Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
80 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
intelligence_src_95e20fde070728fb21Recent successful batchLast successful batch: Last attempt:
intelligence_src_967fc5109ac4b9114dRecent successful batchLast successful batch: Last attempt:
intelligence_src_9a8d7f28650a850d70Recent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Healthcare organizations face an identity conundrum. Clinicians, administrators, contractors and support staff all need reliable access to applications and patient information, but every additional identity and authentication point creates another opportunity for attackers. The challenge? How to protect those accounts without slowing down the people who need to get into critical systems quickly. RSA ID Plus is designed to address both sides of that problem. The identity and access management platform combines multifactor and password-free authentication, single sign-on, adaptive access, risk…
First reported Oct 12, 2026 17:38 UTCCatalog metadata updated Oct 13, 2026 13:09 UTCOpen evidence record
Walk into a modern enterprise security operations center today, and you'll discover just how inexpensive 65-inch monitors are: The walls are covered with them, showing dashboards from security information and event management (SIEM) consoles, extended detection and response (XDR) endpoint security platforms, firewall intrusion prevention systems (IPS) and data loss protection software. It's all very impressive and mission-control. Yet breaches still occur. And after the worst of them, the postmortem is almost always a variation of the same story. Yes, the alert was received. The log clearly…
First reported Oct 09, 2026 19:44 UTCCatalog metadata updated Oct 13, 2026 13:09 UTCOpen evidence record
Mergers and acquisitions are off to a strong start in 2026. According to Kaufman Hall, there were more transactions in Q1 2026 than in any of the previous five Q1 results. That pace continued into Q2 2026, when the industry saw the highest Q2 M&A levels since 2019. Healthcare organizations are continuing to engage in M&As as a strategy to expand care access and bolster stability amid increasing economic pressures. Many of the deals were between hospitals and regional health systems. Click the banner below to sign up for HealthTech’s weekly newsletter.
First reported Sep 23, 2026 19:35 UTCCatalog metadata updated Oct 13, 2026 13:09 UTCOpen evidence record
Artificial intelligence models are evolving at a rapid clip. In a post–Claude Mythos Preview and GPT-5.5 environment, that means capabilities that could massively reduce the time and skill needed to carry out sophisticated cyberattacks are becoming more accessible than ever. For organizations across industries, traditional approaches to cybersecurity are inadequate in keeping up with this ever-changing threat landscape. In a survey of 951 IT decision-makers, CDW found that AI represents both a significant threat and a powerful tool in cybersecurity. In fact, 43% of respondents said…
First reported Sep 30, 2026 19:16 UTCCatalog metadata updated Oct 13, 2026 13:09 UTCOpen evidence record
Thank you to Peter Cullen (@pbcullen), Stefan Goetz (@stefangoetzcorelight), Jan Grashöfer (@J-Gras), Eldon Koyle (@ekoyle), Kara Zaffarano and Kyle Elliott of Trail of Bits in collaboration with OpenAI, AdaLogics in collaboration with Anthropic, and the Canadian Communications Security Establishment for their contributions to this release. This release fixes the following security issues: HIGH: SMB: Chains of AndX messages can crash Zeek Advisory: GHSA-2xc9-g36m-w7jh HIGH: DNP3: Memory exhaustion via file control (g70v1) fields Advisory: GHSA-px95-jfxw-4jw2 HIGH: SIP: Memory exhaustion from long request/response paths Advisory: GHSA-wjf9-326g-m9h3 HIGH: DHCP: Memory exhaustion from retained options after analyzer violation Advisory: GHSA-hxj7-pcq9-c949 HIGH: SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path entries Advisory: GHSA-49x5-fmqq-4ccv HIGH: SMB: DCE/RPC memory exhaustion from fragment state Advisory: GHSA-rmc2-mqq6-wcw9 HIGH: Analyzer manager: Equivalent scheduled analyzers could exhaust memory Advisory: GHSA-3gxr-8f49-vrgr HIGH: ZIP: Unbounded decompression Advisory: GHSA-2prm-q48h-m96w HIGH: Redis: Parsed Redis traffic memory exhaustion Advisory: GHSA-c573-w89f-fpxm HIGH: Invalid IPv6 fragments can lead to unbounded state growth Advisory: GHSA-84jg-cwr7-4p6w HIGH: SSH: Quadratic KEX algorithm CPU exhaustion Advisory: