Browse public community intelligence reports, source analysis, and threat research.
Critical unauthenticated remote code execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619) allow attackers to take full control of web servers by exploiting memory corruption in session upload progress and fatal error handling.
1,186 intel reports
Threat actors manipulate AWS CloudTrail and Google Cloud Logging configurations to blind security teams and maintain persistent visibility within compromised environments.
An OS command injection vulnerability in Ivanti Sentry allows unauthenticated remote attackers to achieve root-level code execution via a specific API endpoint. (CVE-2026-10520)
The Reynolds ransomware group utilizes the NSecKrnl kernel driver to terminate EDR processes and employs double-extortion tactics against enterprise targets.
Threat actors use PowerShell scripts to bypass standard process monitoring, but defenders can leverage the DeviceEvents table in Microsoft Defender XDR to gain visibility into individual command executions.
A likely Iran-nexus activity cluster is deploying BLUERABBIT, a Golang-based backdoor that utilizes RabbitMQ, Redis, and MinIO for C2 and exfiltration prior to disk wiping and ransomware deployment.
Threat actors can abuse the Microsoft WinGet configure command and COM APIs to execute arbitrary PowerShell scripts via YAML files, bypassing standard process monitoring.
Chaotic Eclipse is leveraging zero-day vulnerabilities YellowKey and MiniPlasma to bypass BitLocker and achieve SYSTEM-level privilege escalation on Windows 11 and Server environments.
Microsoft Defender now utilizes Windows Filtering Platform (WFP) integration to monitor inbound remote RPC calls at the OpNum level to detect lateral movement, credential theft, and discovery.
An unknown threat actor is using JavaScript and PowerShell to deliver .NET malware hidden via steganography in MSI-branded JPEG images hosted on legit services.
DirtyFrag is a sophisticated Linux kernel Local Privilege Escalation toolkit that uses page cache corruption and RxRPC/AF_ALG abuse to gain root access.
