Section
Research
Threat intelligence and technical research from vendor labs, coordination centers and independent researchers.
97 matching records, 5 with confirmed exploitation.
-
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
Overview On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497 , an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x , 24.x , and 22.x…
-
php2shell one week later: Why one exploit doesn’t work everywhere
php2shell raised fears of mass exploitation. A week of testing by our research team found that working exploits had to be fitted to each target’s exact PHP setup. Systems that share one build, such as network appliances, are the…
-
Censys takes census of the Internet like no one else
Key Takeaways: A messy week for PHP: how PHP2Shell was disclosed On October 20, PHP announced an emergency release for two pre-auth remote code execution (RCE) flaws in the PHP core, CVE-2026-109618 and CVE-2026-109619, both…
-
Node2Shell (CVE-2026-111497) in active exploitation
Categories: Threat Research Tags: advisory, vulnerability, Node2Shell, Brotli
-
Node.js Brotli Remote Code Execution (Node2Shell)
What is the Vulnerability? CVE-2026-111497 is an out-of-bounds write vulnerability in the Google Brotli decoder, a component used to decompress data encoded with the Brotli compression algorithm. Brotli is widely used in web…
-
Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)
Overview An origin-validation flaw in BeyondTrust Remote Support lets an unauthenticated attacker write files on the appliance and execute code as the site's operating-system user. The entry point is the public customer…
-
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access…
-
Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes…
-
Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own
Executive Summary PHP2Shell’s fix is to update PHP, but patching at scale is slow. Only 199,000 of 156 million PHP installations were patched in the first 12 hours after disclosure. In the meantime, Qualys’s configuration-level…
-
Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder
We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and other runtimes, and explain how to detect and remediate it.
-
CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE
IntroductionOn October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by Node.js and other software. The vulnerability is also known as Node2Shell and…
-
PHP2Shell: What to know about two critical PHP flaws
Here's the lowdown on CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little more than two minutes
-
How Rapid7 InsightGovCloud Supports BOD 22-01 Compliance
An introduction to CISA’s BOD 22-01 Issued nearly four years ago, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive 22-01 (BOD 22-01) has been adopted across both public and private…
-
Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own
Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3…
-
Introducing the Cloudflare PHP Capture the Flag challenge
We are launching a PHP Capture the Flag challenge integrated with our Bug Bounty program to test our WAF protections. Security researchers are invited to bypass our defenses and capture the flag to help make the Internet safer.
-
Discover and remediate PHP2Shell exposure with Tenable
Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster. Key takeaways The PHP2Shell…
-
PHP2Shell Was Exploited Before the Patch
PHP2Shell was exploited four days before its patch. Learn why exploitation is moving ahead of disclosure and how security teams can respond.
-
26th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 26th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japanese cloud hosting provider Onamae Desktop Cloud has confirmed a…
-
Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
-
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos. The post From help desk impersonation to AD CS abuse: Investigating ESC1 and…
-
CVE-2026-20362
CVE-2026-20362 is a high-severity SSRF vulnerability in Cisco Finesse discovered by Horizon3 researchers, with affected versions, mitigations, and a NodeZero Rapid Response test.
-
Operationalizing CISA AA26-194A: Automating Cisco Router Security Assessments with Qualys Policy Audit
Key Takeaways CISA AA26-194A provides actionable guidance to improve the security of Internet-facing Cisco routers against real-world attack techniques. The advisory focuses on configuration hardening and security hygiene, rather…
-
Wireshark 5.0.0rc1 Release
Wireshark Release Candidate 5.0.0 was published : soon we can expect a new major version of Wireshark.
-
CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft
On September 25, 2026, Mandiant released a report regarding continued mass exploitation of CVE-2026-35273 by the ShinyHunters group. TrendAI’s Zero Day Initiative first reported this CVE to Oracle on June 10, 2026, following an…
-
Apple Patches for October 2026
Apple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update.
-
4 real? Tracking exploitation and patching of eMudhra’s weak keys
Four, just four: that’s the key to break into any unpatched connection on the Internet that is using eMudhra certificates. Here’s how we quickly patched Cloudflare, what evidence we can see of attempted exploitation, and how much…
-
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
The self-deleting VOLTA infostealer steals credentials, sessions, and cryptocurrency wallets. Then, it uses LLMs to profile victims and rank their most valuable assets.
