Browse public community intelligence reports, source analysis, and threat research.
Critical unauthenticated remote code execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619) allow attackers to take full control of web servers by exploiting memory corruption in session upload progress and fatal error handling.
1,186 intel reports
The suspected Chinese threat actor TA4922 is expanding globally, utilizing new loaders like RomulusLoader and SilentRunLoader alongside Atlas RAT to target organizations in Asia and Europe.
The Chinese threat actor VerdantBamboo is targeting unmonitored edge appliances such as firewalls and NAS devices to maintain persistence and bypass EDR security controls.
RemusStealer and the SessionGate framework are distributed through a complex ecosystem of impersonation websites and gated Traffic Distribution Systems (TDS) targeting technical users.
The BoldTealLayer campaign utilizes a sophisticated Lua-driven loader to execute fileless .NET payloads by bypassing AMSI and disabling ETW monitoring.
A heap buffer overflow in 7-Zip (CVE-2026-48095) allows remote code execution via a crafted NTFS image that triggers undefined behavior during decompression buffer allocation.
The Yuta/Solara campaign distributes a Python-based port of Glove Stealer targeting Roblox users and developers with advanced Chrome App-Bound Encryption bypasses.
IRGC-affiliated actor Nimbus Manticore deployed the new MiniFast backdoor using AppDomain hijacking and SEO poisoning to target both aviation and software sectors during geopolitical conflict.
DesckVB RAT operators utilize a multi-stage infection chain starting with malspam and legitimate domain redirection to deploy an in-memory .NET Trojan.
The CL-CRI-1089 threat actor is conducting malvertising campaigns targeting macOS users to deploy FlutterShell, a Flutter-based backdoor that facilitates browser hijacking and arbitrary command execution.
The Iran-nexus group Screening Serpens is targeting technology, aerospace, and defense professionals in the US, Israel, and UAE using advanced AppDomainManager hijacking and new RAT variants.
