root@markcardiff:~/reports$ ls -la public-reports

Reports

Public security notes and defensive observations from markcardiff.tech. Reports are written for public consumption: concise, cautious on attribution, and focused on practical defensive takeaways.

Status online

Format static HTML

Theme terminal

PHP2Shell: Critical PHP Vulnerabilities Require Urgent Patching /reports/php2shell-critical-php-vulnerabilities-2026-10-21.html

21 October 2026: public defensive advisory on CVE-2026-109618 and CVE-2026-109619, fixed PHP releases, reported attack attempts and priority remediation.

Captured Citrix NetScaler Payload Analysis: Persistent Access, Tunneling, and Configuration Theft /reports/citrix-netscaler-captured-payload-analysis-2026-10-02.html

Public-safe analysis of a captured NetScaler attacker payload showing hidden web shell deployment, persistence, root-capable execution, internal tunneling capability, and configuration exfiltration risk.

Citrix NetScaler Emergency Advisory: CVE-2026-19490 and CVE-2026-88771 through CVE-2026-88778 /reports/citrix-netscaler-cve-2026-19490-undisclosed-risk-advisory.html

Updated public defensive advisory on exploited Citrix NetScaler CVE-2026-19490 and Citrix CTX697096 for CVE-2026-88771 through CVE-2026-88778, including observed exploitation of two newly published vulnerabilities.

Spam-Bombing, Vishing, and Fake Self-Service Portal Malware Campaign /reports/spam-bombing-vishing-fake-self-service-portal-malware.html

A public-safe defensive report on spam-bombing, external support calls, a fake self-service portal, credential/code harvesting, and user-assisted malware execution.

cufl.ie WordPress ClickFix Malware Compromise /reports/cufl-ie-wordpress-clickfix-malware.html

A public incident report on a compromised WordPress site used to deliver ClickFix-style fake verification malware, including sanitised command structure, blockchain-loader details, IOCs, and defensive hunting guidance.

WordPress ClickFix-Style Web Compromise /reports/wordpress-clickfix-style-web-compromise.html

A public-safe incident report on a redacted WordPress support-site compromise involving rogue plugin code, modified plugin JavaScript, blockchain-backed configuration, and ClickFix-style malware lures.

wp2shell: WordPress Core CVE-2026-63030 Remote Code Execution /reports/wp2shell-wordpress-core-cve-2026-63030.html

A public defensive vulnerability brief on CVE-2026-63030, affected WordPress Core versions, fixed releases, exposure impact, and high-level SOC watchpoints.

ShinyHunters / UNC6240: Oracle PeopleSoft CVE-2026-35273 Campaign /reports/shinyhunters-oracle-peoplesoft-cve-2026-35273.html

A public threat intelligence report on ShinyHunters exploitation of Oracle PeopleSoft, including public IOCs, TTPs, timeline graphics, and SOC detection ideas.

DragonForce Ransomware: From Opportunistic RaaS to Cartel-Style Extortion Platform /reports/dragonforce-ransomware-research.html

A research-focused public overview of DragonForce ransomware, its affiliate model, cartel positioning, reported payload lineage, timeline, and SOC watchpoints.

SSH Password Guessing Activity Observed Against markcardiff.tech /reports/ssh-password-guessing-observations.html

A public write-up of opportunistic SSH password guessing activity, top usernames, source infrastructure context, and high-level defensive interpretation.

Publication posture

Reports intentionally avoid sensitive operational detail and focus on externally safe observations, limitations, and defensive interpretation.

Navigation

Return to the landing page or open a report from the listing above.