# Mallory

> Mallory is an agentic threat-intelligence platform for security teams. It reasons across your attack surface and the global threat landscape — vulnerabilities, exploits, threat actors, malware, and breaking events — to deliver intelligence your team can act on. The pages below are the public view; append `.md` to any vulnerability, actor, or malware URL for a clean Markdown version.

## Core pages
- [Home](https://mallory.ai/): What Mallory is and who it's for.
- [Platform](https://mallory.ai/platform): Know, Respond, Protect: the upstream reasoning layer, end to end.
- [Foundation](https://mallory.ai/platform/foundation): Curated threat intelligence, delivered by API or directly to your AI models.
- [Solutions](https://mallory.ai/solutions): Use cases by team and workflow.
- [Pricing](https://mallory.ai/pricing): Foundation and Frontier plans.
- [About](https://mallory.ai/about): The company, mission, backers, principles, and team.
- [Careers](https://mallory.ai/careers): Why people build at Mallory and how to get in touch.
- [Blog](https://mallory.ai/blog): Product news, research, and analysis.
- [Resources](https://mallory.ai/resources): Everything Mallory publishes: blog, briefs, videos, and press.
- [Press](https://mallory.ai/press): Press releases and coverage of Mallory.
- [Videos](https://mallory.ai/videos): Talks, demos, and interviews from the Mallory team.
- [Intel-led Threat and Exposure Management](https://mallory.ai/briefs/mallory-platform): Mallory correlates 7,500+ intelligence sources with your attack surface, ranks exposures by what attackers are doing, and routes the work into your stack.
- [Findings](https://mallory.ai/briefs/findings): The Mallory Agent investigates across your environment and returns completed findings with severity, evidence, and remediation, in one prioritized queue.
- [MCP and Bring Your Own Key](https://mallory.ai/briefs/mcp): Connect Mallory over MCP in both directions, and run Mallory Agent inference on your own model provider key.

## Live threat intelligence
- [Intelligence feed](https://mallory.ai/intelligence): Breaking, clustered threat-intel stories.
- [Trending intelligence](https://mallory.ai/intelligence/trending): Top vulnerabilities, threat actors, malware, products, and organizations by mention velocity.
- [Live dashboards](https://mallory.ai/intelligence/dashboards): Index of Mallory's continuously updated vulnerability dashboards.
- [Exploitation dashboard](https://mallory.ai/intelligence/exploitation): Live counts of exploited and exploitable CVEs, beyond the KEV catalog.
- [Reserved but Public CVEs](https://mallory.ai/intelligence/rbp): CVEs still reserved at MITRE but already discussed publicly, ranked by mentions.
- [Ransomware dashboard](https://mallory.ai/intelligence/ransomware): Live ransomware activity — trending actors, recent breaches, and tracking stories.
- [Vulnerabilities](https://mallory.ai/intelligence/trending/vulnerabilities): Trending CVEs with exploit and exposure context.
- [Threat actors](https://mallory.ai/intelligence/trending/actors): Tracked adversaries, tradecraft, and targeting.
- [Malware](https://mallory.ai/intelligence/trending/malware): Malware families, IOCs, and ATT&CK mapping.
- [Organizations](https://mallory.ai/intelligence/trending/organizations): Vendors and affected organizations.
- [Products](https://mallory.ai/intelligence/trending/products): Technology products and their exposure.

## Trending vulnerabilities
- [PwnEscape (CVE-2026-99999)](https://mallory.ai/vulnerabilities/CVE-2026-99999.md): severity critical.
- [Authentication Bypass in BeyondTrust Remote Support Internal Messaging (CVE-2026-102764)](https://mallory.ai/vulnerabilities/CVE-2026-102764.md): severity critical.
- [Root Command Execution via AMP Path Traversal in Cisco Secure Email Gateway (CVE-2026-76519)](https://mallory.ai/vulnerabilities/CVE-2026-76519.md): severity critical.
- [Authentication Bypass and Remote Command Execution in Ivanti Connect Secure (CVE-2026-104935)](https://mallory.ai/vulnerabilities/CVE-2026-104935.md): severity high.
- [Authenticated Root Code Execution in Palo Alto Networks PAN-OS Management Interface (CVE-2026-0322)](https://mallory.ai/vulnerabilities/CVE-2026-0322.md): severity high.
- [Unauthenticated command injection in Collabora Online Built-in CODE Server for Nextcloud (CVE-2026-110447)](https://mallory.ai/vulnerabilities/CVE-2026-110447.md): severity critical.
- [OS Command Injection in SiteGuard Server Edition Statistics Function (CVE-2026-106931)](https://mallory.ai/vulnerabilities/CVE-2026-106931.md): severity high.
- [GitLab CI/CD Regular-Expression Compiler Integer Overflow RCE (CVE-2026-97229)](https://mallory.ai/vulnerabilities/CVE-2026-97229.md): severity critical.
- [HTTP/2 upload Use-After-Free in curl (CVE-2026-92392)](https://mallory.ai/vulnerabilities/CVE-2026-92392.md): severity high.
- [Windows Shell Mark of the Web Security Feature Bypass (CVE-2026-96951)](https://mallory.ai/vulnerabilities/CVE-2026-96951.md): severity high.
- [Authenticated CLI Path Traversal in Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager (CVE-2025-61624)](https://mallory.ai/vulnerabilities/CVE-2025-61624.md): severity medium.
- [Remote Code Execution in Drupal Core Field UI (CVE-2026-108097)](https://mallory.ai/vulnerabilities/CVE-2026-108097.md): severity unknown.
- [DLL Search-Path Hijacking in Siemens Software Center (CVE-2026-110936)](https://mallory.ai/vulnerabilities/CVE-2026-110936.md): severity high.
- [Heap Buffer Overflow in NGINX Alias and Rewrite Processing (CVE-2026-15176)](https://mallory.ai/vulnerabilities/CVE-2026-15176.md): severity critical.
- [FortiJump (CVE-2024-47575)](https://mallory.ai/vulnerabilities/CVE-2024-47575.md): severity critical.
- [Compromised emSign Intermediate CA Trust in Go and Rust Certificate Verification (CVE-2026-111943)](https://mallory.ai/vulnerabilities/CVE-2026-111943.md): severity unknown.
- [Authentication Bypass in AhsayCBS JSON API (CVE-2026-105133)](https://mallory.ai/vulnerabilities/CVE-2026-105133.md): severity medium.
- [WinRAR NTFS Alternate Data Stream Path Traversal (CVE-2025-8088)](https://mallory.ai/vulnerabilities/CVE-2025-8088.md): severity high.
- [BlockStrap (CVE-2026-103849)](https://mallory.ai/vulnerabilities/CVE-2026-103849.md): severity critical.
- [Remote Code Execution in AhsayCBS Replication Receiver (CVE-2026-105134)](https://mallory.ai/vulnerabilities/CVE-2026-105134.md): severity critical.
- [Unauthenticated Arbitrary File Read in Atlassian Data Center Products (CVE-2026-21589)](https://mallory.ai/vulnerabilities/CVE-2026-21589.md): severity critical.
- [Authentication Override Cookie Bypass in Palo Alto Networks GlobalProtect (CVE-2026-0257)](https://mallory.ai/vulnerabilities/CVE-2026-0257.md): severity high.
- [Heap Buffer Overflow in NGINX Regex Map Variable Evaluation (CVE-2026-93479)](https://mallory.ai/vulnerabilities/CVE-2026-93479.md): severity critical.
- [Vghost (CVE-2026-74580)](https://mallory.ai/vulnerabilities/CVE-2026-74580.md): severity high.
- [SSRF in Plex Media Server Companion Timeline Callback (CVE-2026-96652)](https://mallory.ai/vulnerabilities/CVE-2026-96652.md): severity medium.

## Trending threat actors
- [N0n](https://mallory.ai/actors/01a0b66b-5d28-7de8-b4e0-bcb3d78f6d49.md)
- [Qilin](https://mallory.ai/actors/019ab9bd-c6a1-7c6e-b28c-cda01d372ff4.md)
- [Metaencryptor](https://mallory.ai/actors/019d0233-4083-707e-b4e1-b8d6b94fc8d1.md)
- [TheGentlemen](https://mallory.ai/actors/019abb07-733a-7e38-ae2d-cd735f8140b3.md)
- [Termite](https://mallory.ai/actors/019aba62-8788-7839-acad-b3dae183a840.md)
- [NightSpire](https://mallory.ai/actors/019ab986-dc48-73a9-a5aa-473a480a44fd.md)
- [blacknevas](https://mallory.ai/actors/019abad0-6808-7ac0-85fc-f377e338e159.md)
- [ARMORY CASTLE](https://mallory.ai/actors/01a14240-70e4-71a9-81b5-6ea5fe76ed68.md)
- [Wallstreet](https://mallory.ai/actors/019f06e7-e4da-7c5b-9482-c22c6379d02c.md)
- [Helix](https://mallory.ai/actors/019f45fd-b615-7f80-b990-1a65d37da594.md)
- [ShinyHunters](https://mallory.ai/actors/019ab9bd-c6aa-7f7d-9076-630e52a81778.md)
- [PEAR](https://mallory.ai/actors/019afe68-e925-7d11-8317-e9068227d36c.md)
- [LeakNet](https://mallory.ai/actors/019cfdb2-d5dc-73c5-ab2c-eac9127cad6d.md)
- [LockBit](https://mallory.ai/actors/019ab9bd-c6ac-7814-a96b-62c6e28547e9.md)
- [Toufan](https://mallory.ai/actors/01a0023f-5395-7498-ac70-5a34985f0289.md)
- [DeadLock](https://mallory.ai/actors/019bbd99-5af2-7e99-ac4e-03d181663e29.md)
- [INCRansom](https://mallory.ai/actors/019abb75-d1ae-706a-ae97-ffe6fb518528.md)
- [UTA0576](https://mallory.ai/actors/01a1362a-0448-75c7-a618-df30ab50d45d.md)
- [Akira](https://mallory.ai/actors/019abb75-d1b9-7402-a825-66d273de4705.md)
- [iah6477](https://mallory.ai/actors/01a0236f-3f71-7f3b-9e85-2f9b71de893a.md)
- [RansomHouse](https://mallory.ai/actors/019ab986-dc51-752e-b5d0-505829c2113c.md)
- [Contagious Interview](https://mallory.ai/actors/019fbed2-0444-796d-9076-511fc7ad30f7.md)
- [Crypto24](https://mallory.ai/actors/019abbe3-3f82-7567-9fb0-ed49d6084749.md)
- [BYOD](https://mallory.ai/actors/01a10c61-2bf7-7d46-bacd-78139aa31b85.md)
- [UNC7017](https://mallory.ai/actors/01a14578-7a7b-7714-b4fe-0c498a1730d7.md)

## Trending malware
- [SAWFLY](https://mallory.ai/malware/01a14240-7039-7c04-b18f-67cc36566873.md)
- [BARECLAW](https://mallory.ai/malware/01a14240-700e-770b-a403-251faf58151e.md)
- [CoGUI](https://mallory.ai/malware/019b9cfa-8cf0-7083-890d-1d5a322d1cc3.md)
- [Pegasus](https://mallory.ai/malware/019ab9bd-b37f-7241-b6c9-fa6a5c21983c.md)
- [Darksword](https://mallory.ai/malware/019d01a2-7aab-79e8-972f-b5f95efd0e30.md)
- [PEERSTITCH](https://mallory.ai/malware/01a13c99-eb51-7721-ba79-995b7d0ff3bd.md)
- [SHINYROAD](https://mallory.ai/malware/01a14578-6747-73c9-a36b-818a3fd6a791.md)
- [Mirai](https://mallory.ai/malware/019ab9bd-b380-706f-8e9b-313a0c30efbe.md)
- [CROSSROAD](https://mallory.ai/malware/01a14578-675b-7820-b2ab-c24b9cbdd3df.md)
- [XMRig](https://mallory.ai/malware/019aba62-7595-7e7a-9982-2ffed904f831.md)
- [Candiru](https://mallory.ai/malware/019abad0-53f4-70b4-847c-91440e47aa86.md)
- [Iron Man System](https://mallory.ai/malware/01a13ae2-93ce-7e4a-b31e-553da994ea7d.md)
- [ROMULUS](https://mallory.ai/malware/01a13ae2-93c8-7630-8eae-9160f51310f1.md)
- [Haozi](https://mallory.ai/malware/01a13ab3-53eb-7eae-b333-a084142617fb.md)
- [Chvost](https://mallory.ai/malware/01a13ae2-93c0-700e-81ae-e28edcb50be3.md)
- [PickleShell](https://mallory.ai/malware/01a13ae2-93d3-7dba-be74-b0edccd24801.md)
- [Hirudo](https://mallory.ai/malware/01a139cf-cd0f-7499-b715-82c9bef00f2c.md)
