Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1161 results
criticalbug_reportVulnerabilityGitLab RCE vulnerabilities require immediate patching per CERT.BE
GitLab (specific versions not provided in advisory). Remote Code Execution vulnerabilities affect GitLab instances. CVE identifiers not specified in available information.
highbug_reportVulnerabilityClickFix campaign targets Ukrainian sites with Psychedelic stealer
Legitimate Ukrainian business websites compromised to serve fake Cloudflare verification pages. Victims on Windows systems tricked into executing msiexec commands that install Psychedelic information stealer.
highbug_reportVulnerabilityRoundcube Webmail vulnerability patched in May under active exploitation
Roundcube Webmail versions prior to May 2024 patch. Specific CVE and affected version numbers not disclosed in available information. Impacts organizations running unpatched Roundcube instances.
highbug_reportVulnerabilityAndroid spyware Corp MDM targets logistics firms via fake Google Play
Android devices in the logistics sector, specifically targeting CEVA Logistics and TKW Logistics employees. Malicious APK distributed via fake Google Play pages at playgoogle.logisticstkwcargo[.]com and playgoogle.ceva-app[.]help.
highbug_reportVulnerabilityClickFix social engineering now top enterprise attack vector via blockchain
All enterprise environments with Windows, macOS, and Linux endpoints. ClickFix is a social engineering technique that bypasses traditional security controls by tricking users into pasting malicious commands into trusted system interfaces (PowerShell,…
criticalbug_reportVulnerabilityWordPress RCE flaw CVE-2026-87902 exploited hours after disclosure
WordPress versions prior to 7.1.2 (also 7.0.6, 6.9.9, 6.8.10). Exploitation requires active theme with top-level directory starting with "page-" and readable local .php file (e.g., pearcmd.php) on server.
highbug_reportVulnerabilityPlaceholder domain third-party.com hijacked to serve ClickFix malware attacks
Windows users accessing third-party.com, a domain widely used as a placeholder in developer documentation (W3C, Chromium, GitHub examples). Over 1,500 files across 1,700+ repositories reference this domain.
highbug_reportVulnerabilityRemControl Android MaaS targets banking users via fake TVTap IPTV app
Android users in Europe (Italy, France, Spain, Poland, Portugal), Canada, and Middle East. Targets 30+ banking applications through phishing overlays. Distributed via malvertising campaigns impersonating TVTap IPTV app on fake Google Play pages.
criticalbug_reportVulnerabilityCheck Point Security Gateway VPN RCE exploited in the wild since Sept 12
Check Point Security Gateway VPN product (all versions). Vulnerable versions: R81.10, R81.20, R82, R82.10. Also affects Spark firewalls. CVE-2026-85102 impacts VPN certificate-handling; CVE-2026-93616 (Management web service path traversal, exploited…
criticalbug_reportVulnerabilityWordPress CVE-2026-87902 under active exploitation for RCE
WordPress versions 4.7 through 7.1.1. Exploitation requires a theme with a top-level directory starting with 'page-' and a readable local .php file (e.g., pearcmd.php). Official PHP Docker images and cPanel with PHP <8.5 are vulnerable by default.
highbug_reportVulnerabilityMalicious Terraform providers on HashiCorp Registry deliver DPRK malware
HashiCorp Terraform Registry and Go module repositories. Specific malicious packages: gocommunity-io/dockerd (222 downloads), kreuzwenker/docker (1,449 downloads), gocommunity.io/orderedbtree, gogets.dev/btreex. Related npm packages also identified.
highbug_reportVulnerabilityGitLab issue email token enables code commits and CI/CD execution as user
GitLab.com (all accounts) and self-managed GitLab instances with incoming email enabled (default). GitLab Dedicated appears unaffected. All user roles affected, with impact severity scaling to account permissions (Guest minimal, Maintainer critical).
criticalbug_reportVulnerabilityMikroTik RouterOS SSH chain grants unauthenticated admin access
MikroTik RouterOS versions prior to 6.49.21, 7.23.4, and 7.24.2. Affects devices with SSH service exposed to untrusted networks or the Internet. Default home configurations are not exposed, but custom firewall rules may create exposure.
criticalbug_reportVulnerabilityCheck Point Management Server RCE under active exploitation (CVE-2026-93616)
Check Point Management Servers - specific affected versions not disclosed in available data. Vulnerability enables unauthenticated arbitrary script execution.
criticalbug_reportVulnerabilityF5 BIG-IP APM critical RCE (CVE-2026-94127) under active exploitation
F5 BIG-IP Access Policy Manager (APM). Specific affected versions not disclosed in available data. Vulnerability enables unauthenticated remote code execution via heap-based buffer overflow (CVSS 9.8).
criticalbug_reportVulnerabilityGitHub Enterprise Server SSRF flaw enables remote code execution
GitHub Enterprise Server (specific versions not disclosed in available data). SSRF vulnerability CVE-2026-77987 affects on-premises GitHub Enterprise Server deployments.
