Attackers are probing CVE-2026-119977, a WordPress Core flaw that opens only during a core update. Here’s how the race works, why the severity ratings disagree, and how to protect your sites.
AI agents are now acting on your endpoints. TrendAI Vision One™ ingests Claude Code and Cowork session records so your team can review what users asked Cowork to do, all in the same console.
TrendAI™ Research supplied intelligence over several months that helped disrupt a botnet of more than 1.3 million pre-infected set-top boxes. We look at how the operation worked, its impact, and what the disruption means for defenders.
Many attackers are switching from file-based malware to memory-based attacks to improve their stealth. “Fileless,” “zero-footprint,” or “living off the land” threats use legitimate applications to carry out malicious activities.
We recently acquired a spam sample that propagates the Loki infostealer through LZH compressed archive files.
A campaign propagates a new malware named ‘BazarBackdoor’, a fileless backdoor reportedly created by the same threat actors behind TrickBot.
We provide recommendations for cloud admins on how to formulate a security strategy when using Kubernetes for container orchestration.
Is your work-from-home set up secure? Here are a few signs to know if your devices have been hacked or infected with malware.
A variant of Loki info stealer that we detected through our honeypot is propagated as Windows CAB file email attachments. It uses process hollowing to evade detection.
A spam campaign that spreads the Ursnif spyware has attachments named after an Australian insurance provider.
Recently, we wrote an article about more than 8,000 unsecured Redis instances found in the cloud. In this article, we expound on how these instances can be abused to perform remote code execution (RCE), as demonstrated by malware samples captured in the wild.
Maze ransomware, notorious for not just encrypting but for stealing victims’ data, attacks a US IT firm. The company sent emails to customers which include IP addresses and file hashes that have been linked to previous Maze attacks.
Cybercriminals behind Nemty ransomware close down their Ransomware-as-a-Service (RaaS) operation as they zero in on private schemes. This is confirmed through a post in a Russian hacker forum.
November 4th, 2026 
4 min read
