Browse public community intelligence reports, source analysis, and threat research.
236 intel reports
Wiz Research discovered CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API allowing full cross-tenant read/write access to databases via a platform-wide master key.
JadeProx is a China-nexus threat cluster targeting Southeast Asia and Latin America using TriBack Loader and various tunneling tools for cyber espionage.
Russia-aligned threat group UAC-0099 is delivering a multi-stage infection chain involving LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2 by abusing legitimate Notepad++ plugin loading routines.
An authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC) allows remote, unauthenticated attackers to execute commands and gain root access via crafted HTTP requests.
An authenticated attacker with repository write access can achieve remote code execution by exploiting an add/add collision in Gitea's diffpatch endpoint to plant a malicious Git hook.
The wp2shell exploit chain leverages vulnerabilities in WordPress Core's REST API and WP_Query to achieve unauthenticated remote code execution on default installations.
The Qilin (aka Agenda) ransomware group is exploiting a critical Palo Alto Networks authentication bypass vulnerability (CVE-2026-0257) to gain initial access and deploy ransomware via credential-driven lateral movement.
A maximum-severity RCE vulnerability in the Ruflo AI agent platform allows unauthenticated attackers to execute commands and poison agent memory.
Attackers are chaining a REST API batch-route confusion vulnerability (CVE-2026-63030) and a SQL injection (CVE-2026-60137) to achieve unauthenticated remote code execution on WordPress Core.
APT28 (Fancy Bear) is conducting a global campaign named FrostArmada, hijacking SOHO router DNS settings to facilitate adversary-in-the-middle attacks targeting Microsoft 365 credentials.
