Browse public community intelligence reports, source analysis, and threat research.
103 intel reports
An unprivileged user can exploit a logic flaw in the Windows Installer service to delete arbitrary folders as SYSTEM and subsequently execute code by planting malicious rollback scripts.
A 16-year-old use-after-free vulnerability in the Linux KVM shadow MMU (CVE-2026-53359) allows guest VMs to escape to the host on x86 Intel and AMD systems.
Russian FSB Center 16 and Static Tundra are actively exploiting the legacy Cisco Smart Install vulnerability (CVE-2018-0171) to extract device configurations and maintain persistence in critical infrastructure.
An unauthenticated remote attacker can achieve kernel-mode code execution or denial-of-service by exploiting an integer overflow in the Windows HTTP.sys driver over TLS connections.
The threat actor Nightmare Eclipse released the RoguePlanet zero-day exploit (CVE-2026-50656) targeting a race condition in Microsoft Defender to achieve SYSTEM privileges on Windows 10 and 11.
The Gentlemen RaaS group is targeting critical infrastructure using custom Go-based backdoors and ransomware variants that leverage GPO deployment and Bring Your Own Vulnerable Driver (BYOVD) techniques.
A flaw in the Linux kernel's act_pedit traffic-control action allows unprivileged users to gain root access by poisoning cached setuid binaries in memory.
A high-severity Linux kernel vulnerability (DirtyClone) allows local attackers to achieve root access by exploiting improper shared memory flag propagation in the networking stack.
The Gentlemen Ransomware-as-a-Service (RaaS) group utilizes a sophisticated EDR-killing framework and targets global organizations using leaked Fortinet VPN credentials.
A low-privileged user can coerce the Windows Store Install Service (SYSTEM) to perform NTLM authentication or execute arbitrary DLLs via UNC-located loose-file package registration.
