Unit 42 warns of two critical PHP RCE flaws scored 9.2
Unit 42 says it has seen proof-of-concept code and telemetry showing over 22.6 million potentially exposed instances.
78
Product
Cortex XDR
- Mentions · 7d0
- Mentions · 30d6
- All mentions21
- First seenAug 17, 2026
- Last mentioned9d ago
Timeline
21 articles · newest firstAI-Assisted Hackers Compromise Government Linux Servers to Deploy Backdoors and Steal Credentials
Unit 42 says unattributed cluster CL-UNK-1211 backdoored government Linux servers and stole administrator credentials.
74
Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords
Unit 42 says CL-UNK-1211 used AI-assisted scripts to steal Linux sudo passwords from government targets.
76
AI-Powered Espionage Campaign Targets Government Linux Infrastructure
Unit 42 says cluster CL-UNK-1211 used AI-generated payloads to spy on government Linux infrastructure.
78
The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk
An opportunistic attacker used stolen credentials and a misconfigured gateway to probe a European bank.
46
Hackers Pose as Dubai Airports Recruiters to Infect Software Engineers With ShelbyLoader V2
Iranian-linked CL-STA-1178 posed as Dubai Airports recruiters to infect engineers with ShelbyLoader V2.
74
12 Best CDR Solutions Compared (2026): Features & Pricing
A 2026 buyer's guide compares 12 cloud detection and response platforms on coverage, response speed, pricing transparency, and free-tier leverage.
15
The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE
Unit 42 demonstrates that root access on a Kubernetes node lets attackers spoof SPIFFE/SPIRE attestation and harvest co-located workloads' SVIDs.
45
The 12 Best Managed XDR Services, Compared and Priced
A comparison of twelve managed XDR providers covering pricing models, telemetry breadth, and distinguishing genuine MXDR from rebranded MDR services.
15
The 12 Best Extended Detection & Response (XDR) Platforms, Compared and Priced
Buyer's guide compares 12 XDR platforms, favoring Microsoft Defender XDR, Stellar Cyber and CrowdStrike, and warns ingestion pricing inflates costs.
14
The 12 Best Endpoint Detection & Response (EDR) Solutions, Compared and Priced
An editorial scorecard ranks 12 EDR platforms, with CrowdStrike and SentinelOne tied at 8.6/10 and telemetry retention identified as the hidden cost driver.
15
Cortex Xdr
Stub page for Palo Alto Cortex XDR with no article text, offering no news content for classification.
5
TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks
TrickBot phishing campaign used SendGrid, fake Google Docs, and Drive-hosted downloaders disguised as Word files to deliver a credential-stealing payload.
50
Cortex XDR™ Detects New Phishing Campaign Installing NetSupport Manager RAT
Cortex XDR threat hunters uncovered a phishing campaign delivering the NetSupport Manager RAT via a fake password-protected NortonLifelock Word document.
42
Threat Assessment: Ryuk Ransomware
Unit 42 assesses Ryuk ransomware amid a CISA/FBI/HHS alert on threats to U.S. healthcare, including the UHS attack that disrupted hospital operations.
68
Threat Brief: Maze Ransomware
Unit 42 issued a threat brief on Maze ransomware, noting an uptick across industries and exploitation of Pulse VPN and IE flaws for initial access.
55
Threat Assessment: Egregor Ransomware
Unit 42 assesses Egregor ransomware, a Sekhmet variant likely run by former Maze affiliates using Qakbot, IcedID, and Ursnif for initial access.
55
Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild
Attackers actively exploit CVE-2025-32433, a CVSS 10.0 unauthenticated RCE in Erlang/OTP SSH, heavily targeting OT and critical infrastructure networks.
90
Threat Brief: Ongoing Russia and Ukraine Cyber Activity
Ukrainian government sites were defaced via OctoberCMS CVE-2021-32648 while Microsoft-attributed actor DEV-0586 deployed destructive WhisperGate malware.
78
Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022
Unauthenticated Confluence RCE CVE-2022-26134 was exploited in the wild; Volexity observed intrusions and Cerber ransomware on unpatched servers.
80
Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated)
Trojanized 3CXDesktopApp installers for Windows and macOS loaded RC4-encrypted shellcode delivering a backdoor to hundreds of thousands of 3CX users.
72
Related CVEs
by mentions- CVE-2019-11510100%10.0Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN
- CVE-2025-55182100%10.0Unauthenticated RCE in React Server Components (React2Shell)
- CVE-2025-3243399%10.0Unauthenticated RCE in Erlang/OTP SSH Server
- CVE-2022-26134100%9.8Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2021-3264890%9.1Authentication Bypass in October CMS Password Reset Enables Account Takeover
- CVE-2018-487890%7.8Use-After-Free RCE in Adobe Flash Player before 28.0.0.161
- CVE-2018-1598290%7.8Use-After-Free in Adobe Flash Player Allows Arbitrary Code Execution
- CVE-2018-817488%7.5Out-of-Bounds Write RCE in Microsoft Windows VBScript Engine
Appears with
- Palo Alto Networksvendor · 20
- Unit 42organization · 14
- Palo Alto Networksorganization · 12
- Microsoftvendor · 6
- Cortex Xpanseproduct · 4
- CrowdStrikevendor · 4
- CL-UNK-1211threat actor · 3
- Trend Microvendor · 3
- Trickbotmalware · 3
- Falconproduct · 2
- Sophosvendor · 2
- SentinelOnevendor · 2
- Linuxproduct · 2
- SysGoRATmalware · 2
- Uptycsvendor · 2
- Sophosorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.