Hundreds of cybersecurity blogs, research reports, and advisories published every day. No one has time to read them all. And the one report that matters? It's buried somewhere in the noise.
That's why DFIR Radar exists.
We monitor the cybersecurity landscape around the clock. Every article is evaluated for DFIR relevance. Only what's genuinely useful makes it through. The rest never reaches your feed.
This feed is the result of that process. Every article is sourced, evaluated, and published only if it meets the standard.
If you find something we missed, our Discord community lets you contribute directly.
Discord community: https://t.co/OxPingPERj
Built by a practitioner who needed this to exist.
Follow once. Stay informed forever.
#DFIR_Radar
CVE-2025-48595 (CVSS 8.4) Android Framework zero-day under active exploitation fixed in June 2026 bulletin. Integer overflow enables local privilege escalation without user interaction. CISA added to KEV catalog with June 5 deadline.
#DFIR_Radar
Espionage actors maintained 150-day persistence in stock exchange executive's Outlook account, using Aspose .NET library to incrementally exfiltrate OST files via Dropbox/OneDrive. IOCs available in Symantec report.
#DFIR_Radar
FileFix evolution: Attackers moved ClickFix social engineering from Win+R dialogs to File Explorer address bars, bypassing Mark of the Web protections. Campaign leverages trusted interfaces to execute malicious PowerShell without triggering SmartScreen warnings.
Technical breakdown:
• KongTuke/LandUpdate808 cluster injects JavaScript into compromised sites creating fake CAPTCHAs
• HTML <input type="file"> opens explorer.exe file dialog while JS writes obfuscated PowerShell to clipboard
• Users paste "verification code" into File Explorer address bar, executing commands directly (T1059.001)
• Bypasses MotW since no file download occurs - payload executes from clipboard in trusted interface
• Process lineage: browser spawns cmd.exe/powershell.exe/wscript.exe indicating exploitation
Hunt for browsers (chrome.exe, msedge.exe) spawning scripting interpreters as child processes. Check HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths registry key for PowerShell commands or HTTP URLs - strong forensic indicator of successful FileFix execution.
#DFIR_Radar
Critical RCE in Everest Forms Pro WordPress plugin under mass exploitation since April. Unauthenticated attackers inject PHP code via form fields to create admin accounts and achieve full site compromise.
Key technical details:
• CVE-2026-3300, CVSS 9.8 - affects versions ≤1.9.12, patched in 1.9.13
• Flaw in process_filter() function concatenates unsanitized user input into eval() statement
• Exploits target "Complex Calculation" feature by breaking string quotes with malicious PHP
• Over 29,300 blocked attempts since disclosure, peak exploitation on May 16th with 17,900 attempts
Attack methodology:
• Single quote injection in text/email/select/radio fields: `';[malicious_php];//`
• Most common payload creates "diksimarina" admin account via wp_insert_user()
• No authentication required, immediate server-side code execution
• Leads to webshell deployment and persistent backdoors
DFIR artifacts:
• Check WordPress user tables for suspicious admin accounts, especially "diksimarina"
• Review web logs for POST requests to /wp-admin/admin-ajax.php with everest_forms parameters
• Monitor top attacking IPs: 202[.]56[.]2[.]126, 209[.]146[.]60[.]26, 15[.]235[.]166[.]18
Hunt for recently created WordPress admin accounts and correlate with form submission logs containing single quotes followed by PHP function calls.
#DFIR_Radar
New research exposes critical flaws in AI skill scanners from ClawHub, Cisco, and https://t.co/8jwR80yy72. Trail of Bits bypassed all scanners in under an hour using simple obfuscation, bytecode poisoning, and prompt injection techniques.
#DFIR_Radar