Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1072 results
highbug_reportVulnerabilityTrojanized HAProxy builds intercept traffic at two South Korean orgs
Two South Korean organizations in automotive and media sectors running compromised HAProxy load balancer binaries. The "ted" backdoor is compiled directly into trojanized HAProxy builds, not a vulnerability in legitimate HAProxy software.
criticalbug_reportVulnerabilityVMware Workstation and Fusion overflow flaws require immediate patching
VMware Workstation and VMware Fusion virtualization products. Specific affected versions not disclosed in available information. Overflow vulnerabilities present significant exploitation risk.
criticalbug_reportVulnerabilityCrowdStrike Falcon zero-day grants SYSTEM privilege escalation on Windows
CrowdStrike Falcon Sensor (all current versions) on Windows 11 25H2 and Windows Server 2025. Vulnerability exploits the Office malicious macros remediation feature. No CVE assigned yet.
highbug_reportVulnerabilityChrome zero-day CVE-2026-85046 actively exploited via V8 type confusion
Google Chrome versions prior to 152.0.7977.82/.83 (Windows/macOS) and 152.0.7977.82 (Linux). Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) also affected pending vendor updates.
highbug_reportVulnerabilityMultiple high-severity vulnerabilities in Jenkins require immediate patching
Jenkins (specific versions not disclosed in advisory). Affects Jenkins core and potentially plugins. Scope and affected version ranges require consultation of Jenkins Security Advisory.
criticalbug_reportVulnerabilityActive RCE exploits target Super Forms and Elementor Pro WordPress plugins
WordPress plugins: Super Forms – Drag & Drop Form Builder (fixed in 6.3.314) and Elementor Pro (fixed in 4.2.2). CVE-2026-14894 affects all unauthenticated users; CVE-2026-32475 requires at least one published Elementor page with Form widget containi…
criticalbug_reportVulnerabilityChrome 152 patches actively exploited V8 type confusion zero-day
Google Chrome versions prior to 152.0.7977.82 on Windows/macOS/Linux. The vulnerability (CVE-2026-85046) affects the V8 JavaScript engine. Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) are also affected pending vendor patches.
highbug_reportVulnerabilityCoder registry compromised via Cloudflare to deliver malicious Terraform modules
Coder registry infrastructure (registry.coder.com) accessed between 07:35 UTC and 21:45 UTC on August 31, 2026. All users who downloaded Terraform modules during this window are potentially affected.
criticalbug_reportVulnerabilityHPE patches critical RCE in ArubaOS-CX network switches (CVE-2026-73749)
ArubaOS-CX network operating system on HPE Aruba enterprise switches. Affected versions: 10.18.0001, 10.17.1021 and earlier, 10.16.1051 and earlier, 10.13.1180 and earlier, 10.10.1180 and earlier.
highbug_reportVulnerability5,000 Dropbox accounts compromised; OAuth and Teams phishing campaigns active
Multiple attack vectors affecting organizations using Microsoft Teams, Dropbox (5,000+ accounts compromised), OAuth-enabled applications, and remote management tools.
criticalbug_reportVulnerabilityCisco patches critical RCE in Nexus 9000 switches and 7 IOS XR flaws
Cisco Silicon One-based Nexus 9000 switches (10 models including N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O/Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, N9K-C9808) running NX-OS 10.3(1) through 10.6(3s).
highbug_reportVulnerabilityBraZetsu malware framework enables Initial Access Broker marketplace
Windows systems in Iberian Peninsula and Latin America, particularly Brazil. Targeted sectors include e-commerce, corporate, financial, industrial, and law enforcement. Browsers affected: Google Chrome, Microsoft Edge, Brave, Vivaldi, Opera.
criticalbug_reportVulnerabilityElementor Pro CVE-2026-32475 actively exploited for webshell uploads
Elementor Pro plugin for WordPress versions 4.2.1 and earlier. Affects sites with published Elementor Pro Form widgets containing File Upload fields. Over 6 million active installations globally.
criticalbug_reportVulnerabilityCisco NX-OS RCE vulnerability requires immediate patching
Cisco NX-OS operating system. Specific affected versions not disclosed in available information. Impacts Nexus switches and potentially other devices running NX-OS.
