Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
satellite_altDaily BriefCyber Threat Daily Brief — October 28, 2026
Today's briefing: 9 critical and 29 high-severity threats. A total of 45 detailed analyses covering vulnerabilities, threat actors, and geopolitical context.
Latest Reports
28 / 1786 results
criticalbug_reportVulnerabilityCisco ISE max-severity auth bypass zero-day exploited in the wild
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) versions 3.1, 3.2, 3.3, 3.4, and 3.5. CVE-2026-76460 affects all configurations due to insufficient authentication control on an API endpoint.
highperson_alertThreat ActorIranian State-Linked Hackers Deploy CHOSEN BRICK Malware
Iranian state-linked threat actors conducting espionage operations targeting dissidents, activists, and journalists globally. The activity is attributed to Iranian intelligence services and is assessed to support regime repression efforts against per…
highbug_reportVulnerabilityKREMLIN malware force-installs malicious Chrome/Edge extensions via bypass
Google Chrome and Microsoft Edge browsers on Windows systems. Active campaign since May 2025 with 1,515+ confirmed infections, primarily in Brazil. Affects users who execute malicious JavaScript files disguised as business documents.
criticalbug_reportVulnerabilityIssabel Framework hard-coded JWT key enables unauthenticated RCE
Issabel Framework (all versions prior to August 1, 2026 patch). Issabel is a web-based framework for open-source unified communications PBX software built on Asterisk.
highperson_alertThreat ActorNightEagle, Hacking Cat, and Toy Ghouls Target Russian Enterprises
Three distinct threat activity clusters are actively targeting Russian enterprises. NightEagle (APT-Q-95) is a sophisticated threat actor active since at least 2023, employing advanced persistence and lateral movement techniques.
highbug_reportVulnerabilityBrowser extensions can hijack AI agents in Chrome, Edge, Comet, Opera, Claude
Chromium-based browsers with embedded AI assistants: Google Chrome (fixed in v143.0.7499.192, Jan 2026), Microsoft Edge (fixed in v150.0.4078.48, July 2026), Perplexity Comet, Opera Neon, and Claude in Chrome extension.
criticalbug_reportVulnerabilityHPE Aruba EdgeConnect SD-WAN auth bypass and RCE flaws require patching
HPE Aruba Networking EdgeConnect SD-WAN appliances. Specific affected versions not disclosed in available data. Vulnerabilities enable authentication bypass and remote code execution.
highbug_reportVulnerabilityAI coding assistant hijacked to spread Shai-Hulud worm across 100 repos
Unnamed SaaS provider; approximately 100 internal code repositories compromised. Attack vector: AI coding assistant session hijack leading to poisoned PyPI package installation, GitHub OAuth token theft, and Shai-Hulud worm deployment.
highbug_reportVulnerabilityParallels Desktop privilege escalation leaves Intel Macs unpatched
Parallels Desktop for Mac versions below 27.0.0. Fix available only in version 27, which requires Apple silicon; Intel-based Macs running version 26.x remain vulnerable. CVE-2026-90894 (CVSS 7.8).
highperson_alertThreat ActorN0va Targets US and EU Orgs with Token-Theft Phishing Campaigns
N0va is a threat actor conducting phishing campaigns targeting organizations across North America and Europe. The actor's motivation appears to be financially driven, with objectives including payment fraud, invoice manipulation, and access to sensit…
highbug_reportVulnerabilitySix critical flaws in WNC T-Mobile 5G Box IDU routers enable RCE
WNC T-Mobile 5G Box IDU routers running firmware versions before 1.1.0.651412. All six CVEs affect the same product and version range. Vulnerabilities include authentication bypass (CVE-2026-40854), three OS command injection flaws (CVE-2026-40855, C…
highbug_reportVulnerabilityGoogle Pixel modem privilege escalation under limited targeted exploitation
Google Pixel devices with cellular modem component. All devices with security patch level prior to 2026-09-05. CVE-2026-58704 is a logic error enabling remote (proximal/adjacent) privilege escalation without user interaction.
criticalbug_reportVulnerabilityConnectWise ScreenConnect CVE-2026-84869 actively exploited in wild
ConnectWise ScreenConnect versions prior to 26.6.5. Affects ScreenConnect clients used by MSPs and IT teams for remote access and system management. Over 1,000 unpatched instances exposed online, primarily in North America (758) and Europe (180).
