Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
satellite_altDaily BriefCyber Threat Daily Brief — October 27, 2026
Today's briefing: 6 critical and 14 high-severity threats. A total of 23 detailed analyses covering vulnerabilities, threat actors, and geopolitical context.
Latest Reports
26 / 1870 results
highpublicGeopoliticalUniversity of Copenhagen breach exposes 525,000 records in test environment
The breach at Denmark's oldest and most prominent research university represents a significant data exposure incident within a NATO and EU member state with advanced cybersecurity frameworks.
highperson_alertThreat ActorARTEX AI Operators Arrested After Breaching 90+ South Korean Orgs
ARTEX AI operators is a seven-member cybercrime group led by a 32-year-old self-taught hacker with penetration testing experience. The leader worked at a cybersecurity company between 2019 and 2022 before launching attacks in September 2025.
highperson_alertThreat Actor953 E-Commerce Stores Compromised in Long-Running Magento Campaign
An unknown threat actor has been conducting a sustained campaign since July 2025 targeting e-commerce platforms, primarily Magento-based online stores. The actor demonstrates sophisticated operational security through scanner-evasion techniques and i…
highbug_reportVulnerabilityPHP Windows packages ship Brotli RCE flaw via cURL auto-decompression
PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 official Windows builds (pre-rebuild). Affects systems using cURL extension with CURLOPT_ENCODING enabled or HTTP client libraries like Guzzle (default behavior) that enable automatic Brotli decompression.
criticalbug_reportVulnerabilityCritical Brotli buffer overflow (CVE-2026-111497) enables RCE in Node.js
Brotli C decoder library versions 1.0.3–1.0.9, 1.1.0, and 1.2.0. Affects Node.js (versions prior to 22.23.4, 24.22.1, 26.12.1), Python HTTP clients (urllib3[brotli], requests, httpx, aiohttp[speedups]), .NET, and any application decompressing attacke…
highperson_alertThreat ActorMicrosoft Teams External Chat Exploited for IT Support Impersonation
Unknown threat actors conducting a recurring social engineering campaign across hundreds of incidents. The activity shows overlap with STAC4749, a tracked cluster known for creating IT-themed cloud domains under the ".top" TLD and using plausible emp…
criticalbug_reportVulnerabilityCritical Brotli decoder flaw in .NET enables RCE via crafted streams
Microsoft .NET 8, 9, 10, and 11 RC3. Applications using ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs are vulnerable.
highpublicGeopoliticalChinese national extradited from Netherlands for $37M crypto fraud
This case exemplifies the transnational nature of cryptocurrency-enabled financial crime and the growing cooperation between Western jurisdictions in prosecuting such offenses.
criticalbug_reportVulnerabilityWasmtime sandbox escape flaws allow malicious WebAssembly code execution
Wasmtime WebAssembly runtime: CVE-2026-115889 affects all architectures in versions before 36.0.19 and 37.0.0–42.x; CVE-2026-115893 affects ARM64/aarch64 only in versions before 36.0.19, 37.0.0–47.x, 48.0.0–48.0.6, and 49.0.0–49.0.3.
highperson_alertThreat ActorOvi Exposes uCreator Android Spyware Targeting Telegram and WeChat
Ovi is a security researcher who discovered and analyzed the uCreator Android spyware kit in October 2026. Ovi is not a threat actor but rather the researcher who exposed this rentable spyware operation.
criticalbug_reportVulnerabilityPHP2Shell RCE flaws (CVE-2026-109618/109619) confirmed exploited in wild
PHP 8.4.26 and likely earlier versions. Affects approximately 70% of websites globally (~5.1 million exposed PHP hosts). Confirmed exploitation against Apache mod_php installations.
highbug_reportVulnerabilityMicrosoft 365 AitM campaign compromises 97 accounts via token replay
Microsoft 365 / Entra ID users across 79 organizations. Campaign active July 14 - September 22, 2026. 497 successful sign-ins from 200,000+ attempts originating from 193.26.115.0/24 IP range. 48 rogue Entra devices registered.
highperson_alertThreat ActorGheist Campaign Steals GitHub Secrets via Automated Workflow Injection
Gheist is an automated campaign tracked since September 15, 2026, named after the user agent "gheist" observed in GitHub API requests. The campaign leverages stolen GitHub tokens to inject malicious workflows into private repositories and GitHub Ente…
criticalbug_reportVulnerabilityCritical RCE in ISC BIND 9 DNS software requires immediate patching
ISC BIND 9 DNS software. Specific vulnerable versions not disclosed in available information. Affects organizations running BIND DNS servers.