GHSA-5v93-pm35-5mq6 HIGH: NVT: Oversized line recovery writes before heap buffer Advisory: GHSA-hww6-p5xp-6rqv HIGH: DHCP: Unbounded state growth via join_data Advisory: GHSA-qf53-234m-7vhq HIGH: FTP: Unbounded state growth via ftp_data_expected Advisory: GHSA-9m23-gwjx-p3j8 HIGH: OCSP: Empty byName responder ID crashes Zeek Advisory: GHSA-j48p-9pm3-pgpx HIGH: ARP: Tunneled ARP traffic crashes Zeek Advisory: GHSA-924m-g9gv-45xc HIGH: LDAP: Unbounded per-connection script state Advisory: GHSA-pxc9-fc9v-r39q HIGH: IRC DCC SEND has unbounded state growth Advisory: GHSA-5h5v-fcxr-f223 HIGH: tunnel_changed event limit bypass on direct/tunneled toggles Advisory: GHSA-72qh-gpq9-cj8w HIGH: Recursive stack exhaustion from deep packet analyzer chains Advisory: GHSA-vh6p-7vxf-m7rh MEDIUM: Telnet: AUTH STATUS options before a NAME is received results in event argument mismatch Advisory: GHSA-qjhc-rfmf-3vgp MEDIUM: UDP: udp_contents events could trigger out-of-bounds reads Advisory: GHSA-q48f-3qm2-j875 MEDIUM: NetBIOS: Memory exhaustion from declared session lengths Advisory: GHSA-gq9q-85wf-mq48 MEDIUM: IRC: Single DCC Send packet can result in scripting error Advisory: GHSA-6566-755c-7mwq MEDIUM: IRC: Invalid DCC Send host/port fields can lead to unexpected parsing results Advisory: GHSA-q6c5-95ff-cwr9 This release fixes the following bugs: IN_ANYWHERE is now allowed as a wildcard in Intel files for the interface field. The Prometheus service discovery endpoint for the telemetry framework was not rendering IPv6 addresses correctly. The unknown_protocols.log previously included the IP next protocol field as a 16 bit value, with the first byte value set to the next protocol followed by a zero byte due to a spurious use of htons(). This has been fixed to be just the next protocol byte. Fixed file descriptors of the WebSocket server and WebSocket client connections (Cluster::listen_websocket()) being inherited by child processes. E.g., when using system() in Zeek scripts or the Input Framework's raw reader functionality.
First reported Aug 19, 2026 17:50 UTCCatalog metadata updated Oct 13, 2026 13:05 UTCOpen evidence record
We'd like to thank Aaron J. Scantlin (@scantlina), @airshelley, Alexey Rubanik (@Rubanik-Alexei), Azil (@achill06), Bauti Peirone (@bautipeirone), Blair McCormick (@blairSmcc03), Craig Leres (@leres), Craig P (@detection-labs), @Cxiyuan, Dragon Roar (@lczllx), @eb-anssi, Eduardo Kohn (@eagle-head), Eldon Koyle (@ekoyle), @franky-m, Jan Grashöfer (@J-Gras), Javid Khan (@dxbjavid), Jie (Link) Zheng (@chillancezen), @jmestwa-coder, Julio César Suástegui (@juliosuas), Keith J. Jones (@keithjjones), Kevin Harrington (@ke5C2Fin), Maor Hamami (@mamaorha), Mario D (@mari0d), Matthias Vallentin (@mavam), Mohan Dhawan (@mdhawan, @Mohan-Dhawan), neil (@neilpang), Otto Fowler (@ottobackwards), Peter Cullen (@pbcullen), Seth Grover (@mmguero), Shubham Kumar (@chmodshubham), Simeon Miteff (@simeonmiteff), Smoot (@stevesmoot), Stefan Götz (@stefangoetzcorelight), Steven (@malvidin), Sujala Vasanthasena Nelavai (@sujalavnelavai), Swastik Bose (@VasuBhakt), @tim-cyb, Urval (@urvalkheni), @uwezkhan and Yacin Nadji (@ynadji) for their contributions to this release. In addition, we're grateful to Kara Zaffarano and Kyle Elliott of Trail of Bits in collaboration with OpenAI, AdaLogics in collaboration with Anthropic, and the Canadian Communications Security Establishment for their code-scanning efforts and resulting bug reports. Breaking Changes Expanding on the removal of Broker::listen_websocket() in Zeek 8.1, this release fully removes Broker's legacy embedded WebSocket server. The script layer no longer provides Broker::BrokerProtocol and the options Broker::default_port_websocket, Broker::default_listen_address_websocket, Broker::web_socket_buffer_size, and Broker::web_socket_overflow_policy have likewise been removed. Use :zeek:see:Cluster::listen_websocket() and the ZEEK_WEBSOCKET_* environment variables instead. In Zeek's core, the Broker manager's Listen() method now always uses Broker's native protocol and no longer accepts the optional BrokerProtocol argument. The BrokerProtocol enum has been removed. Calling the zeek::util::fmt() helper function from non-main threads will now emit a warning of the following form once: zeek::util::fmt() called off the main thread; use threading::BasicThread::Fmt() or std::format() In a debug build, Zeek will also abort. If you see above message, it is likely that an installed plugin spawned a thread and uses the API wrongly (likely input or logging threads). When deploying custom plugins, you should optimally test Zeek and all plugins separately with the thread and address sanitizers enabled (./configure --sanitizers=thread or ./configure --sanitizers=address). The ZeekJS plugin now requires std::format from C++20 which is not available in older distributions using GCC 12.x like Debian 12. If you want to use JavaScript support in Zeek, please update to a more recent distribution. Beginning with Zeek 9.0, the Zeek team is sunsetting our official support of FreeBSD. This is primarily because of our move to a new CI provider and the lack of good support for FreeBSD. We are moving FreeBSD support to the same model as OpenBSD where we will accept patches from external contributors if we break something, but not build and run the test suite on FreeBSD ourselves. This will simplify our maintenance a bit, as well as reduce the amount of time spent on CI jobs. New Functionality The zeek-packet-source-udp (https://github.com/zeek/zeek-packet-source-udp) plugin is now included and enabled by default on Linux and FreeBSD. Instead of reading raw packets from a network interface, this packet source turns Zeek into a UDP server to process UDP-based VXLAN or GENEVE mirror traffic directly: zeek -i udp::0.0.0.0:4789:vxlan The listening UDP socket is opened using the SO_REUSEPORT socket option. When scaling the number of Zeek workers, the kernel will balance packets among the individual UDP sockets based on the hash of the outermost UDP headers. This packet source comes with a few ConnKey implementations
First reported Sep 14, 2026 19:01 UTCCatalog metadata updated Oct 13, 2026 13:05 UTCOpen evidence record
Thank you to Jan Grashöfer (@J-Gras), h4r4kIR1, Javid Khan (@dxbjavid), @jmestwa-coder, and @uwezkhan for their contributions to this release. This release fixes the following security issues: HIGH: The NVT, Rlogin, and RSH analyzers have received fixes to avoid unbounded state growth. Due to the fact that these packets can be received from remote hosts, these are considered DoS risks. The fixes include additional length-checking when processing packets, as well as a new set of weirds for when the standard Content-Line limits are exceeded. HIGH: A specially crafted WebSocket payload can cause the Spicy WebSocket analyzer to use excessive memory when processing close, ping, and pong frames. Due to the fact that these packets can be received from remote hosts, these are considered a DoS risk. The fix caps the size of those frames as per RFC 6455 (to 125 bytes) and adds a new weird for when that limit is exceeded. HIGH: A specially crafted series of Finger packets can cause the Spicy Finger analyzer to use excessive amounts of memory and potentially crash Zeek. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. The fix includes a new Finger::max_line_length script constant. Spicy will report protocol violations if this limit is exceeded. HIGH: A specially crafted Kerberos packet can cause the Kerberos analyzer to enter an invalid state and potentially crash Zeek. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. The fix includes additional checks for the state reported by the Kerberos packets. HIGH: A specially crafted series of RDP packets can cause the RDP analyzer to use excessive amounts of memory and potentially crash Zeek. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. The fix includes a new rpc_max_pending_calls script constant. If this limit is exceeded, a new rpc_discarded_pending_calls event is emitted and a weird is reported. HIGH: A specially crafted IP packet can cause the IP analyzer to read past the end of the contents of the packet when emitting the packet_contents event and possibly crash. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. The fix changes how Zeek checks the remaining length of the packet when emitting the event. The packet_contents event typically isn't used in production setups. HIGH: A specially crafted IP packet can cause the packet discarding code to read off the end of the packet when looking for follow-on header data. This may potentially lead to a crash of Zeek. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. Note that this only applies if the user enables the discarder by implementing one of the discarder_check_* script functions. The fix includes additional length checks to the IP_HDr::ToPktHdrVal method to skip looking for additional headers if there isn’t enough data. HIGH: A specially crafted series of Gnutella packets may cause Zeek to continue accumulating memory and eventually crash. