October 2026: The latest critical PHP vulnerability, leaked on 20 October 2026, is being used against real targets. CYFIRMA has obtained the original target list drawn up by a group of Korean-speaking ...

Lazarus Group (DPRK)-Linked Operators Claim Exploitation of Two Critical PHP-Core RCE Vulnerabilities, Expanding Target Scope from 216 to 581 Hosts CYFIRMA has obtained the operators’ original target ...

Upgrade Wasmtime to versions 36.0.19 or 43.0.0. Avoid compiling untrusted WebAssembly modules using vulnerable versions. Restrict access to untrusted Wasm workloads until patched. Monitor for ...

We expect December to confirm telemetry-led attribution as the norm. The risk is not to the prediction but to defenders who are still deleting the only evidence they will get. On track. Investigations ...

This report covers the analysis and findings related to three Android application packages (APKs) assessed for malicious behavior. The objective of this assessment was to determine whether the samples ...

The cyber threat landscape in the Philippines has intensified significantly over the past year as rapid digital adoption continues to outpace security maturity across government, businesses, and ...

The ransomware primarily targets Windows environments, utilizing Windows services, command-line utilities, registry configurations, system APIs, and filesystem operations to perform encryption, system ...

This report details an active QR code–based crypto drainer campaign targeting Trust Wallet users via Telegram distribution channels. The attack abuses Trust Wallet’s deep link mechanism to redirect ...

The January 2026 Ransomware Threat Report highlights a ransomware ecosystem that has matured into a highly adaptive, service-oriented criminal economy defined less by technical exploitation and more ...

At CYFIRMA, we provide timely insights into emerging threats and malicious tactics targeting organizations and individuals. This report details an investigation aimed at tracking infrastructure linked ...

Lateral Movement T1021.002 Remote Services: SMB/Windows Admin Shares Lateral Movement T1021.003 Remote Services: Distributed Component Object Model The ransomware primarily targets Windows OS, which ...

At CYFIRMA, we are committed to providing up-to-date insights into current threats and the tactics used by malicious actors targeting both organizations and individuals. In this report, we will take ...