Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1120 results
highbug_reportVulnerabilityMultiple high-severity vulnerabilities in Apache Camel require patching
Apache Camel - specific versions not provided in advisory. All deployments using affected versions should be considered at risk until patched.
criticalbug_reportVulnerabilityeMudhra CA private keys compromised; fraudulent certs possible
Eight eMudhra intermediate CA certificates (6 TLS, 2 code-signing) under emSign brand. Affects browsers (Chrome, Firefox, Safari), Go 1.26.x/1.27.x, Python certifi, Rust webpki-roots, NSS, and any software using eMudhra-issued certificates.
criticalbug_reportVulnerabilityFortinet FortiSIEM CVE-2026-106173: PoC exploit for unauthenticated RCE
Fortinet FortiSIEM version 7.5.0. FortiSIEM 7.6 is not affected. The vulnerability targets the gRPC service on TCP port 27918.
highbug_reportVulnerabilityGo 1.27.3 and 1.26.10 block eight eMudhra CA keys over undisclosed risk
Go versions 1.27.3 and 1.26.10 (released October 20, 2026). All Go programs must be rebuilt with these versions to enforce the block. Eight intermediate CA keys from eMudhra (six TLS, two code-signing) under emSign Root TLS CA - G3 and emSign Root CS…
highbug_reportVulnerabilityOVHcloud CLI tool backdoored on GitHub to steal developer credentials
OVHcloud CLI versions 0.11.0 through 0.15.0 on macOS (Intel/ARM), Linux (x86_64/ARM64), and Windows x86-64. Compromised releases available October 19, 2026 from 14:47 to 16:21 UTC. Version 0.10.0 and earlier, plus 0.16.0 are clean.
criticalbug_reportVulnerabilityRank Math PRO WordPress plugin compromised in supply-chain attack
Rank Math PRO version 3.0.123 downloaded from the official vendor website between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC (11-hour window). Free version of Rank Math SEO unaffected.
highbug_reportVulnerabilityAOMEI update servers compromised to distribute malware via Backupper
AOMEI Backupper (Windows backup software) users who checked for updates during three brief windows between April and July 2026: May 28 (10 min), July 16 (6 min), July 20 (5 min).
highbug_reportVulnerabilityPlex2Shell chain exploited in wild to deploy crypto miners and backdoors
Plex Media Server versions prior to 1.43.3.10861. The Plex2Shell chain combines four CVEs (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) to achieve unauthenticated remote code execution.
criticalbug_reportVulnerabilityRank Math PRO WordPress plugin compromised with self-restoring backdoor
Rank Math PRO (paid WordPress SEO plugin) version 3.0.123 downloaded or auto-updated from rankmath.com between 20:02 UTC October 15 and 07:12 UTC October 16, 2026. Free version on WordPress.org (4M+ installs) not affected.
criticalbug_reportVulnerabilityF5 patches critical NGINX RCE flaws in HTTP/3 module and map directive
NGINX Open Source, NGINX Plus, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. Three critical CVEs: CVE-2026-15176 and CVE-2026-97205 (ngx_http_v3_module), CVE-2026-93479 (map directive).
criticalbug_reportVulnerabilityBeyondTrust Remote Support critical flaw requires immediate patching
BeyondTrust Remote Support software. Specific affected versions not disclosed in available advisory. Remote support/privileged access management deployments at risk.
criticalbug_reportVulnerabilityNGINX heap buffer overflow enables RCE; patch immediately
NGINX Plus and NGINX Open Source (specific vulnerable versions not disclosed in available data). Heap-based buffer overflow vulnerabilities affect both commercial and open source editions.
criticalbug_reportVulnerabilityAdobe Commerce/Magento template injection enables remote code execution
Adobe Commerce and Magento Open Source (specific versions not disclosed in available data). Template injection vulnerability affecting web-facing e-commerce platforms.
highbug_reportVulnerabilityGhostAction supply chain attack expands to 94 repos with credential stealer
94 GitHub repositories across 66 owners compromised. Targets open-source developers using GitHub Actions, VS Code, and OAuth device flows. Malware disguised as font file (fa-solid-400.woff2) steals AWS keys, PyPI/npm tokens, Git credentials, Kubernet…
highbug_reportVulnerabilityFake Web3 accelerator spreads malware via npm to steal credentials
npm packages @apexacc/cli and @apexacc/audit (now removed); targets Windows and macOS developer systems. Campaign linked to Apex Accelerator/Apex Foundation (apexaccs[.]org, apexfdn[.]xyz).
