Brotli flaw CVE-2026-111497 may allow RCE via crafted streams
A missed error check in Brotli block decoding can cause an out-of-bounds write when Content-Encoding: br data is decompressed.
68
Organization
Zscaler ThreatLabz
- Mentions · 7d1
- Mentions · 30d7
- All mentions14
- First seenAug 11, 2026
- Last mentioned2d ago
Timeline
14 articles · newest firstSEO poisoning campaign delivers new Armorsteal malware
Fake Chocolatey and Massgrave sites installed a Python remote-access module that steals system data and runs signed tasks.
62
Ransomware at Machine Speed: How GenAI Shrinks the Path after Initial Access
Zscaler says GenAI helps ransomware crews phish better, find sensitive data faster, and build evasive custom scripts.
46
Malicious PDF Reader With 10,000+ Installs on Google Play Delivers Anatsa Banking Trojan
Zscaler found a fake Android PDF reader with 10,000+ Google Play installs acting as dropper for the Anatsa banking trojan, with full IOCs published.
50
Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
Suspected TraderTraitor operators trojanized a Terraform provider to deliver the cross-platform FLATROOF backdoor.
72
Ransomware Data Theft Surged 275% in 2026: Schools, Hospitals, and Government Agencies Had Some of the Largest Claims
Zscaler ThreatLabz reports ransomware data theft claims surged 275%, with Babuk2, INC Ransom, and Pear claiming 30TB, 20TB, and 16TB thefts.
62
From Access to Exfiltration: What Defenders Need to Know
Zscaler ThreatLabz reports ransomware data theft surged 275.8% to 896.2TB, with exfiltration-focused extortion outpacing encryption-centric defenses.
52
Ransomware Leverage is Growing by the Terabyte: Takeaways from ThreatLabz 2026 Ransomware Report
Zscaler ThreatLabz reports top ransomware groups' exfiltrated data volume jumped 276% year-over-year to 896 TB despite payments falling to $327.8M.
60
Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2
Zscaler attributes Operation RapidRust to Pakistan-aligned APT36, targeting Indian and Afghan government and defense entities with new Rust malware and GitHub-based C2.
75
APT36 Targets Indian Government and Defense Organizations With New Rust Malware Arsenal
Pakistan-linked APT36 deployed a Rust malware suite, including RUSTYSHADE and USB-spreading RUSTYMOVE, against Indian and Afghan government and defense targets.
78
Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement
Zscaler ThreatLabz reports SloppyRAT, a new Windows RAT delivered via ClickFix lures that supports reconnaissance, reverse SOCKS proxying, and lateral movement for ransomware affiliates.
50
C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2
Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor likely tied to ransomware actors and delivered via ClickFix chains, using GitHub for C2.
55
CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials
Zscaler details CaptiveCrunch: Midnight Blizzard's Storm-2945 compromises hotel Wi-Fi captive portals to redirect guests and harvest Microsoft 365 credentials via device code phishing.
72
Tracking Shai-Hulud: Inside the ChainDrop NPM Worm
ChainDrop, a Mini Shai-Hulud variant tied to TeamPCP, worms through npm via a compromised maintainer account and anchors C2 in an Ethereum smart contract.
68
Related CVEs
by mentions- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
Appears with
- Zscalervendor · 5
- RUSTYSHADEmalware · 2
- Microsoftvendor · 2
- Transparent Tribethreat actor · 2
- RUSTYMOVEmalware · 2
- BASHNATCHmalware · 2
- APT36threat actor · 2
- PSNATCHmalware · 2
- Backblazeorganization · 1
- npmvendor · 1
- BlueBravothreat actor · 1
- Embargothreat actor · 1
- Earth Karkaddanthreat actor · 1
- flat-cacheproduct · 1
- keyvproduct · 1
- C2Looperproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.