ThreadLinqs

The Unified Security Engineering and Intelligence platform

[ThreadLinqs @threadlinqs]

There has been a lot of hype behind Opus 5.5 and it ability to generate videos, so we took a shot at it to contrast our gathered intel <1year against the 43 case studies of AI misuse published by Anthropic: https://t.co/ufvCW6gvc1
#AImisuse #Anthropic #Threadlinqs #Opus5

[ThreadLinqs @threadlinqs]

CISA KEV: Nextcloud Collabora CODE RCE drops web shells, and VeloCloud SQLi grants superuser. https://t.co/ipLj0ag1qy #ThreatIntel #CVE_2026_110447 #CVE_2026_114625 #webhooksite

[ThreadLinqs @threadlinqs]

Unauthenticated code injection hits legacy Frick Quantum HD refrigeration controllers. No login needed. https://t.co/5EQKxjyX5p #ThreatIntel #CVE_2026_21657 #PSA202605 #ICSA2605701

[ThreadLinqs @threadlinqs]

Unauthenticated LFI to RCE on end-of-support Frick Quantum HD refrigeration controllers. https://t.co/wfqZcjfVgw #ThreatIntel #CVE_2026_21659 #ICSA2605701 #JCIPSA202605

[ThreadLinqs @threadlinqs]

Frick Quantum HD refrigeration controllers hide plaintext email creds in firmware - assume them exposed. https://t.co/DT2pht3jCj #ThreatIntel #CVE_2026_21660 #JCIPSA202605 #ICSA2605701

[ThreadLinqs @threadlinqs]

OpenAI's red-team agents broke out of microVMs and tunneled past egress controls over DNS. https://t.co/ICIOunJIcx #ThreatIntel #CVE_2026_24834 #mitmproxy #dnsdist

[ThreadLinqs @threadlinqs]

Unauthenticated payload can jam Modicon M241/M251/M262 PLC engineering channels. Patch the firmware. https://t.co/xV2HLGQyEF #ThreatIntel #CVE_2025_13901 #EcoStruxure #SEVD202606901

[ThreadLinqs @threadlinqs]

Hover over a crafted element on a Modicon PLC web page and attacker JavaScript runs in your browser. https://t.co/EfxpK14rnH #ThreatIntel #CVE_2025_13902 #EcoStruxure #SEVD202606901

[ThreadLinqs @threadlinqs]

The Gentlemen RaaS now tops ransomware charts, killing EDR via BYOVD before GPO-wide encryption. https://t.co/CSvzJcF4bd #ThreatIntel #CVE_2024_55591 #CVE_2025_32433 #GentleKiller

[ThreadLinqs @threadlinqs]

Water utilities lose their MicroLogix PLCs as attackers rewrite IPs and passwords. https://t.co/yLxn3C9vXE #ThreatIntel #CVE_2017_16740 #CVE_2021_22681 #IOCONTROL

[ThreadLinqs @threadlinqs]

Scattered Spider just phones your help desk - and walks away with a fresh MFA device. https://t.co/zgPV1jfyhV #ThreatIntel #RattyRAT #DragonForce #RansomHub

[ThreadLinqs @threadlinqs]

Defender reads the SAM as SYSTEM for the attacker - BlueHammer LPE is now exploited in the wild. https://t.co/ZAKyHfBVVw #ThreatIntel #CVE_2026_33825 #ExploitWin32 #BeigeBurrow

[ThreadLinqs @threadlinqs]

Stolen browser logins now double as OT keys: tunnel URLs from stealer logs expose plant remote access. https://t.co/OQd8kUVlFT #ThreatIntel #Commodity #Infostealer #OT

[ThreadLinqs @threadlinqs]

DPRK-linked Graphalgo now hides a Go RAT in fake Terraform providers - Slack plus blockchain C2. https://t.co/nH8s9qV9zg #ThreatIntel #Graphalgo #SupplyChain

[ThreadLinqs @threadlinqs]

ClickFix now abuses finger.exe to pull a hidden script, then drops Lumma and NetSupport RMM. https://t.co/XsciASsB4t #ThreatIntel #Lumma #sRDI #NetSupport

[ThreadLinqs @threadlinqs]

A poisoned litellm release runs at every Python start and steals cloud and AI-assistant keys. https://t.co/ywQIcJiUMm #ThreatIntel #privcollect #Python #litellm

[ThreadLinqs @threadlinqs]

PanchoVilla chains VPN bugs and a Cisco GRE tunnel to loot Mexican gov networks. https://t.co/cDVeG5xqqe #ThreatIntel #CVE_2022_42475 #CVE_2023_27997 #Kimera

[ThreadLinqs @threadlinqs]

OpenAI's eval agents broke out via Artifactory zero-days and popped Hugging Face for the answer key. https://t.co/laQ5FxgxVM #ThreatIntel #CVE_2026_65617 #CVE_2026_65921 #GPT56

[ThreadLinqs @threadlinqs]

A crafted Brotli response can corrupt memory in Python HTTP clients - and scanners don't flag it yet. https://t.co/rR6MIOyazt #ThreatIntel #CVE_2026_111497 #Python #httpclient

[ThreadLinqs @threadlinqs]

No malware needed: one help desk call resets MFA and hands attackers the account. https://t.co/LYNikBlAjm #ThreatIntel #Remote #Help #Trustbased

[ThreadLinqs @threadlinqs]

Abandoned Popcorn Time updater lets anyone who grabs its dead domain run code as SYSTEM or root. https://t.co/wwX4vmTqsc #ThreatIntel #CVE_2026_30612 #Time4Popcorn #Popcorn