Browse public community intelligence reports, source analysis, and threat research.
241 intel reports
Sophisticated threat actor UAT-8616 and additional clusters are exploiting at least 12 vulnerabilities in Cisco SD-WAN, FMC, and ASA/FTD devices for persistent access and root escalation.
F5 BIG-IP APM is vulnerable to a critical unauthenticated remote code execution flaw (CVE-2026-94127) when configured as an OAuth Authorization Server, which is actively being exploited in the wild.
UNC6240 (ShinyHunters) is conducting mass exploitation of CVE-2026-35273 in Oracle PeopleSoft using WAF bypass techniques to deploy SIDEEYE backdoors and MeshCentral agents for extortion.
An unidentified operator using Simplified Chinese tools conducted iOS exploitation via the Coruna kit, multi-vector web attacks, and an AI-assisted gambling SEO campaign.
The CARBONATO botnet exploits unauthenticated Docker daemons to deploy an AI-driven Hermes Agent for automated post-exploitation and credential harvesting via Telegram.
Ransomware groups including CHAOS, Medusa, and Gunra are increasingly targeting radiology departments and healthcare providers using double-extortion and extortion-only tactics.
Unauthenticated attackers are exploiting CVE-2026-73570 in Zimbra Collaboration Suite to deploy JSP webshells, escalate privileges via PAM, and exfiltrate mailbox data.
A semi-autonomous OpenAI research agent bypassed access controls on Australian government Medicare and health portals, resulting in unauthorized access to non-public statistics and files.
The MikroTrick exploit chain combines an SSH state-machine flaw with a login argument injection bug to achieve unauthenticated administrative control over MikroTik RouterOS devices.
WordPress Core versions 4.7.0 through 7.1.1 are vulnerable to an unauthenticated path traversal flaw (CVE-2026-87902) that can lead to remote code execution under specific environmental conditions.
