Tim Peck

An unprivileged FreeBSD user can achieve local root access by exploiting a page-cache corruption vulnerability via kTLS-RX and the sendfile(2) system call.

A campaign using Amazon-themed phishing and ClickFix social engineering to deliver the HarborWatch Agent RAT, managed via the Harbor Sentinel Chinese-language admin panel.

Play Ransomware Group's custom Grixba infostealer has evolved from a monolithic tool to a modular, evasive scanner frequently deployed by DPRK-linked initial access brokers.

Threat actors can leverage WSL2's virtualized environment to download and stage payloads on Windows while remaining invisible to host-based network and process-attribution telemetry.

The Miasma threat actor group has expanded its supply chain campaign with 23 new malicious PyPI packages targeting bioinformatics and AI developers through trojanized native extensions and split-payload loaders.

A vulnerability in Hugging Face Transformers allows attackers to execute arbitrary Python code via crafted config.json files in model repositories, bypassing the trust_remote_code protection.

An unauthenticated attacker can chain a gateway bypass with command injection to achieve root privileges on Ubiquiti UniFi OS Server appliances.

The Miasma threat actor is deploying a self-spreading npm worm that utilizes a 'Phantom Gyp' technique to execute code during installation, targeting cloud credentials and AI coding assistants.

Lazarus, Turla, and other advanced actors utilize kernel-level ETW tampering, including DKOM and hardware breakpoints, to blind EDR and anti-cheat telemetry on Windows 11.

Russia's FSB-operated Gamaredon group leverages a modular VBScript and PowerShell arsenal targeting Ukraine through advanced persistence and multi-stage loading techniques.