Browse public community intelligence reports, source analysis, and threat research.
3 intel reports
A pre-authentication memory overread vulnerability (CVE-2026-8451) in Citrix NetScaler appliances configured as SAML IdPs allows for information leakage and denial of service.
Threat actors including GOLD ENCOUNTER and campaigns STAC4713/STAC3725 are abusing QEMU virtualization to hide backdoors and deploy PayoutsKing and 3AM ransomware.
Exploitation of CVE-2026-3055 on Citrix NetScaler allows remote attackers to disclose sensitive memory, including administrative session IDs, via malformed WS-Federation requests.
