Browse public community intelligence reports, source analysis, and threat research.
75 intel reports
A China-nexus threat actor is actively exploiting a critical path traversal flaw in VMware vCenter (CVE-2026-59310) to deploy the linuxFile backdoor and Babuk-derived ransomware across hypervisors.
State-sponsored and crimeware actors are actively exploiting Cisco Secure Firewall Management Center vulnerabilities to deploy Cyclops Blink, Qilin ransomware, and custom web shells.
Unidentified threat actors are exploiting a critical authentication bypass in UpdraftPlus to deliver PHP backdoors disguised as legitimate plugins.
Threat actors are actively exploiting critical arbitrary file upload vulnerabilities in Super Forms and Elementor Pro plugins to deploy the Mushr00w PHP uploader and seize control of WordPress sites.
An advanced threat actor, PoisonedRefresh, is exploiting CVE-2025-53521 in F5 BIG-IP systems to deploy a sophisticated Linux rootkit that injects in-memory PHP webshells.
StyleSmuggler is an unauthenticated remote code execution vulnerability (CVE-2026-75650) in Adobe Commerce and Magento exploited to deploy persistent implants and web shells.
A suspected Chinese-speaking operator utilized the SecFlow AI orchestration framework to exploit multiple vulnerabilities and deploy steganographic GLUTTON webshells against government and education targets across Asia.
An unauthenticated attacker can achieve root Remote Code Execution on SonicWall GMS by chaining multiple patch bypasses for legacy vulnerabilities.
Unauthenticated attackers can achieve remote code execution on WordPress sites by exploiting a critical file upload vulnerability in the Elementor Pro Forms module.
The StopAndProtect operation abuses compromised WordPress sites to distribute a multi-component toolkit for file encryption, data theft, and lateral movement via social engineering.
