Research reports
1,224 reports from 387 publishers45 added in the past week
12 reports, newest added first
Added Mon 26 Oct
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
Group-IB Threat Intelligence, together with NyxLab, collaborated on a joint investigation on a campaign involving widespread exploitation of network edge devices. This joint-investigation effort has managed to uncover indications that this may be connected to…
Vulnerabilities
Added Sun 25 Oct
Resources - SecurityScorecard
PHP2Shell Customer Advisory: CVE-2026-109618 and CVE-2026-109619 Remediation Guide SecurityScorecard’s PHP2Shell advisory covers CVE-2026-109618 and CVE-2026-109619: SecurityScorecard patched its affected PHP site on release day and found no exploitation. See…
Vulnerabilities
Added Sat 24 Oct
ARMORY CASTLE Exploits BeyondTrust
Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar)…
Vulnerabilities
Added Sun 18 Oct
skanthak.homepage.t-online.de/sentinel.html
The Vulnerability and Exploit Detector for Microsoft® Windows™ NT SENTINEL.DLL and SENTINEL.EXE . consists of the inde
Vulnerabilities
rapid7.com/db/modules/exploit/linux/local/service_persistence
Capabilities Attack Surface Management Reveal & protect coverage gaps Exposure Management Identify & remediate at-risk data Vulnerability Management Pinpoint & eliminate risk CyberGRC Manage governance, risk & compliance Next-Gen SIEM Investigate with…
Vulnerabilities
🇬🇧 Houken seeking a path by living on the edge with zero-days
Objet : 🇬🇧 Houken seeking a path by living on the edge with zero-days Gestion du document Référence CERTFR-2025-CTI-009 Titre 🇬🇧 Houken seeking a path by living on the edge with zero-days Date de la première version 01 juillet 2025 Date de la dernière…
Vulnerabilities
Added Wed 14 Oct
Beyond source code: The files AI coding agents trust — and attackers exploit
As AI coding agents become deeply embedded in developer workflows, defenders must evolve their definition of malicious files and rethink how to protect against them. Autonomous AI agents operate across integrated development environments (IDEs), editors,…
Vulnerabilities
Infrastructure Research and Hunting: Boiling the Domain Ocean
The Diamond Model of Intrusion Analysis identifies two main nodes as actor assets that may ultimately interact with a target / victim’s own assets — capabilities and infrastructure. But while “exploitation” is usually considered something the adversary does,…
Vulnerabilities
Added Tue 13 Oct
DarkSword/Coruna Open Directory Finding Report
Open directories on five hosts exposed the full DarkSword/Coruna iOS exploit-and-harvest platform, from the C2 delivery server to the per-wallet theft modules. The infrastructure was still in use at triage time. The platform runs a commercial…
Vulnerabilities
Added Sat 10 Oct
JDY Botnet: How IoT and SOHO Devices Are Exploited
Expanded JDY IoT and SOHO botnet enables rapid vulnerability exploitation Published on Jun 10, 2026 | 11 minute read Black Lotus Labs® recently identified a significant resurgence of the JDY botnet, a covert reconnaissance network tied to China-nexus threat…
VulnerabilitiesBotnets and DDoS
Added Wed 7 Oct
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with…
State-sponsoredVulnerabilities
Added Tue 6 Oct
Warlock Ransomware Attackers Hit Water and Telecom Operators
Warlock first came to prominence via the exploitation of a Microsoft SharePoint “ToolShell” exploit chain. Warlock is developed by a China-nexus threat actor Symantec calls Longlegs (aka Storm-2603). Symantec has previously tied this group to older activity…
RansomwareVulnerabilities
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.