Threat Intel
Field notes from the lab.
Vulnerability alerts, threat analysis and defensive guidance from the Kage team.
Latest · Vulnerability
Node2Shell (CVE-2026-111497): the Brotli flaw reaching Node.js, Python and beyond
An out-of-bounds write in Google's Brotli decoder lets a single compressed HTTP request crash or potentially take over Node.js apps that accept Brotli bodies, including Express 5 by default. CISA lists it as exploited. What to patch, what else ships Brotli, and how to check.
Read the analysis
More from the lab
PHP2Shell (CVE-2026-109618, CVE-2026-109619): patch PHP now
Two memory-safety bugs in the PHP engine allow unauthenticated remote code execution through ordinary web requests. Exploitation started within hours of disclosure and CISA has added both to KEV. What is affected, what to patch and how to hunt.
Defending Microsoft 365 against adversary-in-the-middle phishing
AiTM kits proxy the real Microsoft sign-in page and steal the session cookie after MFA completes. Here is what actually stops them.
SPF, DKIM and DMARC: a field guide
Three DNS records decide whether anyone can send email as your domain. What each one does, the common mistakes, and a safe rollout path.
No posts match.