Tim Peck

Rapidly deployed AI-built educational applications are collecting sensitive student data, including PII and biometric inputs, often without basic security configurations or privacy policies.

A China-nexus threat actor is actively exploiting a critical path traversal flaw in VMware vCenter (CVE-2026-59310) to deploy the linuxFile backdoor and Babuk-derived ransomware across hypervisors.

The Dntry loader utilizes the Linux kernel keyring subsystem to store ELF payloads in slab memory, executing them via anonymous memory mappings to bypass traditional filesystem-based detection.

Unidentified threat actors are exploiting a critical authentication bypass in UpdraftPlus to deliver PHP backdoors disguised as legitimate plugins.

Kimsuky leverages AI agents like opencode and HeadlessChrome to mass-produce decoy documents while evolving its GitHub-based LNK execution framework with enhanced evasion and persistence.

A Chinese-speaking operator utilized rogue Redis replication and multi-protocol exploit toolkits to compromise 3,562 servers for XMRig cryptomining across Asia and Europe.

StyleSmuggler is an unauthenticated remote code execution vulnerability (CVE-2026-75650) in Adobe Commerce and Magento exploited to deploy persistent implants and web shells.

Russian-linked threat actor UAT-10820 utilizes ClearFake infection chains and WebDAV-hosted DLLs to deploy Amatera stealer and follow-on payloads like ZigCryptoStealer and NetSupport Manager.

Threat actors are exploiting ScreenConnect to deploy a four-stage VBScript chain that propagates across active remote sessions, ultimately delivering miners and backdoors.

APT28 and MuddyWater utilize ClickFix variants to compromise organizations via social engineering, deploying multi-stage payloads including steganography and Python-based reverse tunnels for internal network pivoting.