Cybersecurity, AI, etc.
Red teaming (offensive research, new TTPs, exploitation techniques, PoC releases, adversary simulation findings)
The PoeLLM malware campaign has infected more than 3,400 servers, using exposed AI and LLM infrastructure for cryptocurrency mining and botnet expansion, according to reporting published October 9. The campaign…
Attackers used the ARTEX AI pentesting tool and large language models against South Korean financial organizations in a campaign that resulted in data exfiltration, according to reporting published October 9.…
Attackers are exploiting two vulnerabilities in AhsayCBS backup-management software to deploy web shells and XMRig cryptocurrency miners, according to reporting published October 9. Huntress said version 10.3.4 remains vulnerable, making…
A credential-stealing GitHub Actions campaign has been planted in tens of thousands of repositories, according to reporting published October 9. Socket said it identified more than 500 GitHub accounts that…
CISA and partner agencies issued a joint advisory on October 8 describing Chinese government-linked cyber threat actors that combine automated tooling with hands-on activity to steal sensitive data. The advisory…
Security researchers have disclosed a campaign against South Korean financial organizations that reportedly used ARTEX, an AI-driven penetration-testing tool, alongside large language models. CrowdStrike Intelligence said the activity ran from…
Security reporting has highlighted CVE-2026-105192, a critical vulnerability in LMCache, a cache layer used alongside vLLM deployments. The reported issue is an insecure-deserialization path in multiprocess or distributed deployments that…
A reported flaw in GoBalance, a Go implementation used by some hidden services for availability, can allow recovery of the private key controlling an affected .onion address from public information.…
Researchers have described PoeLLM, a cryptomining-focused malware campaign that uses a GitHub-hosted poem to recover command-and-control information. The campaign reportedly affected more than 3,400 servers, with AI-serving and tooling environments…
Huntress has reported active exploitation of two AhsayCBS backup-management vulnerabilities, CVE-2026-105133 and CVE-2026-105134. Reporting says the flaws can be chained to bypass authentication and execute operating-system commands on exposed systems.…