Web Shell

Adobe ColdFusion security bulletin APSB26-68 patches 11 CVEs across ColdFusion 2025 and 2023, including critical arbitrary file read/write vulnerabilities in the RDS module and a path traversal in the CKEditor file manager upload endpoint. When RDS is enabled with authentication disabled, attackers can use the simple length-prefixed RDS RPC protocol to read or write arbitrary files, achieving remote code execution as SYSTEM by deploying a CFML webshell. A separate unauthenticated path traversal in the CKEditor file manager allows file uploads to arbitrary directories, also executing as SYSTEM.

Kaspersky's 2025 compromise assessment report reveals that organizations consistently fail to detect long-dwelling threats, with 30.8% of incidents persisting over 3 months and 52% of high-severity compromises going undetected for 90+ days. Key findings include widespread abuse of LoLBins and remote management tools in every incident-bearing engagement, 40% of web shells surviving in backups to be restored post-remediation, and a strong correlation between in-house forensics/reverse-engineering capability and reduced incident severity. Multiple case studies document dormant crypto-mining on domain controllers (4 years), in-memory LionTail implants on critical servers, PurpleFox rootkit infections evading EDR with disabled memory scanning, and ClipBanker persistence via registry Run keys with Defender exclusions.

Within five days of exposing an Ivanti Sentry management surface to the internet, a controlled sensor recorded ten distinct operators attempting to exploit CVE-2026-10520, the CVSS 10.0 pre-authentication command-injection flaw that CISA had added to its Known Exploited Vulnerab…

2026-05-245 minCheck Pointcritical

This threat intelligence report highlights a surge in ransomware activity, critical zero-day vulnerabilities in Windows, and the active exploitation of Cisco Catalyst SD-WAN controllers. Additionally, it details emerging AI-driven threats, including malicious Hugging Face repositories and the abuse of AI website generators for phishing, alongside an APT intrusion by FamousSparrow targeting the energy sector.

2026-05-136 minMicrosoftcritical

A sophisticated threat actor compromised a third-party IT services provider to abuse legitimate HPE Operations Agent infrastructure, enabling stealthy execution and discovery. The attackers established persistence and harvested credentials using malicious network provider and password filter DLLs on domain controllers, while utilizing web shells and ngrok tunnels to maintain long-term, undetected access.

2026-05-135 minRecorded Futurecritical

In March 2026, 31 high-impact vulnerabilities were actively exploited, highlighted by the Interlock Ransomware Group leveraging a CVSS 10.0 zero-day in Cisco Secure FMC (CVE-2026-20131). The attackers utilized insecure Java deserialization to gain root access, deploying custom RATs, memory-resident web shells, and ransomware across enterprise networks.

2026-05-134 minAkamaicritical

A critical unauthenticated remote code execution vulnerability (APSB25-94) in Magento Open Source and Adobe Commerce allows attackers to upload polyglot files containing PHP code. By exploiting the REST API's cart item custom options, attackers can bypass basic image validation to deploy web shells and execute arbitrary code on the server.

2026-05-135 minCisco Taloshigh

Threat actors increasingly abuse legitimate native utilities, third-party tools, and cloud service clients for data exfiltration, bypassing traditional static detections. The Exfiltration Framework models the behavioral and forensic characteristics of these tools to enable detection based on execution context, network patterns, and artifact persistence rather than tool presence.