Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
satellite_altDaily BriefCyber Threat Daily Brief — October 28, 2026
Today's briefing: 9 critical and 29 high-severity threats. A total of 45 detailed analyses covering vulnerabilities, threat actors, and geopolitical context.
Latest Reports
29 / 1786 results
highperson_alertThreat ActorShinyHunters Breaches AdaptHealth, Exposing 4.1M Patient Records
ShinyHunters is a financially motivated cybercrime group known for large-scale data theft and extortion operations. The group typically targets organizations to steal sensitive data, then demands ransom payments in exchange for not publicly leaking t…
highperson_alertThreat ActorU.S. Disrupts Chinese Organized Crime Scam Marketplace, Freezes $52.8M
Chinese organized crime syndicates operating the Xinbi Guarantee illicit marketplace, a Telegram-based platform facilitating pig butchering romance scams, wire fraud, and money laundering.
highbug_reportVulnerabilityPasskey-themed phishing campaign targets cloud identities via AiTM
Microsoft 365 / Entra ID users across multiple organizations. Campaign active since May 2024 (likely typo in source stating "May 2026"). Targets include SharePoint, OneDrive, Exchange, and Microsoft Graph API access.
highperson_alertThreat ActorChinese AI Firms Conduct Industrial-Scale Distillation on U.S. Models
Six Chinese AI companies—DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI—are attributed by CISA, NSA, and FBI as conducting coordinated, industrial-scale AI model distillation attacks against U.S. frontier AI providers since late 2024.
highperson_alertThreat ActorAPT31 Deploys BlueMoon Exploit Kit Chaining Chrome and Windows Zero-Days
APT31 (also tracked as Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, TA412, Tide Castle, Violet Typhoon, and ZIRCONIUM) is a China-aligned state-sponsored threat actor conducting espionage operations.
highperson_alertThreat ActorGentlemen Ransomware Gang Breaches Veradigm via Third-Party Vendor
The Gentlemen is a double-extortion ransomware gang that emerged around mid-2025. The group operates opportunistically across multiple sectors and geographies, targeting organizations based on access availability rather than strategic selection.
criticalbug_reportVulnerabilitySAP patches two critical RCE flaws in Kernel and NetWeaver (CVSS 10.0)
CVE-2026-44756 (CVSS 10.0) affects SAP Kernel versions 7.22–9.20 and WEBDISP 9.16–9.20 across KRNL64NUC, KRNL64UC, and KERNEL components. CVE-2026-58240 (CVSS 9.8) affects SAP NetWeaver Message Server in Kernel 9.16, 9.18, 9.19, 9.20.
criticalbug_reportVulnerabilityFortinet FortiOS & FortiSwitchManager RCE requires immediate patching
Fortinet FortiOS and FortiSwitchManager affected by remote code execution vulnerability. Specific affected versions not disclosed in available information. CVE identifier not yet assigned or published.
criticalbug_reportVulnerabilityN-able N-central pre-auth RCE (CVE-2026-86218) requires immediate patch
N-able N-central remote monitoring and management (RMM) platform. Specific affected versions not disclosed in available information. Pre-authentication attack surface suggests all internet-facing instances are at risk.
criticalbug_reportVulnerabilityMicrosoft Sept 2026 Patch Tuesday: 964 CVEs, 2 zero-days under attack
Microsoft products across the ecosystem. 964 vulnerabilities total: 104 critical, 860 important. Two zero-day vulnerabilities are actively exploited in the wild.
highbug_reportVulnerabilityDeepSeek Harness agents can escape file sandbox via unauthenticated API
DeepSeek Harness versions 0.1.1-rc.2 and earlier. The tool runs AI coding agents on developer machines. Fixed in version 0.1.2-alpha.2 (npm) and later. Third-party desktop wrappers may ship vulnerable versions independently.
criticalbug_reportVulnerabilityAlby Hub critical flaw enables wallet takeover on internet-exposed instances
Alby Hub versions v1.7.0 through v1.18.5 (all releases before August 2025). Only instances exposed to the internet are vulnerable. Versions v1.19.0 and later are patched. Current version is v1.24.0.
highbug_reportVulnerability36,000 Plex Media Servers remain unpatched against undisclosed flaws
Plex Media Server v1.43.2 and earlier, Plex Desktop prior to v1.115.0. Over 36,000 internet-exposed instances confirmed vulnerable as of September 2026. Affects self-hosted and NAS-based deployments.
highbug_reportVulnerabilityYouTube gaming lures and SEO poisoning deliver multi-payload malware via PPI
Enterprise networks, critical infrastructure, and government entities. Campaign CL-CRI-1171 active since at least 2024, delivering payloads including Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner, and Socks5Systemz via custom loader.
