ills3c Intel&Coffee

A suspected Russian-speaking actor used an AI-assisted toolkit (PentAGI) to exploit PaperCut vulnerabilities (CVE-2026-81578, CVE-2026-82078) and maintain persistence access across 45+ countries.

Private keys for eight eMudhra intermediate CAs were compromised due to flawed key generation, allowing attackers to impersonate websites and services for clients not enforcing Certificate Transparency.

GitLab has released urgent patches for a critical CVSS 10.0 integer overflow vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that allows for remote code execution.

Adversaries are actively exploiting CVE-2026-109618 (PHP2Shell) to achieve remote code execution on Apache/PHP servers by bypassing ASLR through a four-stage multipart request chain.

Suspected Lazarus Group operators are utilizing agentic AI for post-exploitation after compromising global PHP infrastructure via PHP2Shell vulnerabilities.

An unauthenticated attacker can bypass authentication on Cisco SD-WAN vManage devices by utilizing URL-encoded paths and internal usernames to obtain admin-level sessions.

China-aligned threat actor Storm-0940 deployed an agentic AI framework named ARTEX to perform reconnaissance, massive password spraying, and OAuth abuse targeting ConnectWise Cloud Backup and M365 tenants.

Researchers have demonstrated Node2Shell, a remote code execution (RCE) exploit targeting the bundled Brotli decoder in Node.js official builds via crafted compressed data.

A suspected China-nexus actor utilized an AI-assisted custom PHP2Shell exploit chain and Fragnesia kernel LPE to root 25 servers, including U.S. government-affiliated systems.

Critical memory corruption vulnerabilities in the Onigmo regex engine allow remote code execution in Ruby applications, including GitLab, when compiling untrusted regex patterns.