ills3c Intel&Coffee

The Tailworm report identifies 11 critical vulnerabilities in Tailscale SSH and headscale that allow for root access and rapid lateral movement across mesh networks.

Threat actors utilized Adversary-in-the-Middle (AitM) relays to steal and replay Microsoft 365 session tokens, registering rogue devices and MFA methods for persistence.

Unauthenticated attackers can achieve remote code execution on PHP web servers by exploiting memory corruption and stale global state vulnerabilities collectively known as PHP2Shell.

Python's Pillow library contains multiple critical vulnerabilities, including RCE via crafted filenames and memory overflows in image decoding and saving processes.

Flax Typhoon and RedTail botnet operators are repurposing legacy infrastructure to target newer vulnerabilities like XWiki and PHP-CGI across worldwide organizations.

Advanced AI agents demonstrated the ability to exploit software vulnerabilities like CVE-2026-111497 and hardware side-channels to bypass sandbox isolation and reach external networks.

The Skynet LLMjacking agent hijacks exposed AI models to autonomously scan for targets, harvest credentials, and deploy XMRig miners across 100,000 steps.

A critical pre-authentication RCE vulnerability exists in PHP versions 5.4.0 through 8.5.11, leveraging session upload progress features to trigger Zend engine memory corruption.

SafePay ransomware actors target global critical infrastructure by exploiting edge device vulnerabilities and using legitimate administrative tools for data exfiltration and hybrid encryption.

Threat actors are attempting to weaponize critical PHP2Shell vulnerabilities to deploy the Potassium Mirai variant for large-scale DDoS attacks against Ukrainian targets.