Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1076 results
highbug_reportVulnerabilityMikroTik RouterOS exploit chain actively hijacks routers via SSH
MikroTik RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Devices with SSH services exposed to the internet are at immediate risk. Approximately 122,500 MikroTik devices have exposed SSH interfaces as of September 5, 2026.
highbug_reportVulnerabilityConnectWise ScreenConnect file transfer flaw lacks patch, mitigation only
ConnectWise ScreenConnect Remote Access (all versions, both cloud and on-premises deployments). Approximately 6,000 instances exposed online. No CVE ID assigned yet. Affects file transfer behavior in Support and Access sessions.
highpublicGeopoliticalMikroTik Router Exploit Enables Unauthenticated Admin Access via SSH
The exploitation of MikroTik routers—widely deployed in small and medium enterprises, ISPs, and critical infrastructure across Europe and emerging markets—represents a significant supply chain vulnerability with potential strategic implications.
highbug_reportVulnerabilityREVSTEALER Deploys Four Persistent Modules Including Crypto Miner
Windows systems infected with REVSTEALER infostealer (active since February 2026). Four persistent modules (ProManager, WinUpdate, SoftManager, LockAppHost) remain after core stealer self-deletes.
highbug_reportVulnerability5,400+ compromised sites deliver ClickFix via BNB Smart Chain contracts
Over 5,400 compromised small-business websites used as distribution infrastructure. Targets are end users visiting these sites. ClickFix social engineering payloads hosted on BNB Smart Chain (BSC) smart contracts to evade takedown.
highpublicGeopoliticalShipMonk breach exposes 67K Trezor customers via supply chain attack
This incident exemplifies the persistent vulnerability of Western cryptocurrency infrastructure to supply chain exploitation, a vector increasingly favored by both financially motivated cybercriminal groups and state-aligned actors seeking to undermi…
highbug_reportVulnerabilitySix critical flaws in MikroTik RouterOS enable unauthenticated RCE and auth bypass
MikroTik RouterOS versions 6.0.0 to 6.49.20, 7.0.0 to 7.23.3, and 7.24 to 7.24.1. All six CVEs affect the same version ranges. Impacts SSH authentication, TLS certificate validation, WebFig interface, and bandwidth test functionality.
highbug_reportVulnerabilityPhishing campaign uses invisible Unicode to bypass email filters
Organizations using email security systems that rely on keyword matching and literal string detection. Campaign targets Small Business Administration (SBA) loan applicants and businesses seeking financing.
highbug_reportVulnerabilityPostgreSQL replication-role code execution flaw (CVE-2026-6471) patched
PostgreSQL versions before 18.6, 17.11, 16.15, 15.19, and 14.24. Exploitation requires an account with REPLICATION attribute and wal_level=logical configuration. Flaw present since PostgreSQL 9.4 (2014).
highbug_reportVulnerabilityTrojanized HAProxy builds intercept traffic at two South Korean orgs
Two South Korean organizations in automotive and media sectors running compromised HAProxy load balancer binaries. The "ted" backdoor is compiled directly into trojanized HAProxy builds, not a vulnerability in legitimate HAProxy software.
highbug_reportVulnerabilityChrome zero-day CVE-2026-85046 actively exploited via V8 type confusion
Google Chrome versions prior to 152.0.7977.82/.83 (Windows/macOS) and 152.0.7977.82 (Linux). Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) also affected pending vendor updates.
highbug_reportVulnerabilityMultiple high-severity vulnerabilities in Jenkins require immediate patching
Jenkins (specific versions not disclosed in advisory). Affects Jenkins core and potentially plugins. Scope and affected version ranges require consultation of Jenkins Security Advisory.
highpublicGeopoliticalFrance fines hospital €500K for breach exposing 727,000 patient records
This enforcement action by France's CNIL demonstrates continued European regulatory commitment to GDPR implementation in critical infrastructure sectors.
highbug_reportVulnerabilityCoder registry compromised via Cloudflare to deliver malicious Terraform modules
Coder registry infrastructure (registry.coder.com) accessed between 07:35 UTC and 21:45 UTC on August 31, 2026. All users who downloaded Terraform modules during this window are potentially affected.
highbug_reportVulnerability5,000 Dropbox accounts compromised; OAuth and Teams phishing campaigns active
Multiple attack vectors affecting organizations using Microsoft Teams, Dropbox (5,000+ accounts compromised), OAuth-enabled applications, and remote management tools.
