Making sure the checks get printed
Cisco Talos CAIRN research reveals malware authors embedding natural-language prompt-injection instructions in binaries to evade AI-assisted analysis, succeeding ~35% of the time.
60
- Mentions · 7d0
- Mentions · 30d7
- All mentions8
- First seenAug 24, 2026
- Last mentioned22d ago
Timeline
8 articles · newest firstMicrosoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes
Microsoft patched CVE-2026-96940, an Exchange flaw that lets authenticated attackers read other users' mailboxes.
71
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
Warlock is exploiting SharePoint flaws to disable defenses and deploy ransomware against critical infrastructure and government targets.
81
Warlock ransomware breach SharePoint in water, telecom operator attacks
Warlock ransomware exploited SharePoint ToolShell flaws to hit a water utility, telecom, government body, and university.
78
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
Warlock ransomware operators continue exploiting unpatched SharePoint servers at critical infrastructure, government, and education targets.
80
Warlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom Operators
China-nexus Longlegs deploys Warlock ransomware via exploited SharePoint flaws against water utility, telecom, government, and university targets across three continents.
78
Warlock Ransomware Hits Large Spanish, Portuguese Orgs
Warlock ransomware is hitting large Spanish and Portuguese organizations; the Chinese actor blends cybercrime and APT behavior.
66
GentleKiller targets more than 400 security processes across 48 products
ESET details the Gentlemen ransomware gang's in-house GentleKiller EDR-killer framework targeting over 400 security processes across 48 products, supplied to affiliates.
68
Related CVEs
by mentions- CVE-2025-1055<1%5.6A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to…
- CVE-2025-53770100%9.8Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises
- CVE-2025-49704100%8.8Authenticated Code Injection RCE in Microsoft SharePoint
- CVE-2025-4970699%6.5Improper Authentication in Microsoft SharePoint Server (ToolShell Campaign)
- CVE-2025-53771100%6.5Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing
- CVE-2026-5504070%9.1Authentication Bypass in Microsoft SharePoint Server
- CVE-2026-4565980%8.8Authenticated Deserialization RCE in Microsoft SharePoint Server (Actively Exploited)
- CVE-2026-8877911%8.7Unauthenticated denial of service in NetScaler ADC and Gateway
- CVE-2026-3220143%6.5Improper Input Validation Spoofing Vulnerability in Microsoft SharePoint Server
- CVE-2026-969403%8.8Weak authorization privilege escalation in Microsoft Exchange Server
Appears with
- Warlockmalware · 5
- Symantecorganization · 5
- Microsoftvendor · 4
- Microsoftorganization · 4
- Storm-2603threat actor · 4
- Visual Studio Codeproduct · 3
- Longlegsthreat actor · 3
- SharePointproduct · 2
- Carbon Blackorganization · 2
- Violet Typhoonthreat actor · 2
- Linen Typhoonthreat actor · 2
- GentleKillermalware · 1
- HexKillerproduct · 1
- MedusaLockerthreat actor · 1
- Fortinetvendor · 1
- K7RKScanproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.