Browse public community intelligence reports, source analysis, and threat research.
15 intel reports
The Cling botnet exploits multiple IoT vulnerabilities to deploy a worm-like malware that repurposes legitimate STUN traffic and infrastructure for command-and-control communications.
The researcher Nightmare Eclipse (aka MSNightmare) has released multiple proof-of-concept exploits targeting Windows Defender, Kaspersky, Avast, CrowdStrike, and NVIDIA drivers to achieve local privilege escalation or denial-of-service.
Researcher 'Chaotic Eclipse' has released FalconFlank, a zero-day exploit abusing CrowdStrike Falcon's Office macro remediation to achieve SYSTEM privileges on Windows.
The ENIBot IoT botnet actively self-propagates via Telnet and ADB brute-forcing to conduct high-volume Layer 7 DDoS attacks.
AISURU threat actors deployed Kimwolf v7 targeting Android TV boxes and IoT devices using Ethereum Name Service (ENS) for resilient C2 and advanced HTTP/2 DDoS fingerprinting.
Researchers identified five critical and high-severity memory corruption vulnerabilities in the Cloudflare workerd runtime, enabling sandbox escapes and cross-tenant data theft.
Researchers identified 84 'iTrue' vulnerabilities in cellular core networks arising from implicit trust between components, enabling denial-of-service and session hijacking across major open-source and commercial implementations.
Russia-aligned threat group UAC-0099 is delivering a multi-stage infection chain involving LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2 by abusing legitimate Notepad++ plugin loading routines.
Anonymous researcher 'bikini' released Exploitarium, a repository containing over 30 proof-of-concept exploits for unpatched vulnerabilities across multiple software projects, including critical flaws in libssh2 and Gitea.
A 16-year-old use-after-free vulnerability in the Linux KVM shadow MMU (CVE-2026-53359) allows guest VMs to escape to the host on x86 Intel and AMD systems.
