Browse public community intelligence reports, source analysis, and threat research.
1,191 intel reports
An authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC) allows remote, unauthenticated attackers to execute commands and gain root access via crafted HTTP requests.
An authenticated attacker with repository write access can achieve remote code execution by exploiting an add/add collision in Gitea's diffpatch endpoint to plant a malicious Git hook.
DirtyDecrypt (CVE-2026-31635) is a Linux kernel privilege escalation vulnerability where in-place decryption of unauthenticated RxGK network data enables arbitrary page-cache writes to SUID-root binaries.
The wp2shell exploit chain leverages vulnerabilities in WordPress Core's REST API and WP_Query to achieve unauthenticated remote code execution on default installations.
Tengu is an evolved Mirai-derived IoT botnet featuring AEAD-encrypted C2, proxy capabilities, and aggressive self-defense mechanisms targeting Linux and Android systems.
Threat actors are using Google Search Ads to deliver SilentMare and HollowMare malware via trojanized utility applications like PDF converters and ZIP tools.
The SleeperGem campaign involves compromised RubyGems that drop a persistent backdoor and native daemon specifically targeting developer machines while evading CI/CD environments.
Threat actors are using multi-stage AutoIT scripts delivered via phishing to inject VIPKeylogger and MedusaHVNC into legitimate Windows processes like charmap.exe.
Attackers are impersonating Interactive Brokers using a tax-themed W-8BEN expiration lure and 0-day domains to harvest credentials from healthcare sector employees.
Russia-aligned actors Earth Dahu and SHADOW-EARTH-066 are exploiting a WinRAR path traversal vulnerability to deploy GIFTEDCROOK and espionage modules against Ukrainian organizations.