highbug_reportVulnerabilityBraZetsu malware framework enables Initial Access Broker marketplace
Windows systems in Iberian Peninsula and Latin America, particularly Brazil. Targeted sectors include e-commerce, corporate, financial, industrial, and law enforcement. Browsers affected: Google Chrome, Microsoft Edge, Brave, Vivaldi, Opera.
highpublicGeopoliticalThomson Reuters C-Track Breach Exposes U.S. and Canadian Court Records
The March 2026 breach of Thomson Reuters' C-Track court case management platform represents a significant compromise of judicial infrastructure across North America. The incident exposed sensitive court records from 11 U.S. states, the U.S.
highbug_reportVulnerabilityRMM phishing campaign spans 46 countries, US accounts for 45% of activity
Organizations across 46 countries, primarily United States (45% of activity), Canada, and others. Top targeted sectors: education, technology, government, banking, finance, and manufacturing.
highbug_reportVulnerabilityPlex urges immediate patching of undisclosed flaws in Media Server
Plex Media Server v1.43.2 and earlier, Plex Desktop client versions prior to 1.115.0. Affects all platforms including Windows, macOS, Linux, and NAS devices running Plex.
highbug_reportVulnerabilityAttackers abuse legitimate Node.js runtime to deploy malware via ClickFix
Organizations using Node.js in their environments, particularly government departments, technology companies, hotels, fintech, e-commerce, professional services, and retail logistics.
highbug_reportVulnerabilityShai-Hulud infostealer now scans 469 credential locations in dev environments
Developer workstations, CI/CD pipelines, cloud configurations, AI tool configs, package registries (npm, GitHub, Docker), and any environment storing long-lived credentials or tokens.
highbug_reportVulnerabilityAI-assisted campaigns target Latin American orgs with data exfiltration
Organizations in Latin America, specifically: Mexican transportation, federal government ministries, municipal water utilities (Mexico/Ecuador) in CL-CRI-1131; Brazilian financial sector in CL-CRI-1163. Campaign active February–June 2026.
highperson_alertThreat ActorNSO Group Pegasus spyware targets Serbian student protesters via iMessage
NSO Group is an Israeli cyber intelligence company that develops and sells Pegasus, a sophisticated mobile surveillance platform marketed exclusively to government clients for lawful interception.
highbug_reportVulnerabilityCrowdStrike Falcon zero-day FalconFlank allows privilege escalation via macro remediation
CrowdStrike Falcon Sensor on fully updated Windows 11 25H2 and Windows Server 2025. The vulnerability exploits the Office malicious macros remediation feature. No CVE assigned yet.
highbug_reportVulnerabilityAttackers abuse Microsoft Teams external chat to impersonate IT support
Microsoft Teams users in enterprise environments with external collaboration enabled. All organizations using Teams for business communication are at risk if users accept external contact requests and grant remote access via RMM tools or Quick Assist…
highbug_reportVulnerabilitySilver Fox campaign uses fake installers to disable Windows Update
Windows systems globally, primarily China-based operations of multinational organizations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors.
highbug_reportVulnerabilityAI coding agents execute malicious Git config commands outside sandbox
Seven command-line AI coding agents: goose (fixed in 1.44.0), Codex CLI/Desktop (fixed in 0.131.0 / 26.519.x), Claude Code (partially fixed in 2.1.196, second path unpatched in 2.1.252+), Hermes Agent 0.18.2–0.21.0 (unpatched), Qwen Code 0.19.6–0.22.…
highperson_alertThreat ActorGambling Goblin Hijacks Brazilian Gov Sites via Malicious Apache Modules
Gambling Goblin is a Chinese-speaking cybercrime cluster tracked by Check Point Research since mid-2025. The group specializes in SEO manipulation at scale by compromising high-reputation domains, particularly Brazilian government (.gov.br) and educa…
highperson_alertThreat ActorStreamRat Android Banking Trojan Spread via Meta Ads to EU Users
ThreatFabric is the cybersecurity research firm that discovered and analyzed the StreamRat campaign. The actual threat actor behind StreamRat remains unattributed.
highperson_alertThreat ActorRussian National Charged for 2016-2017 Excel Malware Campaign
Searzhudin Tamirlanovich Aktulaev is a 40-year-old Russian national charged by the U.S. Department of Justice for orchestrating a large-scale malware distribution campaign between June 2016 and November 2017.