Browse public community intelligence reports, source analysis, and threat research.
236 intel reports
The Gentlemen Ransomware-as-a-Service (RaaS) group utilizes a sophisticated EDR-killing framework and targets global organizations using leaked Fortinet VPN credentials.
The ShinyHunters extortion group (UNC6240) is exploiting a critical remote code execution zero-day in Oracle PeopleSoft to breach over 100 organizations, primarily in the education sector.
UNC6508, a PRC-nexus threat actor, targets medical and military research institutions using INFINITERED malware to harvest credentials and exfiltrate data via manipulated compliance rules.
CVE-2026-22778 allows remote attackers to execute arbitrary code on vLLM servers by chaining a heap address leak with a JPEG2000 decoder overflow in the video processing stack.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
An unidentified threat actor is using the VAPT offensive framework to hijack misconfigured Ollama AI servers for automated vulnerability scanning, exploit generation, and credential theft.
An attacker compromised the CDN API keys of OptinMonster, TrustPulse, and PushEngage to serve tampered JavaScript that creates rogue admin accounts on customer sites.
A critical pre-authentication vulnerability in Splunk's PostgreSQL Sidecar Service allows unauthenticated attackers to achieve remote code execution through chained exploitation of path traversal and unsafe database parameters.
Authenticated attackers can exploit a path traversal vulnerability in SharePoint's Upload.aspx to upload ASPX webshells and achieve remote code execution.
A chain of three vulnerabilities in the LiteLLM AI gateway allows low-privilege users to bypass authorization, escalate to administrative privileges, and execute arbitrary code on the host server.
