Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 669 results
criticalbug_reportVulnerabilityHPE ClearPass Policy Manager RCE and admin access flaws require patching
HPE Networking ClearPass Policy Manager - specific affected versions not disclosed in available information. Product is a network access control (NAC) solution used for policy management and authentication.
highperson_alertThreat ActorU.S. offers $10M reward for HAFNIUM actor Zhang Yu in Exchange attacks
HAFNIUM (also tracked as Silk Typhoon, Operation Exchange Marauder) is a Chinese state-sponsored APT group attributed by Microsoft and the U.S. government to China's Ministry of State Security (MSS).
highperson_alertThreat ActorZohar Pinhasi Charged with $19M Ransomware Victim Fraud Scheme
Zohar Pinhasi (also known as Zack Silver and Zack Green) is a 50-year-old U.S. and Israeli national who owned and operated MonsterCloud, a Florida-based company purporting to offer ransomware recovery services. Pinhasi is charged by the U.S.
highperson_alertThreat ActorFortiBleed Campaign Exploits Leaked Credentials to Compromise FortiGate VPNs
FortiBleed refers to a large-scale credential-harvesting and access-brokering campaign discovered in June 2026, when attackers inadvertently exposed a server containing usernames and plaintext passwords for 73,932 Fortinet FortiGate firewall URLs acr…
highbug_reportVulnerabilityHackers hijack Google domains via compromised ccTLD registries for Ghana, AS, SL
Domains under .GH (Ghana), .AS (American Samoa), and .SL (Sierra Leone) ccTLDs. Google domains and multiple global brands affected. Third-party registry operators for these ccTLDs were compromised.
highbug_reportVulnerabilityAttackers hijack .gh, .sl, .as registries to issue fraudulent Google certs
All domains under .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTLDs. Confirmed fraudulent certificates issued for Google and YouTube domains between September 22-27, 2026.
criticalbug_reportVulnerabilityHPE AOS-Switch auth bypass and buffer overflow require immediate patching
HPE Networking AOS-Switch (AOS-S) products. Specific affected versions not provided in source material. Vulnerabilities enable authentication bypass and buffer overflow leading to unauthorized access and arbitrary code execution.
criticalbug_reportVulnerabilitySonicWall SMA1000 pre-auth SSRF and post-auth RCE require urgent patching
SonicWall SMA1000 series appliances. Specific affected versions not provided in source material. Two vulnerabilities: pre-authentication SSRF and post-authentication RCE.
highperson_alertThreat ActorShinyHunters Leader Detained in Jordan, Cooperating with FBI
ShinyHunters is a prolific data theft and extortion group attributed to multiple high-profile breaches. The suspected leader, a teenager from Amman, Jordan operating under the handle "Rey" (identified as Saif Al-din Khader), was detained by Jordanian…
highbug_reportVulnerabilityFBI warns FortiBleed campaign actively harvesting Fortinet credentials
Internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. All versions using legacy SHA-256 password storage are vulnerable. Over 86,644 device credentials compromised across 194 countries as of June 2026.
criticalbug_reportVulnerabilityCritical file access flaw in Atlassian Data Center products requires patching
CVE-2026-21589 affects all versions of Atlassian Data Center products prior to fixed releases: Bitbucket (fix: 9.4.26, 10.2.8, 10.5.1), Confluence (9.2.26, 10.2.19), Jira Service Management and Software (5.12.40/9.12.40, 10.3.26, 11.3.12), Bamboo (10…
criticalbug_reportVulnerabilityCritical unauthenticated path traversal in Atlassian products
Multiple Atlassian products: Bitbucket, Jira, Confluence, Bamboo, Crowd Data Centre, Crucible, and Fisheye. Specific vulnerable versions not provided in advisory. CVE identifier not yet assigned.
criticalbug_reportVulnerabilityCitrix Netscaler ADC/Gateway HTTP smuggling flaws require immediate patch
Citrix Netscaler ADC, Netscaler Gateway, and Netscaler FIPS appliances. Specific affected versions not provided in advisory; consult Citrix security bulletin for version details.
highbug_reportVulnerabilityLinux backdoors mimic email security tools to target telecom in Korea, Taiwan
Telecom and network appliances in South Korea and Taiwan. Specific targets: systems running SpamSniper (Korean email security), ShareTech appliances, and Oracle-backed telecom platforms.
