Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

CERT/CC

AWS Security Bulletins

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

CIRCL OSINT Feed

Threatpost

ThreatFox MISP Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, involving out-of-memory corruption during multipart/form-data parsing via session.upload_progress, were leaked before their scheduled patch date. These vulnerabilities have a CVSS v4.0 score of 9.2 but no confirmed successful exploitation in the wild as of October 21, 2026. Scanning activity began shortly after the patch release, linked to a Mirai-style IoT botnet targeting platforms like WooCommerce, WHMCS, and Magento. Despite exposure of over 683,000 IPs running vulnerable PHP versions, technical challenges such as address-space randomization limited reliable exploitation. No official patch information is provided in the data. The threat is currently categorized as a campaign involving php2shell tooling staged across multiple attacker workspaces.

CVE-2026-109618 and CVE-2026-109619 are critical remote code execution vulnerabilities in PHP core caused by out-of-memory corruption during multipart/form-data parsing, exploitable without authentication via session.upload_progress. These flaws were leaked prior to their scheduled patch on October 21, 2026, with scanning and attack attempts detected within 20 minutes of patch release. The attacker infrastructure analysis revealed multiple workspaces preparing php2shell exploit tools targeting popular e-commerce and hosting platforms such as WooCommerce, WHMCS, and Magento. Although over 683,000 IPs with vulnerable PHP versions were exposed, no confirmed successful exploitation was observed, likely due to the complexity of bypassing address-space randomization protections. The campaign activity is linked to a Mirai-style IoT botnet. No patch or remediation details are provided in the input data.

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, involving out-of-memory corruption during multipart/form-data parsing via session.upload_progress, were leaked before their scheduled patch date. These vulnerabilities have a CVSS v4.0 score of 9.2 but no co

Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)

Threats Tagged 'mirai botnet'