Detection engineering insights, threat hunting guides, and MITRE ATT&CK tutorials.
A critical (CVSS 9.8) type confusion flaw in seroval's fromJSON() deserializer (CVE-2026-59940) could let attackers trigger unintended server-side invocation; a downstream RCE-capable path was validated against TanStack Start before the [email protected] fix.
A newly disclosed Kiota flaw (CVE-2026-59864) lets attacker-controlled OpenAPI x-ai-* extensions inject unsanitized paths into generated Copilot/Teams plugin manifests, enabling out-of-package file references when deployed. Fixed in Kiota 1.32.5.
BleepingComputer reports an alleged breach of Thailand's Finance Ministry in which attackers used the open-source Hermes AI agent in unattended "YOLO" mode to automate post-exploitation activity. Details are limited and unconfirmed.
Attackers are reportedly hijacking DNS settings on hotel and conference center Wi-Fi to redirect users to fake Microsoft 365 login pages, per BleepingComputer. Defenders should push phishing-resistant MFA and VPN use for traveling staff.
BlueNoroff is reportedly running a phishing kit impersonating Zoom/Teams that profiles victims' crypto wallets before delivering malware, per The Hacker News. Crypto-adjacent organizations and meeting-link recipients should treat unusual invites with added scrutiny.
A GitHub Security Advisory (CVE-2026-59865) details a command injection flaw in Kiota's `kiota info` command, where a malicious OpenAPI spec could substitute its own install command for kiota's trusted suggestion, risking RCE when developers or the VS Code extension act on it. Fixed in Kiota 1.32.5.
Confiant reports a malvertising campaign, SourTrade, active since late 2024, that impersonates TradingView, Solana, and Luno and has victims' browsers assemble a Windows executable from a legitimate Bun runtime rather than serving one complete file.
CISA added CVE-2025-68686 to its KEV catalog, a FortiOS flaw letting unauthenticated attackers bypass a prior patch for symlink-based persistence via crafted HTTP requests — but only after filesystem-level compromise via another bug.
Attackers are reportedly exploiting an unauthenticated RCE zero-day in the widely used FastJson Java library to target US companies; technical details remain limited.
Arista has patched a maximum-severity command injection zero-day in on-premises VeloCloud Orchestrator that was actively exploited in attacks; admins should patch immediately and review orchestrator logs for signs of compromise.
A GHSA advisory (CVE-2026-46428) reports that lettre's boring-tls backend inverts a hostname-verification flag, silently disabling TLS hostname checks for users relying on the default strict configuration and enabling on-path SMTP interception of credentials and mail content.
A newly disclosed advisory (CVE-2026-54588, CVSS up to 9.3) shows Poweradmin v4.3.2 building OIDC/SAML redirect URLs from an unvalidated Host header, letting attackers hijack authorization codes for full account takeover and, per the advisory, downstream PowerDNS zone compromise.
CVE-2026-52889 is a critical (CVSS 9.8) SSTI flaw in the Formie plugin for Craft CMS, allowing Twig injection via Hidden field defaults that can lead to RCE. A public PoC exists; see our multi-SIEM detection coverage for defenders.
CVE-2026-53913 is a critical (CVSS 9.8) authentication bypass in Apache Camel's camel-keycloak KeycloakSecurityPolicy with a public PoC, allowing unauthenticated access to routes meant to be protected by Keycloak.
Two beta versions of @joyfill npm packages were compromised with an import-time implant that deploys a RAT tied to the DEV#POPPER malware family, per The Hacker News. Teams using these packages should check for the affected versions and treat any install as a potential compromise.
CubePilot, an Australian drone flight-controller maker, disclosed a DNS hijacking attack that allowed traffic interception, per BleepingComputer. Defenders using CubePilot products should verify firmware integrity and watch for DNS record anomalies.
Anthropic says its Claude Mythos Preview model helped derive a key-recovery attack on the post-quantum scheme HAWK-256 and a major speedup for an attack on reduced, seven-round AES-128 — not full AES.
OnTrac has notified customers that attackers breached its corporate network and may have accessed personal customer data; attack details and full scope remain undisclosed.
