Universal Vulnerability Intelligence (UVI)

Apache Log4j2 JNDI Message Lookup Remote Code Execution (Log4Shell)

Unauthenticated remote code execution via recursive JNDI resolution in log messages across enterprise Java applications.

XZ Utils / Liblzma Upstream Supply Chain Backdoor in sshd Authentication

Critical malicious backdoor inserted into xz-utils liblzma enabling unauthorized authentication bypass in OpenSSH daemon.

Node.js Child Process Windows Batch File Command Injection (BatBadBut)

Improper argument escaping in child_process.spawn on Windows permits arbitrary shell command execution via batch files (.bat/.cmd).

runc Leaked Host File Descriptor Host Root Filesystem Overwrite Container Breakout

Vulnerability in runc allows malicious container images or exec sessions to overwrite host binaries and achieve full host breakout.

Rust std::process Command Argument Injection on Windows (BatBadBut)

Improper command-line argument escaping in Rust standard library on Windows enables arbitrary command execution.

OpenSSH Server RegreSSHion Pre-Authentication Remote Code Execution

Signal handler race condition in OpenSSH daemon permits unauthenticated remote code execution as root on glibc Linux systems.

Windows TCP/IP Stack IPv6 Packet Processing Remote Code Execution

Zero-click remote code execution in Windows TCP/IP kernel stack triggered by specially crafted IPv6 packets.

HTTP/2 Rapid Reset Stream Multiplexing Distributed Denial of Service

Flaw in HTTP/2 protocol stream cancellation permits unprecedented distributed denial of service volumetric attacks.

libcurl SOCKS5 Hostname Resolution Heap Buffer Overflow

Heap-based buffer overflow in libcurl during SOCKS5 proxy handshake permits arbitrary code execution or crash.

Git Client Recursive Clone Remote Code Execution via Malicious Submodules

Vulnerability in Git client allows arbitrary code execution during 'git clone --recursive' on case-insensitive filesystems (Windows/macOS).

libwebp Lossless Image Decoding Heap Buffer Overflow Zero-Day

Actively exploited heap buffer overflow in libwebp library enables remote code execution when rendering malicious WebP images.

Spring Cloud Function & Framework SpEL ClassLoader Remote Code Execution (Spring4Shell)

Unauthenticated remote code execution in Spring Framework via class binding on Java 9+ runtimes.

Kubernetes Ingress-Nginx Incomplete Annotation Validation Arbitrary Code Injection

Improper input sanitization in ingress-nginx annotations allows arbitrary code execution and cluster credential theft.

Large-Scale PyPI and npm Package Typosquatting Credential Exfiltration Campaign

Automated distribution of over 300 trojanized open-source packages executing postinstall scripts to steal SSH keys and AWS secrets.

glibc Dynamic Loader Buffer Overflow via GLIBC_TUNABLES (Looney Tunables)

Local privilege escalation to root in GNU C library dynamic loader triggered by crafted GLIBC_TUNABLES environment variable.

Visual Studio Code / Electron Workspace Trust Command Injection Bypass

Bypass of Workspace Trust security boundary permits arbitrary code execution upon opening untrusted git repositories.

Jenkins Core CLI args4j Arbitrary File Read and Remote Code Execution

Unauthenticated arbitrary file read on Jenkins controllers via args4j @ file expansion feature leading to full server takeover.

Docker Desktop Windows and macOS Host File Overwrite Vulnerability

Symlink traversal vulnerability in Docker Desktop container mount synchronization allows host filesystem write.

Sudo Heap-Based Buffer Overflow Local Root Privilege Escalation (Baron Samedit)

Heap buffer overflow in Sudo allows any local user to obtain root privileges without authentication.

PostgreSQL pg_dump and pg_dumpall SQL Injection and Command Execution

Improper quoting in pg_dump when dumping databases containing object names with newlines permits code execution.

OpenSSL X.509 Certificate Name Constraint Punycode Buffer Overflow

Buffer overflow in OpenSSL during certificate verification when parsing email addresses containing Punycode characters.

OpenSSL TLS Heartbeat Extension Memory Information Disclosure (Heartbleed)

Catastrophic missing bounds check in OpenSSL Heartbeat extension enables unauthenticated remote memory dumping.

Microsoft Windows SMBv1 Server Remote Code Execution (EternalBlue / WannaCry)

Zero-click remote code execution in Windows SMBv1 server protocol exploited by WannaCry and NotPetya worms.

