Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1072 results
highbug_reportVulnerabilityMicrosoft patches 974 vulnerabilities, including 2 actively exploited zero-days
Microsoft Windows (all supported versions), Windows Server 2012 and later, and other Microsoft software products. Two actively exploited zero-days: CVE-2026-81963 and CVE-2026-85880 (privilege escalation).
criticalbug_reportVulnerabilityMicrosoft patches 966 flaws including 2 actively exploited zero-days
Microsoft products (specific products and versions not disclosed in provided data). Two zero-day vulnerabilities are actively exploited; 964 additional flaws patched in September 2026 Patch Tuesday.
criticalbug_reportVulnerabilityAdobe Commerce/Magento unauthenticated RCE requires immediate patching
Adobe Commerce and Magento platforms. Specific affected versions not disclosed in available information. Vulnerability allows unauthenticated remote code execution.
highbug_reportVulnerabilityChatGPT prompt injection exfiltrates Gmail data via internal service
ChatGPT users with connected apps (Gmail, other integrations) enabled. All account types affected, including Business, Enterprise, and Edu workspaces. Vulnerability existed in ChatGPT's internal JFrog Artifactory service used for Python/npm package m…
highbug_reportVulnerabilityWeChat zero-click worm enables account takeover via incoming calls
WeChat versions prior to 8.0.77 (Android) and 8.0.76 (iOS) on iPhone and Android devices. Tested vulnerable versions: WeChat 8.0.76 (Android) and 8.0.75 (iOS). Affects an estimated 1.439 billion monthly active users globally.
highbug_reportVulnerabilityFreeIPA flaw chain allows unauthenticated admin credential creation
FreeIPA versions prior to 4.13.4 and 389 Directory Server (389-ds-base) on Red Hat Enterprise Linux and Red Hat Directory Server. Red Hat Identity Management (ipa package) is affected. Default installations are vulnerable.
criticalbug_reportVulnerabilityAdobe Commerce zero-day CVE-2026-75650 exploited since Sept 4 for backdoors
Adobe Commerce 2.4.4 through 2.4.9 (all 2026-aug and earlier), Adobe Commerce B2B 1.3.3 through 1.5.3 (all 2026-aug and earlier), and Magento Open Source 2.4.6 through 2.4.9 (all 2026-aug and earlier).
highbug_reportVulnerabilityPEEP toolkit turns Chrome/Edge into backdoors via malicious extension
Chrome and Edge browsers on Windows and Linux. PEEP is a post-exploitation toolkit requiring prior administrative or code execution access. It masquerades as "Smart Bookmarks" extension (ID: ejkndncpkdcjcikfhiamcdehdoegilbj) and uses native messaging…
criticalbug_reportVulnerabilityMagento StyleSmuggler zero-day actively exploited to deploy backdoor
All versions of Magento and Adobe Commerce, including latest patched versions. Affects approximately 160,000 websites globally, including 14,000 in the top 1 million sites.
highbug_reportVulnerabilityVishing campaign steals M365 tokens via AitM phishing, targets executives
Microsoft 365, SharePoint, OneDrive, Exchange, and Box SaaS platforms. Primarily targets executive-level staff (directors, VPs) in U.S. organizations across construction, engineering, healthcare, pharmaceuticals, real estate, finance, and professiona…
highbug_reportVulnerabilityBigBear 2.0 PhaaS bypasses MFA, steals 5,000+ Microsoft 365 credentials
Microsoft 365 users across 258 organizations in 40+ countries. All authentication methods except FIDO2/WebAuthn hardware tokens are vulnerable. Campaign leverages Evilginx2-based adversary-in-the-middle (AiTM) framework with geo-matched residential p…
highbug_reportVulnerabilitySonicWall Network Security Manager vulnerability requires immediate patching
SonicWall Network Security Manager (NSM). Specific affected versions not disclosed in available advisory. CVE identifier not yet assigned or not publicly disclosed.
criticalbug_reportVulnerabilityMikroTik RouterOS critical vulnerabilities require immediate patching
MikroTik RouterOS - specific versions not provided in advisory. All RouterOS deployments should be considered at risk pending vendor bulletin review.
highbug_reportVulnerabilityTrezor shipping partner breach exposes 81,000 customer records via Metabase
Trezor cryptocurrency hardware wallet customers who placed orders through ShipMonk logistics provider between November 2019 and August 2026. Total of 81,000 customers affected (67,000 U.S.
highbug_reportVulnerabilityWorm-like malware abuses ConnectWise ScreenConnect for lateral spread
ConnectWise ScreenConnect clients (all versions). Attackers deploy rogue ScreenConnect instances via phishing, tech support scams, and fake refund forms.