CISA and Australian authorities have issued new guidance urging critical infrastructure operators to prepare in advance for isolating vital OT systems during cyberattacks or major disruptions.
A critical SQL injection (CVE-2026-54658, CVSS 9.8) in @hypequery/clickhouse's parameter escaping lets attackers break out of query strings via a trailing backslash; patched in v2.0.2 with no viable workaround.
A new GHSA advisory (CVE-2026-64863, CVSS 9.1) shows goshs v2.1.3's --no-delete flag fails to block the WebDAV MOVE verb, letting clients rename or overwrite protected files with a public PoC available.
A new botnet called Dysphoria has reportedly compromised around 200,000 devices globally, which are being used for DDoS attacks and traffic relay operations, per BleepingComputer.
A released PoC exploit for "Certighost," an AD CS vulnerability, reportedly lets authenticated attackers compromise Windows domains — full technical details are still emerging.
Apple is being sued by three plaintiffs who claim a fraudulent Sparrow Wallet app on the App Store led to roughly $1.8 million in stolen Bitcoin, raising questions about app store vetting for crypto wallet apps.
GitHub and PyPI have added a time-based mechanism to Dependabot intended to limit the impact of supply-chain attacks; specifics are still emerging, per BleepingComputer.
Cl0p-linked actors are reportedly chaining an unauthenticated info-disclosure flaw in FlexPLM's WSDL endpoint with a Windchill login servlet bug to achieve pre-auth RCE against internet-exposed PLM deployments, in a new data extortion campaign.
PRODAFT reports that the DevMan ransomware-as-a-service group, tracked as Funky Mantis, runs a centralized portal for affiliates to build payloads, manage victims, and handle payouts.
Endpoint telemetry never sees a stolen refresh token. This playbook gives SOC teams working KQL and SPL detections for device code phishing, illicit OAuth consent grants, MFA fatigue, and service principal credential persistence in Entra ID.
A malvertising campaign is using fake Solana, Luno, and TradingView pages with JavaScript that assembles malware directly in browser memory, according to BleepingComputer. Full technical details are still emerging.
Threat actors are using email addresses from ShinyHunters-linked data breaches to send $2,000 Bitcoin sextortion emails, per BleepingComputer, making the scam lures appear more credible to recipients.
A public PoC now exists for a self-managed GitLab RCE flaw (patched June 10) affecting version 18.11.3, exploitable by any authenticated user with push access via a crafted Jupyter notebook commit.
CVE-2026-54158 (CVSS 9.9) is a stored XSS in SiYuan's genAVValueHTML() that chains to full kernel RCE via its Electron webview context; a public PoC exists. Our KQL, SPL, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike detections flag the kernel-process pivot to host activity.
CVE-2026-55500 (CVSS 9.9) exposes an unauthenticated database import/export interface in the 9router npm package (<=0.4.71), enabling credential theft and full application takeover. A public PoC exists; we detail our KQL, SPL, and multi-SIEM detection coverage.
A critical (CVSS 9.9) SQL injection to RCE chain in DIRAC's FileCatalog DatasetManager, with a public PoC available. Multi-platform SIEM detection covers injection attempts and post-exploitation process spawning.
A CVSS 9.9 Twig-based SSTI in Mautic's theme engine lets attackers inject template syntax via theme customization or import to achieve remote code execution. PoC is public; patches vary by branch.
CVE-2026-9559 is a critical (CVSS 9.9) path traversal in Mautic core's Campaign Import (versions 7.0.0-7.1.1) that can lead to webshell RCE; a public PoC exists. We cover detection across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-50027 lets unauthenticated attackers read, write, and delete memory documents in mcp-memory-service versions before 10.67.1. A public PoC exists — see how our KQL, SPL, and other SIEM detections catch it.
YesWiki before 4.6.6 exposes an unsafe eval() call in its Formula Calculator, allowing unauthenticated remote code execution (CVSS 9.8) with a public PoC available. df00tech ships detection across seven SIEM platforms to catch exploitation attempts.
