Browse public community intelligence reports, source analysis, and threat research.
241 intel reports
The wp2shell exploit chain leverages vulnerabilities in WordPress Core's REST API and WP_Query to achieve unauthenticated remote code execution on default installations.
The Qilin (aka Agenda) ransomware group is exploiting a critical Palo Alto Networks authentication bypass vulnerability (CVE-2026-0257) to gain initial access and deploy ransomware via credential-driven lateral movement.
A maximum-severity RCE vulnerability in the Ruflo AI agent platform allows unauthenticated attackers to execute commands and poison agent memory.
Attackers are chaining a REST API batch-route confusion vulnerability (CVE-2026-63030) and a SQL injection (CVE-2026-60137) to achieve unauthenticated remote code execution on WordPress Core.
APT28 (Fancy Bear) is conducting a global campaign named FrostArmada, hijacking SOHO router DNS settings to facilitate adversary-in-the-middle attacks targeting Microsoft 365 credentials.
An autonomous AI agent framework, suspected to be an OpenAI benchmark model, compromised Hugging Face infrastructure using RCE vulnerabilities in dataset processing pipelines.
The JadeProx cluster, a China-nexus threat group, is using a custom 'TriBack Loader' to deliver AdaptixC2 and Beagle backdoors via DLL sideloading against targets in Southeast Asia and Latin America.
The Clop ransomware gang is actively exploiting CVE-2026-12569 in PTC Windchill and FlexPLM systems to deploy JSP webshells and exfiltrate sensitive product data.
Unauthenticated attackers can achieve remote code execution in ServiceNow AI Platform by escaping a script sandbox through a pre-authentication endpoint and gadget chain.
The Russia-aligned actor TA458 uses half-click XSS zero-day exploits against SOGo, Zimbra, and Roundcube webmail to deploy SpyPress malware and steal sensitive government data.
