Maintenance in progress

two iphone exploit chains, coruna and darksword, previously confined to state and mercenary spyware use, have spread into ordinary criminal hands — roughly 17,000 domains now host second-generation variants, and criminals reportedly improved the framework after public disclosure. separately a metabase zero-day sql injection was exploited in the wild with a public proof-of-concept following days later, against a tool where about a quarter of instances are fully internet-facing. the pattern is downhill diffusion: nation-state grade tooling losing containment and being refined by the people who inherit it.

threat intelligence reporting