Threat Intel
Persistence: The Attacker's Real Goal A Linux server gets cleaned up after an intrusion. The suspicious process is terminated. Credentials are rotated. The system is rebooted. Everything seems secure. A few hours later, the same outbound connection appears again. That's persistence. The attacker no longer needs
Threat Intel
A Mail Server Vulnerability With No Workaround The Exim mail server project announced a critical use-after-free vulnerability in its GnuTLS backend. All versions from 4.97 through 4.99.2 are affected. The only fix is upgrading to 4.99.3. What makes this vulnerability particularly dangerous: triggering
Threat Intel
18 Vulnerabilities, One High-Severity: And AI Found Some OpenSSL released patches for 18 vulnerabilities in June 2026. That alone would be significant. But one detail stands out: several were discovered with AI assistance, including the highest-severity flaw. CVE-2026-45447 is a heap user-after-free bug in
Threat Intel
The Threat Changed: Your Workstation Is Your Supply Chain A developer's machine gets compromised. Credentials are stolen—SSH keys, cloud tokens, npm publishing credentials. The attacker uses those stolen tokens to push malicious code to dependencies. The developer's next package update reaches thousands of users, and
Threat Intel
Now Being Exploited: A Three-Year-Old Container Escape A Linux kernel vulnerability that's been public for three years is now being actively exploited in the wild to escape containers and gain root access. CISA added it to their Known Exploited Vulnerabilities (KEV) catalog on June 2, 2026,
Threat Intel
The Attack: Seconds, Not Hours A new denial-of-service technique discovered by Calif security researchers can knock major web servers offline in seconds from a home computer on a 100 Mbps connection. The attack, dubbed HTTP/2 Bomb, chains two old techniques together in a way that nobody had
Threat Intel
A 19-Year-Old Kernel Bug, Found by Machine Learning, Gives Root Asim Manizada found and disclosed a privilege escalation in the Linux kernel's CIFS (SMB file sharing) subsystem called CIFSwitch. The vulnerability chains four normal pieces of Linux infrastructure—keyrings, the cifs.upcall helper, user namespaces, and
Threat Intel
Critical: Any cPanel User Can Become Root LiteSpeed's cPanel plugin has a privilege escalation flaw that's actively being exploited right now. Any cPanel user on your server—including a compromised account—can run arbitrary scripts as root. CVSS 10.0. This isn't theoretical. What
Threat Intel
The Vulnerability: What's Broken Drupal has a database abstraction API that sits between your application code and the database. Its job is to validate queries and prevent SQL injection. Someone found a flaw in that validation layer that allows crafted requests to bypass the sanitization and inject arbitrary
Threat Intel
What's Happening A new privilege escalation vulnerability in the Linux kernel's RxGK module (part of the RxRPC network transport layer) now has a proof-of-concept exploit. The flaw, dubbed DirtyDecrypt (also called DirtyCBC), allows unprivileged attackers to gain root access under specific conditions. The V12
Threat Intel
What's Happening A researcher known as Chaotic Eclipse (also called Nightmare Eclipse) released working exploit code for a Windows privilege escalation flaw that Microsoft supposedly fixed six years ago. The vulnerability, CVE-2020-17103, allows a standard user to spawn a SYSTEM-level command prompt on fully patched
Threat Intel
Incident Summary NGINX CVE-2026-42945, a heap buffer overflow in ngx_http_rewrite_module, is actively exploited in production environments. The flaw (present since 2008) allows unauthenticated remote attackers to crash nginx worker processes or execute code with crafted HTTP requests. Affected: NGINX versions 0.6.27 through 1.