Intel Exchange

The researcher Nightmare Eclipse (aka MSNightmare) has released multiple proof-of-concept exploits targeting Windows Defender, Kaspersky, Avast, CrowdStrike, and NVIDIA drivers to achieve local privilege escalation or denial-of-service.

Threat actors are actively exploiting CVE-2025-25249, a critical heap overflow in Fortinet's CAPWAP daemon, to deploy the PivotC2 remote access tool for network reconnaissance and lateral movement.

Russian enterprises are facing sophisticated multi-stage attacks from NightEagle, Hacking Cat, and Toy Ghouls involving custom backdoors, wipers, and tunneling tools.

A suspected Russian-speaking threat actor is using AI-powered agents to exploit a critical PaperCut NG/MF vulnerability chain (CVE-2026-81578 and CVE-2026-82078) to target the education sector globally.

A threat actor designated TH-3BB targeted Thai ISP 3BB and Jasmine International using CVE-2024-21762 for initial access and MeshCentral for persistent command-and-control.

Researcher 'Chaotic Eclipse' has released FalconFlank, a zero-day exploit abusing CrowdStrike Falcon's Office macro remediation to achieve SYSTEM privileges on Windows.

CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).

The Iranian threat actor Phosphorus is using a novel PowerShell backdoor dubbed PowerLess that evades detection by executing within a .NET context rather than a standalone process.

Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.

Researchers identified five critical and high-severity memory corruption vulnerabilities in the Cloudflare workerd runtime, enabling sandbox escapes and cross-tenant data theft.