Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
satellite_altDaily BriefCyber Threat Daily Brief — October 28, 2026
Today's briefing: 9 critical and 29 high-severity threats. A total of 45 detailed analyses covering vulnerabilities, threat actors, and geopolitical context.
Latest Reports
29 / 1870 results
criticalbug_reportVulnerabilityLiteLLM 1.107.0 supply chain attack steals credentials via Python hooks
LiteLLM version 1.107.0 distributed via PyPI and official container images on October 21, 2026. Affects any Python environment where the compromised package was installed, including developer workstations, CI/CD agents, test systems, containers, and…
criticalbug_reportVulnerabilityRuby patches Onigmo regex RCE flaws exploited via GitLab untrusted input
Ruby versions 4.0.0–4.0.8, 3.4.0–3.4.11, and 3.3.0–3.3.12. Ruby 3.2 and earlier (EOL) will not receive patches. GitLab versions 7.0+ were affected; patched in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13.
highperson_alertThreat ActorINC & The Gentlemen Affiliates Deploy AI-Driven Phantom Framework
INC and The Gentlemen are Russian-speaking ransomware affiliate groups operating an AI-driven intrusion ecosystem. These actors function both as intrusion and data-extortion operators and as infrastructure providers supporting multiple partners acros…
highpublicGeopoliticalQuest Diagnostics breach exposes patient data via Quanum LSM platform
The breach at Quest Diagnostics, which serves approximately one-third of U.S. adults annually, underscores the persistent vulnerability of critical healthcare infrastructure to unauthorized access.
highbug_reportVulnerabilityPHP RCE flaw CVE-2026-115560 affects rare configs, no patch yet
PHP installations with non-default session configuration: session.serialize_handler set to php_binary or php_serialize, then switched to php at runtime via ini_set() before session_start(), and session upload progress enabled.
highbug_reportVulnerabilityThreat actor k0t exploits Fortinet and Palo Alto firewalls, exposes 70K creds
Fortinet FortiGate and FortiWeb firewalls, Palo Alto Networks GlobalProtect, PAN-OS, and Prisma Access. Exploited vulnerabilities: CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (PAN-OS/Prisma Access authentication bypass).
criticalbug_reportVulnerabilityHPE patches 8 critical auth bypass and RCE flaws in ArubaOS
Aruba Operating System (ArubaOS) versions AOS-8 and AOS-10, affecting Aruba Networking mobility conductors, access points, controllers, and gateway devices.
highbug_reportVulnerabilityPHP warns of unpatched RCE flaw affecting uncommon configurations
PHP web applications with specific configuration: session.serialize_handler set to php_binary or php_serialize, then changed to php via ini_set() before session_start(), with session upload progress enabled.
highperson_alertThreat ActorSandworm and UAC-0099 Deploy Mesh Network Backdoor in Ukraine Wiper Attack
Sandworm is a Russian state-sponsored APT group known for destructive cyber operations, particularly against Ukrainian critical infrastructure. In this operation, Sandworm collaborated with UAC-0099 (aka Earth Sirrush), another Russia-aligned threat…
highbug_reportVulnerability11 critical flaws in CGM CLININET enable RCE and data theft
CGM CLININET healthcare software: all versions before 2026.MS3 affected by most vulnerabilities. CVE-2025-30049 fixed in 2026.MS1 and 2026.MS3. Multiple vulnerabilities (CVE-2025-30045, CVE-2025-30046, CVE-2025-30052, CVE-2025-30053, CVE-2025-30054,…
criticalbug_reportVulnerabilityPillow library RCE via EPS filename injection; upgrade to 13.0.0 required
Pillow versions 2.6.0 through 12.3.0. Affects Python applications processing EPS images with Ghostscript installed, particularly web upload endpoints that accept user-controlled filenames.
criticalbug_reportVulnerabilityNode.js Brotli RCE (CVE-2026-111497) exploited via crafted compression data
Node.js versions 22.x, 24.x, and 26.x on all architectures. Confirmed RCE on 24.22.0 Linux arm64. Applications decoding untrusted Brotli data via fetch() responses or request body middleware (Express 5.x body parsers, body-parser 2.x) are vulnerable.…
highbug_reportVulnerabilityx402 SDK flaws let malicious APIs drain AI agent wallets, bypass payments
x402 SDKs (TypeScript, Python, Go) prior to August 18, 2024 releases. Specifically: @x402/core, @x402/svm, @x402/extensions, @x402/fetch, @x402/axios versions before 2.23.0 (TypeScript); Python package before 2.25.0; Go module before v2.28.0.