highpublicGeopoliticalASOS confirms breach via compromised push notification system
The incident represents a continuation of opportunistic cybercriminal activity targeting cloud infrastructure providers, particularly Snowflake environments, which have been subject to a sustained campaign since mid-2024.
highpublicGeopoliticalASOS investigates breach exposing UK customer data
The incident affecting ASOS, a major UK-based online fashion retailer, represents a routine cybersecurity breach impacting consumer data rather than a geopolitically significant event.
highperson_alertThreat ActorIran-Nexus Actor Targets Iraqi Infrastructure via Blinder Tunnel
CL-STA-1178 is an Iranian state-aligned threat actor tracked by Unit 42, previously associated with campaigns identified by Elastic Security Labs as "The Shelby Strategy." The actor demonstrates sophisticated operational capabilities, frequently empl…
highpublicGeopoliticalNikkei discloses dual email account breaches, phishing campaign
The breach of Nikkei, one of the world's largest financial media corporations with global reach and over 1,500 journalists worldwide, represents a significant compromise of a strategic information node.
highperson_alertThreat ActorInsider Sentenced for Ransomware-Style Extortion Against NJ Employer
Daniel Rhyne, a 57-year-old former core infrastructure engineer from Kansas City, Missouri, executed an insider threat attack against his New Jersey-based industrial employer in November-December 2023.
highperson_alertThreat ActorShinyHunters Breaches FBI via Oracle PeopleSoft Patch Failure
ShinyHunters is a cybercrime group known for data theft and breach operations. In this incident, the group exploited a vulnerability in Oracle PeopleSoft to compromise the FBI's job portal, stealing personal details of thousands of bureau employees.
criticalpublicGeopoliticalDenmark CPR breach exposes 8.8M records via compromised company credentials
The breach of Denmark's Central Person Register (CPR) represents a significant compromise of national identity infrastructure in a NATO member state and key Nordic country.
highpublicGeopoliticalItaly fines IQVIA $7.8M for health data anonymization failures
This enforcement action reflects the European Union's continued assertiveness in wielding GDPR as a regulatory instrument to discipline multinational corporations handling sensitive personal data.
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway DoS flaw requires immediate patching
Citrix NetScaler ADC and NetScaler Gateway (specific versions not disclosed in available data). Remote attackers can trigger denial of service conditions.
criticalpublicGeopoliticalDenmark's national population registry breached, 8.8M records exposed
The breach of Denmark's Central Population Register represents a compromise of critical national infrastructure affecting approximately 80% of all registered individuals in the country's civil registry system.
highpublicGeopoliticalSouth Korea investigates AI-assisted breaches at major banks
The coordinated cyberattacks against South Korea's financial sector—affecting Shinhan Bank, KB Kookmin Bank, and Hana Bank—represent a significant escalation in targeting critical financial infrastructure in Northeast Asia.
highpublicGeopoliticalU.S. arrests alleged Ploutus malware developer linked to Venezuelan gang
The arrest of Anibal Alexander Canelon Aguirre represents a convergence of cybercrime and transnational organized crime with state fragility dynamics. The case illustrates how criminal networks emerging from Venezuela's prolonged political and econom…
highbug_reportVulnerabilityMISP TOTP flaw allows duplicate 2FA codes within validity window
MISP (Malware Information Sharing Platform) - specific vulnerable versions not disclosed in advisory. Affects instances using TOTP-based two-factor authentication.
highbug_reportVulnerabilityApache HTTP Server vulnerabilities require immediate patching
Apache HTTP Server - specific versions not provided in advisory. All organizations running Apache HTTP Server should verify their version against latest security bulletins.
highperson_alertThreat ActorShinyHunters Member "Rey" Detained in Jordan, Cooperating with FBI
ShinyHunters is a prolific cybercriminal group specializing in data theft, extortion, and breach operations. Originating around April-May 2020, the group evolved from earlier extortion-focused collectives TheDarkOverlord and GnosticPlayers.
highperson_alertThreat ActorTA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
TA419 is a China-aligned, espionage-motivated threat actor attributed by Proofpoint. Active since at least April 2025, the group conducts credential phishing campaigns targeting individuals at U.S.