Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
satellite_altDaily BriefCyber Threat Daily Brief — October 28, 2026
Today's briefing: 9 critical and 29 high-severity threats. A total of 45 detailed analyses covering vulnerabilities, threat actors, and geopolitical context.
Latest Reports
26 / 1786 results
highperson_alertThreat ActorBlack Axe Leaders Extradited to US for Wire Fraud and Money Laundering
Black Axe is a transnational cybercrime syndicate founded in 1977 in Nigeria, now recognized as one of the world's most dangerous and far-reaching criminal organizations.
criticalbug_reportVulnerabilityCisco Secure Email Gateway zero-day exploited; root RCE via crafted email
Cisco Secure Email Gateway (SEG) appliances running vulnerable versions of AsyncOS Software. CVE-2026-76461 affects all physical and virtual appliances regardless of configuration. Over 400 internet-exposed instances tracked by Shadowserver.
criticalbug_reportVulnerabilityLiteSpeed Enterprise pre-6.3.7 privilege escalation grants root on shared hosts
LiteSpeed Web Server Enterprise versions before 6.3.7 on shared hosting environments. The vulnerability bypasses isolation controls including CageFS. OpenLiteSpeed status unknown; no matching update released as of September 15.
criticalbug_reportVulnerabilityCisco Secure Email Gateway CVE-2026-76461 exploited for root RCE
Cisco Secure Email Gateway (physical and virtual appliances) running AsyncOS Software versions 15.5 and earlier, 16.0, and 16.5. All device configurations are vulnerable. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected.
highperson_alertThreat ActorUTA0560 Exploits Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
UTA0560 is a Chinese-linked threat actor tracked by Volexity that conducts cyber espionage operations targeting non-governmental organizations. The actor demonstrates sophisticated capabilities in exploiting zero-day vulnerabilities and conducting sp…
highbug_reportVulnerabilityMicrosoft releases emergency patches for RDS failures after September updates
Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, Windows Server 2019/2022/2025. Remote Desktop Services, Hyper-V (HCS-managed VMs with Plan9 shares), and USB Audio Class 1.0 devices with multichannel audio affected by September 2026 security updates.
highpublicGeopoliticalVPN flaw exposes 246,000 Japanese government personnel records
Japan's Digital Agency disclosed a breach affecting its Government Solution Service (GSS) infrastructure, exposing personnel records of government employees, public officials, and associated entities.
criticalbug_reportVulnerabilityDDRop hardware attack breaks Intel TDX and AMD SEV-SNP memory protection
Intel TDX, Intel Scalable SGX, and AMD SEV-SNP confidential computing technologies used in cloud platforms (AWS, Azure, Google Cloud). Requires DDR5 memory systems. Intel Client SGX and NVIDIA confidential GPUs are not affected.
highperson_alertThreat Actor3BB Broadband Intrusion: MeshCentral Backdoor Used for Root Access
The threat actor behind this intrusion remains unattributed. The operation targeted 3BB, Thailand's largest broadband provider, with the apparent objective of exfiltrating subscriber credential databases.
highbug_reportVulnerabilityTelegram Desktop HTML export flaw allowed JavaScript injection via bots
Telegram Desktop versions 4.15.1 (March 2024) through 6.9.3 on Windows, macOS, and Linux. Vulnerability affects HTML-exported chat files created with vulnerable versions. Fixed in 6.9.4 beta (July 3, 2026) and 7.0.1 stable (July 14, 2026).
highperson_alertThreat ActorRed Heron Exploits Gitea RCE to Compromise 13 Organizations
Red Heron is a suspected Chinese threat actor attributed with moderate confidence to operating within a China-linked context. Attribution is based on the use of Simplified Chinese labels for target classification, consistent classification of Taiwan…
highbug_reportVulnerabilityMass-scanning campaign exploits Vite dev servers to steal AWS/Azure creds
Vite versions 7.1.0 through 7.3.2 and 8.x before 8.0.5. Internet-exposed Vite development servers (typically port 5173) running with --host flag, server.host configuration, or misconfigured Docker port mappings.
criticalbug_reportVulnerabilityCheck Point VPN unauthenticated RCE requires immediate patching
Check Point VPN products (specific versions not disclosed in available data). Vulnerability allows unauthenticated remote code execution. No CVE assigned yet.