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. Note that the Gnutella analyzer is disabled by default. The fix includes new Gnutella::max_line_length and Gnutella::max_header_length script constant values to control the maximum size of data processed, as well as new weirds for when the limits are exceeded. MEDIUM: A specially crafted ICMPv6 packet can cause the ICMP analyzer to skip part of the packet and not report corresponding events and logs. Due to the fact that these packets can be received from remote hosts, this is considered an evasion risk. The fix includes additional length-checking and five new weirds to cover the cases where the checks fail. MEDIUM: A specially crafted SSH packet can cause the SSH analyzer to throw BinPAC exceptions for extremely large packets
First reported Jul 10, 2026 20:04 UTCCatalog metadata updated Oct 13, 2026 13:05 UTCOpen evidence record
Thank you to Jan Grashöfer (@J-Gras), h4r4kIR1, Javid Khan (@dxbjavid), @jmestwa-coder, and @uwezkhan for their contributions to this release. This release fixes the following security issues: HIGH: The NVT, Rlogin, and RSH analyzers have received fixes to avoid unbounded state growth. Due to the fact that these packets can be received from remote hosts, these are considered DoS risks. The fixes include additional length-checking when processing packets, as well as a new set of weirds for when the standard Content-Line limits are exceeded. HIGH: A specially crafted WebSocket payload can cause the Spicy WebSocket analyzer to use excessive memory when processing close, ping, and pong frames. Due to the fact that these packets can be received from remote hosts, these are considered a DoS risk. The fix caps the size of those frames as per RFC 6455 (to 125 bytes) and adds a new weird for when that limit is exceeded. HIGH: A specially crafted series of Finger packets can cause the Spicy Finger analyzer to use excessive amounts of memory and potentially crash Zeek. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. The fix includes a new Finger::max_line_length script constant. Spicy will report protocol violations if this limit is exceeded. HIGH: A specially crafted Kerberos packet can cause the Kerberos analyzer to enter an invalid state and potentially crash Zeek. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. The fix includes additional checks for the state reported by the Kerberos packets. HIGH: A specially crafted series of RDP packets can cause the RDP analyzer to use excessive amounts of memory and potentially crash Zeek. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. The fix includes a new rpc_max_pending_calls script constant. If this limit is exceeded, a new rpc_discarded_pending_calls event is emitted and a weird is reported. HIGH: A specially crafted IP packet can cause the IP analyzer to read past the end of the contents of the packet when emitting the packet_contents event and possibly crash. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. The fix changes how Zeek checks the remaining length of the packet when emitting the event. The packet_contents event typically isn't used in production setups. HIGH: A specially crafted IP packet can cause the packet discarding code to read off the end of the packet when looking for follow-on header data. This may potentially lead to a crash of Zeek. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. Note that this only applies if the user enables the discarder by implementing one of the discarder_check_* script functions. The fix includes additional length checks to the IP_HDr::ToPktHdrVal method to skip looking for additional headers if there isn’t enough data. HIGH: A specially crafted series of Gnutella packets may cause Zeek to continue accumulating memory and eventually crash. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. Note that the Gnutella analyzer is disabled by default. The fix includes new Gnutella::max_line_length and Gnutella::max_header_length script constant values to control the maximum size of data processed, as well as new weirds for when the limits are exceeded. MEDIUM: A specially crafted ICMPv6 packet can cause the ICMP analyzer to skip part of the packet and not report corresponding events and logs. Due to the fact that these packets can be received from remote hosts, this is considered an evasion risk. The fix includes additional length-checking and five new weirds to cover the cases where the checks fail. MEDIUM: A specially crafted SSH packet can cause the SSH analyzer to throw BinPAC exceptions for extremely large packets
