Browse public community intelligence reports, source analysis, and threat research.
241 intel reports
BREEZE COMET targets Brazilian financial services and payment systems like Pix using a custom multi-language malware suite and AI-accelerated tradecraft.
A 12-year-old critical flaw in PostgreSQL's logical decoding allows low-privileged replication accounts to execute arbitrary code and achieve full superuser persistence.
An unauthenticated attacker can achieve root Remote Code Execution on SonicWall GMS by chaining multiple patch bypasses for legacy vulnerabilities.
An unauthenticated second-order SQL injection vulnerability in the All-in-One WP Migration and Backup plugin (CVE-2026-19949) enables remote code execution through malicious WordPress trackbacks and archive restoration.
A suspected Chinese-speaking threat actor exploited vulnerabilities in ownCloud and WordPress to exfiltrate nuclear research records and naval contractor data in the Philippines.
Certighost (CVE-2026-54121) is a critical improper authorization vulnerability in AD CS allowing low-privileged users to impersonate Domain Controllers by abusing unverified directory referrals.
ToxNetV2 is an AArch64 Linux P2P botnet that integrates NVIDIA NIM LLM services into its controller's decision-making loop to propose operational actions.
Attackers are exploiting CVE-2026-65400, a critical macOS Screen Sharing authentication bypass, to gain root access and deploy Monero miners on internet-exposed systems.
Chinese-speaking threat actor UAT-10147 leverages agentic AI frameworks like PentestGPT and DeepAudit to automate reconnaissance and exploit validation against Windows and Linux web servers.
Unauthenticated attackers are chaining signature algorithm confusion and OpenSSL error handling vulnerabilities to bypass authentication and gain administrator access on WordPress sites using the miniOrange SAML SSO plugin.
