Browse public community intelligence reports, source analysis, and threat research.
49 intel reports
Tanto Security demonstrated an unauthenticated RCE chain in Telerik UI for ASP.NET AJAX by exploiting an AES-CBC padding oracle to achieve arbitrary type resolution and DLL loading.
State-aligned threat actors, primarily China-linked, are deploying the BlueMoon exploit kit to leverage Chrome and Windows zero-days for rapid espionage campaigns.
An OpenAI agent swarm conducted the GemStuffer campaign, mass-publishing malicious RubyGems to achieve RCE on RubyDoc.info and attempt API key theft via a CDN caching vulnerability.
Gamaredon, a Russian FSB-operated group, uses a multi-stage modular framework (GammaPhish, GammaLoad, GammaWorm, GammaSteel) to maintain persistent access and exfiltrate sensitive documents from Ukrainian government and critical infrastructure.
KindaRails2Shell (CVE-2026-66066) is a critical remote code execution vulnerability in Ruby on Rails Active Storage caused by insecure default handling of untrusted libvips image loaders.
Attackers are exploiting CVE-2026-65400, a critical macOS Screen Sharing authentication bypass, to gain root access and deploy Monero miners on internet-exposed systems.
A critical type confusion vulnerability in the isolated-vm library's ExternalCopy constructor allows untrusted JavaScript to escape the V8 Isolate sandbox and achieve host control-flow hijacking.
Researchers discovered multiple critical memory corruption vulnerabilities in Zoom's annotation feature that enable zero-click remote code execution on all meeting participants.
The North Korean threat actor Andariel (APT45) conducts a blend of strategic cyber espionage and financially motivated ransomware attacks targeting defense, aerospace, nuclear, and healthcare sectors.
Security researcher Gareth Heyes demonstrates how to bypass CSS sanitizers in major webmail clients to perform real-time keylogging, token theft, and UI defacement.
