Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 99 results
criticalbug_reportVulnerabilityCheck Point VPN unauthenticated RCE requires immediate patching
Check Point VPN products (specific versions not disclosed in available data). Vulnerability allows unauthenticated remote code execution. No CVE assigned yet.
highbug_reportVulnerabilityCompromised IP cameras exploited for espionage and DDoS attacks
IP cameras across multiple vendors and models. Organizations with internet-exposed camera infrastructure are at risk. Specific affected vendors and firmware versions not disclosed in CERT.BE advisory.
highpublicGeopoliticalFlorida State Driver Database Breached via Stolen Police Credentials
The breach of Florida's DAVID driver database represents a compromise of critical state-level identity infrastructure in the United States. Driver databases contain personally identifiable information (PII) for millions of residents and serve as foun…
highperson_alertThreat ActorShinyHunters Claims Breach of Florida DMV DAVID Database
ShinyHunters is a financially motivated cybercrime extortion gang known for conducting data breaches targeting organizations with large databases of personally identifiable information (PII).
highpublicGeopoliticalThomson Reuters C-Track Breach Exposes U.S. and Canadian Court Records
The March 2026 breach of Thomson Reuters' C-Track court case management platform represents a significant compromise of judicial infrastructure across North America. The incident exposed sensitive court records from 11 U.S. states, the U.S.
highbug_reportVulnerabilityAttackers abuse legitimate Node.js runtime to deploy malware via ClickFix
Organizations using Node.js in their environments, particularly government departments, technology companies, hotels, fintech, e-commerce, professional services, and retail logistics.
highperson_alertThreat ActorGambling Goblin Hijacks Brazilian Gov Sites via Malicious Apache Modules
Gambling Goblin is a Chinese-speaking cybercrime cluster tracked by Check Point Research since mid-2025. The group specializes in SEO manipulation at scale by compromising high-reputation domains, particularly Brazilian government (.gov.br) and educa…
criticalbug_reportVulnerabilityGeoNetwork RCE chain exploitable without authentication on gov geoportals
GeoNetwork open-source geospatial metadata catalog: all 4.4.x versions up to 4.4.11 and all 4.2.x versions up to 4.2.16. Widely deployed in government, military, and national agency Spatial Data Infrastructure backends across 39 countries, including…
highpublicGeopoliticalBerlin refuses ransom demand after Rhysida-linked breach of state network
The August 2026 compromise of Berlin's state administrative network represents a significant escalation in ransomware targeting of European critical infrastructure and government services.
criticalbug_reportVulnerabilityownCloud CVE-2023-49105 exploited to steal nuclear records from Philippines
ownCloud core versions 10.6.0 through 10.13.0. The vulnerability is a WebDAV API authentication bypass allowing unauthenticated file access when usernames are known and no signing-key is configured (default state). Fixed in version 10.13.1.
criticalbug_reportVulnerabilityCISA orders federal agencies to patch exploited Citrix NetScaler RCE by Aug 29
Citrix NetScaler ADC and NetScaler Gateway appliances with Gateway VPN or AAA virtual server configurations. CVE-2026-8452 (high severity). Over 22,000 NetScaler ADC and 1,800 Gateway instances exposed online globally.
highbug_reportVulnerabilityDDoS campaign disrupts Norway's shared government digital infrastructure
Norway's Digitaliseringsdirektoratet (Digdir) shared government infrastructure, including ID-porten (public login), eSignering (electronic signatures), secure digital mail, government forms, and data exchange services.
highperson_alertThreat ActorOperation QUICSILVER: China-nexus campaign targets Myanmar with QUICAgent
Operation QUICSILVER is attributed with moderate confidence to a China-nexus threat actor conducting cyber espionage operations against Myanmar. The actor demonstrates sophisticated tradecraft, leveraging social engineering lures themed around govern…
criticalbug_reportVulnerabilityCISA orders 3-day patch for exploited Zimbra RCE (CVE-2026-73570)
Zimbra Collaboration Suite (ZCS) versions prior to 10.1.20. Exploitation requires SNMP notifications to be enabled. Over 12,000 Zimbra servers exposed online; 270+ confirmed compromised instances detected by Shadowserver.
