Threat Intel
Evooo1Bot is another Mirai descendant, and the interesting question isn't what it does (routers, cameras, firewalls turned into DDoS bots and proxies, we've seen the shape before) but whether your edge is exposed and how you'd know. FortiGuard Labs' Yi Ping Lin documented
Threat Intel
The first question with SCTPhantom isn't "should I patch," it's "is SCTP even loaded on this host," because for most servers the answer is no and the whole thing is moot, and for the ones where it's yes, you have
Threat Intel
Three weeks after wp2shell, WordPress has shipped another security release with an RCE-capable headline bug, and the coverage is already blurring the two. Get the distinction straight, because it changes your urgency: CVE-2026-64638 in WordPress 7.0.3 is a pre-authentication reflected XSS on the login
Threat Intel
Meta Description Featured Image Alt Text Here's the operational fact underneath a lot of recent AI-security research, stated plainly: the time between a Linux kernel patch going public and a working exploit existing has dropped from days-of-expert-effort to minutes-of-automation. Academic systems now
Threat Intel
If you run cPanel with tenants you don't fully trust, patch tonight. CVE-2026-58048 lets any authenticated account holder who can use the MySQL/MariaDB feature execute arbitrary SQL in the database root context, crossing the boundary between a hosting account and the server's administrative
Threat Intel
The uncomfortable truth about modern email spoofing is that authentication isn't failing, it's passing, exactly as designed. The dangerous messages arrive with valid SPF, a good DKIM signature, and DMARC alignment, because the attacker owns the domain they're sending from and configured it correctly.
Threat Intel
Two path-traversal bugs in Kubernetes storage drivers were patched this spring, and taken as isolated CVEs they're minor: medium severity, privileged access required, fixed. Taken as a pattern, they're a warning about how modern infrastructure fails. SentinelLabs' Shaul Ben Hai found both, and the
Threat Intel
WordPress shipped 6.9.5 and 7.0.2 on July 17 and enabled forced auto-updates, closing a pre-authentication remote code execution in core. Not a plugin. A default install with zero plugins is exploitable by an anonymous HTTP request, no login, no user interaction, no preconditions. The
Threat Intel
Hours after Microsoft's July 2026 Patch Tuesday shipped fixes for over 600 CVEs, the researcher known as Nightmare Eclipse (also Chaotic Eclipse) dropped another one that wasn't in it. LegacyHive is a local privilege escalation in the Windows User Profile Service (ProfSvc) that works on fully
Threat Intel
Another week, another way for a local user to become root on Linux without ever touching the disk. DirtyClone — tracked as CVE-2026-43503, CVSS 8.8 — is the newest member of the DirtyFrag family, and JFrog Security Research published a working exploit walkthrough on June 25, the first public
Threat Intel
There is a fresh local privilege-escalation bug in the Linux kernel, and it has a nasty property: the attack leaves the file on disk completely untouched. Your integrity checks pass, your file hashes match, and a root shell is already open. Tracked as CVE-2026-46331 and nicknamed "
Threat Intel
curl 8.21.0 shipped on June 24, 2026 with patches for 18 vulnerabilities — the most CVEs ever fixed in a single curl release, bringing the project's lifetime total to 206. One of the flaws had been sitting in the code for over 25 years. For a tool