-
YARA-X 1.22.1 Release
YARA-X&#;x26;#;39;s 1.22.1 is a bugfix version, it brings 2 bugfixes.
-
Lessons from Cybersecurity Black Week
A critical PHP flaw, leaked Linux kernel reports, a poisoned LiteLLM release, and more, all in seven days. Which threats called for immediate action, and which generated more noise than real danger?
-
An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure
A Kaspersky expert presents a cloud isolation bypass case honored at Russian Pentest Award 2026. Learn how vulnerabilities in Kubernetes, Konnectivity, and the overlay network lead to RCE and compromise of other tenants' services.
-
Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines
Summary Project Zero compared two automated tools used by Google to find vulnerabilities in Chrome’s JavaScript engine, V8, on a regular basis. Fuzzilli is a generative JavaScript engine fuzzer and BigSleep is an LLM-based bug…
-
Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform
Microsoft wants EDR out of the Windows kernel, and the preview binaries show wesp.sys telling a user-mode client that a process is starting, with nothing in its imports to let that client block it.
-
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased. Finance and public administration tied as the top-targeted industries.
-
AI, Scripts, Operator: Inside the ConnectWise Attack
Microsoft says an AI agent drove the ConnectWise attack. Huntress telemetry is consistent with that: scripted tooling, steered by an operator.
-
Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
Microsoft analyzes a malicious Claude Code–branded extension, its persistent SSH backdoor, and guidance to detect and remediate it. The post Inside a malicious Claude Code-branded extension and its persistent SSH backdoor…
-
This month in security with Tony Anscombe – October 2026 edition
The PHP2Shell disclosure and other major cybersecurity news this month brought into relief the need for well-thought-out cyber-readiness plans
-
Malicious Claude Code extension distributed through Cursor marketplace
Categories: Threat Research Tags: advisory, Cursor
-
A quiet week in infosec <.<
In this edition of the Threat Source newsletter, William explores how PHP has taken over the conversation, Node.js has joined in, but underneath it all, there are still good people doing good work.
-
Cohere’s Qwen Story: Looks More Like Model Jaggedness
Key findings On October 26, Cohere reported a puzzling incident involving Qwen3.8-Flash-Next, an open-weight model from Alibaba. The task was straightforward: write a detection rule for suspicious curl downloads followed by bash…
-
Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia
Kaspersky researchers analyze a complex targeted attack employing NetamLoader, a sophisticated malicious framework and targeting a customized government OS.
-
Amatera: How the prolific infostealer works and spreads
The malware that topped ESET’s infostealer detections in Latin America in the first half of 2026 is an example of how cybercrime has professionalized
-
Horizon3 Announces NodeZero Integration With Palo Alto Networks Cortex XSOAR
Horizon3 announced the availability of its NodeZero® integration with Palo Alto Networks Cortex XSOAR on the Cortex Marketplace.
-
Building Trusted AI Infrastructure
NVIDIA and Eclypsium are advancing infrastructure security for cloud computing and agentic AI with NVIDIA BlueField and Eclypsium Infrastructure Assurance. Download the full technical research report or register for our upcoming…
-
Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants
Cloudflare mitigated over 8,200 DDoS attacks per hour in Q3 2026 as attackers shifted to shorter, high-frequency strikes. Explore the latest threat data, including the collapse of CLDAP vectors and the impact of recent botnet…
-
ESET APT Activity Report Q2 2026–Q3 2026
An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q2 2026 and Q3 2026
-
Tricks from the Past deployed via signed ChatGPT and Claude binaries
Key Points Introduction Over the past two months, we have been tracking a campaign that abuses the popularity of AI tools such as ChatGPT and Claude to spread a custom malware chain we call Yoba. The attackers use fake GitHub…
-
Simplify User Access Management with SCIM on Rapid7 Command Platform
Managing access to security tools shouldn't require another manual process. As organizations grow, keeping user accounts and permissions up to date becomes increasingly complex. Employees join, change roles, and leave, creating a…
-
Deploying AI agents securely: how Kaspersky products mitigate AI threats
We look at best practices for deploying AI tools securely in corporate environments, with Kaspersky Security Center and Kaspersky Endpoint Security as examples. We also cover ways that EDR and TIP can detect AI agents.
