Topic
threat intelligence
11 posts
- ArticleOct 2026 · 17 min
Node2Shell: One Brotli Bug, Reached From Both Sides of the Wire
CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder that Node.js bundles. Attackers reach it inbound, through request bodies that Express 5, Koa and @fastify/compress decompress by default, and outbound, through any response fetch(), axios or got decodes for you. Below: the exposure map, the version traps, what the proofs of concept actually show, and the checklist.
- ArticleOct 2026 · 18 min
PHP2Shell: Two Bugs in PHP Core That Fire Before Your Code Runs
CVE-2026-109618 and CVE-2026-109619 give an unauthenticated HTTP request two independent paths to code execution inside the PHP core itself, both reached while PHP parses the request rather than inside your application; what follows is the exposure matrix, the exploitation record so far, and the checklist for the days before you can patch.
- ArticleAug 2026 · 14 min
XSS2Shell: One Failed Login to PHP on the Server
CVE-2026-64638 is a reflected XSS on the WordPress login page — the finding most teams close as medium. Six gadgets sit between it and a PHP shell, and every one of them was already in core. Here is the chain, the log signatures, and what to harden after you patch.
- ArticleAug 2026 · 15 min
XSS2Shell: מניסיון התחברות כושל אחד ועד PHP על השרת
CVE-2026-64638 היא חולשת XSS מוחזר בעמוד ההתחברות של וורדפרס — בדיוק הממצא שרוב הצוותים סוגרים כבינוני. בין החולשה הזו לבין הרצת PHP על השרת עומדים שישה שלבים נוספים, וכולם כבר היו בליבת המערכת. הנה השרשרת המלאה, חתימות הזיהוי בלוגים, וההקשחה שצריך לעשות אחרי העדכון.
- ArticleJul 2026 · 15 min
Coercion to krbtgt: NTLM Relay and ADCS ESC8 in 2026
A full ESC8 walkthrough against a lab domain, then the forensic reconstruction — why the certificate serial, not the source IP, is the artifact that ties the whole chain together.
- Case StudyJul 2025 · 8 min
When Research Meets Reality
How Threat-Actor Campaigns Cast a Shadow on Legitimate npm Binaries (and What IONSEC IR Sees in the wild)
- BlogAug 2024 · 5 min
Clearing the Mist: Unveiling Fog Ransomware
A full analysis of the Fog Ransomware Group: the malware it deploys, the TTPs it relies on to infiltrate high-tech firms, and how defenders can disrupt it.
- NewsJun 2024 · 1 min
IONSEC Shares Wiper Malware Research with Czech Delegation in Israel
IONSEC hosted a Czech delegation in Israel to present our Wiper malware research, including the campaign we track as Operation HANDALA.
- NewsMay 2024 · 2 min
IONSEC at GPEC 2024 – Showcasing APT Research on the Global Stage
Wow — what a journey GPEC (General Police Equipment Exhibition & Conference) was this year. Standing among 471 exhibitors from 32 different countries was nothing short of inspiring. The scale, the diversity, and the energy of the event made it a true highlight of 2024.
- BlogMar 2024 · 8 min
SovaTeam - New State-Sponsored APT
How IONSEC and White-Hat traced the Sova Team threat actor through a ransom note to uncover a state-sponsored APT operating past strict security controls.
- BlogMar 2024 · 10 min
סקירה מודיעינית 2024 #OpIsrael
IONSEC הינה חברת בוטיק לשירותי אבטחת מידע ותגובה לאירועי סייבר (24/7) העוסקת במחקר ותגובה לאיומים מתקדמים ומספקת פתרונות אבטחה מותאמים אישית לחברות ברחבי העולם.