SolarWinds Orion Platform SUNBURST Supply Chain DLL Backdoor

Trojanized SolarWinds.Orion.Core.BusinessLayer.dll injected into official build releases by nation-state actors.

npm Event-Stream Flatmap-Stream Social Engineering Supply Chain Attack

Legitimate maintainer social engineered into transferring npm package ownership to attacker who injected Bitcoin wallet stealer.

HTTP/2 CONTINUATION Frame Flood Denial of Service across Web Servers & Proxies

Unbounded HTTP/2 CONTINUATION frame processing permits remote resource exhaustion and server crash.

Go net/http Content-Length Chunked Encoding HTTP Request Smuggling

Inconsistent handling of chunked transfer encoding in Go HTTP server permits HTTP request smuggling.

Jinja2 Template Engine XML/HTML Attribute Injection via Macro Arguments

Flaw in Jinja2 XML and HTML attribute escaping allows attribute injection and Cross-Site Scripting (XSS).

OpenSSL ChaCha20-Poly1305 Cipher State Corruption and Cryptographic Bypass

Improper state handling in OpenSSL ChaCha20-Poly1305 can result in uninitialized memory leaks or integrity bypass.

Progress Software MOVEit Transfer SQL Injection Zero-Day (CL0P Ransomware)

Unauthenticated SQL injection in MOVEit Transfer web application exploited in massive global corporate extortion campaign.

VS Code Extension Marketplace Typosquat 'vscode-prettier-formatter' ClipBanker Trojan

Malicious VS Code extension impersonating official Prettier formatter injects cryptocurrency address substitution malware.

Malicious NPM Package 'aws-credential-sync' Stealing Local AWS & SSH Keys

Trojanized npm utility claiming to synchronize AWS profiles silently exfiltrates ~/.aws/credentials and ~/.ssh/id_rsa to Discord webhooks.

Malicious PyPI Package 'kubernetes-helm-helper' Deploying Subnet Reverse Shell

Typosquat on Python Package Index embeds obfuscated reverse shell connecting developer machines to command-and-control server.

Typosquat NPM Package 'solana-web3-utils' Exfiltrating Private Keys from Local .env Files

Malicious package targeting blockchain developers recursively searches directories for .env files containing private keys.

Malicious VS Code Extension 'rust-analyzer-turbo' Side-Loading Obfuscated C2 Beacon

Fake high-performance Rust extension drops native dynamic library executing Cobalt Strike beacon in developer background.

Malicious NPM Package 'react-native-debugger-pro' Harvesting iOS/Android Simulator Tokens

Trojanized mobile debugging library reads simulator Keychain files and browser cookies on developer MacBooks.

Trojanized Terraform Provider 'terraform-provider-cloudstack' Exfiltrating State Files

Malicious Terraform provider published to public registry intercepts terraform apply to steal terraform.tfstate plaintext secrets.

Malicious Go Module 'go-grpc-healthcheck' Stealing CI/CD Environment Variables via init()

Backdoored Go module executes covert token theft during package initialization using Go runtime init() function.

Malicious NPM Package 'vite-plugin-pwa-analyzer' Bundling Silent Cryptominer into Builds

Trojanized Vite plugin injects obfuscated WebAssembly cryptocurrency miner into generated production JavaScript bundles.

Malicious NPM Package 'electron-builder-macos-helper' Stealing Apple Signing Certificates

Trojanized npm package targeting desktop app developers extracts Apple Developer ID code signing certificates and passwords.

QakBot & Cobalt Strike Multi-Feed C2 Infiltration & Stage 2 Beaconing Campaign

Coordinated malware delivery campaign using weaponized ZIP attachments and DLL sideloading to establish resilient Cobalt Strike and QakBot C2 beacon channels.

Deceptive Developer Phishing & Malicious GitHub OAuth Token Harvester Campaign

Targeted credential harvesting and rogue OAuth consent flow impersonating legitimate CI/CD code review bots to siphon private enterprise repositories.

Global Distributed SSH & Developer Runner Brute-Force Botnet Spray

High-volume distributed brute-force network targeting public SSH bastions, developer devboxes, and cloud CI/CD runners.

Edge Gateway Authentication Bypass & Weaponized Zero-Day Exploit Wave

Remote unauthenticated code execution in edge enterprise gateways exhibits 97th percentile EPSS exploitation probability.

Polyfill.io CDN Domain Acquisition & Malicious Script Redirection Supply Chain Attack

Compromised CDN domain polyfill.io served dynamic malicious redirects targeting mobile browsers across 100,000+ websites.

