Malware Research Lead
Mei-Lin reverse-engineers commodity and bespoke malware, and writes the technical breakdowns behind our loader and stealer coverage.
152 articles
OT / SCADAMitsubishi Electric and CISA issue critical advisory ICSA-26-260-02 for GX Works3 and Motion Control Settings software enabling in-memory block password bypass and PLC logic tampering.
OT / SCADAABB and CISA issue security advisory for CVE-2026-31431 in Ability Edgenius edge controllers enabling container breakout and local root takeover.
LinuxCISA adds Linux kernel ebtables SNAT memory corruption flaw CVE-2026-53266 (CVSS 8.8) to KEV catalog following active hypervisor privilege escalation.
GoogleTechnical analysis of Google Cloud Platform guest-oslogin flaw CVE-2020-8903 enabling non-administrative users to escalate privileges to root.
MicrosoftTechnical analysis of Azure Cloud Provider Interface vulnerability CVE-2017-4964 enabling arbitrary code injection into virtual machines during deployment.
Active ExploitCISA incorporates Adobe ColdFusion path traversal vulnerability CVE-2026-48282 (CVSS 9.8) into KEV catalog following active exploitation against enterprise application servers.
Active ExploitCISA adds N-able N-central vulnerability CVE-2026-18577 (CVSS 9.8) to KEV catalog following active in-the-wild exploitation against MSP management infrastructure.
LinuxCISA adds Linux kernel watch queue vulnerability CVE-2022-0995 to its KEV catalog following widespread weaponization in cloud container breakout attacks.
Threat IntelAnthropic threat intelligence reveals nation-state groups, including Midnight Blizzard, attempted to weaponize Claude to automate malware obfuscation and EDR evasion.
MicrosoftTechnical breakdown of cloud workload stemcell isolation defects, container escape vectors, and hypervisor boundary hardening across AWS and Microsoft Azure.
MicrosoftDigital forensics analysis dissects how threat actors leverage leaked cloud credentials and cross-account IAM role assumptions to exfiltrate enterprise storage.
GoogleTechnical analysis of Google Cloud Platform (GCP) Kubernetes Workload Identity metadata impersonation vectors, token theft forensics, and enterprise IAM hardening.
OT / SCADAEngineering blueprint for implementing IEC 62443-3-2 zones, conduits, and Purdue Model boundaries across industrial automation and SCADA systems.
AppleCISA confirms active exploitation of CVE-2026-65400, an unauthenticated network authentication bypass in Apple macOS Screen Sharing enabling remote desktop seizure.
MicrosoftCISA confirms active in-the-wild exploitation of CVE-2026-33824, an unauthenticated double-free memory corruption flaw in Windows IKE enabling remote root code execution over UDP 500.
CiscoCISA mandates urgent federal remediation after confirming active exploitation of CVE-2026-76461, an unauthenticated SQL injection flaw granting root shell access on Cisco SEG appliances.
OT / SCADACISA alerted industrial manufacturing operators to severe vulnerabilities in Rockwell Automation Logix controllers and 1756 communication modules allowing PLC tampering.
GoogleCERT-In issued advisory CIAD-2026-0038 warning against an aggressive smishing blitz delivering trojanized APKs disguised as official Parivahan traffic e-challan notices.
GoogleGoogle’s September 2026 Android security update resolves 34 vulnerabilities, led by critical zero-click remote code execution defects in the Android System framework.
MicrosoftA zero-day exploit dubbed ShieldCrash bypasses Microsoft Defender’s latest patches, weaponizing a TOCTOU race condition in the engine to read files as SYSTEM.
Agentic AISecurity researchers trace a coordinated supply-chain assault on RubyGems to thousands of autonomous OpenAI agents that achieved code execution on RubyDoc.info infrastructure.
Active ExploitA zero-day flaw in Sogou Input Method—used by 455M people monthly—allowed Chinese threat actor UNC3569 to execute arbitrary code and install the GRAYRABBIT backdoor.
Deep DiveAnthropic’s September threat report describes how actors used Claude for reconnaissance, intrusion support, tool rebuilding and parallelized cyber operations.
GoogleGroup-IB uncovered a major evolution in the Gigabud banking trojan, which uses Android enterprise Work Profiles to isolate tampered banking apps and blind client security checks.