Browse public community intelligence reports, source analysis, and threat research.
103 intel reports
Certighost (CVE-2026-54121) is a critical improper authorization vulnerability in AD CS allowing low-privileged users to impersonate Domain Controllers by abusing unverified directory referrals.
Attackers are exploiting CVE-2026-65400, a critical macOS Screen Sharing authentication bypass, to gain root access and deploy Monero miners on internet-exposed systems.
Chinese-speaking threat actor UAT-10147 leverages agentic AI frameworks like PentestGPT and DeepAudit to automate reconnaissance and exploit validation against Windows and Linux web servers.
A Chinese-speaking threat actor is manually exploiting CVE-2026-33824, a critical double-free vulnerability in the Windows IKE Extension, to achieve pre-authentication remote code execution on VPN gateways.
Lazarus Group exploited a zero-day vulnerability in the Windows AppLocker driver (CVE-2024-21338) to deploy an updated FudModule rootkit for kernel-level security disruption.
Nightmare Eclipse released ShieldBreak, a zero-day exploit bypassing previous patches to achieve SYSTEM privileges by exploiting a race condition in the Microsoft Malware Protection Engine.
Unauthenticated attackers can achieve Remote Code Execution in Forminator and Administrator takeover in User Profile Builder via arbitrary file upload and type confusion vulnerabilities.
Lazarus group exploited a Windows AFD.sys zero-day (CVE-2026-68820) to deploy the FudModule rootkit against defense and aviation sectors via trojanized PDF software.
An exploit chain leveraging a Unisoc modem RCE via VoLTE SIP messages achieves full Android kernel access by exploiting improper SoC resource isolation (CWE-1189).
Unidentified threat actors are exploiting a critical macOS Screen Sharing authentication bypass (CVE-2026-65400) to gain root access and deploy Monero miners.