-
Filter generation in practice: from algorithms to LLMs
We automate filter generation for security alerts using an algorithm, a large language model, and a group of LLM agents.
-
ISC Stormcast For Friday, October 30th, 2026 https://isc.sans.edu/podcastdetail/10158
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
-
Tracking AI adoption in North Korean threat actor tradecraft
As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed and efficiency of attacks, we’ve identified North Korean threat actors expanding their use of AI with varying levels of…
-
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.”
-
Ars Technica: Code-execution flaw in UEFI firmware affects most servers on planet Earth
Critical flaw in EDK2 allows attackers to execute code early in the boot process. The post Ars Technica: Code-execution flaw in UEFI firmware affects most servers on planet Earth appeared first on Eclypsium .
-
PHP2Shell: Exploitation Attempts and Remediation Trends
Wiz research has been monitoring PHP2Shell exploitation attempts, but none have succeeded so far. We examine the techniques used, what prevented the attacks from completing and how observed exposure has changed since disclosure.
-
The Pwn Request Reckoning: What Still Works Against GitHub Actions
GitHub's 2026 Actions changes make pull_request_target attacks harder, but not impossible. Here's the residual attack surface and how to audit for it.
-
“Black October” for AI Developer Platforms
A series of agentic attacks on AI Developer Platforms has been leading to LLMJacking at scale.
-
Introducing Censys Starter Subscriptions
Your credits now go up to 4x further If you’ve used a Censys Free or Starter Plan, you know the old credit model: a basic lookup cost one credit, a standard search cost five, and an advanced regex query cost eight. You ended up…
-
Cybersecurity Dive: Hackers could poison AI models by tampering with core infrastructure
AI systems rely on a complex web of hardware. Compromising any one component could let adversaries change model weights. The post Cybersecurity Dive: Hackers could poison AI models by tampering with core infrastructure appeared…
-
Key Takeaways: AI Threat Readiness Survey Report 2026
Key benchmark findings on shadow AI, orchestration risks, and the imperative for an AI-against-AI defensive model.
-
Building Trusted AI Infrastructure
The post Building Trusted AI Infrastructure appeared first on Eclypsium .
-
The Rise of Agentic Attacks: What They Look Like, and Where They're Headed
AI agents are changing how attackers operate. Explore real-world cases of agentic attacks, learn how to identify their fingerprints, and discover what they mean for the future of cybersecurity.
-
The Rise of Agentic Attacks: What They Look Like, and Where They're Headed
AI agents are changing how attackers operate. Explore real-world cases of agentic attacks, learn how to identify their fingerprints, and discover what they mean for the future of cybersecurity.
-
Why Old Vulnerability Management Habits Keep Rising from the Grave
Three customer stories show how to keep severity-only priorities and closed-ticket counts from undermining your CTEM program by tying findings to attack paths and verifying fixes.
-
Reports of SIEM's Death Have Been Greatly Exaggerated
SIEM isn't dead. Its bloated pricing model is. Discover why legacy pricing models need to go, how AI fits in, and how to build a smarter, cost-effective security logging strategy.
-
Eclypsium and NVIDIA Collaborate to Address Emerging AI Infrastructure Attack Surface and Strengthen AI Trust
OverviewToday, Eclypsium released new research demonstrating the importance of addressing security risks in the infrastructure used for training and running AI models and agents, as well as the complex supply chains behind AI…
-
CNN: AI hardware can be hacked so chatbots provide dangerous answers, research shows
The hardware underpinning major AI models can be hacked so that chatbots provide faulty and dangerous answers to questions from users, according to new research shared exclusively with CNN. The post CNN: AI hardware can be hacked…
-
Manipulating AI Models from the Hardware Up
New threat research on an attack chain targeting AI compute infrastructure, enabling compromise of a model with no visible IOCs. The post Manipulating AI Models from the Hardware Up appeared first on Eclypsium .
