Browse public community intelligence reports, source analysis, and threat research.
81 intel reports
A suspected Russian-speaking actor used an AI-assisted toolkit (PentAGI) to exploit PaperCut vulnerabilities (CVE-2026-81578, CVE-2026-82078) and maintain persistence access across 45+ countries.
Adversaries are actively exploiting CVE-2026-109618 (PHP2Shell) to achieve remote code execution on Apache/PHP servers by bypassing ASLR through a four-stage multipart request chain.
DPRK-linked actors are utilizing ErrTraffic ClickFix lures on compromised WordPress sites alongside fake recruiter personas to deliver Node.js-based RATs with Polygon-hosted C2 resolvers.
Flax Typhoon and RedTail botnet operators are repurposing legacy infrastructure to target newer vulnerabilities like XWiki and PHP-CGI across worldwide organizations.
Critical unauthenticated remote code execution vulnerabilities in the PHP engine, dubbed PHP2Shell, are being exploited in the wild to deploy webshells.
Threat actor CL-UNK-1211 and other groups are leveraging AI agents and LLM-generated code to discover zero-days and orchestrate rapid exploitation campaigns against Linux infrastructure.
The CodeAIAssistant malicious VS Code extension abuses Model Context Protocol (MCP) install prompts and direct Node.js child_process spawning to execute arbitrary commands.
Unauthenticated attackers are exploiting CVE-2026-88771 in NetScaler ADC and Gateway appliances using a multi-stage log-poisoning technique to achieve remote code execution and deploy web shells.
Adversaries are actively exploiting multiple zero-day vulnerabilities in Citrix NetScaler ADC and Gateway to deploy persistence mechanisms including PHP-based webshells and remote management tools.
Adversary c05d5254 uses the PoisonedRefresh rootkit to inject fileless PHP web shells into F5 BIG-IP APM memory via CVE-2025-53521 exploitation.
