AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
Æ / PUBLIC MALWARE INTELLIGENCE

Follow the evidence.

Published file metadata, source observations, indicators, and research history in one bounded catalog.

2,400+Reachable catalog records
28 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page

Feed collection status

Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.

1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.

Review source update dates and status
  • src_dd4a4c98d64bc46b3fCollection status unverifiedLast successful batch: Unverified

Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.

Clear filters
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
REPORT1 SOURCE

The Linuxsys Cryptominer

VulnCheck observes exploitation of CVE-2021-41773 in the wild, and attributes the attack to the Linuxsys cryptominer. The team additionally discovers that the cryptominer has been part of a long-running campaign exploiting multiple vulnerabilities with a consistent attacker methodology since at least 2021.

First reported Jul 17, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

SiftRanking Canary Intelligence

Canary Intelligence captures thousands of real-world exploitation attempts every day, but scale alone does not create insight. This post walks through how clustering, structured feature extraction, and SiftRank transform raw exploitation telemetry into AI-driven prioritization. The result is a repeatable workflow that surfaces high-leverage attacker activity in minutes.

First reported Mar 02, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

Monsta FTP: An SSRF Blocklist That Forgot IPv6 Exists

VulnCheck's Initial Access Intelligence team details an unauthenticated SSRF in Monsta FTP 2.14.4, where an IPv4-only blocklist waves through the IPv4-mapped IPv6 form of the cloud metadata endpoint and bypasses both the front gate and the anti-rebinding recheck.

First reported Jul 14, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

Exposing CVEs from Black Bastas' Chats

Late last week, chat logs from Black Basta became available, offering rare insight into the operations of one of the most infamous ransomware groups. This research focuses on the vulnerabilities and CVEs mentioned in these logs, with the goal of providing defenders with actionable intelligence on the tactics of Black Basta.

First reported Feb 24, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

Zyxel HTTP Vulnerability

As a follow-up to our previous Zyxel Telnet Vulnerabilities blog, VulnCheck examines CVE-2024-40890, a recently disclosed vulnerability in the HTTP interface of many end-of-life Zyxel CPE routers.

First reported Feb 07, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

Virtualizor: The Login Parameter That Skips the Login

VulnCheck's Initial Access Intelligence team details an unauthenticated remote root RCE in the Virtualizor admin panel, where the pre-auth billing-module hook is guarded only against requests whose act is not 'login', so act=login walks straight into it, the hook unserializes an attacker POST field and splices its uid into a root shell, and the parameterized queries do not help because MySQL casts

First reported Sep 22, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

n8n Should Have More Than One CISA KEV Entry

CISA recently added CVE-2025-68613, an authenticated n8n RCE, to its KEV catalog, but that framing misses how the vulnerability is actually exploited. In practice, it can be paired with CVE-2026-21858, an authentication bypass that is already being actively exploited in the wild. With over 14,000 exposed n8n instances, this attack path is both practical and widespread. The bypass enabling these ch

First reported Mar 20, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

FileRun: Four More Ways to Run Your Files

VulnCheck's Initial Access Intelligence team details four authenticated remote code execution vulnerabilities in FileRun, where a contact-sheet handler and a settings test endpoint run attacker input through a shell, and a delegated administrator turns a control-panel field into stacked SQL that a permission-blob deserialization weaponizes into a webshell.

First reported Sep 10, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

WP2Shell Vulnerabilities: CVE-2026-60137 and CVE-2026-63030

Two new WordPress core vulnerabilities were disclosed on July 17, prompting broad concern from the security community. CVE-2026-60137 and CVE-2026-63030 are able to be chained for remote code execution against out-of-the-box WordPress installations, with multiple paths to RCE possible.

First reported Jul 17, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

React2Shell and What Our Canaries See

We're already seeing active React2Shell exploitation, and defenders need to know what it looks like. VulnCheck Canary Intelligence has captured real attacker probes and payloads, offering early insight into how operators are weaponizing the vulnerability. The post includes detailed examples and a list of observed IPs to support immediate defensive action.

First reported Dec 09, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
REPORT1 SOURCE

FileRun: When Your File Manager Runs Your Files

VulnCheck's Initial Access Intelligence team details an OS command injection in FileRun's thumbnail generation, where the extractors pass user-controlled filenames to exec() without shell escaping, yielding remote code execution for any authenticated user or, through a public file-request weblink, without credentials.

First reported Aug 13, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record

The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.

A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.