Browse public community intelligence reports, source analysis, and threat research.
Critical unauthenticated remote code execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619) allow attackers to take full control of web servers by exploiting memory corruption in session upload progress and fatal error handling.
1,186 intel reports
TeamPCP executed a supply chain attack on the elementary-data PyPI package using GitHub Actions injection to distribute a credential-stealing payload targeting data engineers.
NVIDIA's NemoClaw sandbox environment is vulnerable to data exfiltration and configuration poisoning via weaponized authorized tools and emoji-based evasion.
BlueNoroff is targeting Web3 and cryptocurrency executives using AI-generated deepfake meetings and ClickFix clipboard injection to deploy credential stealers.
Kernel-level anti-cheat systems utilize deep OS integration and rootkit-like behaviors to counter sophisticated threats including DMA hardware, BYOVD attacks, and hypervisor-based cheats.
Threat actor Dr. Tube uses the Bissa Scanner and AI tools like Claude Code to exploit React2Shell vulnerabilities at scale, targeting financial and crypto sectors for secret harvesting.
Exploits named BlueHammer and RedSun leverage a TOCTOU race condition (CVE-2026-33825) in Windows Defender to achieve SYSTEM-level privilege escalation via filesystem manipulation.
Lotus Wiper is a destructive malware campaign targeting the energy and utilities sector in Venezuela, using batch scripts and masqueraded binaries to wipe physical drives and delete system recovery mechanisms.
The Kyber ransomware group deploys specialized dual-platform payloads targeting VMware ESXi infrastructure and Windows file systems, utilizing hybrid encryption and extensive anti-recovery techniques.
The Gentlemen RaaS employs a multi-platform locker suite targeting Windows, Linux, and ESXi environments, utilizing SystemBC and Cobalt Strike for lateral movement and persistence.
Threat actors compromised the Axios npm package to deliver a multi-platform Remote Access Trojan (RAT) via the malicious dependency 'plain-crypto-js'.