Gitea's Docker image defaults REVERSE_PROXY_TRUSTED_PROXIES to *, letting unauthenticated attackers spoof X-WEBAUTH-USER for full admin takeover (CVSS 9.8, public PoC). Affects Gitea < 1.26.3.
CVE-2026-48204 (CVSS 9.8) lets attackers override Apache Camel camel-mongodb-gridfs operations and inject NoSQL operators via unfiltered gridfs.* headers, risking data disclosure and file deletion. A public PoC exists; see our multi-SIEM detection coverage.
9router (npm) versions 0.2.21-0.4.41 ship a hardcoded default JWT signing secret (CWE-798), letting attackers forge admin tokens and fully bypass authentication. A public PoC exists; df00tech ships detection across KQL, SPL, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-45659 is a critical .NET deserialization RCE in Microsoft SharePoint Server actively exploited in the wild (CISA KEV). df00tech ships detection coverage across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-49252 is a CVSS 9.9 prototype pollution flaw in @deepstream/server (< 10.0.5) with a public PoC, enabling RCE or DoS via crafted messages. Detection coverage ships for Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-50545 (CVSS 9.9) is an unpatched Fission serverless framework flaw allowing PodSpec injection via Environment CRDs, enabling privileged container escape and full Kubernetes cluster takeover. A public PoC is available.
CVE-2026-50563 is an unpatched CVSS 9.9 PodSpec injection flaw in Fission (<=1.23.0) that lets low-privileged users escape containers and compromise the underlying Kubernetes node. A public PoC is available; detection coverage ships for Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and C
CVE-2026-54769 is a CVSS 10.0 sandbox escape in Langroid's TableChatAgent (<=0.65.1) caused by an incomplete eval() mitigation, enabling RCE. A public PoC is available; detection coverage ships for Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-48282 is a CISA KEV-listed path traversal flaw in Adobe ColdFusion enabling file read and potential RCE. Detection coverage is available for Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-48908 is a KEV-listed unrestricted file upload flaw (CWE-434) in JoomShaper SP Page Builder for Joomla, enabling PHP webshell upload and remote code execution. Detection coverage ships for Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-56290 is a KEV-listed improper access control flaw in the Joomlack Page Builder for Joomla, enabling unauthorized administrative access. df00tech ships detection coverage across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
BleepingComputer reports on a new RAT called Dolphin X that reportedly uses an AI-powered feature to score and rank infected victims for attackers. Details are limited and unverified, but the trend toward automated post-compromise victim triage is worth watching.
Origin Energy has confirmed a breach in which an unauthorized party accessed and leaked customer PII online; full scope and attack details remain unconfirmed.
CVE-2026-47428 is a CVSS 9.6 reflected XSS in @vitest/browser (versions 4.0.17–4.1.6 and 5.0.0-beta.0–5.0.0-beta.3) with a public PoC, enabling arbitrary JavaScript execution in CI/CD and developer browser contexts via an unsanitized otelCarrier query parameter.
CVE-2026-12569 is a CISA KEV-listed unsafe deserialization and improper input validation flaw in PTC Windchill and FlexPLM, enabling remote code execution via crafted HTTP payloads. Active exploitation is confirmed — deploy detections across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle,
CVE-2026-20230 is a KEV-listed unauthenticated SSRF in Cisco Unified Communications Manager enabling internal reconnaissance and metadata credential theft. Detection coverage ships for Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-46595 is a CVSS 10.0 authentication bypass in golang.org/x/crypto/ssh (< 0.52.0) allowing attackers to skip public-key authorization via VerifiedPublicKeyCallback. A public PoC is live — patch immediately and deploy detections across your SIEM estate.
CVE-2026-55166 is a CVSS 9.9 SSRF+IDOR chain in Netflix Lemur (<1.9.2) enabling AWS IAM credential theft and PKI compromise. A public PoC is available — detection coverage ships for Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-49257 is a CVSS 10.0 authentication bypass in mcp-pinot-server (<=3.0.1) that exposes all MCP tools to unauthenticated callers due to a default oauth_enabled=False and a wildcard bind address. A public PoC is available — patch or restrict access immediately.
