17.8B
accounts exposed
- 1,033 breaches tracked
- 674 leak passwords
Practitioner-first cyber intelligence hub
Turn cyber intelligence into practical decisions.
Investigate vulnerabilities, follow source-backed threat signals and move from evidence to action with practical research, detection context and privacy-aware security tools.
Live threat board
Updated continuously from ShellCodeX trackers & CISA KEV
4,092
victim claims tracked
- +217 in the last 7 days
- 74 groups active this month
20
intel signals in 24h
- 18 rated high or critical
- Peak CVSS 10
Daily threat climate
65
/ 100
Elevated
▼ 2 vs yesterday
Updated 22 hours ago
Cyber Weather
A daily reading of the global cyber threat climate.
Critical AI signals are shaping today's risk
The current stream is above normal baseline. ShellCodeX Pulse reviewed 19 published signals from the last 24 hours, with AI as the dominant theme and critical as the highest observed severity.
Dominant threat
AI
Signals reviewed
19 · 24h
2 critical
14 high
3 medium
Ransomware
Severe
Vulnerabilities
Severe
Malware
Severe
Cloud
Severe
AI
Severe
Activity is easing off; AI should keep receding unless a new disclosure lands.
Signals shaping today
Open Pulse
ServiceNow fixes three critical code injection vulnerabilities
KindaRails2Shell Arbitrary File Read Lets Attackers Steal Secrets
CISA adds PaperCut CVEs to KEV after active intrusions escalate
CVE-2026-82078
McKesson confirms breach after ShinyHunters extortion deadline nears
CVE-2026-82078
×2
Microsoft
Kaspersky
Featured Highlights
Featured articles and tools in one rotating spotlight.
Featured Article
Hunting and Containing Live AWS Access Keys in Production
A public leak lands in your ticketing system: a repo, a build artifact, or a dataset contains an AWS access key. This article shows the exact commands, CloudTrail queries and containmen...
Read Story ▸
Featured Article
Keycloak CVE-2026-18963 Testing & Hunting Guide
A practical, hands-on guide for application security testers and defenders to test, detect and remediate Keycloak CVE-2026-18963. Includes exploit checks, DB and event queries, SIEM hun...
Read Story ▸
Featured Article
Detecting CVE-2026-19478 Exploitation in GitLab GraphQL
When a self‑hosted GitLab project disappears after an unauthenticated GraphQL POST, this guide shows where to look and what rules to run. Includes SIEM queries, Sigma rules and an audit...
Read Story ▸
Featured Article
Leveraging HTTP/2 for Covert Command and Control
Explore how attackers exploit HTTP/2 features for stealthy command and control channels and learn detection strategies.
Read Story ▸
Featured Article
Crafting HTTP Desync Attacks for Web Anomalies
Explore the intricacies of HTTP desync attacks and how they can reveal critical web vulnerabilities. A must-know for penetration testers.
Read Story ▸
Featured Article
Bypassing CSRF Protections with JSONP
Explore how JSONP can be exploited to bypass CSRF protections in web applications. Understand the methods and defensive measures.
Read Story ▸
Featured Article
Exploiting Misconfigured S3 Buckets for Data Exfiltration
Misconfigured S3 buckets pose a significant security risk, often leading to data exfiltration. Discover techniques used by attackers and how to safeguard your data.
Read Story ▸
Featured Article
18 Browser Extensions Every Red Teamer Should Know in 2026
Discover 18 powerful browser extensions every red teamer, penetration tester, and bug bounty hunter should know in 2026. From reconnaissance and proxy management to endpoint discovery,...
Read Story ▸
Featured Article
Analysis of Recent Ransomware Attacks Targeting Critical Infrastructure
Explore the latest ransomware attacks on critical infrastructure, their implications, and strategies for mitigation.
Read Story ▸
Featured Article
Why Threat Actors Still Rely on Simple Mistakes — and Why It Still Works
An analysis of why threat actors continue to exploit simple security mistakes — and how real-world incidents prove that basic errors still lead to major breaches.