Microsoft Netlogon Cryptographic Flaw Elevation of Privilege (Zerologon)

Flaw in AES-CFB8 implementation allows unauthenticated domain elevation to Domain Admin in seconds.

Apache Commons Text Remote Code Execution via StringSubstitutor Interpolator (Text4Shell)

Improper variable interpolation in StringSubstitutor enables unauthenticated RCE via dns, url, and script prefixes.

Microsoft Outlook MonikerLink NTLM Credential Leaking & Remote Code Execution

Critical vulnerability in Microsoft Outlook bypasses Protected View to leak NTLM hashes and execute remote code via file:// monikers.

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution (Follina)

Zero-day vulnerability in MSDT invoked via Microsoft Word ms-msdt schema allows code execution even when macros are disabled.

Informational: Residential Proxy Botnets Fueling Automated Credential-Stuffing Against Dev & Git Portals

Public chatter and investigative reports track massive distributed botnets rotating consumer IPs to bypass rate-limiting on developer portals.

Informational: Prompt Injection Vectors in Autonomous IDE AI Coding Assistants

Security research highlights untrusted context poisoning in AI coding extensions, enabling silent workspace secret exfiltration.

Informational: Post-Quantum Transition Race Conditions & Degradation Vectors in Hybrid TLS 1.3

Cryptographic researcher chatter and preprints identify record fragmentation vulnerabilities in early ML-KEM deployments.

Informational: Dangling CNAME Hijacking of Orphaned Cloud Storage in CI/CD Build Pipelines

Underground chatter and telemetry indicate threat actors systematically claiming abandoned S3 and Blob domains cited in legacy setup scripts.

Informational: eBPF Stealth Rootkit Techniques & Container Escape Vectors Discussed in Underground Channels

Underground hacker telemetry and researcher PoCs demonstrate eBPF ring-buffer manipulation to conceal malicious processes.

Informational: Browser Extension Native Messaging Bridge Hijacking by Infostealer Malware

Investigative reporting and infostealer malware analysis reveal systematic tampering with Native Messaging host registries on dev machines.

Informational: Adversarial Model Context Protocol (MCP) Tool Poisoning & Shadow Server Registration

Security research highlights untrusted schema injection in AI developer assistants connecting to local Model Context Protocol (MCP) endpoints.

Informational: ML Supply Chain Typosquatting Bypassing SafeTensors Deserialization Guarantees

Public research alerts flag malicious Hugging Face model weights bundling companion preprocessing scripts that execute arbitrary Python code.

Informational: BGP Route Hijacking Campaigns Intercepting Regional Open-Source Package Mirrors

Network telemetry and underground chatter indicate localized BGP prefix hijacks intercepting package registry traffic to serve poisoned dependency tarballs.

Informational: VS Code Extension Shadow-Forking & Dormant Publisher Account Takeovers

Threat actors actively purchase expired domains linked to abandoned VS Code Marketplace extensions to push malicious automatic updates.

Informational: Real-Time AI Voice Cloning Vishing Targeting Enterprise DevOps & IT Helpdesks

Security chatter and intelligence bulletins warn of sophisticated vishing attacks using generative AI voice models to reset engineer MFA credentials.

Informational: GitHub Actions Runner Cache Poisoning via Cross-Branch Cache Key Collisions

Research teardowns reveal techniques where external pull requests exploit actions/cache scoping to poison dependency caches for main branch builds.

Informational: WebAssembly SIMD Register Allocation Flaws Inducing Host Process Memory Corruption

Academic cryptographers and browser security researchers publish preprints detailing register allocation flaws in Wasm JIT engines.

Informational: Unauthenticated Wireless ADB Probing on Developer Local Area Networks

Network telemetry highlights automated malware scanning developer home and office subnets for open Android Debug Bridge ports.

Informational: Dangling DNS CNAME Takeovers Targeting Corporate Developer Portals & Documentation

Investigative research catalogs thousands of abandoned developer documentation subdomains vulnerable to zero-click domain takeovers.

Informational: Semantic Concurrency & Memory Bugs in LLM-Transpiled C-to-Rust Codebases

Security essays and academic audits highlight silent race conditions and use-after-free bugs introduced by automated C-to-Rust rewrites.

Informational: Devcontainer Root Breakouts via Ubiquitous /var/run/docker.sock Mounts

Cloud threat research highlights systemic container breakouts in remote IDE environments sharing host Docker sockets.

