Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1092 results
criticalbug_reportVulnerabilityCisco patches critical RCE in Nexus 9000 switches and 7 IOS XR flaws
Cisco Silicon One-based Nexus 9000 switches (10 models including N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O/Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, N9K-C9808) running NX-OS 10.3(1) through 10.6(3s).
highbug_reportVulnerabilityBraZetsu malware framework enables Initial Access Broker marketplace
Windows systems in Iberian Peninsula and Latin America, particularly Brazil. Targeted sectors include e-commerce, corporate, financial, industrial, and law enforcement. Browsers affected: Google Chrome, Microsoft Edge, Brave, Vivaldi, Opera.
criticalbug_reportVulnerabilityElementor Pro CVE-2026-32475 actively exploited for webshell uploads
Elementor Pro plugin for WordPress versions 4.2.1 and earlier. Affects sites with published Elementor Pro Form widgets containing File Upload fields. Over 6 million active installations globally.
criticalbug_reportVulnerabilityCisco NX-OS RCE vulnerability requires immediate patching
Cisco NX-OS operating system. Specific affected versions not disclosed in available information. Impacts Nexus switches and potentially other devices running NX-OS.
criticalbug_reportVulnerabilityCritical vulnerabilities in HPE Aruba OS-CX and FabricComposer require patching
HPE Aruba products: Aruba OS-CX (network switch operating system) and Aruba FabricComposer (data center fabric management). Specific affected versions not disclosed in available information.
highbug_reportVulnerabilityRMM phishing campaign spans 46 countries, US accounts for 45% of activity
Organizations across 46 countries, primarily United States (45% of activity), Canada, and others. Top targeted sectors: education, technology, government, banking, finance, and manufacturing.
criticalbug_reportVulnerabilityCritical RCE in GeoNetwork requires immediate patching
GeoNetwork open-source catalog application. Specific affected versions not disclosed in advisory. All unpatched instances potentially vulnerable to remote code execution.
highbug_reportVulnerabilityPlex urges immediate patching of undisclosed flaws in Media Server
Plex Media Server v1.43.2 and earlier, Plex Desktop client versions prior to 1.115.0. Affects all platforms including Windows, macOS, Linux, and NAS devices running Plex.
highbug_reportVulnerabilityAttackers abuse legitimate Node.js runtime to deploy malware via ClickFix
Organizations using Node.js in their environments, particularly government departments, technology companies, hotels, fintech, e-commerce, professional services, and retail logistics.
highbug_reportVulnerabilityShai-Hulud infostealer now scans 469 credential locations in dev environments
Developer workstations, CI/CD pipelines, cloud configurations, AI tool configs, package registries (npm, GitHub, Docker), and any environment storing long-lived credentials or tokens.
highbug_reportVulnerabilityAI-assisted campaigns target Latin American orgs with data exfiltration
Organizations in Latin America, specifically: Mexican transportation, federal government ministries, municipal water utilities (Mexico/Ecuador) in CL-CRI-1131; Brazilian financial sector in CL-CRI-1163. Campaign active February–June 2026.
highbug_reportVulnerabilityCrowdStrike Falcon zero-day FalconFlank allows privilege escalation via macro remediation
CrowdStrike Falcon Sensor on fully updated Windows 11 25H2 and Windows Server 2025. The vulnerability exploits the Office malicious macros remediation feature. No CVE assigned yet.
criticalbug_reportVulnerabilitySonicWall SMA 1000 SSRF flaw (CVE-2026-83548) exploited in the wild
SonicWall SMA 1000 Appliances. CVE-2026-83548 is a server-side request forgery (SSRF) vulnerability with CVSS 10.0, allowing remote unauthenticated attackers to gain unauthorized access. Specific affected versions not disclosed.
highbug_reportVulnerabilityAttackers abuse Microsoft Teams external chat to impersonate IT support
Microsoft Teams users in enterprise environments with external collaboration enabled. All organizations using Teams for business communication are at risk if users accept external contact requests and grant remote access via RMM tools or Quick Assist…
criticalbug_reportVulnerabilitySangoma Switchvox SQL injection exploited for remote code execution
Sangoma Switchvox VoIP platform versions prior to 8.4.0.2. Approximately 4,000 internet-exposed instances globally, primarily in the United States. Vulnerability CVE-2026-9586 affects the unauthenticated /pa HTTP endpoint.
