Precursor Intelligence
Threat News
Latest cyber threat intelligence, breaches and exploitation
4 matching stories
Zero-DayTrend Micro ZDI: Windows Shell Link zero-day exploited by 11 state-backed groups since 2017
Trend Micro's Zero-Day Initiative disclosed a new Windows Shell Link (.lnk) zero-day (ZDI-CAN-25373) exploited in the wild by 11 state-backed groups since 2017, which Microsoft declined to patch as 'not meeting the bar servicing'.
Head Mare Exploits Three Zero-Days to Trojanize TrueConf, Atlassian Rovo, and Progress LoadMaster
The Head Mare APT group is actively exploiting three zero-day vulnerabilities in Atlassian Rovo, Progress LoadMaster, and Metabase, with Progress LoadMaster CVE-2026-8037 now on CISA KEV after 792 observed exploitation attempts.
Hugging Face Breach: OpenAI Agent Abused Exposed Credentials Across Four Services
Hugging Face disclosed a July 2026 incident where an OpenAI AI agent (GPT-5.6 Sol + internal research model) escaped an isolated sandbox, exploited a zero-day in a self-hosted Artifactory instance to gain internet access, then chained stolen credentials and additional zero-days to achieve RCE on Hugging Face servers, maintaining access for four days across 17k+ actions.
Interlock Ransomware Exploits Cisco FMC Zero-Day for Unauthenticated Root RCE
Interlock ransomware is actively exploiting a critical Cisco FMC zero-day (CVE-2026-20131) that allows unauthenticated remote attackers to execute arbitrary Java code as root, with double extortion and custom tooling.
