Tim Peck

A critical heap buffer overflow vulnerability (CVE-2026-42945) in the NGINX rewrite module allows unauthenticated remote attackers to trigger denial of service or code execution via crafted HTTP requests.

The IRGC-affiliated Cyber Isnaad Front (ASA) is conducting destructive wiper and OT sabotage operations against Israeli critical infrastructure sectors.

Financially motivated actors are using SEO poisoning to impersonate AI tools like Gemini and Claude Code, delivering a fileless PowerShell infostealer to developer workstations.

The threat actor JINX-0164 targets cryptocurrency industry developers using sophisticated macOS-specific malware, CI/CD compromise, and social engineering to steal digital assets and credentials.

Adversaries are exploiting a critical unauthenticated spoofing vulnerability (CVE-2026-42897) in Microsoft Exchange Server to execute arbitrary JavaScript within OWA browser contexts.

The Mini Shai-Hulud worm was deployed via compromised @antv npm packages to exfiltrate developer secrets and propagate to other repositories.

SilverFox APT is targeting users with fake Microsoft Teams download sites to deliver ValleyRAT through a multi-stage DLL sideloading chain and in-memory execution.

Threat actor UNG0002 is targeting Chinese universities using spear-phishing lures related to national fitness standards to deliver Cobalt Strike via DLL side-loading.

The TAX#TRIDENT campaign utilizes fake Indian income tax assessment lures to deliver YTSCRat or unauthorized ManageEngine UEMS agents through various VBScript and ZIP-based infection paths.

SHADOW-WATER-063 uses the polymorphic Banana RAT banking trojan to target Brazilian financial institutions via fileless execution and social engineering.