Node2Shell: Node.js Brotli Remote Code Execution Vulnerability
A high-severity out-of-bounds write vulnerability in the Node.js Brotli decoder (Node2Shell) allows remote code execution when processing malformed compressed data.

Browse public community intelligence reports, source analysis, and threat research.
23 intel reports
The Iran-nexus group Screening Serpens is targeting technology, aerospace, and defense professionals in the US, Israel, and UAE using advanced AppDomainManager hijacking and new RAT variants.
China-aligned actor SHADOW-EARTH-053 targets government and defense sectors in Asia using DLL sideloading, multiple tunneling tools, and exploitation of CVE-2025-55182.
Multiple China-aligned threat actors, including Stately Taurus and clusters CL-STA-1048/1049, are targeting a Southeast Asian government using a diverse toolkit of USB-propagated malware, novel loaders, and remote access Trojans.