Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1067 results
highbug_reportVulnerabilityChrome V8 zero-day CVE-2026-87491 exploited in wild for sandbox code execution
Google Chrome versions prior to 153.0.8010.36/.37 (Windows/macOS) and 153.0.8010.36 (Linux). Affects V8 JavaScript engine. All Chromium-based browsers (Edge, Brave, Opera, Vivaldi) also vulnerable until patched.
highperson_alertThreat ActorSophos Analyzes Memory-Resident PHP Web Shell in F5 BIG-IP APM
Sophos is a cybersecurity vendor that published technical analysis on September 7, 2026, examining malware targeting F5 BIG-IP Access Policy Manager (APM) appliances. Sophos is the researcher/defender in this context, not the threat actor.
highbug_reportVulnerabilityChrome zero-day CVE-2026-87491 exploited in wild, seventh in 2024
Google Chrome versions prior to 153.0.8010.36 (Windows/Linux) and 153.0.8010.37 (Mac) on all desktop platforms. Vulnerability exists in V8 JavaScript/WebAssembly engine.
highbug_reportVulnerabilityMicrosoft patches 974 vulnerabilities, including 2 actively exploited zero-days
Microsoft Windows (all supported versions), Windows Server 2012 and later, and other Microsoft software products. Two actively exploited zero-days: CVE-2026-81963 and CVE-2026-85880 (privilege escalation).
highperson_alertThreat ActorDoppelCart: 119,000+ Fake E-Commerce Domains Used for Card Theft
DoppelCart is a large-scale fraud operation attributed to coordinated threat actors conducting payment card theft through fraudulent e-commerce infrastructure.
highperson_alertThreat ActorShinyHunters Claims Breach of Florida DMV DAVID Database
ShinyHunters is a financially motivated cybercrime extortion gang known for conducting data breaches targeting organizations with large databases of personally identifiable information (PII).
highperson_alertThreat ActorSlim Spider Targets Brazilian Financial Institutions for Crypto Theft
Slim Spider is a previously undocumented, financially motivated threat actor attributed by CrowdStrike to Brazil-based operations targeting Brazilian financial institutions since at least March 2026.
highperson_alertThreat ActorLiquid Hackers Exploit Elements Bug, Return 85% of Stolen Bitcoin
Liquid Hackers is a group that exploited a vulnerability in the Elements software underlying the Liquid Network Bitcoin sidechain on September 6, 2026. The actors self-identify as "white hats" and communicated via on-chain messages, claiming their in…
highbug_reportVulnerabilityChatGPT prompt injection exfiltrates Gmail data via internal service
ChatGPT users with connected apps (Gmail, other integrations) enabled. All account types affected, including Business, Enterprise, and Edu workspaces. Vulnerability existed in ChatGPT's internal JFrog Artifactory service used for Python/npm package m…
highperson_alertThreat ActorAI-Powered Credential Harvesting Campaign Compromises Thousands in 6 Hours
The campaign involves financially motivated threat actors leveraging autonomous AI agents and multi-agent attack frameworks to conduct large-scale credential harvesting operations.
highbug_reportVulnerabilityWeChat zero-click worm enables account takeover via incoming calls
WeChat versions prior to 8.0.77 (Android) and 8.0.76 (iOS) on iPhone and Android devices. Tested vulnerable versions: WeChat 8.0.76 (Android) and 8.0.75 (iOS). Affects an estimated 1.439 billion monthly active users globally.
highbug_reportVulnerabilityFreeIPA flaw chain allows unauthenticated admin credential creation
FreeIPA versions prior to 4.13.4 and 389 Directory Server (389-ds-base) on Red Hat Enterprise Linux and Red Hat Directory Server. Red Hat Identity Management (ipa package) is affected. Default installations are vulnerable.
highperson_alertThreat ActorBengalSEO Campaign Exploits Bing SEO to Deploy MayaBot Malware
BengalSEO is a financially motivated campaign operating from Rajasthan, India since at least 2015. The operation is driven by IT service providers WeConnect Solutions LLC (formerly iConnect Soft Solutions LLC) and Garage2Global.
highpublicGeopoliticalGrindr Settles U.K. Privacy Lawsuit Over HIV Data Sharing for £26M
This settlement reflects the extraterritorial enforcement reach of European data protection frameworks, particularly GDPR, which has become a de facto global standard for privacy regulation.
