Intel Exchange

Threat actors are chaining critical vulnerabilities CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 appliances to gain root access and pivot into internal corporate networks.

Adversaries can achieve remote code execution as SYSTEM or root by submitting crafted SVG files containing shell-invoking delegates to image-processing pipelines.

Russian intelligence services APT28 (GRU) and FSB Center 16 are systematically compromising SOHO and enterprise routers to build global proxy networks and conduct DNS hijacking for credential theft.

A China-linked actor is using the advanced Daxin kernel-mode rootkit alongside a novel Stupig backdoor to maintain decade-long persistence in a Taiwan manufacturing firm.

An unknown threat actor deployed a new Rust-based ransomware called Spirals against a South Asian IT services company using web shell access and rapid lateral movement.

Sophisticated threat actor UAT-8616 is targeting Cisco Catalyst SD-WAN components using zero-day vulnerabilities to gain root access and manipulate network fabric configurations.

Russian FSB Center 16 (Static Tundra) targets critical infrastructure by exploiting weak SNMP configurations and legacy Cisco vulnerabilities to exfiltrate device configurations.

Educational writeup documenting various SQL Injection (SQLi) techniques, including UNION-based, blind, error-based, and out-of-band exfiltration targeting common SGBDs.

An unauthenticated remote attacker can achieve kernel-mode code execution or denial-of-service by exploiting an integer overflow in the Windows HTTP.sys driver over TLS connections.

Russian-speaking threat actors are exploiting CVE-2026-35616 in FortiClient EMS to deploy EKZ Stealer and FortigateSniffer, facilitating credential harvesting and subsequent ransomware attacks by INC Ransom and Lynx.