CVE-2026-48749 is a CVSS 9.9 container escape in Incus (< 7.2.0) allowing arbitrary host file read/write via crafted rootfs symlinks. A public PoC is available; df00tech ships detections across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-48750 is a CVSS 9.9 symlink-follow flaw in the Incus container manager that lets a crafted container image write attacker-controlled content to arbitrary host paths, enabling container escape. A public PoC exists; df00tech ships detection coverage across Sentinel, Splunk, Elastic, QRadar, S
CVE-2026-48751 is a CVSS 9.9 missing authorization flaw in Incus (incusd) prior to v7.2.0 that lets restricted-project tenants escape to arbitrary host command execution. A public PoC is available; df00tech ships detection coverage across seven SIEM platforms.
CVE-2026-48752 is a CVSS 9.9 container escape in Incus (incusd < 7.2.0) where a crafted image symlink in templates/ allows arbitrary host file read/write. A public PoC exists — patch immediately and deploy our 7-platform detection coverage.
CVE-2026-48753 is a CVSS 9.9 path traversal flaw in Incus (< 7.1.0) allowing arbitrary host file writes via malicious S3 multipart upload keys. A public PoC is available; df00tech ships detections across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-48558 is a KEV-listed authentication bypass in SimpleHelp (CWE-347) allowing unauthenticated attackers full access to remote support infrastructure. Detection coverage ships for Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-48755 is a critical (CVSS 9.9) argument injection flaw in Incus versions prior to 7.2.0 that enables arbitrary code execution at incusd process privileges. A public PoC is available and no patch exists yet — deploy detections now.
CVE-2026-48769 is a CVSS 9.9 arbitrary file write flaw in Incus (< 7.2.0) caused by improper image hash validation, with a public PoC available. Detection rules covering Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike are now live.
CVE-2026-47668 is a CVSS 10.0 unauthenticated RCE in dbgate-serve ≤ 7.1.8 where the JSON Script Runner endpoint executes arbitrary JavaScript with no auth check. A public PoC is available and no patch exists; detection coverage ships for Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and
CVE-2026-54051 is a CVSS 9.9 OS command injection flaw in the network-ai npm package (versions < 5.9.1) with a public PoC available. df00tech provides detection coverage across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-47429 is a CVSS 9.8 missing-authorization flaw in the Vitest UI server that lets unauthenticated remote attackers read arbitrary files and execute code. A public PoC exists — patch to vitest 3.2.6 or 4.1.0 immediately.
CVE-2025-58048 is a CVSS 9.9 unrestricted file upload flaw in Paymenter (< 1.2.11) with a public PoC, enabling unauthenticated remote code execution via PHP webshell upload. Patch immediately and deploy the df00tech detection pack for coverage across Sentinel, Splunk, Elastic, and four more SIEMs.
CVE-2026-53753 is a CVSS 9.8 pre-auth RCE in Crawl4AI (≤0.8.6) exploitable via Python generator frame introspection to escape AST sandboxing. A public PoC is available; no patch exists — deploy our 7-SIEM detection coverage now.
CVE-2026-56266 is a CVSS 9.8 critical vulnerability bundle in Crawl4AI <= 0.8.6's Docker API, combining unauthenticated access, path traversal file write, SSRF, XSS, and JS execution. A public PoC is available with no patch released.
CVE-2025-67038 is an actively exploited code injection flaw (CWE-78/CWE-94) in Lantronix EDS5000 serial device servers, listed in CISA's KEV catalog. Detection coverage ships for Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-34908 is an actively exploited improper access control flaw in Ubiquiti UniFi OS, listed on the CISA KEV catalog. df00tech ships detection coverage across seven SIEM platforms targeting unauthorized API access and management plane compromise.
CVE-2026-34909 is an actively exploited path traversal flaw (CWE-22) in Ubiquiti UniFi OS, listed on the CISA KEV catalog. Detection coverage is available for Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-34910 is a CISA KEV-listed improper input validation flaw in Ubiquiti UniFi OS enabling unauthorized access or command execution on Dream Machines, Cloud Keys, and managed switches — with no patch yet available.
