Tim Peck

The Dirty Frag vulnerability exploits logical defects in splice system calls and network protocol stacks to achieve stable, non-race condition privilege escalation on Linux systems.

Threat actor SheldIO is deploying Amatera Stealer 4.0.2 via the EVALUSION campaign, featuring advanced evasion techniques and significantly expanded targeting for cryptocurrency wallets and messaging apps.

The Belarus-aligned actor FrostyNeighbor is targeting Ukrainian governmental organizations using updated PicassoLoader variants and victim-validated delivery chains.

GhostLock leverages standard Windows API calls to acquire exclusive handles on SMB shares, causing ransomware-like availability denial without encryption or file modifications.

Six vulnerabilities in dnsmasq, including two critical heap overflows, enable remote code execution and denial-of-service across diverse Linux-based environments.

The KongTuke group is leveraging Microsoft Teams social engineering to deploy ModeloRAT, escalate privileges via CVE-2023-36036, and harvest domain credentials using fake Windows lock screens.

Spanish and Portuguese speaking threat actors are utilizing agentic AI to automate full-chain intrusions against government and financial sectors in Latin America.

Kimsuky (APT43) is utilizing updated PebbleDash and AppleSeed malware variants, alongside legitimate tools like VSCode and DWAgent, to target South Korean defense and government entities.

Likely state-sponsored actor CL-STA-1132 is exploiting a zero-day buffer overflow (CVE-2026-0300) in PAN-OS Captive Portal to achieve root-level remote code execution.

Gamaredon (UAC-0010) is utilizing spearphishing emails and the CVE-2025-8088 WinRAR vulnerability to deploy GammaDrop and GammaLoad malware against Ukrainian state institutions.