Browse public community intelligence reports, source analysis, and threat research.
13 intel reports
GitLab has released urgent patches for a critical CVSS 10.0 integer overflow vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that allows for remote code execution.
The threat actor k0t (aka CryptoFeel) is mass-exploiting edge appliances via CVE-2025-64446 and CVE-2026-0257 to steal credentials and facilitate ransomware attacks.
Ransomware actors Spikey Scorpius and Tarnished Scorpius are exploiting an authentication bypass in PAN-OS GlobalProtect (CVE-2026-0257) to gain initial access, bypass MFA, and pivot to virtualization infrastructure.
Qilin and INC ransomware groups are exploiting CVE-2026-0257 in PAN-OS to bypass MFA and pivot into VMware virtualization environments for offline credential dumping.
Ransomware groups including Qilin and Settra are exploiting CVE-2026-0257 to bypass authentication in Palo Alto Networks GlobalProtect for unauthorized internal network access.
Ransomware actors including Spikey Scorpius and Tarnished Scorpius are exploiting CVE-2026-0257 to bypass MFA and gain initial access to corporate networks via PAN-OS VPNs.
China-nexus actors UAT-11587 and UNC6384 are targeting government, diplomatic, and policy organizations across Asia and Europe using the novel Rust-based Antino backdoor and PlugX RAT via complex multi-stage infection chains.
The threat actor Storm-2755, also known as Payroll Pirates, uses adversary-in-the-middle (AiTM) phishing and residential proxies to compromise Microsoft 365 accounts for targeted financial data collection.
Storm-2755 (Payroll Pirates) uses AiTM phishing and residential proxies to compromise Microsoft 365 accounts for financial data theft and payroll diversion.
The Qilin (aka Agenda) ransomware group is exploiting a critical Palo Alto Networks authentication bypass vulnerability (CVE-2026-0257) to gain initial access and deploy ransomware via credential-driven lateral movement.
