Browse public community intelligence reports, source analysis, and threat research.
75 intel reports
Unauthenticated remote code execution vulnerabilities in Citrix NetScaler ADC and Gateway are being actively exploited in the wild to deploy webshells and steal credentials.
Critical unauthenticated remote code execution vulnerabilities in the PHP engine, dubbed PHP2Shell, are being exploited in the wild to deploy webshells.
The suspected PRC-nexus actor ARMORY CASTLE exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to deploy custom SAWFLY webshells and BARECLAW tunnelers for credential theft and lateral movement.
An unknown threat actor is infecting Magento e-commerce stores with scanner-evading JavaScript loaders via malicious CMS blocks to target shoppers.
Threat actor CL-UNK-1211 and other groups are leveraging AI agents and LLM-generated code to discover zero-days and orchestrate rapid exploitation campaigns against Linux infrastructure.
Chinese-speaking and English-speaking threat actors are using the Cairn AI penetration testing tool to automate vulnerability discovery and web shell deployment against global e-commerce and retail targets.
Unauthenticated attackers are exploiting CVE-2026-88771 in NetScaler ADC and Gateway appliances using a multi-stage log-poisoning technique to achieve remote code execution and deploy web shells.
Adversaries are actively exploiting multiple zero-day vulnerabilities in Citrix NetScaler ADC and Gateway to deploy persistence mechanisms including PHP-based webshells and remote management tools.
Chinese state-backed actors including Linen Typhoon and Violet Typhoon are exploiting CVE-2025-53770 in Microsoft SharePoint to achieve unauthenticated remote code execution and data theft.
Adversaries, including activity sharing infrastructure history with APT29, are exploiting CVE-2026-42589 in Gotenberg to deploy the 'cache_base' Go-based reverse shell and a broader toolkit.
