Active Threats
Explore the latest active threats being deployed by malicious actors as of 2026. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
THREAT OF THE MONTH
CVE-2026-109618 and CVE-2026-109619: PHP2Shell RCE Flaws
SOC Prime Bias: Critical
Huntress
42 Weaponized GitHub Repositories Reveal a Hidden npm Publisher
SOC Prime Bias: Critical
JFrog Security Research
CVE-2026-73570: Zimbra Log File Abuse Enables Remote Code Execution
SOC Prime Bias: Critical
elastic
Storm-0940 Broadens ARTEX Attacks to IT and Software Vendors
SOC Prime Bias: Critical
wiz.io
SEO Poisoning Campaign Delivers Armorsteal Malware
SOC Prime Bias: High
zscaler.com
SafePay Ransomware: Tactics, Techniques, and Defensive Measures
SOC Prime Bias: High
CISA
eMudhra CA Incident Analysis: Key Findings and Impact
SOC Prime Bias: High
corelight.com
CVE-2026-111497: Critical Node2Shell Flaw in Node.js Brotli Decoder
SOC Prime Bias: High
sysdig.com
ClickFix Campaign Uses Amazon Lures to Deploy Malware
SOC Prime Bias: High
Huntress
UAC-0099 and Sandworm Deploy MythicRatatoskr Backdoor via Yggdrasil
SOC Prime Bias: Critical
welivesecurity.com
INC and The Gentlemen Ransomware Expose AI-Powered Attack Infrastructure
SOC Prime Bias: Critical
SOCRadar