CVE-2026-52813 is a CVSS 10.0 path traversal flaw in Gogs (< 0.14.3) that lets attackers write malicious Git hook files outside the repository root, achieving RCE. A public PoC is available; df00tech ships detection coverage for Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStri
CVE-2026-54350 is a CVSS 10.0 NoSQL operator injection flaw in @budibase/server < 3.39.12 that allows unauthenticated attackers to exfiltrate data, bypass auth, and achieve RCE — a public PoC is already available.
CVE-2026-44179 is a CVSS 9.9 server-side template injection flaw in XWiki Pro Macros (versions 1.13–1.14.5) enabling unauthenticated RCE via the excerpt-include macro. A public PoC is available; detection coverage ships for Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-52806 is a CVSS 9.9 command injection flaw in Gogs (< 0.14.3) allowing RCE via git rebase --exec argument injection during PR merges. A public PoC is available — patch immediately or use our seven-platform detection rules to catch exploitation in progress.
CVE-2026-33646 is a CVSS 9.6 template injection flaw in mise (< 2026.3.10) that allows arbitrary code execution via malicious .tool-versions files. A public PoC exists; df00tech ships detection coverage across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-47413 is a CVSS 9.6 privilege escalation flaw in praisonai-platform < 0.1.4 that lets any authenticated workspace member silently promote users to owner via an unprotected API endpoint. A public PoC is available; df00tech ships detection coverage across seven SIEM platforms.
CVE-2026-0755 is a CVSS 9.8 OS command injection flaw in gemini-mcp-tool (npm, versions 1.1.2–1.1.5) with a public PoC, enabling arbitrary code execution and file exfiltration via malicious prompt strings.
CVE-2026-30120 is a CVSS 9.8 code injection RCE in the Remotion npm package (< 4.0.410) with a public PoC already released. Detection coverage ships across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-32966 is a CVSS 9.8 missing authorization flaw in Apache DolphinScheduler before 3.4.2 that allows unauthenticated attackers to extract database credentials and connection strings via the DataSource API. A public PoC is available; patch immediately and deploy SIEM detection.
CVE-2026-44180 is a CVSS 9.8 input validation bypass in Jupyter Enterprise Gateway (>= 2.0.0rc1, < 3.3.0) that allows attackers to escape container isolation and spawn arbitrary kernels. A public PoC exists and no patch is available — deploy SIEM detections now.
CVE-2026-47103 is a CVSS 9.8 eval injection flaw in python-statemachine 3.0.0–3.2.0 that lets attackers execute arbitrary Python code via malicious SCXML input. A public PoC is available; df00tech ships detection coverage across seven SIEM platforms.
CVE-2026-47210 is a CVSS 9.8 sandbox escape in npm vm2 (≤ 3.11.3) exploiting the JSPI/Promise species pattern in .finally() to achieve arbitrary host code execution. A public PoC exists and no patch is available — df00tech ships detection rules across seven SIEMs.
CVE-2026-47391 is a CVSS 9.8 unauthenticated RCE in PraisonAI <= 4.6.39 where the A2A endpoint passes LLM output to Python eval() with no auth or sanitisation. A public PoC exists; patch is unavailable.
CVE-2026-47393 (CVSS 9.8) exposes PraisonAI's Flask API server without any authentication when deployed via the built-in API mode. A public PoC is available and no patch exists — network-accessible deployments on versions <= 4.6.39 are fully exploitable today.
CVE-2026-47396 is a CVSS 9.8 authentication bypass in PraisonAI's call server: when CALL_SERVER_TOKEN is unset, any unauthenticated attacker can enumerate, invoke, or delete AI agents. A public PoC is available; patch is pending.
CVE-2026-47410 (CVSS 9.8) allows unauthenticated attackers to forge admin JWTs in praisonai-platform <= 0.1.2 by exploiting a hardcoded default signing key. A public PoC exists; no patch is available.
CVE-2026-48062 is a CVSS 9.8 file upload bypass in CodeIgniter4 (<4.7.2) where the ext_in rule fails to enforce extension restrictions, enabling web shell upload and RCE. A public PoC exists — patch now and deploy detection coverage across your SIEM.
