Ethan Andrews

China-nexus threat actors are targeting Myanmar government personnel using a VHD-delivered Golang backdoor named QUICAgent that utilizes QUIC protocol for C2 communication.

Researchers discovered multiple critical memory corruption vulnerabilities in Zoom's annotation feature that enable zero-click remote code execution on all meeting participants.

A critical type confusion vulnerability in the isolated-vm library's ExternalCopy constructor allows untrusted JavaScript to escape the V8 Isolate sandbox and achieve host control-flow hijacking.

Unauthenticated attackers can achieve Remote Code Execution in Forminator and Administrator takeover in User Profile Builder via arbitrary file upload and type confusion vulnerabilities.

The Evooo1Bot and GorillaBot threat actors are deploying highly modular Mirai-based malware targeting Linux systems and IoT devices to execute large-scale DDoS attacks and establish persistent proxy relays.

An attacker targeted hardware wallet users using a typosquatted Ledger domain laundered through an Australian venue's authenticated transactional email infrastructure.

An exploit chain leveraging a Unisoc modem RCE via VoLTE SIP messages achieves full Android kernel access by exploiting improper SoC resource isolation (CWE-1189).

An unidentified APT actor is exploiting a critical directory traversal vulnerability in VMware vCenter (CVE-2026-59310) to deploy reverse SSH tools for persistent network access.

Unidentified threat actors are exploiting a critical macOS Screen Sharing authentication bypass (CVE-2026-65400) to gain root access and deploy Monero miners.

Gray-market services like Poison Claude and Ecomagent exploit cloud promotional credits and synthetic identities to resell discounted, proxied access to frontier AI models.