company
Google's cybersecurity research unit tracking state-sponsored and criminal threat actors, publishing analysis on malware, phishing, and attacker infrastructure.
No evidence-backed relationships are recorded.
Google Threat Intelligence Group counted 10,740 vulnerability disclosures in August, more than double the monthly figure at the start of 2026. Exploitation is rising more slowly, so the first call on any budget reopened this quarter is triage capacity.
Reality
Bouras, Dai and Mechtaev found a static denylist let 46 of 75 prompt injections execute in a coding agent, against 3 under preflight-scoped capabilities. A same-day Google report of malware stealing OIDC tokens from GitHub Actions runners puts the outer limit on an agent in the CI job's permissions.
Reality
Google's threat intelligence group counts 18 exploited flaws a month in 2026, up from 10.5 in 2025, while zero-days rose only from eight to 11. GTIG attributes most of the added attacks to fast weaponization of disclosed n-days, so the exposure sits in the days after a patch ships.
Perspective Coverage
4 publishersReality
LevelBlue says attackers are exploiting NetScaler flaw CVE-2026-88771, rated 9.5, to create a hidden superuser account and plant web shells. The patch closes the injection but removes neither, so already-exposed appliances need a compromise check.
Reality
Microsoft says China-linked operators have used NeedyMantis since at least October 2025 to keep access to telecom, university and government-linked networks. It goes in after the break-in, so defenders have to hunt for it inside networks already breached.
Perspective Coverage
3 publishersReality
Mandiant and Google traced a September 2026 campaign exploiting NetScaler bug CVE-2026-88772, CVSS 9.5, to root on appliances with no login. From there the intruders drop web shells and a Python tunneler that reaches into victims' internal networks to steal credentials.
Perspective Coverage
21 publishersReality
Google's Threat Intelligence Group counted 141 flaws exploited in the wild from January to August, while monthly disclosures doubled to 10,740. Patch teams do better sorting by that exploited set than by the total, though attackers now reach some public flaws within days.
Reality
Attacker server logs show the Coruna iOS WebKit kit compromising a live iPhone's browser in six seconds, two months after Google published its teardown. It fired with no tap from the user, on a phone still running iOS 15.8.3.
Reality
ShinyHunters is again mass-exploiting Oracle PeopleSoft flaw CVE-2026-35273, defeating firewall rules by URL-encoding a single character. Anyone who filtered the endpoint instead of applying Oracle's June 10 patch should assume exposure.
Perspective Coverage
8 publishersReality
Mandiant says ShinyHunters has planted web shells on dozens of Oracle PeopleSoft systems by URL-encoding one character to get past firewall rules. Employers that treated June's stopgap as the fix now have to patch and also look for any access the attackers left behind.
Reality
ShinyHunters is exploiting an unpatched CVSS 9.8 pre-login flaw in Oracle PeopleSoft, encoding one URL character to slip past WAF rules matching the raw path. Mandiant has confirmed JSP web shells on dozens of systems.
Reality
Google says UNC6671 split its extortion into Redact, Pink, Helix and Falcon on shared infrastructure while still working finance, legal and med tech. It averages 1.5 new victims a day.
Reality
Google's threat intelligence team ties three suspected Russian clusters to abuse of Google OAuth, app passwords and device linking. MFA completes normally, so consent telemetry is the control.
Reality
The firm says intruders reached its cloud platforms in July and took names, birth dates and Social Security numbers. Google attributes the campaign to BlackFile, a Com affiliate with four extortion brands.
Reality
Google Threat Intelligence and Mandiant put the Brazilian crew's route to Pix and STR at password spraying plus a fake IT support call, which means the controls that bite here are RMM allow-listing and out-of-band verification of the help desk.
Reality
Attackers using AI can fix and retest a failed cloud privilege escalation in minutes instead of hours, according to an analysis in The Hacker News. The cost it puts on defenders is the hours spent rebuilding each alert's context before anyone acts.
Reality
The September threat report puts 151 million Claude exchanges on 3,500 accounts Anthropic links to Alibaba, about 469 a day per account. The only figure denominated in money anywhere near it is a 2.7% share move.
Perspective Coverage
3 publishersReality
Spain's AEPD published the account but has not yet verified it. In it, the agent scanned for flaws, logged in, altered personal data and opened invoices. The agency's own position is that AI adds speed and scale, not new threats.
Perspective Coverage
3 publishersReality
SlowMist says its evidence for the iPhone Safari attack on crypto wallet keys covers iOS 18.4 to 18.6.2 and that it has confirmed no theft victim. The firm calls this week's iOS 13 to 26.5 warnings preliminary and still tells iPhone users to install security updates.
Reality
Austin Larsen of Google's threat intelligence group says a Mandiant persona sat in TeamPCP's inner circle from almost the start of the campaign. For the companies the group breached, that infiltration was the warning system.
Reality
Build · September 22, 2026 · 1 publisher
Security · September 21, 2026 · 1 publisher
Security · September 17, 2026 · 1 publisher
Leadership · September 16, 2026 · 2 publishers
Security · September 16, 2026 · 1 publisher
Leadership · September 15, 2026 · 1 publisher
Invest · September 14, 2026 · 1 publisher
Build · September 12, 2026 · 1 publisher
Product · September 11, 2026 · 1 publisher
Build · September 10, 2026 · 1 publisher
Security · September 9, 2026 · 1 publisher
Security · September 9, 2026 · 1 publisher
Security · September 8, 2026 · 1 publisher
Security · September 8, 2026 · 3 publishers
Security · September 8, 2026 · 1 publisher
Product · September 8, 2026 · 1 publisher
Security · August 28, 2026 · 1 publisher
Build · August 31, 2026 · 1 publisher
Build · August 23, 2026 · 1 publisher
Leadership · August 22, 2026 · 1 publisher
Build · August 21, 2026 · 1 publisher
Product · August 21, 2026 · 1 publisher
Product · August 21, 2026 · 1 publisher
Leadership · August 19, 2026 · 1 publisher
Leadership · August 19, 2026 · 1 publisher
Security · August 19, 2026 · 1 publisher