CVE-2026-49980 is a CVSS 9.8 unauthenticated RCE in Rclone 1.46.0–1.74.2: attackers can execute arbitrary commands via the RC API when rcd runs with --rc-serve. A public PoC is available; no patch exists yet.
CVE-2026-53633 is a CVSS 9.8 RCE in @vitest/browser and vite-plus: an unauthenticated CDP proxy lets attackers overwrite config files and execute arbitrary code. A public PoC is available; no patch exists yet.
CVE-2026-47137 is a CVSS 10.0 sandbox escape in vm2 ≤3.11.3 that bypasses the CVE-2023-37903 patch via the nesting:true option, enabling full RCE from within a sandboxed Node.js context. A public PoC exists and no patch is available.
CVE-2026-54782 is a CVSS 10.0 authentication bypass in CoreWCF.Primitives where unsigned or malformed SAML tokens are accepted as valid, granting unauthenticated access to WCF endpoints. A public PoC exists — patch or detect now.
CVE-2026-47392 is a CVSS 9.9 sandbox escape in PraisonAI (praisonaiagents <= 1.6.39, PraisonAI <= 4.6.39) exploitable via print.__self__ builtins leak — a public PoC exists and no patch is available.
CVE-2026-47724 is a CVSS 9.9 missing authorization flaw in nebula-mesh (pre-0.3.4) that lets any authenticated operator access or destroy another tenant's mesh resources. A public PoC is available; df00tech ships detection coverage across seven SIEM platforms.
CVE-2026-47744 is a CVSS 9.9 authorization bypass in the Shopper e-commerce framework (shopper/framework < 2.8.0) allowing authenticated low-privilege users to escalate to admin. A public PoC is available — deploy detections now.
CVE-2026-48030 is a CVSS 9.9 OS command injection flaw in Pheditor 2.0.1–2.0.3 with a public PoC and no patch. Our detection covers Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-55255 is a critical IDOR (CVSS 9.9) in Langflow prior to 1.9.1, allowing authenticated attackers to access other users' AI flow data via /api/v1/responses. A public PoC is available; patch or restrict the endpoint immediately.
A GHSA advisory reports that OpenAM's WebAuthn deserialization filter fails to check nested objects beyond stream depth 1, allowing a pre-auth gadget-chain RCE (CVE-2026-62263) despite an earlier fix; a public PoC reportedly exists.
Researchers published a working exploit, dubbed Certighost, that lets a low-privileged AD user get a Domain Controller certificate and use its replication rights to DCSync the krbtgt secret.
A newly disclosed unauthenticated RCE in OpenAM (CVE-2026-62379, CVSS 9.8) lets attackers load arbitrary Java classes via the /authservice endpoint on default configs; a PoC is public and a fix exists in 16.1.2.
A Bing malvertising campaign is pushing a fake Claude desktop installer, hosted on a legitimate Claude.ai domain, that delivers SectopRAT malware to victims.
NSA, CISA, and partners reportedly attribute exploitation of a Zimbra webmail zero-day to a Russian espionage group that stole email, saved passwords, and 2FA recovery codes via a click-to-open payload.
CISA warns that Russian state-sponsored group Laundry Bear (Void Blizzard) is combining phishing with a patched Zimbra Collaboration vulnerability to steal email from targeted organizations.
CVE-2026-50522 is a CISA KEV-listed deserialization flaw (CWE-502) in Microsoft SharePoint enabling RCE via crafted serialized payloads, actively exploited in the wild. Our detection spans Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-16232 is a KEV-listed authentication bypass in Check Point SmartConsole (CWE-287) that lets attackers access management sessions without valid credentials. We cover detection across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-54052 is a critical (CVSS 9.9) authorization bypass in n8n-mcp <= 2.56.0 that lets attackers read other tenants' workflow backups, potentially exposing embedded credentials and secrets. A public PoC exists and no patch is currently available.
CVE-2026-0770 is a KEV-listed, actively exploited flaw in Langflow that lets attackers trigger execution of untrusted components. Our detection catches it via anomalous outbound connections, child process spawns, and untrusted calls to flow-execution endpoints.