-
Deploying a Local Ghidra Server for Your Malware Analysis Lab
Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it&#;x26;#;39;s convenient to play with snapshots in your lab. Start a new investigation from a clean snapshot and…
-
ISC Stormcast For Thursday, October 29th, 2026 https://isc.sans.edu/podcastdetail/10156
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
-
AI used in Aur0ra ransomware testing and execution
The GOLD OGRE threat group has used AI extensively to develop tools and to orchestrate and execute ransomware operations Categories: Threat Research Tags: AI, Ransomware, Aur0ra
-
Prediction Markets Emerge as a New Vertical for Traffer Teams
Discover how Russian traffer teams use turnkey fraud infrastructure to exploit prediction markets.
-
Unwrapping Retail Peak Season Cyber Threats
Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust. The post Unwrapping Retail Peak Season Cyber Threats appeared first on Unit 42…
-
Politicians in U.S. and E.U. Say Targeted Ads Are a Security Risk
Politicians in Europe and the U.S. are speaking out against the use of advertising technology to infect targets with zero-click spyware. The post Politicians in U.S. and E.U. Say Targeted Ads Are a Security Risk appeared first on…
-
LABScon26 Replay
Harvard Professor James Mickens weighs the promises of AI against its potential harms, arguing for hardware-based mechanisms to isolate frontier models.
-
Millions of security cameras at risk: DoS vulnerability in Intelbras devices
During our research, we discovered a denial-of-service vulnerability that could affect millions of Intelbras IP camera systems built on the platform platform of a popular Chinese manufacturer.
-
ISC Stormcast For Wednesday, October 28th, 2026 https://isc.sans.edu/podcastdetail/10154
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
-
Serbian Prosecutor Who Investigated Belgrade Trump Tower Project ‘Targeted with Spyware’
New findings by the Citizen Lab and SHARE Foundation show that a prominent supporter of Serbia's student movement was targeted with spyware. The post Serbian Prosecutor Who Investigated Belgrade Trump Tower Project ‘Targeted with…
-
From federal SOCs to Talos: Ryan Fetterman on practical security research
What does it mean to be "blue collar" for the blue team? Ryan Fetterman discusses the realities of detection engineering, and shares his philosophy on building a career in security without burning out.
-
ISC Stormcast For Tuesday, October 27th, 2026 https://isc.sans.edu/podcastdetail/10152
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
-
Looking for a Language [Guest Diary]
[This is a Guest Diary by Jeffray Spence, an ISC intern as part of the SANS.edu BACS program]
-
ISC Stormcast For Monday, October 26th, 2026 https://isc.sans.edu/podcastdetail/10150
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
-
Code security for new coders
This post breaks down essential code security terms and tools so that you can build safely from the start.
-
YARA-X 1.22.0 Release
YARA-X';s 1.22.0 release brings 11 improvements and 9 bugfixes.
-
Managed for Malice: How Attackers Turn MDM into Remote Access
Attackers abuse legitimate MDM platforms to deploy rogue RMM tools, turning device management into a pathway for remote access and persistence.
-
Censys AI Agents: Automate Investigations and Amplify Your Threat Intel
Censys Investigator, our agentic framework, now has an API. The same inputs you’d give it in Platform (domains, IPs, or a full threat intel report) can now come from a script, a SOAR playbook, or an AI agent. You get back an…
-
Whole-of-state defense: How SLED agencies can secure critical infrastructure in the AI era
AI is widening the attack surface of the critical infrastructure facilities and services that state, local, and education (SLED) organizations run. In the final post of our Cybersecurity Awareness Month series, we explain how a…
-
Camera Management Software Compromise Leads to Malware Deployment
Attackers compromised camera management software to deploy malware, establish persistence, and beacon to C2. Huntress breaks down the attack chain and IOCs.
-
Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang
A configuration mismatch in GLM 5.3 on Workers AI triggered an SGLang bug that exposed KV cache pages across requests. Here is how we addressed the issue.
-
Meet the Huntress Neighborhood Watch Program
Learn more about how Huntress protects MSPs with our Neighborhood Watch Program. Test the agentic platform and 24/7 SOC in your environment before rolling out to clients.
-
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security…
Reuse this view
Same filters as JSON: /api/items?category=research&window=7d&limit=100. RSS for this section: feed.xml.