Blogs on Information Technology, Network & Cybersecurity | Seqrite

Introduction

As part of our ongoing malware research at Seqrite Labs, we analysed an infected Windows machine with three scheduled tasks: SysCheck2, SysCheckX and SysHeal. All three pointed to C:\Windows\SystemHealth\Update, and the machine was talking to datamons[.]org. When we opened the folder, we found a complete malware ki...

The Evolution of Qilin

Throughout the year 2026, the creators of Qilin (Agenda) ransomware have made fundamental changes to their malware. The initial version was an application that would require the attacker to log in, provide parameters, and enter commands manually. Further versions evolved into an automated payload that could spread through multipl...

PHP2Shell affects how PHP handles a request that runs out of memory or encounters a fatal error. If the failure interrupts an operation before it finishes, PHP can leave an array entry only partly initialized or retain a pointer to memory that is later freed. Request cleanup or a subsequent request can then use that invalid state, causing memory corruption that can lead to re...

WP2Shell is a critical WordPress Core exploit chain disclosed in July 2026 that can enables pre-authentication remote code execution (RCE) on vulnerable WordPress installations. The chain is particularly significant from a threat-intelligence perspective because it removes the requirement for an attacker to first obtain valid credentials or authenticate to the target applicat...

Malware is becoming increasingly sophisticated, making it difficult for organizations to detect emerging threats using traditional signature-based security tools alone. Attackers use techniques such as code obfuscation, polymorphism, and sandbox evasion to bypass conventional security measures.

Artificial intelligence (AI) and machine learning (ML) are transforming mal...