highbug_reportVulnerabilityTelerik UI for ASP.NET AJAX RCE exploit published, patch available
Telerik UI for ASP.NET AJAX versions 2010.1.309 through 2026.2.519. Exploitation requires non-default configuration: RadAsyncUpload control with custom encryption key and server-side handler reading upload results.
highbug_reportVulnerabilityMikroTik RouterOS exploit chain actively hijacks routers via SSH
MikroTik RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Devices with SSH services exposed to the internet are at immediate risk. Approximately 122,500 MikroTik devices have exposed SSH interfaces as of September 5, 2026.
highbug_reportVulnerabilityConnectWise ScreenConnect file transfer flaw lacks patch, mitigation only
ConnectWise ScreenConnect Remote Access (all versions, both cloud and on-premises deployments). Approximately 6,000 instances exposed online. No CVE ID assigned yet. Affects file transfer behavior in Support and Access sessions.
criticalbug_reportVulnerabilityN-able N-central RCE flaw (CVE-2026-86218) exploited in wild
N-able N-central RMM platform: all on-premises builds below version 2026.3.1.14, including servers patched with Hotfix 3 (2026.3.1.13) released hours earlier. Hosted N-central (NCOD) instances already patched by vendor.
criticalbug_reportVulnerabilityN-able N-central RCE flaw (CVE-2026-86218) exploited in the wild
N-able N-central on-premises deployments prior to version 2026.3 Hotfix 4. Approximately 1,500 instances exposed online, primarily in the US and Europe. Used by IT departments and MSPs for remote monitoring and management.
highbug_reportVulnerabilityREVSTEALER Deploys Four Persistent Modules Including Crypto Miner
Windows systems infected with REVSTEALER infostealer (active since February 2026). Four persistent modules (ProManager, WinUpdate, SoftManager, LockAppHost) remain after core stealer self-deletes.
criticalbug_reportVulnerabilityMagento/Adobe Commerce zero-day actively exploited since Sept 4
Magento Open Source and Adobe Commerce all current versions including 2.4.6, 2.4.7, 2.4.8, and 2.4.9. Confirmed exploitation on Magento Open Source; Adobe Commerce impact unconfirmed. Unauthenticated remote code execution via GraphQL.
criticalbug_reportVulnerabilityCritical VMware Workstation/Fusion integer overflow allows VM escape
VMware Workstation and VMware Fusion versions 25H2 and 26H1. Affects systems with VMXNET3 virtual network adapter (CVE-2026-59346) and HGFS enabled (CVE-2026-59347). Both vulnerabilities require local administrative privileges on the guest VM.
highbug_reportVulnerability5,400+ compromised sites deliver ClickFix via BNB Smart Chain contracts
Over 5,400 compromised small-business websites used as distribution infrastructure. Targets are end users visiting these sites. ClickFix social engineering payloads hosted on BNB Smart Chain (BSC) smart contracts to evade takedown.
highbug_reportVulnerabilitySix critical flaws in MikroTik RouterOS enable unauthenticated RCE and auth bypass
MikroTik RouterOS versions 6.0.0 to 6.49.20, 7.0.0 to 7.23.3, and 7.24 to 7.24.1. All six CVEs affect the same version ranges. Impacts SSH authentication, TLS certificate validation, WebFig interface, and bandwidth test functionality.
criticalbug_reportVulnerabilityMikroTik RouterOS SSH vulnerabilities actively exploited (MikroTrick)
MikroTik RouterOS all versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Devices with SSH service exposed to the internet are at highest risk. Six vulnerabilities identified, two critical (CVE-2026-67276, CVE-2026-86060) enable full device tak…
criticalbug_reportVulnerabilityPaperCut auth bypass and RCE chain actively exploited in education sector
PaperCut NG and MF, all versions. Primarily targeting education sector (K-12 schools and universities) in the U.S. and Europe. CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution) exploited in chain.
highbug_reportVulnerabilityPhishing campaign uses invisible Unicode to bypass email filters
Organizations using email security systems that rely on keyword matching and literal string detection. Campaign targets Small Business Administration (SBA) loan applicants and businesses seeking financing.
criticalbug_reportVulnerabilityCitrix NetScaler auth bypass CVE-2026-19490 exploited in the wild
Citrix NetScaler ADC and NetScaler Gateway appliances configured as AAA virtual servers or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy). Specific vulnerable versions not disclosed in advisory.
highbug_reportVulnerabilityPostgreSQL replication-role code execution flaw (CVE-2026-6471) patched
PostgreSQL versions before 18.6, 17.11, 16.15, 15.19, and 14.24. Exploitation requires an account with REPLICATION attribute and wal_level=logical configuration. Flaw present since PostgreSQL 9.4 (2014).