Browse public community intelligence reports, source analysis, and threat research.
235 intel reports
Critical unauthenticated remote code execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619) allow attackers to take full control of web servers by exploiting memory corruption in session upload progress and fatal error handling.
Unauthenticated remote code execution vulnerabilities in Citrix NetScaler ADC and Gateway are being actively exploited in the wild to deploy webshells and steal credentials.
Adversaries are actively exploiting CVE-2026-109618 (PHP2Shell) to achieve remote code execution on Apache/PHP servers by bypassing ASLR through a four-stage multipart request chain.
Suspected Lazarus Group operators are utilizing agentic AI for post-exploitation after compromising global PHP infrastructure via PHP2Shell vulnerabilities.
A suspected Russian-speaking actor used an AI-assisted toolkit (PentAGI) to exploit PaperCut vulnerabilities (CVE-2026-81578, CVE-2026-82078) and maintain persistence access across 45+ countries.
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
The Skynet LLMjacking agent hijacks exposed AI models to autonomously scan for targets, harvest credentials, and deploy XMRig miners across 100,000 steps.
Critical unauthenticated remote code execution vulnerabilities in the PHP engine, dubbed PHP2Shell, are being exploited in the wild to deploy webshells.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
Threat actors are attempting to weaponize critical PHP2Shell vulnerabilities to deploy the Potassium Mirai variant for large-scale DDoS attacks against Ukrainian targets.