criticalbug_reportVulnerabilityCritical vulnerabilities in HPE Aruba OS-CX and FabricComposer require patching
HPE Aruba products: Aruba OS-CX (network switch operating system) and Aruba FabricComposer (data center fabric management). Specific affected versions not disclosed in available information.
highbug_reportVulnerabilityRMM phishing campaign spans 46 countries, US accounts for 45% of activity
Organizations across 46 countries, primarily United States (45% of activity), Canada, and others. Top targeted sectors: education, technology, government, banking, finance, and manufacturing.
criticalbug_reportVulnerabilityCritical RCE in GeoNetwork requires immediate patching
GeoNetwork open-source catalog application. Specific affected versions not disclosed in advisory. All unpatched instances potentially vulnerable to remote code execution.
highbug_reportVulnerabilityPlex urges immediate patching of undisclosed flaws in Media Server
Plex Media Server v1.43.2 and earlier, Plex Desktop client versions prior to 1.115.0. Affects all platforms including Windows, macOS, Linux, and NAS devices running Plex.
highbug_reportVulnerabilityAttackers abuse legitimate Node.js runtime to deploy malware via ClickFix
Organizations using Node.js in their environments, particularly government departments, technology companies, hotels, fintech, e-commerce, professional services, and retail logistics.
highbug_reportVulnerabilityShai-Hulud infostealer now scans 469 credential locations in dev environments
Developer workstations, CI/CD pipelines, cloud configurations, AI tool configs, package registries (npm, GitHub, Docker), and any environment storing long-lived credentials or tokens.
highbug_reportVulnerabilityAI-assisted campaigns target Latin American orgs with data exfiltration
Organizations in Latin America, specifically: Mexican transportation, federal government ministries, municipal water utilities (Mexico/Ecuador) in CL-CRI-1131; Brazilian financial sector in CL-CRI-1163. Campaign active February–June 2026.
highbug_reportVulnerabilityCrowdStrike Falcon zero-day FalconFlank allows privilege escalation via macro remediation
CrowdStrike Falcon Sensor on fully updated Windows 11 25H2 and Windows Server 2025. The vulnerability exploits the Office malicious macros remediation feature. No CVE assigned yet.
criticalbug_reportVulnerabilitySonicWall SMA 1000 SSRF flaw (CVE-2026-83548) exploited in the wild
SonicWall SMA 1000 Appliances. CVE-2026-83548 is a server-side request forgery (SSRF) vulnerability with CVSS 10.0, allowing remote unauthenticated attackers to gain unauthorized access. Specific affected versions not disclosed.
highbug_reportVulnerabilityAttackers abuse Microsoft Teams external chat to impersonate IT support
Microsoft Teams users in enterprise environments with external collaboration enabled. All organizations using Teams for business communication are at risk if users accept external contact requests and grant remote access via RMM tools or Quick Assist…
criticalbug_reportVulnerabilitySangoma Switchvox SQL injection exploited for remote code execution
Sangoma Switchvox VoIP platform versions prior to 8.4.0.2. Approximately 4,000 internet-exposed instances globally, primarily in the United States. Vulnerability CVE-2026-9586 affects the unauthenticated /pa HTTP endpoint.
criticalbug_reportVulnerabilityAll-in-One WP Migration plugin SQL injection enables site takeover
All-in-One WP Migration and Backup plugin for WordPress, versions through 7.109. Over 5 million active installations, with approximately 3.25 million sites (65%) still running vulnerable versions. Fixed in version 7.110.
highbug_reportVulnerabilitySilver Fox campaign uses fake installers to disable Windows Update
Windows systems globally, primarily China-based operations of multinational organizations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors.
criticalbug_reportVulnerabilityJFrog Artifactory auth bypass exploited to forge admin tokens
JFrog Artifactory self-managed instances in default configuration. Patched in versions 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20 (released August 28, 2026). JFrog Cloud environments already protected.
criticalbug_reportVulnerabilitySonicWall SMA1000 RCE vulnerabilities under active exploitation
SonicWall SMA1000 series appliances. Specific affected versions not disclosed in available information. Vulnerabilities enable remote code execution.
criticalbug_reportVulnerabilityLangflow RCE vulnerability under active exploitation, patch immediately
Langflow (specific versions not disclosed in available data). The vulnerability affects Langflow installations exposed to network access. No CVE assigned yet.