First reported Jul 10, 2026 20:04 UTCCatalog metadata updated Oct 13, 2026 13:05 UTCOpen evidence record
Thank you to Peter Cullen (@pbcullen), Stefan Goetz (@stefangoetzcorelight), Jan Grashöfer (@J-Gras), Eldon Koyle (@ekoyle), Simeon Miteff (simeonmiteff), Kara Zaffarano and Kyle Elliott of Trail of Bits in collaboration with OpenAI, AdaLogics in collaboration with Anthropic, and the Canadian Communications Security Establishment for their contributions to this release. This release fixes the following security issues: HIGH: SMB: Chains of AndX messages can crash Zeek Advisory: GHSA-2xc9-g36m-w7jh HIGH: DNP3: Memory exhaustion via file control (g70v1) fields Advisory: GHSA-px95-jfxw-4jw2 HIGH: SIP: Memory exhaustion from long request/response paths Advisory: GHSA-wjf9-326g-m9h3 HIGH: DHCP: Memory exhaustion from retained options after analyzer violation Advisory: GHSA-hxj7-pcq9-c949 HIGH: SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path entries Advisory: GHSA-49x5-fmqq-4ccv HIGH: SMB: DCE/RPC memory exhaustion from fragment state Advisory: GHSA-rmc2-mqq6-wcw9 HIGH: Analyzer manager: Equivalent scheduled analyzers could exhaust memory Advisory: GHSA-3gxr-8f49-vrgr HIGH: ZIP: Unbounded decompression Advisory: GHSA-2prm-q48h-m96w HIGH: Redis: Parsed Redis traffic memory exhaustion Advisory: GHSA-c573-w89f-fpxm HIGH: Invalid IPv6 fragments can lead to unbounded state growth Advisory: GHSA-84jg-cwr7-4p6w HIGH: SSH: Quadratic KEX algorithm CPU exhaustion Advisory: GHSA-5v93-pm35-5mq6 HIGH: NVT: Oversized line recovery writes before heap buffer Advisory: GHSA-hww6-p5xp-6rqv HIGH: DHCP: Unbounded state growth via join_data Advisory: GHSA-qf53-234m-7vhq HIGH: FTP: Unbounded state growth via ftp_data_expected Advisory: GHSA-9m23-gwjx-p3j8 HIGH: OCSP: Empty byName responder ID crashes Zeek Advisory: GHSA-j48p-9pm3-pgpx HIGH: ARP: Tunneled ARP traffic crashes Zeek Advisory: GHSA-924m-g9gv-45xc HIGH: LDAP: Unbounded per-connection script state Advisory: GHSA-pxc9-fc9v-r39q HIGH: IRC DCC SEND has unbounded state growth Advisory: GHSA-5h5v-fcxr-f223 HIGH: tunnel_changed event limit bypass on direct/tunneled toggles Advisory: GHSA-72qh-gpq9-cj8w HIGH: Recursive stack exhaustion from deep packet analyzer chains Advisory: GHSA-vh6p-7vxf-m7rh MEDIUM: Telnet: AUTH STATUS options before a NAME is received results in event argument mismatch Advisory: GHSA-qjhc-rfmf-3vgp MEDIUM: UDP: udp_contents events could trigger out-of-bounds reads Advisory: GHSA-q48f-3qm2-j875 MEDIUM: NetBIOS: Memory exhaustion from declared session lengths Advisory: GHSA-gq9q-85wf-mq48 MEDIUM: IRC: Single DCC Send packet can result in scripting error Advisory: GHSA-6566-755c-7mwq MEDIUM: IRC: Invalid DCC Send host/port fields can lead to unexpected parsing results Advisory: GHSA-q6c5-95ff-cwr9 This release fixes the following bugs: IN_ANYWHERE is now allowed as a wildcard in Intel files for the interface field. The Prometheus service discovery endpoint for the telemetry framework was not rendering IPv6 addresses correctly. The unknown_protocols.log previously included the IP next protocol field as a 16 bit value, with the first byte value set to the next protocol followed by a zero byte due to a spurious use of htons(). This has been fixed to be just the next protocol byte. Fixed file descriptors of the WebSocket server and WebSocket client connections (Cluster::listen_websocket()) being inherited by child processes. E.g., when using system() in Zeek scripts or the Input Framework's raw reader functionality.
First reported Aug 19, 2026 17:51 UTCCatalog metadata updated Oct 13, 2026 13:05 UTCOpen evidence record
Seb Moss speaks with Ben Pritchard of AVK about meeting data center power demands via microgrids, innovative pod factories, and creative financing backed by a $1B investment.
First reported Oct 12, 2026 16:32 UTCCatalog metadata updated Oct 13, 2026 13:03 UTCOpen evidence record
Seb Moss speaks with Nick Marlow of BCS about the evolving European data center landscape, from rising power demands to the challenges of site selection
First reported Oct 12, 2026 16:11 UTCCatalog metadata updated Oct 13, 2026 13:03 UTCOpen evidence record
To spin off 2.2GW non-Nordic AI data center portfolio into a new listed firm
First reported Oct 13, 2026 10:41 UTCCatalog metadata updated Oct 13, 2026 13:03 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.