Exploits & Zero-Days
Brotli Flaw Behind 'Node2Shell': What to Patch and Where It Hides
28 Ekim 20266 min read
TrendAI™ Research
28 Ekim 2026
6 min read
Read article
TrendAI™
Güvenlik Blogu
Öne Çıkan Blog Yazıları
Exploits & Zero-Days
Two Critical PHP Flaws Leaked Before the Patch: What Organizations Should Do Now
On 20 October at 15:20 UTC, a Hacker News post leaked details of two critical PHP vulnerabilities that could allow remote code execution. The post was removed, but screenshots circulated on X and Mastodon.
22 Ekim 2026
Read article
Exploits & Zero-Days
Eight Compromised eMudhra CA Keys: What Happened and What Organizations Should Do Now
Eight eMudhra intermediate CA keys were compromised, some as weak as 3 bits. Learn the code-signing risk and the steps to hunt for misuse and close the gap from TrendAI™.
21 Ekim 2026
Read article
Exploits & Zero-Days
What a Week for CISOs: PHP, eMudhra, and the Questions Your Board Will Ask
Two critical PHP flaws leaked before patches shipped, and the same day Mozilla disclosed weak eMudhra certificate authority keys. In this post, TrendAI™ Global CISO Sundari Parekh gives security leaders a practical playbook.
21 Ekim 2026
Read article
Araştırma makaleleri arayın
Site search
Filter by:
Targeted attacks
Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities
This blog discusses the steganography, cloud abuse, and email-based backdoors used against the Ukrainian defense supply chain in the latest Pawn Storm campaign that TrendAI™ Research observed and analyzed.
March 26th, 2026 20 min read
Read Article
Your AI Stack Just Handed Over Your Root Keys: Inside the litellm PyPI Breach
Litellm PyPI breach explained: malicious versions steal cloud credentials, SSH keys, and Kubernetes secrets. Learn impact and urgent mitigation steps.
March 25th, 2026 6 min read
Read Article
Malware
Copyright Lures Mask a Multi‑Stage PureLog Stealer Attack on Key Industries
We look into a stealthy multi‑stage attack campaign that delivers PureLog Stealer entirely in memory using encrypted, fileless techniques.
March 19th, 2026 14 min read
Read Article
From Misconfigured Spring Boot Actuator to SharePoint Exfiltration: How Stolen Credentials Bypass MFA
Not every cloud breach starts with malware or a zero-day. In this incident, attackers discovered an exposed Spring Boot Actuator endpoint, harvested credentials from leaked configuration data, then used the OAuth2 Resource Owner Password Credentials (ROPC) flow to authenticate without MFA.
March 18th, 2026 7 min read
Read Article
Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack
Warlock continues to enhance its attack chain with new tactics to improve persistence, lateral movement, and defense evasion using an expanded toolset: TightVNC Yuze, and a persistent BYOVD technique leveraging the NSec driver.
March 16th, 2026 13 min read
Read Article
Cloud securityDevops
Cracking the Isolation: Novel Docker Desktop VM Escape Techniques Under WSL2
TrendAI™ Research has discovered several new methods that enable attackers to escape Docker Desktop's WSL2 VM and run arbitrary code on the host. Our analysis highlights how trusted development tooling can create unexpected attack surfaces when internal APIs and configuration mechanisms are left exposed.
March 12th, 2026 12 min read
Read Article
Cloud security
Azure Control Plane Threat Detection With TrendAI Vision One™
Malicious access to the Azure control plane can lead to a cascade of assaults that can be disastrous and difficult to detect. TrendAI Vision One™ helps protect the Azure control plane through early threat identification and rapid response.
March 10th, 2026 10 min read
Read Article
CISOs in a Pinch: A Security Analysis of OpenClaw
Learn about OpenClaw (a sovereign agent) and how this can be viable for enterprises.
March 10th, 2026 5 min read
Read Article
Through the Lens of MDR: Analysis of KongTuke’s ClickFix Abuse of Compromised WordPress Sites
Our analysis of an active KongTuke campaign deploying modeloRAT — malware capable of reconnaissance, command execution, and persistent access — through compromised WordPress sites and fake CAPTCHA lures shows that the group still operates this delivery chain in parallel with the newer CrashFix technique.
March 10th, 2026 9 min read
Read Article
Europol, Microsoft, TrendAI™ and Collaborators Halt Tycoon 2FA Operations
Tycoon 2FA was dismantled this week by law enforcement and industry partners including TrendAI™. The phishing-as-a-service platform offered MFA bypass services using adversary-in-the-middle (AitM) proxying.
March 4th, 2026 7 min read
Read Article