CVE-2021-27137 is a KEV-listed stack-based buffer overflow in DD-WRT's web management interface enabling RCE or DoS. Our detection covers abnormal HTTP requests, httpd crashes, and post-exploitation IoT segment activity across seven SIEM platforms.
CVE-2026-60137 is a CISA KEV-listed SQL injection vulnerability in WordPress Core, actively exploited in the wild against wp-admin, wp-json, and xmlrpc.php. WordPress 7.0.2 patches the flaw; our detection ships across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
A critical (CVSS 9.9) flaw in Fission <= 1.23.0 lets attackers with Environment/Function access bypass SecurityContext hardening and deploy privileged pods, risking node or cluster compromise. PoC is public.
CVE-2026-44935 (CVSS 9.9) lets low-privileged users in Rancher Fleet exfiltrate Secrets/ConfigMaps from arbitrary namespaces via unvalidated Helm valuesFrom references. A public PoC exists; see our KQL, SPL, and other SIEM detections for exploitation attempts.
CVE-2026-52831 is a critical (CVSS 10.0) command injection flaw in Nuclio's cron trigger handling that allows unauthenticated RCE via unsanitized event headers/body. A public PoC exists; our detection covers seven SIEMs, watching for shell metacharacter injection and anomalous CronJob-spawned proces
CVE-2026-48939 is a KEV-listed unrestricted file upload flaw in Joomla's iCagenda component enabling web shell uploads and RCE; our detection covers the exploitation pattern across KQL, SPL, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
Web shells give attackers persistent, hands-on-keyboard access to compromised web servers. Learn to detect T1505.003 with practical KQL and SPL queries covering process lineage, webroot file writes, and IIS access-log anomalies.
CVE-2026-50564 (CVSS 9.9) lets Fission Environment CRD authors inject privileged, host-namespace PodSpec fields into builder/executor pods, enabling node compromise in multi-tenant clusters. A public PoC exists; df00tech ships detection across KQL, SPL, Elastic, QRadar, Sumo Logic, Chronicle, and Cr
CVE-2026-50551 is a critical (CVSS 9.9) stored XSS-to-RCE chain in SiYuan's kernel via unsanitized attribute view asset cells, with a public PoC available. Our detection covers the injection, API abuse, and post-exploitation stages across seven SIEM platforms.
CVE-2026-25089 is a KEV-listed OS command injection flaw in Fortinet FortiSandbox enabling arbitrary command execution. We cover detection across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-39808 is a KEV-listed OS command injection flaw in Fortinet FortiSandbox's management interface. Our detection catches it via anomalous process execution and shell-metacharacter requests across KQL, SPL, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-58644 is a KEV-listed deserialization flaw in Microsoft SharePoint enabling remote code execution. Our detections cover post-exploitation indicators like w3wp.exe anomalies, webshell drops, and LSASS access across seven SIEM platforms.
CVE-2026-45262 is a critical (CVSS 9.9) authenticated SQL injection in FacturaScripts's REST API filter parameter, with public PoC code and potential for SSRF-driven database host compromise. We ship detection coverage across seven major SIEM platforms.
CVE-2026-56291 is a KEV-listed unrestricted file upload flaw in Balbooa Forms for Joomla, letting attackers upload web shells for RCE. Our detection ships across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2023-4346, a CISA KEV-listed flaw in KNX's connection authorization lockout, lets attackers brute-force building automation access keys. Our KQL, SPL, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike detections flag the repeated failed auth attempts that reveal it.
CVE-2026-15409 is a KEV-listed SSRF flaw in SonicWall SMA1000 appliances letting attackers pivot into internal networks and cloud metadata. Our detection catches it via SIEM correlation of anomalous outbound requests across seven platforms.
CVE-2026-46817, a CISA KEV-listed privilege escalation flaw in Oracle E-Business Suite, enables authentication bypass and escalation to APPS/SYSADMIN roles. df00tech ships detections across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike.
CVE-2026-56155 is a KEV-listed access control flaw in Microsoft AD FS that lets limited-privilege actors obtain unauthorized federated access. Our detection tracks anomalous token issuance, claims rule changes, and AD FS admin activity across seven SIEM platforms.
