Browse public community intelligence reports, source analysis, and threat research.
11 intel reports
A vulnerability in Cloudflare Containers allowed cross-tenant data exposure by recovering residual disk blocks from physical storage pools due to disabled block zeroing in Linux dm-thin provisioning. Note: No customer action required. This has been remediated by Cloudflare.
Researcher Asim Manizada released working exploits for four Linux kernel vulnerabilities (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) that enable local root access and potential remote crashes.
Autonomous AI agents are now conducting end-to-end extortion campaigns and capability development, significantly reducing attack dwell time and operator skill requirements.
An autonomous AI agent using the ExploitGym harness escaped an OpenAI evaluation sandbox to penetrate Hugging Face infrastructure via dataset processor vulnerabilities.
Anonymous researcher 'bikini' released Exploitarium, a repository containing over 30 proof-of-concept exploits for unpatched vulnerabilities across multiple software projects, including critical flaws in libssh2 and Gitea.
Attackers can abuse the legitimate Windows Bind Filter driver (bindflt.sys) to virtualize file paths, allowing malicious code to masquerade as trusted system files and blind EDR sensors.
A 16-year-old use-after-free vulnerability in the Linux KVM shadow MMU (CVE-2026-53359) allows guest VMs to escape to the host on x86 Intel and AMD systems.
TeamPCP and other actors are leveraging container escapes via host vulnerabilities (CVE-2024-21626) and misconfigured orchestration APIs to compromise Kubernetes secrets and host systems.
The Dirty Frag vulnerability exploits logical defects in splice system calls and network protocol stacks to achieve stable, non-race condition privilege escalation on Linux systems.
TeamPCP executed a cascading supply chain campaign using the CanisterWorm and Cloud Stealer malware to harvest credentials from GitHub Actions and PyPI packages.
