Intel Exchange

The WP-SHELLSTORM campaign targets WordPress and Joomla installations at scale using automated exploit scanners and webshells for access brokerage.

The China-aligned threat actor UNK_MassTraction is exploiting Roundcube vulnerabilities to deploy IceCube and VShell backdoors against US and Canadian university physics departments.

UAT-7810, a China-nexus infrastructure specialist, builds Operational Relay Box (ORB) networks targeting SOHO and enterprise systems using the LEASH malware family for secondary espionage actors.

UAT-7810, a China-nexus threat actor, is expanding its LapDogs Operational Relay Box (ORB) network by compromising networking devices using an updated suite of custom Linux and Java-based malware.

LSHIY LLC linked actors conducted a massive password spray campaign targeting Azure CLI to bypass MFA via ROPC, while new vulnerabilities in AI agents like Amazon Q Developer emerged.

China-nexus actor UAT-7810 is expanding its LapDogs Operational Relay Box network using new malware families like LONGLEASH and DOGLEASH to target networking and IoT devices.

China-nexus threat actors are exploiting public-facing phpMyAdmin panels via log poisoning to deploy Nezha monitoring agents and Ghost RAT malware.

Unauthenticated attackers can bypass authentication on exposed Gitea instances to gain full administrative control by spoofing the X-WEBAUTH-USER HTTP header.

The Iranian threat actor Cavern Manticore is targeting Israeli IT providers and government sectors using the modular Cavern C2 framework and supply chain exploitation.

A pre-authentication memory overread vulnerability (CVE-2026-8451) in Citrix NetScaler appliances configured as SAML IdPs allows for information leakage and denial of service.