Google Threat Intelligence

Search everything

Mentions · 7d0
Mentions · 30d1
All mentions8
First seenAug 18, 2026
Last mentioned19d ago

Timeline

8 articles · newest first

Commentary says defenders must catch up after Claude Mythos

Cited tests say Mythos ran a 32-step simulated network attack, and Glasswing is expanding to about 150 organizations.

CSO OnlineOct 23, 09:00 UTC · 19d agoAI safety & security5 · 3 reads

Vulnerability Discovery and Exploitation Trends in the AI Era

Google Threat Intelligence reports monthly CVE disclosures doubled to 10,740 by August 2026, exploited vulnerabilities rose to 18 monthly, and AI-assisted finds skew toward RCE.

Google Threat IntelligenceSep 30, 14:00 UTC · Sep 30, 2026Research 3 sources16 · 5 reads

AI-Found Vulnerabilities More Likely to Enable RCE, Google Says

GTIG finds 50% of likely AI-discovered vulnerabilities enable RCE versus 26% of others, as exploitation accelerates; BeyondTrust CVE-2026-1731 was exploited within four days.

Infosecurity MagazineSep 30, 14:00 UTC · Sep 30, 2026ResearchExploited3 sourcesCVE-2026-17313 · 1 read

Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT

Mass exploitation of NetScaler CVE-2026-88772 grants attackers root access to deploy WHIPSHOT web shells and SLAPSHOT tunneler against government and financial targets.

The Hacker NewsSep 30, 08:24 UTC · Sep 30, 2026Exploit / PoCExploitedCVE-2026-88772 CVE-2026-887712 · 1 read

Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances

Actively exploited Citrix NetScaler zero-days CVE-2026-88772/88771 give attackers root access; Mandiant uncovers WHIPSHOT web shells and SLAPSHOT tunneler in ongoing campaign.

Google Threat IntelligenceSep 29, 05:00 UTC · Sep 29, 2026Exploit / PoCExploitedCVE-2026-88772 CVE-2026-887714 · 2 reads

Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign

ShinyHunters (UNC6240) resumed mass-exploiting Oracle PeopleSoft via a WAF-bypassing variant of CVE-2026-35273, deploying web shells and SideEye to extort victims.

SecurityWeekSep 28, 10:56 UTC · Sep 28, 2026Threat actorExploitedCVE-2026-352734 · 1 read

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.

BleepingComputerSep 11, 17:26 UTC · Sep 11, 2026Phishing & fraudExploited6 · 1 read

Staying Ahead of Adversarial AI Through Agentic Source Code Review

Google Threat Intelligence details an agentic AI pipeline with human expert oversight to review source code and outpace AI-enabled attackers.

Google Threat IntelligenceAug 18, 14:00 UTC · Aug 18, 2026Research2

Related CVEs

by mentions

CVE-2026-8877182%9.5
Unauthenticated RCE in Citrix NetScaler ADC and Gateway
published Sep 27, 2026Citrix NetScaler ADCKEVPoC ×5
CVE-2026-8877277%9.5
Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway
published Sep 27, 2026Citrix NetScaler ADCKEVPoC ×4
CVE-2026-173194%9.9
Pre-Authentication OS Command Injection RCE in BeyondTrust Remote Support and PRA
published Feb 6, 2026BeyondTrust Remote Support (RS)KEVRansomwarePoC
CVE-2026-3527397%9.8
Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools
published Jun 11, 2026Oracle PeopleSoft Enterprise PeopleTools (Updates Environment Management component)KEVRansomwarePoC

Appears with

Mandiantorganization · 4
Citrixorganization · 3
Oracleorganization · 2
ShinyHuntersthreat actor · 2
NetScalerorganization · 2
Helixthreat actor · 1
BlackFilethreat actor · 1
Hacktron AIorganization · 1
Storm-3121threat actor · 1
SharePoint Onlineproduct · 1
Microsoft Graphproduct · 1
Storm-3032threat actor · 1
Salesforceproduct · 1
FBIorganization · 1
Claude Securityproduct · 1
GreyNoiseorganization · 1

Entities are extracted by the model from each article. First seen Aug 18, 2026, last mentioned 19d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.