Browse public community intelligence reports, source analysis, and threat research.
6 intel reports
The TRUST#GRAFT campaign utilizes a browser-mediated JavaScript loader to hijack authenticated WordPress administrator sessions for the deployment of a persistent PHP backdoor.
Threat actors are actively exploiting a decade-old improper access control vulnerability in ProFTPD's mod_copy module to achieve unauthenticated remote code execution on Linux/Unix systems.
Tanto Security demonstrated an unauthenticated RCE chain in Telerik UI for ASP.NET AJAX by exploiting an AES-CBC padding oracle to achieve arbitrary type resolution and DLL loading.
Threat actors are leveraging compromised WordPress sites and blockchain smart contracts to deliver Amatera password stealers and WebRTC stagers through ClickFix lures.
Attackers are chaining a REST API batch-route confusion vulnerability (CVE-2026-63030) and a SQL injection (CVE-2026-60137) to achieve unauthenticated remote code execution on WordPress Core.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