CVE-2026-56164 is a KEV-listed unauthenticated access flaw in Microsoft SharePoint Server enabling RCE and webshell deployment; our detection covers anonymous endpoint access, anomalous IIS child processes, and webshell drops across seven SIEM platforms.
Bring Your Own Vulnerable Driver (BYOVD) attacks let adversaries kill EDR from kernel space before your detections ever fire. This guide gives SOC analysts concrete KQL and SPL queries to catch driver loads, service creation, and kernel tampering mapped to MITRE ATT&CK T1068.
Production KQL (Microsoft Sentinel) and SPL (Splunk) detections for MITRE ATT&CK T1558 — Kerberoasting, AS-REP Roasting, Golden and Silver Tickets — with Event 4769/4768 logic and tuning guidance for SOC teams.
How threat actors weaponize legitimate remote access software like AnyDesk, ScreenConnect, and Atera — and the production KQL and SPL detection rules SOC teams need to catch T1219 abuse before ransomware lands.
Production KQL and SPL detection rules for MITRE ATT&CK T1055 process injection — DLL injection, process hollowing, thread hijacking, PE injection, and Early Bird APC — with tuning guidance for SOC teams.
Production-grade KQL and SPL detection queries for five critical vulnerabilities in the CISA Known Exploited Vulnerabilities catalog. Map KEV to MITRE ATT&CK, prioritise alerts, and close the gap between patch lag and detection coverage.
Every ransomware deployment starts with killing the AV. KQL queries for Microsoft Sentinel and SPL for Splunk to catch Defender disablement, service stops, taskkill abuse, and unauthorized exclusion additions before encryption begins.
Real KQL and SPL detection rules for catching LOLBin abuse — mshta, regsvr32, rundll32, WMI, and BITS Jobs — using MITRE ATT&CK T1218, T1047, and T1197 mapped queries from the df00tech library.
A practical guide to building your first SOC detection library: required logs, MITRE ATT&CK prioritisation, starter KQL and SPL queries, and a development loop that works.
A practical C2 detection rule guide for SOCs: beaconing analysis, DNS tunneling, Cobalt Strike, Sliver, and protocol tunneling with KQL and SPL queries.
Credential dumping detection for T1003.001 LSASS, SAM, and NTDS extraction. KQL and SPL queries to catch Mimikatz, ProcDump, comsvcs.dll, and DCSync in your environment.
Production-tested lateral movement detection KQL queries for Microsoft Sentinel and Defender for Endpoint covering T1021 — RDP, SMB admin shares, and WinRM.
A practical phishing detection rule guide for T1566 covering spearphishing attachments, links, and service-based phishing with KQL queries for Microsoft Defender and Sentinel.
Build a PowerShell detection rule for T1059.001 with production KQL for Microsoft Sentinel and SPL for Splunk. Covers encoded commands, AMSI bypass, and tuning.
A ransomware detection rule playbook for 2026: TTPs, KQL queries, and LockBit, BlackCat, Akira tells — catch mass file encryption and shadow copy deletion pre-detonation.
Scheduled task detection for T1053.005 with production KQL and SPL queries for Microsoft Sentinel and Splunk — covering schtasks.exe, at.exe, cron, 4698/4700/4702 events, and hidden task persistence.
SPL vs KQL for detection engineering — side-by-side Splunk and Microsoft Sentinel syntax with real queries for PowerShell, LSASS, and scheduled task detections.
The most important MITRE ATT&CK techniques every SOC analyst must detect, prioritized by real-world frequency with KQL detection coverage for each.
df00tech provides 704 production-ready KQL and SPL detection rules mapped to the MITRE ATT&CK framework. Learn how comprehensive detection coverage protects your environment.
A practical guide for SOC teams on using the MITRE ATT&CK framework to identify detection gaps, prioritise rule development, and measure coverage improvements over time.
Hands-on KQL threat hunting queries for Microsoft Sentinel, covering credential dumping, UAC bypass, log tampering, ingress tool transfer, and password spraying detection.