Browse public community intelligence reports, source analysis, and threat research.
Critical unauthenticated remote code execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619) allow attackers to take full control of web servers by exploiting memory corruption in session upload progress and fatal error handling.
1,186 intel reports
The threat actor UAT-10362 is targeting Taiwanese NGOs and universities with a modular Lua-based stager called LucidRook and a reconnaissance tool named LucidKnight.
Threat actors including Slow Pisces and TeamPCP are increasingly exploiting Kubernetes vulnerabilities and misconfigured RBAC to escalate privileges and compromise cloud environments.
The threat actor UAT-10608 is leveraging the React2Shell (CVE-2025-55182) vulnerability to deploy an automated framework that harvests credentials, SSH keys, and cloud tokens from Next.js applications.
SERPENTINE#CLOUD has updated its delivery chain using ClickFix lures and Cloudflare tunnels to deploy a multi-RAT suite including Brute Ratel C4 and PureHVNC.
Threat actor TeamPCP compromised the LiteLLM AI proxy via a cascading supply chain attack originating from malicious GitHub Actions in the Trivy vulnerability scanner.
Lazarus Group utilizes a macOS 1st-stage loader named unioncryptoupdater to execute 2nd-stage payloads directly from memory using repurposed open-source code.
A Chinese-speaking threat actor uses VoidLink, a modular AI-assisted framework, to deploy hybrid LKM/eBPF rootkits for kernel-level stealth and ICMP-based C2 on Linux systems.
DPRK-linked threat actors are targeting South Korean organizations using LNK files that execute multi-stage PowerShell scripts and abuse GitHub as a command-and-control infrastructure.
North Korean actor Sapphire Sleet compromised the popular Axios npm package to deliver platform-specific RATs via a malicious dependency named plain-crypto-js.
The FAUX#ELEVATE campaign uses heavily obfuscated VBScript lures targeting French corporate environments to deploy a multi-stage toolkit including XMRig miners and browser credential stealers.