highbug_reportVulnerabilityOctober Windows Server updates break Exchange OWA sign-in and mail flow
On-premises Exchange Server systems running on Windows Server 2019 and later, after installing October 2026 Windows Server security updates. All Exchange versions on affected Windows Server versions are potentially impacted.
criticalbug_reportVulnerabilityUnpatched Broadcom Wi-Fi WPS flaw enables remote code execution as root
Broadcom Wi-Fi Protected Setup (WPS) implementation in routers and access points. Vulnerable chip families: older eCos-based models (BCM3380, BCM3383, BCM33834) - unpatchable "forever day"; newer Linux-based models (BCM3390, BCM65xx, BCM68xx) - patch…
highbug_reportVulnerabilitySiteGuard WAF flaw CVE-2026-106931 exploited for root/SYSTEM RCE
SiteGuard Server Edition for Apache httpd, Nginx, and IIS (excluding FreeBSD) versions 2.20 through 8.00 Update 4; FreeBSD editions 2.20 through 7.00 Update 5. Vulnerability requires statistics function to be enabled (default).
criticalbug_reportVulnerabilityConnectWise shuts down Cloud Backup after M365 tenant compromise
ConnectWise Cloud Backup service (formerly SkyKick Cloud Backup) and connected Microsoft 365 tenants. All customers using the service for backup operations are affected.
criticalbug_reportVulnerabilityDrupal patches two critical RCE flaws in all supported versions
All supported versions of Drupal CMS. Specific version numbers and CVE identifiers not provided in available data. Both vulnerabilities enable remote code execution.
highbug_reportVulnerabilityMalicious npm package 'imgdecode' delivers shellcode loader on Windows
npm package 'imgdecode' versions 1.0.0 through 1.0.3, published by user 'malfexteste8'. Part of broader MALFEX campaign targeting Windows systems via npm supply chain. Downloaded 979 times. Package was still available on npm as of October 17, 2026.
criticalbug_reportVulnerabilityCritical RCE in Adobe Commerce/Magento allows arbitrary PHP execution
Adobe Commerce and Magento installations. Specific affected versions not disclosed in available information. Vulnerability resides in BlockStrap component.
highbug_reportVulnerabilityOpenBSD 7.9 root exploit chains 37-year-old integer overflow with UAF
OpenBSD 7.9 and 7.8 (all architectures). Vulnerability in shmat(4) shared-memory attach function (integer overflow) and separate kernel reference-counting use-after-free. Both flaws patched via errata 018 (Sept 14) and 026 (Sept 30).
highbug_reportVulnerabilityCandiru spyware deployed via zero-click malicious ads at Al Jazeera
Al Jazeera Media Network devices (Windows confirmed, likely mobile); 45+ devices compromised 2024-2025. Broader campaign placed 3.77 billion ad bids across 75,373 Android/iOS apps and 120,768 websites (March-June 2026).
criticalbug_reportVulnerabilityMultiple critical vulnerabilities in Juniper Junos OS require urgent patching
Juniper Networks Junos OS - specific affected versions not disclosed in available advisory. All organizations running Junos OS on network devices should assume potential exposure until vendor guidance is reviewed.
criticalbug_reportVulnerabilityAOMEI Backupper update servers compromised to deliver backdoor via tampering
AOMEI Backupper (Windows backup software), at least version 8.3.0 confirmed affected. All installations that checked for updates during three confirmed tampering windows between May 28 and July 20, 2026 (total ~21 minutes across three incidents).
criticalbug_reportVulnerabilityBeyondTrust Remote Support zero-day exploited by China APT Armory Castle
BeyondTrust Remote Support (formerly Bomgar) versions 24.3.1 through 26.2.3. Self-hosted deployments exposed to the internet are at highest risk. SaaS customers were patched automatically as of October 9, 2026.
criticalbug_reportVulnerabilityBeyondTrust Remote Support zero-day exploited by China-nexus APT since August
BeyondTrust Remote Support (RS) version 26.2.3 and earlier; Privileged Remote Access (PRA) shares affected code. SaaS customers patched October 8, 2026; self-hosted installations require manual patching if auto-update disabled.
criticalbug_reportVulnerabilityPalo Alto PAN-OS RCE under active exploitation, patch immediately
Palo Alto Networks PAN-OS. Specific affected versions not disclosed in available information. Remote code execution vulnerability actively exploited in the wild.
criticalbug_reportVulnerabilityCisco Secure Email Gateway under active exploit for file write/RCE
Cisco Secure Email Gateway (formerly IronPort). Specific vulnerable versions not disclosed in available data. Affects on-premises appliances.