SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
Featured Article
CVE Research
Synology NAS Under Siege: C3RB3R Ransomware Strikes Unpatched Devices
Synology has warned customers about an ongoing wave of ransomware attacks targeting network-attached storage (NAS) devices running outdated versions of DiskStation Manager (DSM). The attacks have been associated with C3RB3R ransomware, a threat capable of encrypting stored files and demanding payment for their recovery.
CVE Research
NetamLoader Malware Targets Asian Government Windows 10 Systems Through Advanced .NET Injection
NetamLoader is a multi-stage .NET malware loader targeting customized Windows 10 systems used by Asian government organizations. Discover its AppDomainManager injection techniques, XAML-based execution, AMSI bypass, encrypted command-and-control communications, indicators of compromise, and mitigation strategies.
CVE Research
WARP PANDA Weaponizes VMware ESXi Zero-Day Logging Gap to Evade Audit Visibility
China-nexus threat actor Warp Panda exploited an insufficient logging zero-day in VMware ESX (CVE-2026-41709) to blind audit visibility, deploying BRICKSTORM malware and hijacking Microsoft 365 accounts across targeted U.S. legal networks
CVE Research
PolyShell: Critical Magento Flaw Allows Unauthenticated RCE, Exploited Since March 2026
CVE-2026-48356 is a critical unrestricted file upload vulnerability in Adobe Commerce and Magento Open Source. Unauthenticated attackers can submit polyglot files through guest-cart REST item routes and write them under pub/media/custom_options/. When the web server executes or serves that path as PHP, the result can be remote code execution or stored XSS. Mass exploitation has been observed since March 2026, including links to CMS-block loaders on hundreds of stores. The issue is listed in the CISA KEV catalog. This article covers how the flaw works, campaign activity, indicators of compromise, affected and fixed versions under APSB26-73, and practical remediation steps.
CVE Research
PHP2Shell After the Patch: The FAQ for Verification, Detection and Response
Patches for PHP2Shell are out, but verifying them, trusting interim mitigations and checking for earlier compromise are where teams are stuck. This FAQ covers stale version banners, container rebuilds, WAF limits, detection signals and what to rotate.