Research

Technical deep dives, reverse-engineering write-ups and data-led studies of attacker behaviour, drawn from vendor telemetry and independent research.

11 articles

3D conceptual illustration of artificial intelligence neural network core undergoing covert adversarial model extraction and knowledge distillation theft with glowing cyber telemetry

High

ResearchTechnology, Cloud & SaaS

CISA, NSA, and FBI Warn Critical Infrastructure of Advanced AI Model Extraction Campaigns

A joint cybersecurity advisory from CISA, NSA, and FBI alerts defense contractors and cloud vendors to sophisticated state-sponsored AI model extraction campaigns.

14 Sept 20269 min read

Daniel Okafor

$3D technical illustration of fractured Microsoft Defender security shield and race condition threads exposing NT AUTHORITY SYSTEM core access$
ResearchTechnology, Cloud & SaaSHigh
'ShieldCrash' exploit bypasses Microsoft Defender patch, enabling local SYSTEM file access
A zero-day exploit dubbed ShieldCrash bypasses Microsoft Defender’s latest patches, weaponizing a TOCTOU race condition in the engine to read files as SYSTEM.
Mei-Lin Chen14 Sept 20267 min read
ResearchGovernment & DefenceHigh
Anthropic says AI is moving from assistant to orchestrator in cyber operations
Anthropic’s September threat report describes how actors used Claude for reconnaissance, intrusion support, tool rebuilding and parallelized cyber operations.
Mei-Lin Chen12 Sept 20267 min read
ResearchTechnology, Cloud & SaaSCritical
GitSpawn flaws in AI coding agents execute arbitrary code from malicious repository configurations
Manifold Security discovers GitSpawn: eight vulnerabilities across seven AI coding tools (Claude Code, Cursor, Codex) that execute attacker code from repository .git/config.
Priya Raman12 Sept 20267 min read
ResearchEducation & AcademiaHigh
Eight new ransomware brands in one week: why tracking group names has stopped working
One tracker logged 315 leak-site posts from 40 groups in a single August week, eight of them new. Brand-based detection cannot keep pace. Here is what to instrument instead.
Daniel Okafor10 Sept 20266 min read
ResearchTechnology, Cloud & SaaSCritical
BlueMoon Exploit Kit: Chrome V8 Zero-Day Chained with Windows Kernel Escalation
Proofpoint disclosed the BlueMoon exploit kit weaponizing Google Chrome V8 flaws (CVE-2026-87491) alongside Windows kernel privilege escalation in state-aligned espionage attacks.
Mei-Lin Chen9 Sept 20266 min read
ResearchTechnology, Cloud & SaaSCritical
DeepSeek Harness Vulnerability Allowed AI Coding Agents to Disable Their Sandbox
OX Security and VulnCheck disclosed CVE-2026-82533 in DeepSeek Harness, where prompt injection allowed sandboxed AI coding agents to disable their own security isolation.
Mei-Lin Chen9 Sept 20265 min read
ResearchEducation & AcademiaHigh
Screening Serpens shipped six RAT builds in ten weeks. The config file is what gives them away
Unit 42 documented six new RAT variants from Iran-nexus Screening Serpens between February and April 2026. The hashes rotate; the AppDomainManager config file does not.
Mei-Lin Chen9 Sept 20266 min read
ResearchTelecom & MediaCritical
Salt Typhoon has compromised networks in more than 80 countries, researchers say
The Chinese state-aligned group has moved well beyond telecoms into transportation and government, in what is now one of the broadest espionage campaigns on record.
Daniel Okafor7 Sept 20268 min read
ResearchEducation & Academia
Breakout time falls to 72 minutes — and most SOCs are not built for it
The 2026 benchmark from foothold to active exfiltration is 72 minutes, a fourfold reduction. Human-paced triage no longer fits inside the window.
Priya Raman5 Sept 20267 min read
ResearchEducation & AcademiaHigh
Attackers impersonated hundreds of brands on GitHub to push malware through search results
A campaign beginning in late June 2026 built hundreds of fake brand repositories on GitHub and used SEO to place them at the top of software download searches.
Mei-Lin Chen4 Sept 20266 min read