highpublicGeopoliticalU.S. Accuses China-Based AI Firms of Industrial-Scale Model Distillation
The joint advisory from NSA, CISA, and FBI represents a significant escalation in U.S.-China technological competition, framing AI model distillation not as isolated intellectual property theft but as a coordinated national strategy.
highbug_reportVulnerabilityChrome V8 zero-day CVE-2026-87491 exploited in wild for sandbox code execution
Google Chrome versions prior to 153.0.8010.36/.37 (Windows/macOS) and 153.0.8010.36 (Linux). Affects V8 JavaScript engine. All Chromium-based browsers (Edge, Brave, Opera, Vivaldi) also vulnerable until patched.
criticalbug_reportVulnerabilitycPanel SQL injection flaw allows mail users to escalate to root
All supported versions of cPanel and WHM (release lines 11.110, 11.134, 11.136, 11.138, and WP Squared). Fixed in builds 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and 11.138.1.9 (WP Squared).
highperson_alertThreat ActorSophos Analyzes Memory-Resident PHP Web Shell in F5 BIG-IP APM
Sophos is a cybersecurity vendor that published technical analysis on September 7, 2026, examining malware targeting F5 BIG-IP Access Policy Manager (APM) appliances. Sophos is the researcher/defender in this context, not the threat actor.
criticalbug_reportVulnerabilityMicrosoft Defender zero-day "ShieldCrash" bypasses September patch
Microsoft Defender on all supported Windows 10, Windows 11, and Windows Server versions with September 2026 Patch Tuesday updates applied. The vulnerability is an incomplete fix for CVE-2026-69414 (ShieldBreak), allowing arbitrary file read as SYSTEM…
highbug_reportVulnerabilityChrome zero-day CVE-2026-87491 exploited in wild, seventh in 2024
Google Chrome versions prior to 153.0.8010.36 (Windows/Linux) and 153.0.8010.37 (Mac) on all desktop platforms. Vulnerability exists in V8 JavaScript/WebAssembly engine.
highbug_reportVulnerabilityMicrosoft patches 974 vulnerabilities, including 2 actively exploited zero-days
Microsoft Windows (all supported versions), Windows Server 2012 and later, and other Microsoft software products. Two actively exploited zero-days: CVE-2026-81963 and CVE-2026-85880 (privilege escalation).
highperson_alertThreat ActorDoppelCart: 119,000+ Fake E-Commerce Domains Used for Card Theft
DoppelCart is a large-scale fraud operation attributed to coordinated threat actors conducting payment card theft through fraudulent e-commerce infrastructure.
criticalbug_reportVulnerabilityMicrosoft patches 966 flaws including 2 actively exploited zero-days
Microsoft products (specific products and versions not disclosed in provided data). Two zero-day vulnerabilities are actively exploited; 964 additional flaws patched in September 2026 Patch Tuesday.
highperson_alertThreat ActorShinyHunters Claims Breach of Florida DMV DAVID Database
ShinyHunters is a financially motivated cybercrime extortion gang known for conducting data breaches targeting organizations with large databases of personally identifiable information (PII).
highperson_alertThreat ActorSlim Spider Targets Brazilian Financial Institutions for Crypto Theft
Slim Spider is a previously undocumented, financially motivated threat actor attributed by CrowdStrike to Brazil-based operations targeting Brazilian financial institutions since at least March 2026.
highperson_alertThreat ActorLiquid Hackers Exploit Elements Bug, Return 85% of Stolen Bitcoin
Liquid Hackers is a group that exploited a vulnerability in the Elements software underlying the Liquid Network Bitcoin sidechain on September 6, 2026. The actors self-identify as "white hats" and communicated via on-chain messages, claiming their in…
criticalbug_reportVulnerabilityAdobe Commerce/Magento unauthenticated RCE requires immediate patching
Adobe Commerce and Magento platforms. Specific affected versions not disclosed in available information. Vulnerability allows unauthenticated remote code execution.
highbug_reportVulnerabilityChatGPT prompt injection exfiltrates Gmail data via internal service
ChatGPT users with connected apps (Gmail, other integrations) enabled. All account types affected, including Business, Enterprise, and Edu workspaces. Vulnerability existed in ChatGPT's internal JFrog Artifactory service used for Python/npm package m…
highperson_alertThreat ActorAI-Powered Credential Harvesting Campaign Compromises Thousands in 6 Hours
The campaign involves financially motivated threat actors leveraging autonomous AI agents and multi-agent attack frameworks to conduct large-scale credential harvesting operations.