Browse public community intelligence reports, source analysis, and threat research.
105 intel reports
Attackers are exploiting a maximum-severity zero-day vulnerability in Cisco Identity Services Engine (ISE) to bypass authentication and gain root-level access.
Threat actors are chaining three JFrog Artifactory vulnerabilities to bypass authentication, escalate privileges to administrator, and deploy Rust-based backdoors.
Settra ransomware targets consumer services and manufacturing sectors using MeshAgent RMM for persistence and Bring Your Own Vulnerable Driver (BYOVD) to disable security tools.
Researcher Asim Manizada released working exploits for four Linux kernel vulnerabilities (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) that enable local root access and potential remote crashes.
The NightEagle APT group (APT-Q-95) is targeting Russian businesses by deploying the GhostContainer backdoor on Microsoft Exchange servers and utilizing legitimate tunneling tools for lateral movement.
Researchers at Forever Security demonstrated 'BragJack', a technique using malicious browser extensions to hijack AI assistants in Chrome, Edge, Comet, Opera Neon, and Claude by manipulating trusted domains and network traffic.
ParaShells (CVE-2026-90894) allows a local non-admin macOS user to gain root access by exploiting a world-writable socket and argument injection in the Parallels Desktop background service.
Threat actors are actively exploiting CVE-2026-5430 in WSO2 API Manager using forged JWT tokens with unsupported signing algorithms to gain administrative access.
Multiple espionage threat actors, including China-aligned TA412, are deploying the BlueMoon exploit kit to chain Chrome V8 RCE and Windows kernel LPE vulnerabilities for malware delivery.
A threat actor designated TH-3BB targeted Thai ISP 3BB and Jasmine International using CVE-2024-21762 for initial access and MeshCentral for persistent command-and-control.