highbug_reportVulnerabilityAcronis cPanel Backup plugin privilege escalation exploited in wild
Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021 and Acronis Backup extension for Plesk (Linux) before build 1.8.11.638. Affects Linux-based web hosting control panel deployments.
criticalbug_reportVulnerabilityWooCommerce Wholesale Lead Capture flaw exploited for PHP backdoor uploads
WooCommerce Wholesale Lead Capture WordPress plugin, all versions up to and including 2.0.3.1. Approximately 6,000+ active installations. CVE-2026-27540 (CVSS 9.8) - arbitrary file upload due to missing validation in wwlc_file_upload_handler AJAX act…
highbug_reportVulnerabilityAcronis cPanel/Plesk backup plugin flaw exploited for Linux privilege escalation
Acronis Backup plugin for cPanel & WHM (builds < 1.9.3.1021) and Acronis Backup extension for Plesk (builds < 1.8.11.638). Affects Linux servers running these backup integrations in web hosting environments.
highbug_reportVulnerabilityAdmin Menu Editor Pro supply chain attack backdoors 1,500 WordPress sites
Admin Menu Editor Pro WordPress plugin versions 2.35 and 2.36. At least 230 customers affected across approximately 1,500 WordPress sites. The free version (300,000+ installations) is not affected.
criticalbug_reportVulnerabilitySAP Extended Passport Processing memory corruption flaw patched
SAP Extended Passport Processing (EPP) component across SAP products. Specific affected versions not disclosed in available information. Organizations running SAP systems with EPP functionality should assume exposure.
highperson_alertThreat ActorREF9334 Deploys KREMLIN Malware Targeting Brazilian Financial Sector
REF9334 is a Brazilian threat actor tracked by Elastic Security Labs, active since at least May 2025. The actor specializes in banking fraud operations targeting Brazilian financial institutions through sophisticated malware delivery campaigns.
highperson_alertThreat ActorIran MOIS Uses Telegram-Controlled Malware to Target Dissidents
Iran's Ministry of Intelligence and Security (MOIS), the country's primary intelligence agency, is attributed by the FBI, UK NCSC, and Netherlands AIVD as the operator behind this espionage campaign.
highbug_reportVulnerabilityBambooToken malware uses MQTT protocol to target Windows and Linux systems
Windows and Linux systems, particularly organizations in Asia and South America. Targets include financial, government, mobile app developers, and various enterprises. Campaign active since February 2023 through July 2026.
highbug_reportVulnerabilityCisco Secure Email Gateway SQL injection requires urgent patching
Cisco Secure Email Gateway (formerly IronPort). Specific affected versions not disclosed in available information. SQL injection vulnerability allows potential unauthorized database access.
criticalbug_reportVulnerabilityWooCommerce Wholesale Lead Capture plugin under active exploitation
WooCommerce Wholesale Lead Capture premium plugin for WordPress, versions 2.0.3.1 and older. CVE-2026-27540: unauthenticated arbitrary file upload vulnerability allowing PHP webshell deployment.
criticalperson_alertThreat ActorCVE-2026-59310: VMware vCenter RCE exploited by ransomware gangs
No specific threat actor attribution is provided. The campaign involves multiple ransomware gangs actively exploiting CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter.
highperson_alertThreat ActorIranian State Actors Deploy CHOSEN BRICK Against Dissidents Globally
Iranian state cyber actors are attributed by NCSC UK, FBI, and AIVD to deploying CHOSEN BRICK malware against dissidents, activists, and journalists perceived as threats to the Iranian regime.
highperson_alertThreat ActorIranian State Actors Deploy CHOSEN BRICK Spyware Against Dissidents
Iranian state-sponsored cyber actors conducting surveillance operations against individuals perceived as threats to the Iranian regime. The NCSC assesses that Iran almost certainly uses cyber activity to support repression of dissidents, activists, a…
highbug_reportVulnerabilityMarimo RCE (CVE-2026-39987) exploited for 8-second pivot to SSH bastion
All versions of Marimo notebook application. CVE-2026-39987 is a pre-authenticated remote code execution vulnerability (CVSS 9.3) actively exploited within hours of public disclosure.
highbug_reportVulnerabilityMass-scanning campaign exploits Vite CVE-2026-39364 for cloud credentials
Vite development servers exposed to the internet via --host flag or server.host configuration. Affects deployments where sensitive files exist in server.fs.allow directories and are matched by server.fs.deny patterns.