highbug_reportVulnerabilitySQL Injection flaws in Alior Bank PrestaShop module expose backoffice data
Alior Bank "raty" module for PrestaShop. CVE-2026-7848 affects versions 8.0.0 to 8.1.11 (fixed in 8.1.11 and 9.0.7). CVE-2026-15600 affects versions 8.1.9 to 8.1.12 (fixed in 8.1.12 and 9.0.8).
highbug_reportVulnerabilityCompromised IP cameras exploited for espionage and DDoS attacks
IP cameras across multiple vendors and models. Organizations with internet-exposed camera infrastructure are at risk. Specific affected vendors and firmware versions not disclosed in CERT.BE advisory.
highbug_reportVulnerabilityMicrosoft September 2026 updates break RDS on Windows Server and clients
Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and Windows 10/11 all versions that applied September 2026 Patch Tuesday updates. Impacts Remote Desktop Services (RDS), RDP connections, MMC, RDS Licensing Diagnoser, and File Explorer.
highperson_alertThreat ActorHISHIMIRO/jeetbot.cc Leaked OAuth Tokens from 31K Twitch Users
HISHIMIRO/jeetbot.cc is a Russia-based commercial bot service operator linked to the malicious Twitch browser extension "Twitch Enhanced Viewer | JeetBot." The operator, identified as Cyprus-based developer Aleksandr Popov, runs JeetBot as a commerci…
criticalbug_reportVulnerabilityTencent Sogou Input Method RCE exploited by UNC3569 for GrayRabbit
Tencent Sogou Input Method for Windows, versions prior to 16.3.0.3498. Hundreds of millions of installations in China. Vulnerability CVE-2026-51990 is a one-click remote code execution flaw exploiting unvalidated URI handler, unrestricted URL navigat…
highbug_reportVulnerabilityMicrosoft warns of passkey phishing and CEO fraud campaigns targeting cloud
Microsoft cloud environments (Azure AD/Entra ID, Microsoft 365, SharePoint, OneDrive). Campaign 1: U.S. enterprise users in IT services, consumer goods, real estate, and manufacturing (August 2026).
criticalbug_reportVulnerabilityGitLab CE/EE path traversal vulnerability requires immediate patching
GitLab Community Edition (CE) and Enterprise Edition (EE). Specific affected versions not disclosed in available information.
highbug_reportVulnerabilityCISA adds 5 exploited flaws in Artifactory, ScreenConnect, RouterOS to KEV
JFrog Artifactory (CVE-2026-42016, CVE-2026-42018), ConnectWise ScreenConnect client (CVE-2026-84869), and MikroTik RouterOS (CVE-2026-67277, CVE-2026-86060). All vulnerabilities are actively exploited in the wild.
criticalbug_reportVulnerabilityCheck Point VPN critical flaws CVE-2026-85102/85103 face imminent exploit
Check Point VPN products. Specific affected versions not disclosed in available information. Both CVE-2026-85102 and CVE-2026-85103 are rated critical severity.
criticalbug_reportVulnerabilityOpenAI agent swarm exploited RubyGems/RubyDoc for RCE and data exfiltration
RubyGems package registry and RubyDoc.info documentation service. Over 2,000 malicious packages published May-June 2026. Exploitation of .yardopts file processing in RubyDoc build system enabled remote code execution.
highperson_alertThreat ActorMultiple APT and Cybercrime Groups Abuse Claude AI to Extract Android Secrets
This activity involves multiple distinct threat actor categories operating independently: state-sponsored espionage groups linked to Russia and China, and financially motivated cybercrime actors.
highpublicGeopoliticalFlorida State Driver Database Breached via Stolen Police Credentials
The breach of Florida's DAVID driver database represents a compromise of critical state-level identity infrastructure in the United States. Driver databases contain personally identifiable information (PII) for millions of residents and serve as foun…
highperson_alertThreat ActorShinyHunters and Helix Linked to Passkey-Themed M365 Phishing Campaign
ShinyHunters and Helix are cybercrime actors linked to data extortion operations. Both groups have established reputations in the underground economy for compromising corporate environments and exfiltrating sensitive data for extortion or sale.