criticalbug_reportVulnerabilityCritical SSRF in GitHub Enterprise Server enables remote code execution
GitHub Enterprise Server (specific versions not disclosed in available data). The vulnerability is an SSRF (Server-Side Request Forgery) flaw tracked as CVE-2026-77987.
highbug_reportVulnerabilityNetwork management systems under active attack via critical flaws
Network management platforms including Cisco Secure Firewall Management Center (FMC), Cisco Identity Services Engine (ISE), SonicWall SMA 1000, Check Point VPN gateways, HPE Fabric Composer, EdgeConnect SD-WAN Orchestrator, NVIDIA Unified Fabric Mana…
highbug_reportVulnerabilityKubernetes Config Connector confused deputy flaw enables GCP org takeover
Google Kubernetes Config Connector (KCC) running in Google Kubernetes Engine (GKE) clusters. All versions appear affected. Organizations using KCC with organization-level or broad IAM roles (e.g., roles/owner, roles/resourcemanager.organizationAdmin)…
highbug_reportVulnerabilityMemTensor npm and PyPI packages compromised to deliver sckit credential stealer
MemTensor packages: npm package @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, 0.1.25; PyPI package MemoryOS version 2.0.34 (now quarantined). Malicious Go-based credential stealer targets Windows, Linux, and macOS systems.
highbug_reportVulnerabilityWEBCON BPS IDOR flaw exposes employee vacation data to authenticated users
WEBCON BPS versions 2024.1.1.145 through 2025.2.1.176 and 2026.1.1.1 through 2026.1.1.19. The vulnerability affects the /api/vacations/{path} endpoint, specifically the Gantt vacation chart API's selectedPeople parameter.
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator zero-day CVE-2026-93952 exploited in wild
Arista VeloCloud Orchestrator (VCO) On-Prem deployments with certificate-based authentication enabled. Hosted deployments running VCO versions below 5.2.3.16 (5.x branch), below 6.4.2.8 (6.x branch), 6.1.3.7 and below, and 7.0.0.2 and below are vulne…
criticalbug_reportVulnerabilitycPanel CalDAV flaw allows hosting account holders to execute code as root
cPanel & WHM version 120 and later (CVE-2026-87899, CVE-2026-68490); WP Toolkit 6.11.2-10794 and older (CVE-2026-87900). Affects shared hosting environments where cPanel is deployed. WP Squared also affected.
highbug_reportVulnerabilityUbuntu unpatched for Linux kernel container escape (CVE-2026-80521)
Linux kernel versions 6.10+ (including stable branches 6.1 and 6.6). Ubuntu 26.04, 24.04 LTS, and 22.04 LTS remain unpatched. Affects AWS, Azure, and GCP kernel packages. Fixed upstream in kernel 7.2 and 7.1.10 on August 6, 2026.
highbug_reportVulnerabilityToll fraud campaign uses Meta ads and 17 Google Play apps to steal via SMS
Polish mobile users targeted via 1,235 Meta advertisements promoting 17 malicious Android applications on Google Play. Confirmed apps include Messenger Pro (com.messages.sms.messenger.textmessage.owyo v9.0) and Phone Cleaner Master.
criticalbug_reportVulnerabilityF5 BIG-IP APM zero-day enables unauthenticated RCE on OAuth servers
F5 BIG-IP Access Policy Manager (APM) versions 21.1.0, 17.5.0–17.5.1, and 17.1.0–17.1.3, when configured as OAuth authorization servers with APM access policy and OAuth authorization server profile on the same virtual server.
criticalbug_reportVulnerabilityWordPress Click2Shell and Comment2Shell RCE flaws require immediate patch
WordPress core installations vulnerable to Click2Shell and Comment2Shell remote code execution flaws. Specific affected versions not disclosed in advisory. All unpatched WordPress sites at risk of full compromise.
highbug_reportVulnerabilityRogue MFA providers can steal passwords in Microsoft Entra post-compromise
Microsoft Entra ID (formerly Azure AD) environments using external MFA providers. Requires attacker to already control a Global Administrator or Authentication Policy Administrator account.
criticalbug_reportVulnerabilityF5 BIG-IP APM heap overflow (CVE-2026-94127) exploited in the wild
F5 BIG-IP APM versions 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0 when configured with an access policy and OAuth profile on a virtual server. Unauthenticated remote code execution possible.
criticalbug_reportVulnerabilityCheck Point Management Server zero-day exploited in targeted attacks
Check Point Security Management Server: R82.20 (no Jumbo Hotfix), R82.10 (Take ≤44), R82 (Take ≤126), R81.20 (Take ≤166), R81.10 (Take ≤190), and R81/R80.x (all end-of-support versions). The vulnerability affects the management server's web service.