Browse public community intelligence reports, source analysis, and threat research.
Critical unauthenticated remote code execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619) allow attackers to take full control of web servers by exploiting memory corruption in session upload progress and fatal error handling.
1,186 intel reports
Threat actors including GOLD ENCOUNTER and campaigns STAC4713/STAC3725 are abusing QEMU virtualization to hide backdoors and deploy PayoutsKing and 3AM ransomware.
Storm-2755 uses AiTM techniques and SEO poisoning to hijack user sessions and divert payroll payments within Canadian organizations.
North Korean state actor Sapphire Sleet targets cryptocurrency and finance sectors using social engineering and multi-stage AppleScript-based infection chains on macOS.
The PowMix botnet targets Czech organizations using compliance-themed phishing lures and sophisticated PowerShell-based in-memory execution.
A coordinated campaign of 36 malicious npm packages disguised as Strapi CMS plugins targets Guardarian cryptocurrency infrastructure to execute Redis RCE, steal database secrets, and establish persistent C2.
A coordinated campaign involving 108 malicious Chrome extensions uses shared C2 infrastructure to exfiltrate Telegram sessions, steal Google account identity, and maintain backdoors for remote URL injection.
Threat actors are exploiting a zero-day vulnerability in Adobe Reader via malicious PDF files to execute privileged APIs and steal sensitive data, specifically targeting the Russian oil and gas sector.
Threat actors are increasingly abusing native Microsoft 365 mailbox rules to maintain persistence, suppress security alerts, and automate data exfiltration following account compromise.
JanelaRAT is an evolving variant of BX RAT targeting financial and cryptocurrency institutions in Latin America through DLL side-loading and sophisticated overlay attacks.
The BlueHammer exploit chains NTFS junctions, batch oplocks, and the Cloud Files API to force Windows Defender into leaking SAM hive hashes, granting attackers SYSTEM-level access.