highbug_reportVulnerabilityAI coding agents tricked into installing malware via planted instruction files
AI coding agents including OpenAI Codex and Anthropic Claude Code. Developers running agents in ~/Downloads folder are at risk. Attack leverages AGENTS.md/CLAUDE.md instruction files to install malicious npm package function-color (part of MALFEX cam…
highbug_reportVulnerabilityUnpatched Tailscale SSH flaws enable root escalation via port forwarding
Tailscale version 1.104.2 and headscale version 0.29.5. Affects networks with Tailscale SSH enabled and port forwarding configured. Headscale 0.29.5 cannot disable forwarding, making all SSH grants potentially exploitable.
highperson_alertThreat ActorNorth Korea Linked to PHP2Shell Scanning Campaign Targeting Global Infra
North Korean threat actors, attributed with moderate confidence to operators within the Lazarus Group ecosystem, are conducting a deliberate, low-and-slow scanning campaign targeting vulnerable PHP infrastructure globally.
highbug_reportVulnerabilityMalicious AGENTS.md files hijack AI coding agents via Downloads folder
AI coding agents including OpenAI Codex, Claude Code, and Cursor CLI when launched from ~/Downloads directory. Browsers Chrome, Edge, and Firefox allow silent file downloads to this location.
criticalperson_alertThreat ActorBlackX UEFI bootkit exploits Baton Drop to bypass Secure Boot
BlackX is a UEFI bootkit malware family deployed in an espionage campaign in early 2026. The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group also tracked as Brass Typhoon, Wicked Panda, and Barium…
criticalbug_reportVulnerabilityCritical vulnerabilities in HPE Networking AOS require immediate patching
HPE Networking AOS (ArubaOS-Switch). Specific affected versions not disclosed in available information. Multiple critical-severity vulnerabilities reported by CERT.BE.
highbug_reportVulnerabilityBrotli decoder memory corruption enables RCE in Node.js, Bun, Python, Envoy
Google Brotli C library 1.0.3–1.2.0; Node.js 22.x, 24.x, 26.x (pre-patch); Bun ≤1.4.3; Envoy 1.36–1.39 (if Brotli enabled); Istio 1.29–1.31 (if Brotli enabled); Python Brotli ≤1.2.0 and brotlicffi ≤1.2.0.x; cdxgen ≤13.4.0/12.8.8.
criticalbug_reportVulnerabilityLiteLLM supply chain attack via leaked master key compromised v1.107.0
LiteLLM Python package version 1.107.0 (published October 21, 2026 to PyPI, Docker Hub, and GHCR). Threat actor gained owner-level access to BerriAI GitHub organization via unrevoked master key exposed May 27, 2026.
highbug_reportVulnerabilityAbandoned Popcorn Time fork updater posed botnet risk to 2-3M systems
Time4Popcorn (abandoned Popcorn Time fork): Windows versions ≤6.2.1.18, Mac ≤6.2.1.17, Android ≤3.5.0.173. Updater.exe ran with SYSTEM/root privileges, checked for updates over unencrypted HTTP to abandoned domains.
criticalbug_reportVulnerabilityCISA: Collabora Online and Arista VeloCloud flaws exploited in wild
Collabora Online Built-in CODE Server (richdocumentscode) within NextCloud platform, fixed in version 26.4.303 (September 2026). Arista VeloCloud Orchestrator on-premise versions, fixed in 5.2.3.18, 6.1.3.10, and 6.4.2.12 (October 2026).
highbug_reportVulnerabilityTime4Popcorn updater flaw enabled RCE with elevated privileges
Time4Popcorn app (Popcorn Time fork), all versions with vulnerable updater mechanism. Millions of devices potentially affected. Application is abandoned and no longer maintained.
criticalperson_alertThreat ActorAPT41 Deploys BlackX UEFI Bootkit Against Central Asian Diplomats
APT41 (also tracked as Wicked Panda, Brass Typhoon, BARIUM) is a China-linked state-sponsored advanced persistent threat group attributed by Kaspersky to the BlackX bootkit campaign.