Executive Summary Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Both are remote code execution (RCE) vulnerabilities rated as 9.2…
This report provides an overview of the top five initial access threat vectors observed by Unit 42 Threat Intelligence for September 2026. Adversary activity during…
When unusual activity was detected on a European bank’s central IT system, its internal security team quickly recognized that the incident warranted immediate response. They…
Executive Summary Unit 42 is aware of possible zero-day activity against NetScaler devices. Citrix reports that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild.…
Executive Summary This article reviews an Atomic macOS (AMOS) stealer malware infection generated in a lab environment. While several sources have published articles analyzing AMOS…
Executive Summary We have analyzed two ongoing, multi-stage network intrusion and data-exfiltration campaigns targeting organizations in Latin America. Corroborating recent findings from the broader threat…
Unit 42 responded to an incident where a human attacker used frontier AI to breach an enterprise network autonomously as part of a ransomware attack.…
Introducing a New Angle on LLM Safety Our previous research on logit-gap steering demonstrated that the safety guardrails of an aligned LLM can be bypassed…
While supply chain threats have been quietly compounding over the past decade, the last 12–18 months have triggered a drastic shift in the scale and…
The Identity Gap: Why Trust Has Become the New Attack Surface In The 72-Minute Race, we explored how attackers are compressing the time between initial…
Executive Summary It’s three a.m., do you know what your AI agent is doing? Unit 42 has responded to a growing number of AI token…
Executive Summary Unit 42 has observed a persistent cyberespionage campaign we track as CL-STA-1114. This activity cluster overlaps with activity from a Russian threat actor…
