Newton Mail is Being Resurrected Again, This Time by Superfans

Newton Mail, a subscription-based email client with an impressively large fanbase, is being reincarnated by new owners: long-time fans Maitrik Kataria and Justin Mitchell. From a report: After Newton's owner Essential announced it would be shutting down in February -- for the second time, Kataria and Mitchell reached out to the company to figure out how they could save their favorite email client. And somehow they've done it. Newton, which was originally produced under the name CloudMagic, has been shut down and given new life more times than most companies are afforded. CloudMagic rebranded as Newton in 2016 and did pretty well for itself -- by the time it first shut down in the summer of 2018, the service had more than 40,000 paid subscribers. The purchase of Newton Mail by Kataria and Mitchell brings the mail client back to its roots as a company free of venture capital funding. Newton will need to bank on its long-standing fan base's willingness to pay subscription fees for a mail client if it wants to survive. Otherwise, history is doomed to repeat itself once again.

Read more of this story at Slashdot.

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - Newton Mail is Being Resurrected Again, This Time by Superfans
id: 3607c4f3-6b3f-4783-8600-5e0738b3c676
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-27
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-27"
        description = "YARA Signature for "
    strings:
        $str = "Newton Mail is Being Resurrect" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Newton Mail is Being Resurrected Again T")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*Newton Mail is Being Resurrected Again T*"

CommonSecurityLog
| where Message has "Newton Mail is Being Resurrected Again T"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc