Intel Exchange

Threat actors are actively exploiting critical deserialization vulnerabilities in on-premises Microsoft SharePoint Server to achieve remote code execution and maintain persistence via machine key theft.

Cl0p ransomware affiliates are exploiting a critical RCE vulnerability (CVE-2026-12569) in PTC Windchill and FlexPLM systems to deploy JSP webshells and exfiltrate data.

An authenticated attacker with repository write access can achieve remote code execution by exploiting an add/add collision in Gitea's diffpatch endpoint to plant a malicious Git hook.

The wp2shell exploit chain leverages vulnerabilities in WordPress Core's REST API and WP_Query to achieve unauthenticated remote code execution on default installations.

Attackers are chaining a REST API batch-route confusion vulnerability (CVE-2026-63030) and a SQL injection (CVE-2026-60137) to achieve unauthenticated remote code execution on WordPress Core.

The Clop ransomware gang is actively exploiting CVE-2026-12569 in PTC Windchill and FlexPLM systems to deploy JSP webshells and exfiltrate sensitive product data.

The Russia-aligned actor TA458 uses half-click XSS zero-day exploits against SOGo, Zimbra, and Roundcube webmail to deploy SpyPress malware and steal sensitive government data.

Adversaries can exploit Azure Container Registry permissions to push malicious images, modify ACR Tasks, and abuse Managed Identities for secret exfiltration and remote code execution.

An unknown threat actor deployed a new Rust-based ransomware called Spirals against a South Asian IT services company using web shell access and rapid lateral movement.

The WP-SHELLSTORM campaign targets WordPress and Joomla installations at scale using automated exploit scanners and webshells for access brokerage.