Browse public community intelligence reports, source analysis, and threat research.
Critical unauthenticated remote code execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619) allow attackers to take full control of web servers by exploiting memory corruption in session upload progress and fatal error handling.
1,186 intel reports
The CrystalX RAT is a sophisticated Malware-as-a-Service platform written in Go that combines traditional spyware, credential theft, and unique 'prankware' capabilities to target users globally.
The Russia-aligned actor Pawn Storm (APT28) is deploying the PRISMEX malware suite via zero-day exploits and advanced steganography to target the Ukrainian defense supply chain and NATO logistics hubs.
The Kimsuky threat group is distributing complex Python-based backdoors and downloaders via multi-stage LNK files using scheduled tasks for persistence.
Attackers can chain an authentication bypass (CVE-2026-2699) with a file upload vulnerability (CVE-2026-2701) to achieve remote code execution on Progress ShareFile Storage Zone Controllers.
Atomic Stealer (AMOS) leverages a new macOS persistence mechanism, anti-VM evasion, and trojanized hardware wallet applications to exfiltrate sensitive data and crypto credentials.
A Russian-origin .NET remote access toolkit named CTRL uses weaponized LNK files to deploy modular payloads for credential theft, RDP session hijacking, and FRP-based reverse tunneling.
Analysis of active exploitation targeting a new critical WebLogic RCE (CVE-2026-21962) alongside persistent legacy vulnerabilities like CVE-2020-14882.
Aura Stealer is a sophisticated C++ info-stealer utilizing five obfuscation layers and Heaven's Gate techniques to target Chromium browsers and crypto wallets.
North Korean-linked EtherRAT utilizes 'EtherHiding' via Ethereum smart contracts to manage resilient C2 infrastructure for host fingerprinting and asset theft.
A vulnerability chain in Azure Arc for Windows allows low-privileged users to hijack service communications, escalate to SYSTEM and take over the machine's Azure cloud identity.
