What attackers used,
and one thing worth checking.

One short email a month from H2 Labs. It takes the flaws that CISA, the US cybersecurity agency, added that month to its catalogue of flaws used in real attacks, sorts them by kind of product, and names one thing worth checking on your own systems, with how to check it.

Letters

Newest first, each one in full with its sources.

November 2026

34 flaws attackers used, and two Windows versions near their end

The 34 flaws CISA added to its catalogue from 4 October to 3 November, by kind of product, and one command that lists Windows 11 23H2 and Windows Server 2016 in your domain.

H2 Labs2026-11-05

Get the letter by email

Confirm your address and the checklist comes first; the next letter follows on the second Thursday of the month.

Work email

The monthly letter and occasional news from H2 Labs: what attackers used each month, one thing worth checking, and now and then a new checklist, tool or service of ours. The checklist comes first. We email a link to confirm the address, and every email has a one-click unsubscribe.

H2 Labs keeps this address; Resend, in the United States, delivers our email. What we keep and for how long: privacy notice.

MonthlyWhat attackers used. The flaws CISA added to its catalogue that month, by kind of product.
One checkWorth checking. One thing to look at on your own systems, and how to check it.
SourcedEvery figure sourced. Each letter ends with its sources and the date they were checked.