Browse public community intelligence reports, source analysis, and threat research.
76 intel reports
Adversaries are actively exploiting CVE-2026-109618 (PHP2Shell) to achieve remote code execution on Apache/PHP servers by bypassing ASLR through a four-stage multipart request chain.
A suspected Russian-speaking actor used an AI-assisted toolkit (PentAGI) to exploit PaperCut vulnerabilities (CVE-2026-81578, CVE-2026-82078) and maintain persistence access across 45+ countries.
Critical unauthenticated remote code execution vulnerabilities in the PHP engine, dubbed PHP2Shell, are being exploited in the wild to deploy webshells.
Unauthenticated attackers are exploiting CVE-2026-88771 in NetScaler ADC and Gateway appliances using a multi-stage log-poisoning technique to achieve remote code execution and deploy web shells.
The CodeAIAssistant malicious VS Code extension abuses Model Context Protocol (MCP) install prompts and direct Node.js child_process spawning to execute arbitrary commands.
Adversaries are actively exploiting multiple zero-day vulnerabilities in Citrix NetScaler ADC and Gateway to deploy persistence mechanisms including PHP-based webshells and remote management tools.
Adversary c05d5254 uses the PoisonedRefresh rootkit to inject fileless PHP web shells into F5 BIG-IP APM memory via CVE-2025-53521 exploitation.
Suspected TraderTraitor group targets developers using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware via lookalike domains and GitHub.
Threat actors are actively exploiting a decade-old improper access control vulnerability in ProFTPD's mod_copy module to achieve unauthenticated remote code execution on Linux/Unix systems.
Threat actor marchos1as uploaded typosquatted AUR packages impersonating yay and paru to execute malicious scripts delivering the CHAOS remote access trojan.