- [Laplas](https://mallory.ai/malware/019abd9b-8caa-7d29-8998-2b4cb61cd895.md)
- [KGB RAT](https://mallory.ai/malware/019d921d-44f8-7f3d-811c-a545615b2cf6.md)
- [LegionLoader](https://mallory.ai/malware/019d7da8-7729-7908-91c9-3eb8739e7088.md)
- [Aoki](https://mallory.ai/malware/01a13f64-270d-7228-a2a8-6e1c6e443e1c.md)
- [ADAPTAGENT](https://mallory.ai/malware/01a14578-672e-73c2-94dc-7f18197cea8a.md)
- [myawesomeproxy](https://mallory.ai/malware/01a152a1-911e-7064-9c48-eebf5bc5afc3.md)
- [njRAT](https://mallory.ai/malware/019abb07-5cd3-7b80-b248-9d5d46839516.md)
- [Iron Man](https://mallory.ai/malware/01a13ab3-53ed-78bc-b078-62351e9a4e47.md)

## Blog
- [Rapid Response: PHP's Critical RCE Fixes Skip 884,000 Internet-Facing Hosts](https://mallory.ai/blog/php-rce-rapid-response): PHP patches two critical RCEs on October 21, but only for 8.2 and later. About 884,000 internet-facing hosts run a branch that will get no fix.
- [Findings: Fix What Matters First](https://mallory.ai/blog/mallory-findings): Mallory Agents investigate alerts and advisories, then file findings with evidence, severity, and remediation steps your team can triage, route, and track.
- [A Conversation With Jace Davis, Mallory's First Sales Hire](https://mallory.ai/blog/family-is-the-why-jace-davis): Jace Davis, Mallory's first sales hire, on what drives him, why he wanted to build from a blank page, and the impact he wants to have.
- [The Mallory App for Splunk Closes the Loop on Every Match](https://mallory.ai/blog/mallory-app-for-splunk): The Mallory App for Splunk imports Mallory's threat intelligence into Splunk ES, matches it against your telemetry, and reports every confirmed match back to Mallory as a sighting, automatically.
- [Nightmare-Eclipse Moves Past Windows Defender.](https://mallory.ai/blog/nightmare-eclipse-moves-past-defender): Nightmare-Eclipse expanded past Windows Defender to CrowdStrike, Avast, Kaspersky, and NVIDIA this year. Here's what's patched, confirmed, and still just a claim.
- [Why I Bet on Mallory's Team, Not Just Its Category](https://mallory.ai/blog/joining-mallory-as-founding-marketing-lead): Why I joined Mallory as Founding Marketing Lead, and why this team is finally building exposure management right instead of bolting it on.
- [We Turned Claude Code Into a Malware Analysis System](https://mallory.ai/blog/mortex-claude-code-malware-analysis): At Black Hat USA 2026, Mallory researcher Maxim Gofnung traces Mortex from a one-off Claude Code result through a coordination failure, a runtime gap static analysis cannot see, and a sealed case landing in Mallory.
- [Bring Your Own Key Is Now Generally Available](https://mallory.ai/blog/byok-bring-your-own-key): BYOK lets the Mallory Agent reason on the AI provider your organization already vetted and contracted, instead of Mallory's own model account.
- [Adversary Timelines Have Collapsed: Defenders Must Rethink Proactive Security with Agents](https://mallory.ai/blog/adversary-timelines-collapsed): AI has cut disclosure-to-exploitation to hours. Mallory's new architecture unifies context, reasoning, and policy so agents can act safely, under your rules.
- [Five Eyes to Boards: Back to Basics, Faster](https://mallory.ai/blog/five-eyes-ai-shift): Six cybersecurity agency heads signed one statement on AI and cyber risk. Their answer is not more tools. It is the basics, done faster, because the gap between disclosure and exploitation is shrinking to months.
