Browse public community intelligence reports, source analysis, and threat research.
76 intel reports
Unauthenticated remote code execution vulnerabilities in Citrix NetScaler ADC and Gateway are being actively exploited in the wild to deploy webshells and steal credentials.
A suspected China-nexus actor utilized an AI-assisted custom PHP2Shell exploit chain and Fragnesia kernel LPE to root 25 servers, including U.S. government-affiliated systems.
Critical unauthenticated remote code execution vulnerabilities in the PHP engine, dubbed PHP2Shell, are being exploited in the wild to deploy webshells.
An unknown threat actor is infecting Magento e-commerce stores with scanner-evading JavaScript loaders via malicious CMS blocks to target shoppers.
The suspected PRC-nexus actor ARMORY CASTLE exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to deploy custom SAWFLY webshells and BARECLAW tunnelers for credential theft and lateral movement.
Chinese-speaking and English-speaking threat actors are using the Cairn AI penetration testing tool to automate vulnerability discovery and web shell deployment against global e-commerce and retail targets.
Threat actor CL-UNK-1211 and other groups are leveraging AI agents and LLM-generated code to discover zero-days and orchestrate rapid exploitation campaigns against Linux infrastructure.
Unauthenticated attackers are exploiting CVE-2026-88771 in NetScaler ADC and Gateway appliances using a multi-stage log-poisoning technique to achieve remote code execution and deploy web shells.
Adversaries are actively exploiting multiple zero-day vulnerabilities in Citrix NetScaler ADC and Gateway to deploy persistence mechanisms including PHP-based webshells and remote management tools.
Chinese state-backed actors including Linen Typhoon and Violet Typhoon are exploiting CVE-2025-53770 in Microsoft SharePoint to achieve unauthenticated remote code execution and data theft.
