Note: YARA-X v1.21.0 adds a parent_name field to the items in vt.behaviour.processes_list, and v1.22.0 adds ancestor_names. VirusTotal now fills that list for every sandbox report that includes a process tree, by flattening it. The result is one entry per process, and each entry knows the name of the process that…
On October 20, the PHP security team announced an out-of-band security release for Wednesday, October 21, 2026 at 14:00 UTC , fixing two critical vulnerabilities rated CVSS v4.0 9.2 (CVE-2026-109618 and CVE-2026-109619). Hours before the release, technical details leaked publicly. They point to the…
In Part III of our "From Automation to Infection" series (following Part I and Part II ), we analyzed 35,878 AI agent skills submitted to VirusTotal and found that 62% of the 6,637 malicious skills contain no malicious code. Their payload is written as plain-language instructions inside the skill documentation. A…
In November 2015, we released our first in-house macOS sandbox, Box of Apples , followed by an update in March 2018 that introduced HTML behavior reports, desktop screenshots, and process trees. Over the past decade, the macOS ecosystem and the threat landscape targeting it have changed dramatically. Apple…
In Part I and Part II of this series, we looked at an initial sample of 3,016 AI agent skills and showed how they were becoming a new supply-chain delivery channel. The flow of skills reaching VirusTotal keeps growing, so for this follow-up we expanded the study more than tenfold, to 35,878 skills from a snapshot of…
Until now, an IP report in VirusTotal told you a lot about reputation, who hosts it, what resolves to it (passive DNS) and which files talk to it . It told you nothing about what the machine itself was running. VirusTotal now scans the public IPv4 space every day and stores, for each IP, the open and closed ports, the…
Introduction In today's fast-moving cybersecurity landscape, threat analysts must move beyond basic, binary reputation scores to successfully defend against modern, highly adaptive web threats. Traditional URL analysis has been redefined by the launch of URL Scanning 2.0 , an update that significantly expands…
We’re adding a new specialist to VirusTotal’s Crowdsourced AI lineup: Knostic 's AgentMesh Agentic Security Supply Chain Reputation Engine. We are partnering with them to analyze Visual Studio Code extension (.VSIX) files. This complements our existing Code Insight and other AI contributors by helping developers,…