritize remediation given active exploitation in the wild.

5.5/10·CISA Current Activity·Mali

Primary Source ↗Details →

CyberUpdate🇨🇳China 🇷🇺Russia156d ago

Introduction Google Threat Intelligence Group (GTIG) has identified a new and powerful exploit kit targeting Apple iPhone models running iOS version 13.0 (released in September 2019) up to version 17.2.1 (released in December 2023) . The exploit kit, named “Coruna” by its developers, contained five full iOS exploit chains and a total of 23 exploits. The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non-public exploitation techniques and mitigation bypasses.

5.5/10·Mandiant Threat Intelligence

Primary Source ↗Details →

CyberUpdate🇺🇸United States43d ago

New details have been revealed on how hackers exploited a Cisco Catalyst SD-WAN vulnerability tracked as CVE-2026-20245 in zero-day attacks to create rogue root accounts on targeted devices. [...]

5.3/10·Bleeping Computer

Primary Source ↗Details →

CyberUpdate🇺🇸United States50d ago

What if your AI coding assistant could be tricked into stealing your own company's secrets - by reading a single booby-trapped bug report? No phishing email. No malware.

5.3/10·Graham Cluley Security

Primary Source ↗Details →

CyberUpdate🇷🇺Russia65d ago

The Russian hacking group known as Gamaredon has been attributed to the continued exploitation of a WinRAR vulnerability to deliver multiple malware families aimed at data theft and propagation. Per Sekoia, the activity involves the weaponization of CVE-2025-8088, a path traversal flaw in WinRAR, to launch an HTML Application payload dubbed GammaPhish, which is then used to retrieve an

5.3/10·The Hacker News

Primary Source ↗Details →

CyberUpdate104d ago

A company asserts that its V4 system matches US-based system performance while utilizing open source code, presenting potential security and competitive concerns in the technology sector.

5.2/10·14ymedio (Cuba — Spanish)

Primary Source ↗Details →

CyberUpdate🇺🇸United States 🇷🇺Russia8d ago

Cisco is warning that a high-severity Secure Firewall Management Center (FMC) static credential vulnerability, tracked as CVE-2026-20316, was actively exploited in zero-day attacks to gain unauthorized access to vulnerable devices. [...]

5.1/10·Bleeping Computer

Primary Source ↗Details →

CyberUpdate🇹🇼Taiwan10d ago

Many people download Windows utility software by simply searching through Google and clicking to download. However, nowadays the websites ranked at the top are not necessarily official sites. Foreign media reports indicate that cyber attackers are launching large-scale fraud campaigns, creating over 70 counterfeit websites that impersonate well-known system tools.

5.1/10·Liberty Times

Primary Source ↗Details →

CyberUpdate🇺🇸United States23d ago

SonicWall has warned of active exploitation of two zero-day vulnerabilities impacting Secure Mobile Access (SMA) 1000 series appliances, one of which could be exploited to achieve arbitrary command execution. The vulnerabilities are listed below - CVE-2026-15409 (CVSS score: 10.0) - A Server-side request forgery (SSRF) vulnerability that a remote unauthenticated attacker could exploit to

5.1/10·The Hacker News

Primary Source ↗Details →

CyberUpdate🇲🇱Mali24d ago

Cybersecurity researchers have discovered 11 old, Microsoft-signed, Unified Extensible Firmware Interface (UEFI) applications that could be abused to bypass Secure Boot on most systems using the modern firmware standard. "An attacker exploiting one of these vulnerable applications can execute untrusted code during system boot, enabling deployment of malicious UEFI bootkits or other malware,"

5.1/10·The Hacker News

Primary Source ↗Details →

CyberUpdate🇹🇷Turkey 🇷🇴Romania 🇵🇰Pakistan+331d ago

Turkey’s software and defense company HAVELSAN reportedly exported the ADVENT combat management system to Romania this month, the first time that the naval command and control solution was delivered to a NATO member state. HAVELSAN carried out this export through the sale of the CAm.ROMAN corvette to Romania , according to Anadolu . In accordance with the export agreement, the ADVENT system was delivered together with the vessel for use by the Romanian Naval Forces.  The delivery marks the first time ADVENT has entered the inventory of a NATO ally, following previous exports to Pakistan, Indonesia, Ukraine, Qatar, Oman, Nigeria, Malaysia, and Chile.

5.1/10·Romania Insider

Primary Source ↗Details →

CyberUpdate🇺🇸United States 🇨🇳China 🇷🇺Russia+236d ago

Attackers are hiding a data-stealing trojan inside fake exploit code aimed at the people who hunt bugs for a living. The malware, called ChocoPoC, travels in Python proof-of-concept (PoC) repositories on GitHub that claim to exploit hot new CVEs. Run one, and it quietly lifts your saved passwords, browser cookies, and files, then hands the attacker a shell on your machine. YesWeHack and

5.1/10·The Hacker News

Primary Source ↗Details →

CyberUpdate🇺🇸United States38d ago

An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously unreported malware families, TaskWeaver and Djinn Stealer. The intrusion involves the exploitation of CVE-2026-48558 (CVSS score: 10.0), a critical authentication bypass vulnerability impacting the OpenID Connect (OIDC) flow that an unauthenticated

5.1/10·The Hacker News

Primary Source ↗Details →

CyberUpdate🇺🇸United States38d ago

The threat actor is focused on collecting credentials, SSH keys, cryptocurrency wallets, and development tooling. The post Critical SimpleHelp Vulnerability Exploited for Malware Delivery appeared first on SecurityWeek .

5.1/10·SecurityWeek

Primary Source ↗Details →

CyberUpdate🇺🇦Ukraine 🇷🇺Russia 🇸🇰Slovakia39d ago

A Russian advanced persistent threat (APT) group has continued to evolve and expand its malware arsenal as part of its ongoing cyber onslaught against Ukraine throughout 2025. Slovakian cybersecurity company ESET said it observed 35 distinct spear-phishing campaigns mounted by Gamaredon against new targets, with most of them taking place in the second half of the year. Primary targets of these

5.1/10·The Hacker News

Primary Source ↗Details →