highbug_reportVulnerabilityPEEP toolkit turns Chrome/Edge into backdoors via malicious extension
Chrome and Edge browsers on Windows and Linux. PEEP is a post-exploitation toolkit requiring prior administrative or code execution access. It masquerades as "Smart Bookmarks" extension (ID: ejkndncpkdcjcikfhiamcdehdoegilbj) and uses native messaging…
highbug_reportVulnerabilityVishing campaign steals M365 tokens via AitM phishing, targets executives
Microsoft 365, SharePoint, OneDrive, Exchange, and Box SaaS platforms. Primarily targets executive-level staff (directors, VPs) in U.S. organizations across construction, engineering, healthcare, pharmaceuticals, real estate, finance, and professiona…
highbug_reportVulnerabilityBigBear 2.0 PhaaS bypasses MFA, steals 5,000+ Microsoft 365 credentials
Microsoft 365 users across 258 organizations in 40+ countries. All authentication methods except FIDO2/WebAuthn hardware tokens are vulnerable. Campaign leverages Evilginx2-based adversary-in-the-middle (AiTM) framework with geo-matched residential p…
highbug_reportVulnerabilitySonicWall Network Security Manager vulnerability requires immediate patching
SonicWall Network Security Manager (NSM). Specific affected versions not disclosed in available advisory. CVE identifier not yet assigned or not publicly disclosed.
highbug_reportVulnerabilityTrezor shipping partner breach exposes 81,000 customer records via Metabase
Trezor cryptocurrency hardware wallet customers who placed orders through ShipMonk logistics provider between November 2019 and August 2026. Total of 81,000 customers affected (67,000 U.S.
highbug_reportVulnerabilityWorm-like malware abuses ConnectWise ScreenConnect for lateral spread
ConnectWise ScreenConnect clients (all versions). Attackers deploy rogue ScreenConnect instances via phishing, tech support scams, and fake refund forms.
highbug_reportVulnerabilityTelerik UI for ASP.NET AJAX RCE exploit published, patch available
Telerik UI for ASP.NET AJAX versions 2010.1.309 through 2026.2.519. Exploitation requires non-default configuration: RadAsyncUpload control with custom encryption key and server-side handler reading upload results.
highbug_reportVulnerabilityMikroTik RouterOS exploit chain actively hijacks routers via SSH
MikroTik RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Devices with SSH services exposed to the internet are at immediate risk. Approximately 122,500 MikroTik devices have exposed SSH interfaces as of September 5, 2026.
highbug_reportVulnerabilityConnectWise ScreenConnect file transfer flaw lacks patch, mitigation only
ConnectWise ScreenConnect Remote Access (all versions, both cloud and on-premises deployments). Approximately 6,000 instances exposed online. No CVE ID assigned yet. Affects file transfer behavior in Support and Access sessions.
highpublicGeopoliticalMikroTik Router Exploit Enables Unauthenticated Admin Access via SSH
The exploitation of MikroTik routers—widely deployed in small and medium enterprises, ISPs, and critical infrastructure across Europe and emerging markets—represents a significant supply chain vulnerability with potential strategic implications.
highbug_reportVulnerabilityREVSTEALER Deploys Four Persistent Modules Including Crypto Miner
Windows systems infected with REVSTEALER infostealer (active since February 2026). Four persistent modules (ProManager, WinUpdate, SoftManager, LockAppHost) remain after core stealer self-deletes.
highbug_reportVulnerability5,400+ compromised sites deliver ClickFix via BNB Smart Chain contracts
Over 5,400 compromised small-business websites used as distribution infrastructure. Targets are end users visiting these sites. ClickFix social engineering payloads hosted on BNB Smart Chain (BSC) smart contracts to evade takedown.
highpublicGeopoliticalShipMonk breach exposes 67K Trezor customers via supply chain attack
This incident exemplifies the persistent vulnerability of Western cryptocurrency infrastructure to supply chain exploitation, a vector increasingly favored by both financially motivated cybercriminal groups and state-aligned actors seeking to undermi…
highbug_reportVulnerabilitySix critical flaws in MikroTik RouterOS enable unauthenticated RCE and auth bypass
MikroTik RouterOS versions 6.0.0 to 6.49.20, 7.0.0 to 7.23.3, and 7.24 to 7.24.1. All six CVEs affect the same version ranges. Impacts SSH authentication, TLS certificate validation, WebFig interface, and bandwidth test functionality.
highbug_reportVulnerabilityPhishing campaign uses invisible Unicode to bypass email filters
Organizations using email security systems that rely on keyword matching and literal string detection. Campaign targets Small Business Administration (SBA) loan applicants and businesses seeking financing.
highbug_reportVulnerabilityPostgreSQL replication-role code execution flaw (CVE-2026-6471) patched
PostgreSQL versions before 18.6, 17.11, 16.15, 15.19, and 14.24. Exploitation requires an account with REPLICATION attribute and wal_level=logical configuration. Flaw present since PostgreSQL 9.4 (2014).