Browse public community intelligence reports, source analysis, and threat research.
11 intel reports
Zeabur is permanently shutting down following an October 2026 breach that exposed 3.2 million secrets and granted attackers root access to customer infrastructure via compromised administrative credentials.
Threat actors are exploiting a remote code execution vulnerability in REDCap servers (CVE-2026-90817) to deploy XMRig miners using fileless techniques and steganography.
Sophisticated threat actor UAT-8616 and additional clusters are exploiting at least 12 vulnerabilities in Cisco SD-WAN, FMC, and ASA/FTD devices for persistent access and root escalation.
An unidentified attacker compromised 3BB's network in Thailand, deploying MeshCentral for persistence and targeting subscriber RADIUS databases after attempting to exploit FortiGate SSL-VPN vulnerabilities.
A Chinese-speaking operator utilized rogue Redis replication and multi-protocol exploit toolkits to compromise 3,562 servers for XMRig cryptomining across Asia and Europe.
Virtualizor update infrastructure was compromised to deliver the 'nerat' RAT via malicious PHP modifications and a Java-based persistence mechanism on hypervisor nodes.
NadMesh is an autonomous, Go-based botnet designed to harvest AI service credentials and exploit infrastructure including Docker, Kubernetes, and Model Context Protocol (MCP) services.
Sophisticated threat actor UAT-8616 is targeting Cisco Catalyst SD-WAN components using zero-day vulnerabilities to gain root access and manipulate network fabric configurations.
Unauthenticated attackers can bypass authentication on exposed Gitea instances to gain full administrative control by spoofing the X-WEBAUTH-USER HTTP header.
A critical authentication bypass in Cisco Catalyst SD-WAN's vdaemon service allows unauthenticated attackers to gain control-plane access by impersonating a vHub device.