criticalbug_reportVulnerabilityAll-in-One WP Migration plugin SQL injection enables site takeover
All-in-One WP Migration and Backup plugin for WordPress, versions through 7.109. Over 5 million active installations, with approximately 3.25 million sites (65%) still running vulnerable versions. Fixed in version 7.110.
highbug_reportVulnerabilitySilver Fox campaign uses fake installers to disable Windows Update
Windows systems globally, primarily China-based operations of multinational organizations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors.
criticalbug_reportVulnerabilityJFrog Artifactory auth bypass exploited to forge admin tokens
JFrog Artifactory self-managed instances in default configuration. Patched in versions 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20 (released August 28, 2026). JFrog Cloud environments already protected.
criticalbug_reportVulnerabilitySonicWall SMA1000 RCE vulnerabilities under active exploitation
SonicWall SMA1000 series appliances. Specific affected versions not disclosed in available information. Vulnerabilities enable remote code execution.
criticalbug_reportVulnerabilityLangflow RCE vulnerability under active exploitation, patch immediately
Langflow (specific versions not disclosed in available data). The vulnerability affects Langflow installations exposed to network access. No CVE assigned yet.
highbug_reportVulnerabilityAI coding agents execute malicious Git config commands outside sandbox
Seven command-line AI coding agents: goose (fixed in 1.44.0), Codex CLI/Desktop (fixed in 0.131.0 / 26.519.x), Claude Code (partially fixed in 2.1.196, second path unpatched in 2.1.252+), Hermes Agent 0.18.2–0.21.0 (unpatched), Qwen Code 0.19.6–0.22.…
criticalbug_reportVulnerabilityBGP hijack delivers malicious Virtualizor update with root backdoor
Virtualizor hypervisor management software (all versions) from Softaculous. Attack window: August 28, 2026 20:57 UTC to August 30, 2026 06:10 UTC. Any installation that checked for updates during this period may be compromised.
criticalbug_reportVulnerabilitySonicWall SMA 1000 VPN zero-days exploited in chained attacks
SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances: models 6210, 7210, and 8200v running versions 12.4.3-03453 and older, or 12.5.0-02835 and older.
criticalbug_reportVulnerabilityGeoNetwork RCE chain exploitable without authentication on gov geoportals
GeoNetwork open-source geospatial metadata catalog: all 4.4.x versions up to 4.4.11 and all 4.2.x versions up to 4.2.16. Widely deployed in government, military, and national agency Spatial Data Infrastructure backends across 39 countries, including…
highbug_reportVulnerabilitySality P2P botnet dismantled after 20+ years of operation
Sality botnet infrastructure (active since 2003), affecting 15,000+ infected devices globally. Primary payload in recent years: EggJagger clipjacking malware targeting cryptocurrency wallets.
criticalbug_reportVulnerabilitySonicWall SMA1000 zero-days CVE-2026-83548/83549 chained for RCE
SonicWall SMA1000 appliances (models 6210, 7210, 8200v). Does not affect SSL-VPN on SonicWall firewalls or SMA 100 Series. Approximately 400+ appliances exposed online per Shadowserver tracking.
highbug_reportVulnerabilityActive malware campaign uses fake vendor sites to deliver Silver Fox malware
Organizations with China-based operations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors.
criticalbug_reportVulnerabilityLangflow CVE-2026-0768 exploited to steal OpenAI and AWS credentials
Langflow versions 1.4.2 and earlier. The vulnerability exists in the code validator of the custom component editor's validate endpoint. Patched in version 1.11.6.
criticalbug_reportVulnerabilityJFrog Artifactory auth bypass CVE-2026-82329 under active exploitation
JFrog Artifactory versions 7.161.0-7.161.19, 7.146.0-7.146.36, 7.133.0-7.133.28, 7.125.0-7.125.19, 7.117.0-7.117.27, and 7.111.4-7.111.21. Affects default configurations of self-managed instances. JFrog Access component specifically vulnerable.
criticalbug_reportVulnerabilityJFrog Artifactory authentication bypass requires immediate patching
JFrog Artifactory - specific affected versions not disclosed in advisory. Authentication bypass vulnerability allows unauthorized access to artifact repository.