- [The Real Change in BOD 26-04 Is Forensic Triage](https://mallory.ai/blog/bod-26-04-forensic-triage): CISA's new directive replaces fixed KEV deadlines with risk-based timelines. The bigger change: for the highest-risk vulnerabilities, agencies must now determine whether the asset was already compromised, within 72 hours.
- [Compromised Packages Drop Daily. Are You Running Any of Them?](https://mallory.ai/blog/supply-chain-compromised-package-audit): From an overnight supply chain compromise to a scheduled audit of your own GitHub org. A live stream of compromised packages, an agent that checks whether you're running any of them, and a daily 6am email with the answer.
- [Mallory is now SOC 2 Type 2 certified](https://mallory.ai/blog/soc2-type2-certified): Our SOC 2 Type 2 examination is complete, less than 60 days after GA. The report is available to security teams under NDA.
- [VulnOps, Minus the Mythology](https://mallory.ai/blog/mythos-vuln-ops-patchmageddon): Vuln-ops gets talked about like a mythology. Here's what five minutes of it actually looks like in Mallory, from a Slack ping on Bleeding Llama (CVE-2026-7482) to on-demand Suricata rules.
- [Enhancing Cyber Situational Awareness with Mallory Stories](https://mallory.ai/blog/delivering-signal-over-noise): Cyber defense starts with situational awareness. Mallory Stories cluster millions of references into one coherent view, tailored to your environment.
- [Why I'm Backing Mallory](https://mallory.ai/blog/why-im-backing-mallory): The Mallory team has built a modern cyber-security platform that sits at the intersection of AI-Native Operations and Exposure Management. Mallory's agentic capabilities serve several use cases, builders, and operators alike.
- [Mallory on Unsupervised Learning](https://mallory.ai/blog/demoing-mallory-unsupervised-learning): Jonathan Cran joins Daniel Miessler on Unsupervised Learning for a full walkthrough of Mallory — from real-time threat stories and entity resolution to scheduled monitoring, asset context, and agent integration.
- [HD Moore on Delivering Value with Mallory](https://mallory.ai/blog/hd-moore-delivering-value): The runZero co-founder on how his team uses Mallory to get ahead of new vulnerabilities — often notifying customers before the first news article drops.
- [Announcing Decibel's Investment in Mallory](https://mallory.ai/blog/dan-nguyen-huu-investing-in-mallory): Decibel partner Dan Nguyen-Huu on the evolution of threat intelligence — from raw data feeds to contextualized, actionable insight delivered in the context of your environment.
- [Matt Johansen on AI Native Cyber Threat Intelligence](https://mallory.ai/blog/mattjay-new-approach-threat-intel): Longtime security practitioner Matt Johansen on why LLMs change everything for threat intelligence — from natural language queries to agents that act on intel autonomously.
- [John Sapp, CISO Texas Mutual: Where Mallory Fits](https://mallory.ai/blog/john-sapp-force-multiplier): John Sapp runs dual managed services to triage alerts down to true positives. From there, Mallory is the force multiplier that enables his analysts to investigate deeply and respond fast.
- [Meet the Founder: Why We Built Mallory](https://mallory.ai/blog/meet-the-founders): Our CEO Jonathan Cran on the problem Mallory was built to solve: helping security teams figure out if they're affected and take action, fast.
- [Mallory goes GA: Introducing our AI-Native Threat Intelligence Platform](https://mallory.ai/blog/launching-mallory): Today, we're launching Mallory, our AI-Native Threat Intelligence Platform built for exposure investigation. Here's why we built it, what it does, and what's next.
- [Introducing Mallory](https://mallory.ai/blog/introducing-mallory): We're excited to introduce Mallory, a stealth-mode startup focused on supporting security operations teams through high quality and operationally efficient cyber threat intelligence.

## Optional
- [Full content dump](https://mallory.ai/llms-full.txt): all of the above with entity bodies inlined.
- [Sitemap](https://mallory.ai/sitemap.xml)
- [Blog RSS](https://mallory.ai/feed)
- [Intelligence RSS](https://mallory.ai/feed/stories)