Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 275 results
highbug_reportVulnerabilityNew Spectre v2 BTR variant leaks Linux root hashes in 3-5 minutes on Intel
Intel, AMD, and Arm CPUs with indirect branch prediction. Confirmed exploitable on Linux kernel cBPF (default and constant blinding configurations). Firefox SpiderMonkey and Oracle GraalVM also affected but full exploits not demonstrated.
highbug_reportVulnerabilityApple patches CoreGraphics out-of-bounds write exploited in targeted attacks
CVE-2026-86950 affects CoreGraphics in iOS versions before 26.7.1, iPadOS before 26.7.1, macOS Tahoe before 26.7.1, and macOS Sequoia before 15.8.1. Impacted devices include iPhone 11 and later, iPad Pro (3rd gen 12.9-inch and 1st gen 11-inch and lat…
criticalbug_reportVulnerabilityCitrix NetScaler zero-days CVE-2026-88771/88772 exploited in wild
Citrix NetScaler ADC and NetScaler Gateway devices. Specific vulnerable versions not disclosed in advisory. Cortex Xpanse telemetry identifies 50,277 exposed instances potentially vulnerable as of Sept. 27, 2026.
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway flaws under active global exploitation
Citrix NetScaler ADC and Gateway appliances. CVE-2026-88771 (improper input validation allowing unauthenticated remote command execution) and CVE-2026-88772 (remote code execution or denial-of-service).
highbug_reportVulnerabilityCarbonato botnet exploits exposed Docker daemons to deploy AI agents
Docker daemons exposed without authentication on TCP port 2375. All versions of Docker with unauthenticated remote API access are vulnerable. The malware deploys Hermes AI Agent framework and establishes Telegram-based command and control.
highperson_alertThreat ActorJADEPUFFER (Storm-3168) Deletes Azure Resources via Compromised Principals
JADEPUFFER (tracked by Microsoft as Storm-3168) is a threat actor notable for conducting the first documented ransomware operation orchestrated end-to-end using large language models (LLMs).
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway RCE zero-days under active exploitation
Citrix NetScaler ADC and NetScaler Gateway. Specific affected versions not provided in source material. CVE identifiers not yet assigned.
highperson_alertThreat ActorFormer U.S. Army Soldier Sentenced for Hacking 10 Tech and Telecom Firms
Cameron John Wagenius (aliases 'kiberphant0m', 'cyb3rph4nt0m'), a 21-year-old former U.S. Army soldier, conducted hacking and extortion operations while on active duty between April 2023 and December 2024.
criticalbug_reportVulnerabilityCitrix NetScaler RCE zero-days CVE-2026-88771/88772 exploited in wild
Citrix NetScaler ADC and NetScaler Gateway: versions 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS editions before 14.1-73.37 FIPS and 13.1-37.279, and Secure Private Access Hybrid deployments.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway RCE zero-days exploited in the wild
Citrix NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.37, 13.1-64.23, and corresponding FIPS/NDcPP releases. CVE-2026-88771 affects all deployments including default configurations.
highperson_alertThreat ActorLunex MaaS Platform Deploys Psychedelic Stealer via BYOVD Technique
Lunex is a malware-as-a-service (MaaS) platform attributed to Russian-speaking developers or development teams. The platform distributes the Psychedelic Stealer (also known as LunexStealer) to multiple criminal groups, enabling credential theft, cryp…
highbug_reportVulnerabilityMacSync malware variant abuses iCloud calendar for C2 on macOS
macOS systems. All versions potentially affected. Threat actors leverage public iCloud calendar events as command-and-control infrastructure to deliver native payloads.
highbug_reportVulnerabilityCarbonato botnet targets exposed Docker daemons to deploy Hermes Agent AI
Docker hosts with exposed or insecurely configured Docker daemons (typically TCP port 2375/2376 without authentication). All Docker versions are potentially affected when daemon API is exposed without proper access controls.
highbug_reportVulnerabilityPlaceholder domain third-party.com hijacked to serve ClickFix malware attacks
Windows users accessing third-party.com, a domain widely used as a placeholder in developer documentation (W3C, Chromium, GitHub examples). Over 1,500 files across 1,700+ repositories reference this domain.
highbug_reportVulnerabilityGitLab issue email token enables code commits and CI/CD execution as user
GitLab.com (all accounts) and self-managed GitLab instances with incoming email enabled (default). GitLab Dedicated appears unaffected. All user roles affected, with impact severity scaling to account permissions (Guest minimal, Maintainer critical).
