Research reports
1,224 reports from 387 publishers45 added in the past week
77 reports, newest added first
Added Mon 26 Oct
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
Group-IB Threat Intelligence, together with NyxLab, collaborated on a joint investigation on a campaign involving widespread exploitation of network edge devices. This joint-investigation effort has managed to uncover indications that this may be connected to…
Vulnerabilities
Added Sun 25 Oct
Resources - SecurityScorecard
PHP2Shell Customer Advisory: CVE-2026-109618 and CVE-2026-109619 Remediation Guide SecurityScorecard’s PHP2Shell advisory covers CVE-2026-109618 and CVE-2026-109619: SecurityScorecard patched its affected PHP site on release day and found no exploitation. See…
Vulnerabilities
Added Sat 24 Oct
ARMORY CASTLE Exploits BeyondTrust
Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar)…
Vulnerabilities
Added Sun 18 Oct
skanthak.homepage.t-online.de/sentinel.html
The Vulnerability and Exploit Detector for Microsoft® Windows™ NT SENTINEL.DLL and SENTINEL.EXE . consists of the inde
Vulnerabilities
rapid7.com/db/modules/exploit/linux/local/service_persistence
Capabilities Attack Surface Management Reveal & protect coverage gaps Exposure Management Identify & remediate at-risk data Vulnerability Management Pinpoint & eliminate risk CyberGRC Manage governance, risk & compliance Next-Gen SIEM Investigate with…
Vulnerabilities
🇬🇧 Houken seeking a path by living on the edge with zero-days
Objet : 🇬🇧 Houken seeking a path by living on the edge with zero-days Gestion du document Référence CERTFR-2025-CTI-009 Titre 🇬🇧 Houken seeking a path by living on the edge with zero-days Date de la première version 01 juillet 2025 Date de la dernière…
Vulnerabilities
Added Wed 14 Oct
Beyond source code: The files AI coding agents trust — and attackers exploit
As AI coding agents become deeply embedded in developer workflows, defenders must evolve their definition of malicious files and rethink how to protect against them. Autonomous AI agents operate across integrated development environments (IDEs), editors,…
Vulnerabilities
Infrastructure Research and Hunting: Boiling the Domain Ocean
The Diamond Model of Intrusion Analysis identifies two main nodes as actor assets that may ultimately interact with a target / victim’s own assets — capabilities and infrastructure. But while “exploitation” is usually considered something the adversary does,…
Vulnerabilities
Added Tue 13 Oct
DarkSword/Coruna Open Directory Finding Report
Open directories on five hosts exposed the full DarkSword/Coruna iOS exploit-and-harvest platform, from the C2 delivery server to the per-wallet theft modules. The infrastructure was still in use at triage time. The platform runs a commercial…
Vulnerabilities
Added Sat 10 Oct
JDY Botnet: How IoT and SOHO Devices Are Exploited
Expanded JDY IoT and SOHO botnet enables rapid vulnerability exploitation Published on Jun 10, 2026 | 11 minute read Black Lotus Labs® recently identified a significant resurgence of the JDY botnet, a covert reconnaissance network tied to China-nexus threat…
VulnerabilitiesBotnets and DDoS
Added Wed 7 Oct
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with…
State-sponsoredVulnerabilities
Added Tue 6 Oct
Warlock Ransomware Attackers Hit Water and Telecom Operators
Warlock first came to prominence via the exploitation of a Microsoft SharePoint “ToolShell” exploit chain. Warlock is developed by a China-nexus threat actor Symantec calls Longlegs (aka Storm-2603). Symantec has previously tied this group to older activity…
RansomwareVulnerabilities
Added Sat 26 Sep
Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit
Acronis Threat Research Unit (TRU) uncovered a multinational campaign in which a Chinese-speaking threat actor, tracked as Red Heron, rapidly weaponized CVE-2026-60004 to compromise internet-facing instances of Gitea, a self-hosted source-code management…
MalwareVulnerabilities
Added Fri 25 Sep
Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack
Check Point Research is tracking a long‑running campaign called Operation Dream Job, targeting organizations worldwide, with a particular focus on the defense sector. The campaign is affiliated to DPRK-linked Lazarus group and its latest wave focuses on the…
Vulnerabilities
Added Wed 23 Sep
public-research/datasurge/report.md at main · deepfield/public-research
Most Mirai forks spread first and ask questions later. They brute-force telnet, chain CVEs, scan port ranges, and race to claim as many devices as possible before the next reboot clears them from memory. Datasurge does not. It has no propagation scanner, no…
Vulnerabilities
Added Fri 7 Aug
Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit
By By Greg Lesnewich, Stuart Del Caliz, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team July 29, 2026 By Greg Lesnewich, Stuart Del Caliz, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and…
Vulnerabilities
Added Thu 6 Aug
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. The activity was observed between May 27, 2026, and…
Vulnerabilities
Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access
Since our February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has continued to track a maturing transition from nascent AI-enabled operations to the industrial-scale application of generative models within adversarial…
Vulnerabilities
Added Tue 28 Jul
JadePuffer Becomes the First Ransomware Campaign to Let an AI Agent Run the Entire Attack
No excerpt available.
RansomwareVulnerabilities
Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation
In early July 2026, Volexity was engaged to perform an incident response investigation where it discovered a threat actor had successfully compromised SonicWall Secure Mobile Access (SMA) VPN appliances through a chain of multiple zero-day exploits in the…
VulnerabilitiesMobile
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.