Intel Exchange

Browse public community intelligence reports, source analysis, and threat research.

Cover image for Node2Shell: Node.js Brotli Remote Code Execution Vulnerability

Node2Shell: Node.js Brotli Remote Code Execution Vulnerability

A high-severity out-of-bounds write vulnerability in the Node.js Brotli decoder (Node2Shell) allows remote code execution when processing malformed compressed data.

avatar
Tim Peck@timpeck4 hours ago

4 intel reports

WSO2 API Manager JWT Bypass Exploitation

Threat actors are actively exploiting CVE-2026-5430 in WSO2 API Manager using forged JWT tokens with unsupported signing algorithms to gain administrative access.

avatar
Min Sakka@AlphaOmega
1 month ago
12
Breaking LiteLLM: Authentication Bypass and Root RCE

LiteLLM vulnerabilities (CVE-2026-59821, CVE-2026-59822) enable unauthenticated attackers to bypass security controls, achieve root-level RCE, and exfiltrate cloud IAM credentials.

avatar
Arnold Chan@slaz
2 months ago
6
CaptiveCrunch: Russian APTs Target Travelers via Wi-Fi Hijacking

Storm-2945, a sub-cluster of Midnight Blizzard (APT29), is hijacking hospitality Wi-Fi networks to deliver CornFlake RAT and ChocoShell infostealer via DNS poisoning and fake update prompts.

avatar
Ethan Andrews@eandrews
3 months ago
15
ADFS Golden SAML via Machine DPAPI Recovery

Mandiant researchers identified a method for attackers to recover active ADFS signing keys from Machine DPAPI when configuration drift occurs during manual certificate rotations, enabling Golden SAML token forgery.

avatar
Ethan Andrews@eandrews
4 months ago
15