highbug_reportVulnerabilityPHP2Shell RCE flaws exploited to deploy Mirai botnet, attacks unsuccessful
PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) enable unauthenticated remote code execution via crafted HTTP requests.
highpublicGeopoliticalCapcom breach exposes 11.7M accounts; Japan gaming sector targeted again
The breach of Capcom's CAPCOM ID service represents the second significant compromise of the Japanese gaming giant in six years, following a 2020 Ragnar Locker ransomware incident.
criticalbug_reportVulnerabilityLiteLLM PyPI and Docker supply chain attack delivers credential stealer
LiteLLM version 1.107.0 on PyPI (all seven .whl packages for Windows, Linux, macOS) and Docker images (v1.107.0, latest, main-latest, main-stable) on Docker Hub and GHCR. Attack window: October 21, 2026, 11:39–14:20 UTC.
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator SQL injection zero-day under active exploit
Arista VeloCloud Orchestrator (VCO) versions before 5.2.3.18, 6.1.3.10, and 6.4.2.12. On-premises deployments affected; Hosted and Dedicated orchestrators already patched. VeloCloud Gateway and Edge devices not affected.
criticalbug_reportVulnerabilityeMudhra CA exits SSL/TLS business after 8 intermediate keys found guessable
eMudhra certificate authority: 8 intermediate CA private keys compromised (6 for TLS). Approximately 30,800 unexpired certificates chained to emSign ECC Root CA - G3, 99.9% issued through InCommon (higher education).
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator SQL injection zero-day under active exploit
Arista VeloCloud Orchestrator (VCO) On-Prem deployments. Patched versions: 5.2.3.18+, 6.1.3.10+, 6.4.2.12+. Hosted VCO instances already patched. Unpatched on-prem deployments remain vulnerable.
criticalbug_reportVulnerabilityeMudhra CA private keys compromised; MitM attacks possible via rogue certs
Eight intermediate Certificate Authority (CA) private keys from eMudhra Limited (Indian CA). Affects any TLS/SSL certificates issued by these compromised intermediates, including public-facing services, VPNs, APIs, and internal infrastructure relying…
criticalbug_reportVulnerabilityTwo 9.0 CVSS RCE flaws in Linux KSMBD disclosed before kernel fixes
Linux KSMBD (kernel SMB server) on all distributions where the module is loaded. ZDI-CAN-33774 affects any KSMBD install on port 445. ZDI-CAN-33549 requires SMB Direct transport with RDMA-capable network hardware or rxe software driver.
highpublicGeopoliticalNew Mexico Court Orders Meta to Pay $25B for Cambridge Analytica Violations
The ruling represents a significant escalation in U.S. state-level enforcement against major technology platforms, following federal actions that resulted in a $5 billion FTC fine in 2019 and an $18 billion multi-state settlement in August 2026.
criticalbug_reportVulnerabilityGitLab unauthenticated RCE vulnerability requires immediate patching
GitLab (specific versions not disclosed in available information). Vulnerability allows unauthenticated remote code execution. No CVE assigned yet or not publicly disclosed.
highbug_reportVulnerabilityMultiple high-severity vulnerabilities in Node.js require immediate patching
Node.js - specific versions not provided in advisory. All Node.js deployments should be evaluated for patch applicability.
criticalbug_reportVulnerabilityFortinet releases critical security updates across multiple products
Multiple Fortinet products affected. Specific product names, versions, and CVE identifiers not disclosed in available advisory. CERT.BE has issued urgent patching guidance.
highbug_reportVulnerabilityCleanShot X deserialization flaw enables code execution via malicious files
MTW CleanShot X for macOS versions 4.0.0 through 4.5.2. Fixed in versions 4.5.2, 4.6.3, 4.7.8, and 4.8.10. Affects users who open .cleanshot project files from untrusted sources.
highbug_reportVulnerabilityINTERPOL disrupts 10,909 cybercrime networks, arrests 1,462 in 21 countries
Global cybercrime infrastructure across 21 African and international countries. Targeted networks include phishing operations, business email compromise (BEC), investment fraud schemes, illegal cryptocurrency mining, and botnet infrastructure.
highbug_reportVulnerabilityPHP2Shell flaws exploited 4 days before patches; 5.1M hosts exposed
PHP (all versions prior to October 21, 2026 patches). Affects up to 80% of websites including WordPress, Drupal, Joomla. VirusTotal tracks 5.1 million exposed PHP hosts, ~3.8 million with open ports.
criticalbug_reportVulnerabilityCritical PHP vulnerabilities enable remote code execution
PHP (specific versions not disclosed in advisory). All systems running vulnerable PHP installations are affected. CERT.BE issued critical-severity warning for multiple RCE vulnerabilities.