Browse public community intelligence reports, source analysis, and threat research.
105 intel reports
The ShieldCrash exploit targets CVE-2026-69414 to achieve arbitrary file read as SYSTEM by bypassing incomplete patches for the ShieldBreak vulnerability in Windows Defender.
KATARU is a newly observed IoT malware family that utilizes Linux local privilege escalation exploits and encrypted C2 to conduct DDoS attacks.
Tanto Security demonstrated an unauthenticated RCE chain in Telerik UI for ASP.NET AJAX by exploiting an AES-CBC padding oracle to achieve arbitrary type resolution and DLL loading.
Security researcher Nightmare Eclipse disclosed a Microsoft Defender zero-day exploit named ShieldBreak that bypasses previous patches to grant SYSTEM privileges.
State-aligned threat actors, primarily China-linked, are deploying the BlueMoon exploit kit to leverage Chrome and Windows zero-days for rapid espionage campaigns.
Researcher 'Chaotic Eclipse' has released FalconFlank, a zero-day exploit abusing CrowdStrike Falcon's Office macro remediation to achieve SYSTEM privileges on Windows.
Exploits targeting Linux kernel interfaces and SUID helpers use copy-on-write bugs and namespace manipulation to achieve root access.
Security researcher Chaotic Eclipse has released multiple proof-of-concept exploits, including FalconFlank and ShieldBreak, targeting CrowdStrike, Kaspersky, and Microsoft Defender to achieve SYSTEM privileges.
A suspected Chinese-speaking operator utilized the SecFlow AI orchestration framework to exploit multiple vulnerabilities and deploy steganographic GLUTTON webshells against government and education targets across Asia.
A Russian-speaking Aurora ransomware affiliate utilizes AI-assisted planning and Active Directory exploits to compromise over twenty organizations globally before deploying a Zig-based encryptor.
