Browse public community intelligence reports, source analysis, and threat research.
6 intel reports
KATARU is a newly observed IoT malware family that utilizes Linux local privilege escalation exploits and encrypted C2 to conduct DDoS attacks.
Exploits targeting Linux kernel interfaces and SUID helpers use copy-on-write bugs and namespace manipulation to achieve root access.
The threat actor Nightmare Eclipse released the RoguePlanet zero-day exploit (CVE-2026-50656) targeting a race condition in Microsoft Defender to achieve SYSTEM privileges on Windows 10 and 11.
A high-severity Linux kernel vulnerability (DirtyClone) allows local attackers to achieve root access by exploiting improper shared memory flag propagation in the networking stack.
An unprivileged unprivileged user can gain root access on major Linux distributions by exploiting CVE-2026-31431, a deterministic 4-byte page cache write bug in the authencesn cryptographic template.
The PhantomRaven actor is targeting DeFi, Cloud, and AI developers via 33 malicious NPM packages using a multi-stage Remote Dynamic Dependency chain to harvest credentials.
