T1059 - Command and Scripting Interpreter - MITRE ATT&CK

Related Threat Clusters

• Critical SonicWall SMA1000 Vulnerabilities Under Active Exploitation

  SonicWall has reported two critical vulnerabilities, CVE-2026-15409 and CVE-2026-15410, affecting its SMA1000 Series appliances, which are currently being actively exploited. The first vulnerability, CVE-2026-15409, is…

  27 articles · Updated July 15, 2026
• Critical Zero-Day Vulnerability CVE-2026-20182 Exploited in Cisco SD-WAN Systems

  Cisco has disclosed a critical authentication bypass vulnerability, CVE-2026-20182, affecting its Catalyst SD-WAN Controller and Manager. This flaw allows unauthenticated remote attackers to bypass authentication and…

  131 articles · Updated May 14, 2026
• Critical Joomla JCE Vulnerability Under Active Exploitation

  A critical vulnerability in the Joomla Content Editor (JCE), tracked as CVE-2026-48907, allows unauthenticated attackers to execute remote code on affected Joomla sites. This flaw affects JCE versions below 2.9.99.6 and…

  33 articles · Updated June 17, 2026
• Critical Unauthenticated RCE Vulnerability in LiteLLM Exploited in the Wild

  A critical command injection vulnerability, CVE-2026-42271, in LiteLLM, an open-source AI gateway, allows unauthenticated remote code execution (RCE) when chained with CVE-2026-48710, a Host header validation bypass in…

  17 articles · Updated June 9, 2026
• Critical Zero-Day Vulnerability in LiteSpeed cPanel Plugin Actively Exploited

  A critical zero-day privilege escalation vulnerability in the LiteSpeed User-End cPanel plugin is being exploited in the wild, allowing authenticated cPanel users to execute arbitrary scripts as root. This flaw, tracked…

  17 articles · Updated May 23, 2026
• CVE-2026-47668: Unauthenticated RCE Vulnerability in DbGate

  DbGate's JSON script runner has a critical vulnerability (CVE-2026-47668) that allows unauthenticated remote code execution via the functionName parameter in JSON script assign commands. The vulnerability arises from…

  2 articles · Updated June 6, 2026
• Akira Ransomware Group Targets Critical Infrastructure, Extracts $42 Million

  The Akira ransomware group has been identified as a significant threat to critical infrastructure, with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI warning of its active ransomware…

  9 articles · Updated November 14, 2025
• Critical Remote Code Execution Vulnerability Exploited by China-Nexus Actor

  On April 3, 2025, Ivanti disclosed CVE-2025-22457, a critical buffer overflow vulnerability affecting Ivanti Connect Secure and other products. The vulnerability allows unauthenticated remote code execution, and…

  2 articles · Updated June 17, 2026
• Operation Highland: Velvet Ant's Decade-Long Espionage Campaign

  Operation Highland, attributed to the Velvet Ant cyberespionage group, involved a sophisticated attack that began in 2016 and persisted undetected for a decade. The attackers hijacked the authentication stack of a major…

  9 articles · Updated June 13, 2026
• Cisco IOS Vulnerability CVE-2008-4128 Under Active Exploitation

  CISA has warned of ongoing attacks exploiting the CVE-2008-4128 vulnerability in Cisco IOS 12.4, a cross-site request forgery flaw. This vulnerability, which has been known since 2008, allows attackers to execute…

  5 articles · Updated July 14, 2026

Recent Intelligence Reports

• CVE-2026-15410 — nvd.nist.gov · July 17, 2026
• CVE-2026-39808 — fortiguard.fortinet.com · July 17, 2026
• The Ttf Trap A Global Campaign Of A Low Detection Lua Loader — www.fortinet.com · July 17, 2026
• Token Security research on how enterprises are actually deploying agents — www.token.security · July 17, 2026
• Fake TTF files deliver stealthy malware in global phishing campaign — Csoonline · July 17, 2026
• Google Mandiant warns of exposed serverless functions as attack vector — Feeds.Feedburner · July 16, 2026
• New TELEPUZ malware spreads via ClickFix lures — Feeds.Feedburner · July 16, 2026
• Hardening serverless cloud functions against lateral movement and AI risks — Feeds.4Sysops · July 16, 2026

Related Entities