criticalbug_reportVulnerabilityCISA orders patching of two actively exploited TrueConf Server flaws
TrueConf Server, a self-hosted corporate messaging and video conferencing platform. CVE-2026-72529 (critical missing authentication allowing remote script execution via TCP port 4307) and CVE-2026-72530 (critical sandbox escape enabling arbitrary OS…
criticalbug_reportVulnerabilityCISA: Critical MLflow SSRF flaw (CVE-2026-64849) exploited in the wild
MLflow open-source AI engineering platform, all versions prior to 3.15.0. Default MLflow Tracking Server deployments without authentication are vulnerable.
highperson_alertThreat ActorSilkParasite Targets Central Asian Governments with Five New RATs
SilkParasite is a previously unreported cyber espionage operation first discovered in late 2025, assessed with medium confidence to be a China-nexus threat cluster.
criticalbug_reportVulnerabilityWindows IKE Extension RCE (CVE-2026-33824) actively exploited
All supported Windows 10, Windows 11, and Windows Server versions. The vulnerability affects the Windows Internet Key Exchange (IKE) Service Extensions (MS-IKEE) component accessible via UDP ports 500 and 4500.
highperson_alertThreat ActorIranian Cavern C2 Framework Evolves with DNS and Google Apps Script Relay
Cavern (aka Cav3rn) is a command-and-control framework attributed to Iranian nation-state threat actors, specifically linked to Cavern Manticore, a hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS).
highpublicGeopoliticalFrench tax authority breach exposes 678,000 records amid rising attacks
The breach of France's General Directorate of Public Finances (DGFiP) represents the latest in a sustained pattern of cyberattacks targeting French government infrastructure throughout 2026.
highpublicGeopoliticalSwiss government SharePoint breach exposes 200 accounts via July flaws
The breach of Switzerland's Federal Office for Information Technology and Telecommunication (BIT) represents a significant compromise of neutral state infrastructure.
highbug_reportVulnerabilityCISA orders 3-day patch for exploited IBM Langflow, N-central, Tomcat flaws
IBM Langflow (CVE-2026-9198, CVSS 9.8) - default deployments vulnerable to unauthenticated RCE via API endpoint chaining. N-able N-central (CVE-2026-18576) - all versions before 2026.3 allow unauthenticated admin account hijacking; incomplete patch b…
highpublicGeopoliticalU.K. Police Legal Database Breach Exposes Officer Contact Data on Dark Web
The breach of the Police National Legal Database represents a targeted exposure of U.K. law enforcement and criminal justice infrastructure, albeit limited to contact metadata rather than operational intelligence.
highperson_alertThreat ActorChinese-Speaking Actor Deploys OctLurk & SilkLurk in Central Asia
A Chinese-speaking threat actor, not yet attributed to any known APT group, has been conducting targeted cyber espionage operations against government and strategic organizations in Central Asia and Syria since January 2025.
highbug_reportVulnerabilityRussian APT exploits OWA XSS flaw for persistent mailbox access
Microsoft Outlook Web Access (OWA) vulnerable to CVE-2026-42897 (CVSS 8.1), a cross-site scripting flaw. Targets include U.S. and European government entities, telecommunications, financial, hospitality, and aerospace sectors.
highperson_alertThreat ActorEast Asia-Linked Actor Deploys TELESHIM, MIXEDKEY, BINDCLOAK Against ME Gov
An unattributed threat actor assessed with moderate-to-high confidence to originate from East Asia, based on operational hours (4 a.m.–12 p.m. UTC, peaking 7–11 a.m.
highperson_alertThreat ActorHermes AI Agent Used for Post-Exploitation at Thai Finance Ministry
The threat actor behind this intrusion remains unattributed. Hunt.io assesses with low-to-medium confidence that the operator is Chinese-speaking or fluent in Chinese, based on linguistic artifacts (password containing "Leishen," meaning thunder god)…
highperson_alertThreat ActorJadeProx Deploys TriBack Loader Against Asian, Latin American Targets
JadeProx is a China-nexus threat actor tracked by Group-IB, discovered through an exposed Alibaba Cloud server in Singapore in mid-April 2026. The actor targets government, healthcare, and education organizations across Asia and Latin America.
highpublicGeopoliticalSouth Korea discloses 10-month breach of diplomatic training platform
The compromise of South Korea's National Diplomatic Academy represents a significant intelligence collection operation targeting a key U.S. ally in Northeast Asia.
highbug_reportVulnerabilityAI-assisted phishing toolkit targets Windows users in Mexico via fake gov site
Windows users in Mexico targeted via fake government ID-lookup website. Delivery mechanism uses WebDAV to distribute infostealer malware. Toolkit contains 1,048 files including phishing templates, droppers, and builder documentation.