Intel Exchange

Browse public community intelligence reports, source analysis, and threat research.

Cover image for Critical RCE PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Critical RCE PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Critical heap use-after-free vulnerabilities in the PHP core allow unauthenticated remote code execution and memory disclosure targeting web servers globally.

avatar
Mateus Dornelas@salenrod8 hours ago

2 intel reports

AI-Powered Phishing-as-a-Service Kits Target Microsoft 365 Identities

The threat actor Storm-2372 is utilizing AI-built phishing kits, TokenLover and YaksaLover, to automate large-scale BEC attacks and persistence via Windows Hello for Business key injection.

avatar
Tim Peck@timpeck
3 months ago
19
WordPress Core wp2shell Pre-Authentication RCE Exploit Chain

The wp2shell exploit chain leverages vulnerabilities in WordPress Core's REST API and WP_Query to achieve unauthenticated remote code execution on default installations.

avatar
Tim Peck@timpeck
3 months ago
129