Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
satellite_altDaily BriefCyber Threat Daily Brief — October 28, 2026
Today's briefing: 9 critical and 29 high-severity threats. A total of 45 detailed analyses covering vulnerabilities, threat actors, and geopolitical context.
Latest Reports
26 / 1870 results
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway flaws exploited globally, CISA orders patching
Citrix NetScaler ADC and NetScaler Gateway all versions. CVE-2026-88771 affects all deployments; CVE-2026-88772 requires DTLS enabled (default on VPN virtual servers).
criticalbug_reportVulnerabilityCISA orders federal agencies to patch exploited Citrix NetScaler RCE flaws
Citrix NetScaler ADC and NetScaler Gateway all versions prior to 14.1-73.37, 13.1-64.23, 14.1-FIPS 14.1-73.37, and 13.1-FIPS/13.1-NDcPP 13.1.37.279. CVE-2026-88771 affects all default configurations; CVE-2026-88772 requires DTLS enabled (default on V…
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway: 2 critical RCE flaws under active exploit
Citrix NetScaler ADC and NetScaler Gateway versions 13.1 before 13.1-64.23, 14.1 before 14.1-73.37, and FIPS editions. CVE-2026-88771 affects all deployments (no preconditions).
criticalbug_reportVulnerabilityCitrix NetScaler RCE zero-days CVE-2026-88771/88772 exploited in wild
Citrix NetScaler ADC and NetScaler Gateway: versions 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS editions before 14.1-73.37 FIPS and 13.1-37.279, and Secure Private Access Hybrid deployments.
highbug_reportVulnerabilityCloudflare patches cross-tenant data leak in Containers service
Cloudflare Containers and Sandboxes service, available to Workers Paid plan customers. All customers using Containers on shared physical hosts were potentially affected.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway RCE zero-days exploited in the wild
Citrix NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.37, 13.1-64.23, and corresponding FIPS/NDcPP releases. CVE-2026-88771 affects all deployments including default configurations.
highperson_alertThreat ActorShinyHunters Exploits Oracle PeopleSoft CVE via WAF Bypass
ShinyHunters is a financially motivated extortion gang known for data theft and extortion operations. The group targets organizations with vulnerable internet-facing applications to exfiltrate sensitive data and leverage it for ransom demands.
highperson_alertThreat ActorLunex MaaS Platform Deploys Psychedelic Stealer via BYOVD Technique
Lunex is a malware-as-a-service (MaaS) platform attributed to Russian-speaking developers or development teams. The platform distributes the Psychedelic Stealer (also known as LunexStealer) to multiple criminal groups, enabling credential theft, cryp…
highbug_reportVulnerabilityCompromised GitHub Actions re-enabled with malicious code for 7+ days
Two third-party GitHub Actions previously compromised in Mini Shai-Hulud campaign. Specific action names not disclosed. Affects any workflows consuming these actions during the exposure window (7+ days).
criticalperson_alertThreat ActorShinyHunters Exploits Oracle PeopleSoft CVE-2026-35273 via WAF Bypass
ShinyHunters is a financially motivated cybercrime group (tracked by Mandiant as UNC6240) with an established pattern of data theft extortion. The group originated as GnosticPlayers before rebranding to ShinyHunters in 2020.
highbug_reportVulnerabilityElementor WordPress plugin CSRF flaw enables admin account takeover via link
Elementor Website Builder WordPress plugin versions 4.3.0 and 4.3.1 only. Affects over 2 million active installations. Fixed in version 4.3.2.
highbug_reportVulnerabilityCISA: SharePoint RCE and MikroTik RouterOS flaws exploited in wild
CVE-2026-65660: Microsoft Office SharePoint Server (unspecified versions). CVE-2026-67279: MikroTik RouterOS 7.x builds. Both vulnerabilities confirmed exploited in active attacks.
highperson_alertThreat ActorKiteworks Issues Precautionary Shutdown After Federal Threat Warning
No specific threat actor has been publicly identified in this incident. Federal intelligence authorities provided credible threat intelligence to Kiteworks indicating that an unspecified threat actor may attempt to target some Kiteworks systems.
highpublicGeopoliticalU.S. Soldier Sentenced for Snowflake Breach Targeting 100M AT&T Records
This incident represents a significant insider threat case involving an active-duty U.S. Army soldier with secret-level security clearance who exploited cloud infrastructure vulnerabilities to conduct financially motivated cybercrime.
highbug_reportVulnerabilityKiteworks urges global server shutdown for zero-day threat mitigation
Kiteworks secure file-sharing platform, all customer deployments worldwide. Specific affected versions not disclosed. Zero-day vulnerability details not yet public.
highperson_alertThreat ActorClop Ransomware Leak Site Compromised via Grav CMS Path Traversal Flaw
This incident involves two distinct threat actors: Clop, a financially motivated ransomware operation known for large-scale data extortion campaigns, and ShinyHunters, a cybercrime actor specializing in data breaches and database theft.
highbug_reportVulnerabilityElementor WordPress plugin CSRF flaw enables admin account creation
Elementor plugin for WordPress. Specific affected versions not disclosed in available data. Impacts WordPress sites using the Elementor page builder plugin.
criticalbug_reportVulnerabilityCISA: Critical WSO2 auth bypass CVE-2026-5430 under active exploit
WSO2 enterprise products (specific versions not provided in source), Microsoft SharePoint (unspecified versions), and Adobe Commerce (unspecified versions).
highperson_alertThreat ActorStorm-3168 (JADEPUFFER) conducts agentic Azure cloud attacks
Storm-3168 is Microsoft's tracking designation for JADEPUFFER, a threat actor first documented by Sysdig in July 2026 as the first known agentic ransomware operation.
highbug_reportVulnerabilityGitHub Actions repos re-enabled with Mini Shai-Hulud malware intact
Two GitHub Actions repositories (actions-cool/issues-helper and actions-cool/maintain-one-comment) compromised in May 2026. Any CI/CD workflows referencing these actions by version tags (e.g., v2.2.1 or later from May 18, 2026) executed malicious pay…
criticalbug_reportVulnerabilityServiceNow critical vulnerabilities require immediate patching
ServiceNow platform (specific versions not disclosed in advisory). Scope and affected components not detailed in available information.
highperson_alertThreat ActorRydox Marketplace Operator Pleads Guilty to Data Trafficking
Ardit Kutleshi, a 28-year-old Kosovar national, operated Rydox, a large-scale illegal online marketplace facilitating the sale of stolen personal information, login credentials, credit card details, and cybercrime tools.
criticalperson_alertThreat ActorLazarus Group Steals $351.6M from Bitget via Backend Compromise
Lazarus Group (G0032), also tracked as Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, and ZINC, is a North Korean state-sponsored APT group. The actor is financially motivated, conducting large-scale cryptocurrency heists to generate revenue f…
highbug_reportVulnerabilityRoundcube pre-auth SQL injection CVE-2026-48842 exploited in wild
Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 with virtuser_query plugin enabled. Over 523,000 Roundcube instances exposed to internet; 10 confirmed vulnerable as of September 23, 2026.
highbug_reportVulnerabilityCloudflare Containers flaw exposed leftover disk data across customers
Cloudflare Containers and Cloudflare Sandboxes. All customers using these services were potentially affected. The vulnerability stemmed from thin-provisioned disk blocks not being wiped before reallocation across customer accounts.
criticalbug_reportVulnerabilityWSO2 and Adobe Commerce flaws actively exploited, added to CISA KEV
CVE-2026-5430: WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway (all versions not specified). CVE-2026-71362: Adobe Commerce and Magento (versions not specified).