Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
31 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_5feda8a4ed64053ab2Collection status unverifiedLast successful batch: Unverified
src_b53fef74a3c7e31cbcCollection status unverifiedLast successful batch: Unverified
src_cd2ab764e32599c232Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
We explore how AWS neutralizes exposed IAM credentials using managed policies, detailing GitHub secret scanning and CloudTrail monitoring strategies. The post From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies appeared first on Unit 42.
First reported Sep 21, 2026 10:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
Cross-environment attacks demand a new approach to security operations. Learn how Unit 42 Managed XSIAM helps SOC teams investigate complete attack paths. The post Inside the Modern SOC: Defending the Cross-Environment Pivot appeared first on Unit 42.
First reported Sep 17, 2026 22:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments The post Evolution of Web3 in Cloud Supply Chain Attacks appeared first on Unit 42.
First reported Oct 07, 2026 22:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
Explore how attackers targeting Latin American entities use AI for data exfiltration and how basic OpSec errors allow defenders to disrupt operations. The post Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America appeared first on Unit 42.
First reported Sep 03, 2026 10:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
Learn how the Spring Ring campaign abuses Microsoft Teams and voice phishing to deploy malware and target enterprise domain controllers. The post Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams appeared first on Unit 42.
First reported Aug 31, 2026 10:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could pos
First reported Oct 06, 2026 15:46 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271) It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. T
First reported Oct 06, 2026 16:43 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free in midcomms commit While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning: . In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() This patch fix
First reported Oct 07, 2026 09:53 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
It was discovered that librsvg incorrectly handled duplicate XML entity declarations while processing SVG documents containing nested XML inclusions. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
First reported Oct 06, 2026 17:47 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
It was discovered that Sudo did not properly handle time-based access restrictions when sudoers rules used NOTBEFORE or NOTAFTER with timestamps omitting the trailing timezone indicator. A local attacker could possibly use this issue to execute commands outside the intended time window by manipulating the TZ environment variable.
First reported Oct 07, 2026 13:12 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
Darshan U discovered that Ubuntu Pro for WSL exposed the attach token in command-line arguments when enabling a subscription on a WSL instance. An attacker could possibly use this issue to obtain sensitive information and gain unauthorized access to Ubuntu Pro repositories.
First reported Oct 06, 2026 20:11 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
Timo Preißl discovered that U-Boot incorrectly handled certain malformed ZFS file system metadata. An attacker could possibly use this issue to trigger an integer overflow and out-of-bounds memory access, resulting in arbitrary code execution or a denial of service. (CVE-2025-70290) Timo Preißl discovered that U-Boot incorrectly calculated buffer sizes when processing certain ext4 file systems. An
First reported Oct 06, 2026 16:09 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
It was discovered that Poppler had an integer overflow in FoFiTrueType::cvtSfnts. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-102620) It was discovered that Poppler had an integer overflow in SplashClip::clipToPath. An attacker could possibly use this issue to cause Poppler to crash, resulting in a deni
First reported Oct 07, 2026 13:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
It was discovered that Go Networking did not properly handle server errors after sending a GOAWAY frame during HTTP/2 connection shutdown, which could cause the connection to hang. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2022-27664) It was discovered that Go Networking had quadratic complexity when decoding HPACK headers in HTTP/2 streams. A remote attack
First reported Oct 07, 2026 19:09 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
It was discovered that libwebsockets did not properly validate user-supplied data when parsing HTTP/2 HPACK path headers, which could result in a write past the end of an allocated buffer. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-19773) It was discovered that libwebsockets did not properly handle CBOR recording in the LECP parser, which could result in a write
First reported Oct 07, 2026 10:05 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
AWS WAF logs are keeping receipts, including your session tokens. In this blog, we walk through the risk of default WAF logging configurations and the tool built to pull, analyze, and replay what gets left behind.
First reported Sep 01, 2026 04:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
AI doesn't let attackers walk through walls, but it makes finding the cracks more efficient. In this blog, we cut through the hype and explain what AI-driven offense really looks like and why hard controls still work.
First reported Aug 13, 2026 04:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
The AWS access keys are in hand... now what? In Part 1 of this blog series, we break down AWS credential types, where to find them, and how to validate and use them during a security engagement.
First reported Sep 10, 2026 04:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
SpooNMAP used to hand you a list of open ports; the latest update tells you which ones actually matter. In this blog, we detail the new automated findings reporting, LLM detection, and performance improvements.
First reported Aug 25, 2026 04:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
Logging isn't a switch to flip; it's something to tune and maintain. In this blog, we outline a four-step Active Directory logging framework covering log sizing, audit policies, detection goals, and gap analysis.
First reported Oct 06, 2026 04:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
Manufacturing knows what happens when IT and OT divide; AI governance is an unexpected chance to do it differently. In this blog, we walk through a unified governance model that bridges both before bad habits set in.
First reported Aug 18, 2026 04:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
Meet HashcatRosetta—the Hashcat rule decoder you didn't know you needed. In Part 2 of this blog series, we go through how it translates, analyzes, and optimizes rule files to maximize cracking efficiency.
First reported Oct 01, 2026 04:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
Six stages. Multiple encryption layers. One static analysis. In this blog, we unpack a multi-stage malware loader combining Python obfuscation, Donut shellcode, and laZzzy PE encryption, without executing the payload.
First reported Sep 17, 2026 04:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.