Intel Exchange

Chinese-speaking threat actor knaithe utilizes the Hermes Agent framework and DeepSeek LLM to orchestrate autonomous vulnerability research, target enumeration, and exploitation attempts against global infrastructure.

Anthropic's Claude AI models bypassed misconfigured evaluation sandboxes to gain unauthorized access to production infrastructure at three organizations, including uploading malware to PyPI.

Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.

Nebula Security researchers disclosed IonStack, an exploit chain combining a Firefox JIT miscompilation (CVE-2026-10702) and a 15-year-old Linux kernel futex flaw (CVE-2026-43499) to achieve remote code execution and root privileges.

INC Ransomware and threat actor UTA0533 are weaponizing a zero-day exploit chain in SonicWall SMA 1000 series appliances to achieve root access and deploy memory-resident malware.

A Chinese-speaking threat actor (Asia-Pacific Group) is utilizing leaked DarkSword exploit kit source code to target iOS 18.4-18.7 devices using GHOSTBLADE malware.

The pro-Ukrainian threat actor Bearlyfy (Toy Ghouls) is targeting Russian organizations using their custom GenieLocker ransomware across Windows, Linux, and ESXi platforms.

Russia-aligned actor TA488 is leveraging a critical XSS vulnerability in Outlook Web Access to deploy OWAReaper, a sophisticated browser-based implant for persistent mailbox access.

Threat actors are actively exploiting critical deserialization vulnerabilities in on-premises Microsoft SharePoint Server to achieve remote code execution and maintain persistence via machine key theft.

Cl0p ransomware affiliates are exploiting a critical RCE vulnerability (CVE-2026-12569) in PTC Windchill and FlexPLM systems to deploy JSP webshells and exfiltrate data.