Browse public community intelligence reports, source analysis, and threat research.
241 intel reports
An unidentified threat actor is using the VAPT offensive framework to hijack misconfigured Ollama AI servers for automated vulnerability scanning, exploit generation, and credential theft.
An attacker compromised the CDN API keys of OptinMonster, TrustPulse, and PushEngage to serve tampered JavaScript that creates rogue admin accounts on customer sites.
Authenticated attackers can exploit a path traversal vulnerability in SharePoint's Upload.aspx to upload ASPX webshells and achieve remote code execution.
A critical pre-authentication vulnerability in Splunk's PostgreSQL Sidecar Service allows unauthenticated attackers to achieve remote code execution through chained exploitation of path traversal and unsafe database parameters.
A chain of three vulnerabilities in the LiteLLM AI gateway allows low-privilege users to bypass authorization, escalate to administrative privileges, and execute arbitrary code on the host server.
The Gentlemen ransomware, operated by the Phantom Mantis group (LARVA-368), has evolved from a RaaS affiliate into an independent operation featuring AI-assisted development and a self-propagating worm module.
OceanLotus (APT32) is leveraging SPECTRALVIPER in targeted supply-chain attacks against Vietnamese stock investors and infrastructure corporations to support domestic surveillance.
UNC6240 (ShinyHunters) exploited CVE-2026-35273 as a zero-day to target Oracle PeopleSoft infrastructure, primarily in the higher education sector, for data exfiltration and extortion.
ServiceNow instances running the Australia release or specific legacy configurations were vulnerable to unauthorized data queries via an unauthenticated REST API endpoint.
An OS command injection vulnerability in Ivanti Sentry allows unauthenticated remote attackers to achieve root-level code execution via a specific API endpoint. (CVE-2026-10520)
