Ethan Andrews

The researcher Nightmare Eclipse (aka MSNightmare) has released multiple proof-of-concept exploits targeting Windows Defender, Kaspersky, Avast, CrowdStrike, and NVIDIA drivers to achieve local privilege escalation or denial-of-service.

Suspected Silver Fox (Yinhu) threat actors are targeting Chinese-speaking users and multinational operations in China using high-fidelity spoofed vendor sites to deliver persistent implants like ValleyRAT.

The Exilware threat group uses the AI-driven BraZetsu Python framework to compromise Windows hosts and monetize access via the 'Infect Marketplace.'

U-Sec researchers discovered a vulnerability (WVE-2026-007) in Log4j where MarshalledObject allows attackers to bypass FilteredObjectInputStream (FOIS) allowlists during LogEvent deserialization.

KindaRails2Shell (CVE-2026-66066) is a critical remote code execution vulnerability in Ruby on Rails Active Storage caused by insecure default handling of untrusted libvips image loaders.

Attackers can achieve full Active Directory domain takeover in under one hour using legitimate protocols like Kerberos and SMB without deploying malware.

Unauthenticated attackers are actively exploiting a SQL injection vulnerability (CVE-2026-9586) in Sangoma Switchvox's /pa endpoint to achieve remote code execution and deploy reverse shells.

Auto-Color is a Linux backdoor that uses a double-forking mechanism and an LD_PRELOAD-based rootkit (libcext.so.2) to hide files and network activity while communicating with a C2 server at 146.70.41.178.

An unauthenticated second-order SQL injection vulnerability in the All-in-One WP Migration and Backup plugin (CVE-2026-19949) enables remote code execution through malicious WordPress trackbacks and archive restoration.

A suspected Chinese-speaking threat actor exploited vulnerabilities in ownCloud and WordPress to exfiltrate nuclear research records and naval contractor data in the Philippines.