Informational: Git Submodule Path Traversal & Hook Execution Vectors in Recursive Clones

Underground intel and exploit proof-of-concepts detail path traversal techniques in .gitmodules weaponized against developers running git clone --recursive.

Informational: Persistent Background Daemonization via NPM postinstall Process Detachment

Threat intelligence telemetry detects malicious npm packages spawning detached POSIX daemon processes that outlive package installation.

Informational: Cache-Timing Side-Channels in Early Post-Quantum (PQC) ML-KEM Reference Implementations

Cryptographic preprints analyze microarchitectural timing leakages in newly standardized post-quantum key encapsulation algorithms.

Informational: Shadow AI Code Assistant Telemetry Exfiltration via Rogue Language Server Protocol (LSP) Daemons

Investigative research tracks unofficial AI coding plugins transmitting proprietary source code ASTs to third-party telemetry mirrors.

Informational: Local Model Context Protocol (MCP) Indirect Prompt Injection Triggering Arbitrary Shell Execution

Security preprints demonstrate prompt injection via untrusted repository READMEs and issues invoking local MCP command tools.

Informational: Drive-By Browser DevTools Protocol (CDP) WebSocket Hijacking Probing Localhost Debug Ports

Security disclosures identify drive-by web scripts port-scanning localhost (9222/5858) to hijack developer browser sessions.

Informational: Container-to-Host Root Escalation via Shared Docker Socket in Self-Hosted CI/CD Runners

Cloud threat research documents recurring privilege escalation in self-hosted GitHub Actions and GitLab CI runner clusters.

Informational: Zero-Click Pre-Launch Build Task Hooks in Crafted .vscode/tasks.json Bypassing Workspace Trust

Security researcher writeup reveals how crafted repository task configurations execute arbitrary code when cloning and inspecting code.

Informational: Steganographic Code Execution Payloads Disguised Inside Open-Source AI Model Weights (GGUF / Safetensors)

AI safety researchers discover malicious steganographic payloads and polyglot files uploaded to public machine learning registries.

Informational: Automated Developer Tunnels (Cloudflare / ngrok) Accidentally Exposing Cloud Metadata (IMDSv1)

Telemetry reports mass scanning of ephemeral tunnel subdomains harvesting exposed cloud credentials from local dev servers.

Informational: Unauthenticated Named Pipe Relay in Windows Subsystem for Linux (WSL2) & Docker Desktop

Security research discloses local privilege escalation vectors via unauthenticated inter-process named pipes on Windows developer laptops.

Informational: Branch History Injection & Speculative Cache Side-Channels in Node.js & V8 JIT Compilers

Academic preprint details microarchitectural cache-timing side channels in JavaScript JIT execution engines.

Informational: Malicious Recursive Git Submodule Configurations Executing Arbitrary Pre-Commit Scripts

Security research analyzes argument injection vectors in recursive git submodule cloning (`--recurse-submodules`).

Informational: Trojan Source 2.0: Invisible Unicode Directional Overrides Masking Vulnerabilities in Code Reviews

Academic researchers publish new Unicode Bidirectional (BiDi) override techniques that evade modern syntax highlighters.

Informational: Mass Abandoned Domain Hijacking Targeting Stale Open-Source Package Maintainers

Threat intelligence monitors automated re-registration of expired maintainer email domains to hijack package release tokens.

Informational: Monorepo Dependency Confusion Exploiting Unscoped Internal Package Fallbacks

Security research whitepaper demonstrates corporate credential harvesting via unscoped internal package name squatting.

Informational: Unauthenticated Lateral Movement to Kubelet API via Active Developer Port-Forward Tunnels

Cloud penetration testing writeups demonstrate container breakouts pivoting through active `kubectl port-forward` tunnels.

Informational: Dormant Secret Persistence in Local Git Object Packs from Untracked Stashes & Reflog Buffers

Forensic research warns that deleting secrets from code still leaves plain-text tokens in `.git/objects` packs.

Informational: Localhost Port Grabbing & OAuth PKCE Downgrade in Developer CLI Authentication Flows

Security research evaluates loopback redirect security in CLI tools (AWS CLI, gcloud, Supabase, Vercel).

Informational: GitHub Security Lab Advisory GHSL-2025-021: Arbitrary Workflow Command Injection in CI/CD Automation Toolkits

GitHub Security Lab research identifies systemic expression injection vulnerabilities across open-source GitHub Actions workflows.