Security Research

CVE Research

Gorbag Targets Ukrainian Organizations with BeautyStealer and WinRAR Exploitation

Gorbag uses spearphishing and weaponized WinRAR archives to deploy BeautyStealer against Ukrainian organizations. The malware steals browser credentials, VPN configuration files, and targeted documents before exfiltrating the data and deleting itself.

CVE Research

Synology NAS Under Siege: C3RB3R Ransomware Strikes Unpatched Devices

Synology has warned customers about an ongoing wave of ransomware attacks targeting network-attached storage (NAS) devices running outdated versions of DiskStation Manager (DSM). The attacks have been associated with C3RB3R ransomware, a threat capable of encrypting stored files and demanding payment for their recovery.

CVE Research

CISA KEV Exploitation in October 2026: Threat Actors, CVEs and Attack Trend

CVE Research

NetamLoader Malware Targets Asian Government Windows 10 Systems Through Advanced .NET Injection

NetamLoader is a multi-stage .NET malware loader targeting customized Windows 10 systems used by Asian government organizations. Discover its AppDomainManager injection techniques, XAML-based execution, AMSI bypass, encrypted command-and-control communications, indicators of compromise, and mitigation strategies.

CVE Research

Agentic AI in the Wild: How AI-Driven Attacks Are Changing Vulnerability Management

CVE Research

WARP PANDA Weaponizes VMware ESXi Zero-Day Logging Gap to Evade Audit Visibility

China-nexus threat actor Warp Panda exploited an insufficient logging zero-day in VMware ESX (CVE-2026-41709) to blind audit visibility, deploying BRICKSTORM malware and hijacking Microsoft 365 accounts across targeted U.S. legal networks

CVE Research

Cisco Firewall Zero-Day Under Attack: Hackers Exploit SSL VPN Flaw to Crash ASA and FTD Devices

CVE Research

PolyShell: Critical Magento Flaw Allows Unauthenticated RCE, Exploited Since March 2026

CVE-2026-48356 is a critical unrestricted file upload vulnerability in Adobe Commerce and Magento Open Source. Unauthenticated attackers can submit polyglot files through guest-cart REST item routes and write them under pub/media/custom_options/. When the web server executes or serves that path as PHP, the result can be remote code execution or stored XSS. Mass exploitation has been observed since March 2026, including links to CMS-block loaders on hundreds of stores. The issue is listed in the CISA KEV catalog. This article covers how the flaw works, campaign activity, indicators of compromise, affected and fixed versions under APSB26-73, and practical remediation steps.