Read Story ▸
Featured Tool
dismap
Asset discovery and identification tools 快速识别 Web 指纹信息，定位资产类型。辅助红队快速定位目标资产信息，辅助蓝队发现疑似脆弱点
Open Tool ▸
Featured Tool
shod4nd0rk
A Python tool for managing and searching Shodan dorks, including adding, deleting, and searching dorks with an easy-to-use menu interface.
Open Tool ▸
Featured Tool
MailV4l1d8r
A powerful email validation tool for checking disposable and unsafe email addresses using multiple APIs and additional security checks.
Open Tool ▸Technology Pulse
Live signals from the cybersecurity and infrastructure ecosystem.
PoC : [webapps] Bludit CMS - Stored XSS
• 1 day ago
0-Day : Pointer leaks through pointer-keyed data st...
• 11 months ago
PoC : [webapps] Wolf CMS 0.8.3.1 - RCE v
• 1 day ago
Campaign : Guildma (Astaroth) malware infection from Br...
• 6 hours ago
News : Attackers Exploit Critical JFrog Artifactory...
• 10 hours ago
CVE : CVE-1999-1467
• 36 years ago
Campaign : ISC Stormcast For Tuesday, September 1st, 20...
• 1 day ago
0-Day : Defeating KASLR by Doing Nothing at All
• 9 months ago
Campaign : The Coding-Agent Trap: When a "Free" LLM End...
• 1 day ago
News : Iranian Hackers Pose as Recruiters to Delive...
• 15 hours ago
Articles
An operational playbook to prioritise and remediate CVE-2026-21962 in Oracle WebLogic. Includes triage heuristics, detection queries, WAF rules and timeline SLAs to act fast.
Prioritizing and Remediating CVE-2026-21962 in Oracle WebLogic
An operational playbook to prioritise and remediate CVE-2026-21962 in Oracle WebLogic. Includes triage heuristic...
Read ▸
A public leak lands in your ticketing system: a repo, a build artifact, or a dataset contains an AWS access key. This article shows the exact commands, CloudTrail queries and conta...
Hunting and Containing Live AWS Access Keys in Production
A public leak lands in your ticketing system: a repo, a build artifact, or a dataset contains an AWS access key....
Read ▸
A practical, hands-on guide for application security testers and defenders to test, detect and remediate Keycloak CVE-2026-18963. Includes exploit checks, DB and event queries, SIE...
Keycloak CVE-2026-18963 Testing & Hunting Guide
A practical, hands-on guide for application security testers and defenders to test, detect and remediate Keycloa...
Read ▸
When a self‑hosted GitLab project disappears after an unauthenticated GraphQL POST, this guide shows where to look and what rules to run. Includes SIEM queries, Sigma rules and an...
Detecting CVE-2026-19478 Exploitation in GitLab GraphQL
When a self‑hosted GitLab project disappears after an unauthenticated GraphQL POST, this guide shows where to lo...
Read ▸
If your org runs Zimbra Collaboration Suite with the zimbra-snmp package installed, CVE-2026-73570 lets unauthenticated attackers execute OS commands when SNMP notifications are en...
Hunting and Containing Zimbra CVE-2026-73570 with IDS, SIEM and EDR
If your org runs Zimbra Collaboration Suite with the zimbra-snmp package installed, CVE-2026-73570 lets unauthen...
Read ▸Tools
Curated open-source picks
A not so awesome list of adversary emulation gems for aspiring red/blue/purple teamers
adversaryemulation-gems
A not so awesome list of adversary emulation gems for aspiring red/blue/purple teamers
Open ▸
:computer:🛡️ A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams.
awesome-cybersecurity-blueteam
:computer:🛡️ A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue tea...
Open ▸
Build, Share, and Grow with the Community.
ShellCodeX is evolving into a practical technology hub for builders and teams. We publish high-signal articles, curate useful tools, and spotlight real community events in one place.
Guides
Open-Source Tools
Community Events