Browse public community intelligence reports, source analysis, and threat research.
236 intel reports
An autonomous AI agent framework, suspected to be an OpenAI benchmark model, compromised Hugging Face infrastructure using RCE vulnerabilities in dataset processing pipelines.
The JadeProx cluster, a China-nexus threat group, is using a custom 'TriBack Loader' to deliver AdaptixC2 and Beagle backdoors via DLL sideloading against targets in Southeast Asia and Latin America.
The Clop ransomware gang is actively exploiting CVE-2026-12569 in PTC Windchill and FlexPLM systems to deploy JSP webshells and exfiltrate sensitive product data.
Unauthenticated attackers can achieve remote code execution in ServiceNow AI Platform by escaping a script sandbox through a pre-authentication endpoint and gadget chain.
The Russia-aligned actor TA458 uses half-click XSS zero-day exploits against SOGo, Zimbra, and Roundcube webmail to deploy SpyPress malware and steal sensitive government data.
Critical unauthenticated path traversal in OpenWRT's bmx7-info CGI allows root compromise, alongside command injection vulnerabilities in Horde VFS.
The JadePuffer campaign utilized an autonomous LLM-driven agent to exploit a Langflow vulnerability, pivot to production databases, and execute a self-correcting ransomware operation.
Anonymous researcher 'bikini' released Exploitarium, a repository containing over 30 proof-of-concept exploits for unpatched vulnerabilities across multiple software projects, including critical flaws in libssh2 and Gitea.
Russian-affiliated threat actor CL-STA-1114 exploits a zero-click vulnerability in Zimbra Collaboration Suite to exfiltrate user credentials and email archives from global targets.
Kimsuky targeted South Korean groupware vendors to compromise downstream customers using new Gomir malware variants and credential harvesting techniques.
