Browse public community intelligence reports, source analysis, and threat research.
Critical unauthenticated remote code execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619) allow attackers to take full control of web servers by exploiting memory corruption in session upload progress and fatal error handling.
3 intel reports
ClickFix campaigns are deploying PavinLoader, a multi-stage .NET loader that uses EtherHiding and MSBuild to deliver Amatera Stealer and other payloads.
Remcos RAT is a sophisticated Windows remote access trojan used by actors like APT33 and UAC-0050 for extensive surveillance, credential theft, and full system control.
The VEIL#DROP framework utilizes Google's Blogspot platform and living-off-the-land binaries to deploy the PureLog Stealer in memory via a multi-stage fileless chain.
