Exploits & Zero-Days
Brotli Flaw Behind 'Node2Shell': What to Patch and Where It Hides
October 28th, 20266 min read
TrendAI™ Research
October 28th, 2026
6 min read
Read article
TrendAI™
Security Blog
Featured Blogs
Exploits & Zero-Days
Two Critical PHP Flaws Leaked Before the Patch: What Organizations Should Do Now
On 20 October at 15:20 UTC, a Hacker News post leaked details of two critical PHP vulnerabilities that could allow remote code execution. The post was removed, but screenshots circulated on X and Mastodon.
October 22nd, 2026
Read article
Exploits & Zero-Days
Eight Compromised eMudhra CA Keys: What Happened and What Organizations Should Do Now
Eight eMudhra intermediate CA keys were compromised, some as weak as 3 bits. Learn the code-signing risk and the steps to hunt for misuse and close the gap from TrendAI™.
October 21st, 2026
Read article
Exploits & Zero-Days
What a Week for CISOs: PHP, eMudhra, and the Questions Your Board Will Ask
Two critical PHP flaws leaked before patches shipped, and the same day Mozilla disclosed weak eMudhra certificate authority keys. In this post, TrendAI™ Global CISO Sundari Parekh gives security leaders a practical playbook.
October 21st, 2026
Read article
Search for research articles
Site search
Filter by:
AICyber crime
The Hidden Risk in Your AI Rollout: Your Endpoints
Rethink endpoint security for the AI era. Endpoints now converge users, identities, data, and AI, increasing risk from shadow AI and advanced attacks. This demands stronger visibility, correlation, and resilience.
June 8th, 2026
Read Article
Pwn2Own Berlin 2026: On the Ground With TrendAI™ ZDI's Biggest AI Showdown Yet
47 zero-days fell at Pwn2Own Berlin 2026 for US$1,298,250 in payouts. TrendAI™ was on the ground all three days — here's what we saw.
June 1st, 2026 10 min read
Read Article
AI
The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment Variables
An OAuth supply chain compromise at Vercel exposed how trusted third party apps and platform environment variables can bypass traditional defenses and amplify blast radius. This article examines the attack chain, underlying design tradeoffs, and what it reveals about modern PaaS and software supply chain risk.
April 20th, 2026 29 min read
Read Article
U.S. Public Sector Under Siege: Threat Intelligence for Q1 2026
The first quarter of 2026 has reinforced a hard truth: U.S. government agencies and educational institutions are operating in the most hostile cyber threat environment ever recorded.
April 9th, 2026 7 min read
Read Article
AI
Claude Code Packaging Error Remains a Lure in an Active Campaign: What Defenders Should Do
Threat actors leveraged Anthropic’s Claude Code npm release packaging error to distribute Vidar, GhostSocks, and PureLog Stealer. This blog details immediate steps organizations can take and best practices to prevent further risk.
April 7th, 2026 6 min read
Read Article
MalwareAISocial engineering
Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads
A packaging error in Anthropic’s Claude Code npm release briefly exposed internal source code. This entry examines how threat actors rapidly weaponized the resulting attention, pivoting an existing AI-themed campaign to spread Vidar and GhostSocks.
April 3rd, 2026 18 min read
Read Article
Cyber threats
Axios NPM Package Compromised: Supply Chain Attack Hits JavaScript HTTP Client with 100M+ Weekly Downloads
A supply chain attack hit Axios when attackers used stolen npm credentials to publish malicious versions containing a phantom dependency. This triggered a cross-platform RAT during installation and replaced its files with clean decoys, making detection challenging.
March 31st, 2026 10 min read
Read Article
AI
The Real Risk of Vibecoding
This blog looks at how AI‑driven vibecoding speeds up software development while increasing security risk by outpacing traditional review and ownership. It explains why security needs to move earlier and be built into modern development workflows.
March 31st, 2026 5 min read
Read Article
Cyber crime
TeamPCP’s Telnyx Attack Marks a Shift in Tactics Beyond LiteLLM
Moving beyond their LiteLLM campaign, TeamPCP weaponizes the Telnyx Python SDK with stealthy WAV‑based payloads to steal credentials across Linux, macOS, and Windows.
March 30th, 2026 6 min read
Read Article
Exploits & Zero-DaysCyber threats
Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise
TeamPCP orchestrated one of the most sophisticated multi-ecosystem supply chain campaigns publicly documented to date. It cascaded through developer tooling and compromised LiteLLM and exposed how AI proxy services that concentrate API keys and cloud credentials become high-value collateral when supply chain attacks compromise upstream dependencies.
March 26th, 2026 26 min read
Read Article