This GreyNoise Labs report provides detailed analysis of out-of-band interaction domain (OAST) activity observed during January 3-9, 2026, identifying three distinct campaigns exploiting vulnerabilities including MCP server command injection and React2Shell (CVE-2025-55182). It includes comprehensive telemetry such as JA4 fingerprint clusters, payload samples, IOC tables, and detection recommendations, offering actionable intelligence for defenders.
This GitHub repository provides a detailed analysis and proof-of-concept exploit for CVE-2026-21440, a critical path traversal vulnerability in the AdonisJS framework's multipart file upload handling. The vulnerability allows unauthenticated remote attackers to write arbitrary files on the server, potentially leading to remote code execution. The repository includes remediation guidance, affected versions, and a safe testing script for defenders.
A hacker known as "James" leaked the complete user database of BreachForums, a major Dark Web forum for stolen data trading and hacking discussions. The breach exposes detailed user metadata including usernames, hashed passwords, emails, IP addresses, and PGP keys, affecting over 320,000 users and potentially aiding law enforcement investigations. The incident highlights vulnerabilities in cybercriminal infrastructure and provides actionable intelligence on key threat actors and forum operators.
I&#;x26;#;39;m always looking for new ways of manipulating the data captured by my DShield sensor [1]. This time I used Gephi [2] and Graphiz [3] a popular and powerful tool for visualizing and exploring relationships between nodes, to examine the relationship between the source IP, filename and which sensor got a copy of the file. I queried the past 30 days of data stored in my ELK [4] database in Kibana using ES|QL [5][6] to query and export the data and import the result into Gephi. 
For the latest discoveries in cyber research for the week of 5th January, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Two US banks, Artisans’ Bank and VeraBank, disclosed that customer data was exposed in an August ransomware attack on their vendor, Marquis Software. The vendor was breached via SonicWall vulnerability, and while […] The post 5th January – Threat Intelligence Report appeared first on Check Point Research .
For the latest discoveries in cyber research for the week of 29th December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Romanian Waters, the country’s national water management authority, was hit by a ransomware attack that resulted in nearly 1,000 computer systems across national and regional offices being encrypted. The attack affected geographic […] The post 29th December – Threat Intelligence Report appeared first on Check Point Research .
For the latest discoveries in cyber research for the week of 22nd December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES An adult content platform PornHub has disclosed a data breach linked to analytics provider Mixpanel. The breach exposed more than 200 million records related to Premium users, including email addresses, search, watch, […] The post 22nd December – Threat Intelligence Report appeared first on Check Point Research .
The British government is investigating a “cyber incident” following news reports that hackers linked to China have gained access to thousands of confidential documents. The post UK Government Acknowledges It Is Investigating Cyber Incident After Media Reports appeared first on SecurityWeek .
The trucking industry group has released its 2026 Transportation Industry Cybersecurity Trends Report. The post NMFTA Warns of Surge and Sophistication of Cyber-Enabled Cargo Theft appeared first on SecurityWeek .
This content announces the launch of the new Project Zero blog, highlighting past research posts on Windows exploitation techniques and zero-day vulnerabilities. It does not describe a specific vulnerability or active threat but rather serves as an informational update about ongoing research efforts.
For the latest discoveries in cyber research for the week of 15th December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The Indian government confirmed cyber incidents involving GPS spoofing at seven major airports, including Delhi, Mumbai, Kolkata, and Bengaluru. The attack affected aircrafts using GPS-based landing procedures. Despite signal disruption to navigation […] The post 15th December – Threat Intelligence Report appeared first on Check Point Research .
For the latest discoveries in cyber research for the week of 8th December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The University of Pennsylvania and the University of Phoenix were hit by data breaches after attackers exploited zero-day vulnerabilities in Oracle E-Business Suite servers. At least 1,488 people at UPenn and numerous […] The post 8th December – Threat Intelligence Report appeared first on Check Point Research .
The 25-page document outlines four principles for securely integrating AI with operational technology. The post Global Cyber Agencies Issue AI Security Guidance for Critical Infrastructure OT appeared first on SecurityWeek .
This report details the creation of a PrintSpoofer exploit from scratch, demonstrating how the SeImpersonatePrivilege can be abused to escalate privileges from a user with limited rights (such as IIS AppPool identities) to SYSTEM on Windows. The exploit leverages Windows Named Pipes and the Print Spooler's RPC interface, bypassing path validation via a forward slash trick to cause the SYSTEM service to connect to a malicious pipe. This connection allows token impersonation and ultimately spawning a SYSTEM shell. The author documents the technical journey including Windows internals, token manipulation, RPC calls, and evasion techniques.
We explain how vulnerabilities in DeckMate 2 shuffling machines allowed criminals to gain insights into opponents’ hands and win massive sums at poker.
By: Dikla Barda, Roman Zaikin, and Oded Vanunu On November 30, 2025, Check Point Research detected a critical exploit targeting Yearn Finance’s yETH pool on Ethereum. Within hours, approximately $9 million was stolen from the protocol. The attacker achieved this by minting an astronomical number of tokens—235 septillion yETH (a 41-digit number)—while depositing only 16 […] The post The $9M yETH Exploit: How 16 Wei Became Infinite Tokens appeared first on Check Point Research .
For the latest discoveries in cyber research for the week of 1st December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES OpenAI has experienced a data breach resulting from a compromise at third-party analytics provider Mixpanel, which exposed limited information of some ChatGPT API clients. The leaked data includes names, email addresses, approximate […] The post 1st December – Threat Intelligence Report appeared first on Check Point Research .