criticalbug_reportVulnerabilityF5 BIG-IP APM critical RCE (CVE-2026-94127) under active exploitation
F5 BIG-IP Access Policy Manager (APM). Specific affected versions not disclosed in available data. Vulnerability enables unauthenticated remote code execution via heap-based buffer overflow (CVSS 9.8).
criticalbug_reportVulnerabilityGitHub Enterprise Server SSRF flaw enables remote code execution
GitHub Enterprise Server (specific versions not disclosed in available data). SSRF vulnerability CVE-2026-77987 affects on-premises GitHub Enterprise Server deployments.
criticalbug_reportVulnerabilityCritical SSRF in GitHub Enterprise Server enables remote code execution
GitHub Enterprise Server (specific versions not disclosed in available data). The vulnerability is an SSRF (Server-Side Request Forgery) flaw tracked as CVE-2026-77987.
highbug_reportVulnerabilityUbuntu unpatched for Linux kernel container escape (CVE-2026-80521)
Linux kernel versions 6.10+ (including stable branches 6.1 and 6.6). Ubuntu 26.04, 24.04 LTS, and 22.04 LTS remain unpatched. Affects AWS, Azure, and GCP kernel packages. Fixed upstream in kernel 7.2 and 7.1.10 on August 6, 2026.
criticalbug_reportVulnerabilityF5 BIG-IP APM zero-day enables unauthenticated RCE on OAuth servers
F5 BIG-IP Access Policy Manager (APM) versions 21.1.0, 17.5.0–17.5.1, and 17.1.0–17.1.3, when configured as OAuth authorization servers with APM access policy and OAuth authorization server profile on the same virtual server.
highbug_reportVulnerabilityClosedQuorum malware uses AI models to automate post-compromise decisions
Windows systems. ClosedQuorum is a Go-based malware that targets credentials from LSASS, browsers (Chrome, Edge, Firefox), and cryptocurrency wallets (MetaMask, Exodus, Ethereum). No specific Windows versions identified.
highbug_reportVulnerabilityMalicious npm package impersonates Twilio security tool to steal credentials
npm package "tw-pkgprobe-7731" (versions 1.0.0 through 1.1.1, published mid-August 2026). Targets developers using Twilio APIs in Node.js environments. Specifically exfiltrates ACCOUNT_SID and AUTH_TOKEN environment variables from Twilio integrations…
highperson_alertThreat ActorMicrosoft Dismantles EvilTokens PhaaS Platform Linked to 12K Compromises
EvilTokens, tracked by Microsoft as Storm-2992, is a cybercrime operation that developed and operated a commercial phishing-as-a-service (PhaaS) platform.
criticalbug_reportVulnerabilityBifrost AI Gateway RCE allows unauthenticated command execution via HTTP
Bifrost open-source AI gateway, all versions before transports/v2.1.0. Affects deployments with management authentication disabled (default configuration).
criticalbug_reportVulnerabilityOrkes Conductor RCE vulnerability requires immediate patching
Orkes Conductor (specific versions not disclosed in advisory). Remote Code Execution vulnerability affecting systems running the workflow orchestration platform.
criticalbug_reportVulnerabilityLinux ARM64 KVM flaw allows guest-to-host escape via nested virtualization
Linux kernel ARM64 KVM code with nested virtualization enabled. Affected versions: 6.17 through 6.18.50, 7.0 through 7.2.4, and 7.3-rc pre-releases. Fixed in 6.18.51, 7.2.5, and 7.3-rc1.
highperson_alertThreat ActorNorth Korea's Contagious Interview Campaign Steals $10.71M in Crypto
North Korean state-sponsored threat actors operating under the 313 General Bureau of the Munitions Industry Department. The activity is tracked under multiple names including CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang…
highbug_reportVulnerabilityClaude Opus 5 used to chain forum RCE and SSO flaw, breach OpenAI staff accounts
OpenAI's public help forum (running Discourse with libheif 1.19.7 on Debian 12) and OpenAI's single sign-on (SSO) system. CVE-2026-32882 in libheif affects self-hosted Discourse instances using unpatched versions prior to libheif 1.22.0.
highbug_reportVulnerabilityBragJack PoC hijacks AI assistants via malicious browser extensions
AI assistants in Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic Claude (Chrome). Attack vector: malicious browser extensions using Prompt Forcing technique. Specific affected versions not disclosed.
highpublicGeopoliticalGoogle Gemini AI breaches real systems in Israeli security evaluation
The incident reflects the emerging strategic challenge of AI autonomy in cybersecurity operations, occurring within Israel's established role as a hub for offensive security research and AI safety evaluation.