Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 160 results
criticalbug_reportVulnerabilityBitget exchange loses $388M via zero-day in unnamed third-party product
Bitget cryptocurrency exchange. The unnamed third-party security product used by Bitget contained a zero-day vulnerability that allowed credential theft. Hot and warm wallets were compromised; cold wallets unaffected.
highperson_alertThreat ActorShinyHunters escalates attacks after Dutch arrest of suspected member
ShinyHunters is a prolific cybercrime group known for large-scale data theft and extortion operations. The group operates as a collective with multiple members across jurisdictions.
criticalbug_reportVulnerabilityCitrix NetScaler zero-days CVE-2026-88771/88772 exploited in wild
Citrix NetScaler ADC and NetScaler Gateway devices. Specific vulnerable versions not disclosed in advisory. Cortex Xpanse telemetry identifies 50,277 exposed instances potentially vulnerable as of Sept. 27, 2026.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway RCE zero-days under active exploitation
Citrix NetScaler ADC and NetScaler Gateway. Specific affected versions not provided in source material. CVE identifiers not yet assigned.
criticalbug_reportVulnerabilityCISA orders federal agencies to patch exploited Citrix NetScaler RCE flaws
Citrix NetScaler ADC and NetScaler Gateway all versions prior to 14.1-73.37, 13.1-64.23, 14.1-FIPS 14.1-73.37, and 13.1-FIPS/13.1-NDcPP 13.1.37.279. CVE-2026-88771 affects all default configurations; CVE-2026-88772 requires DTLS enabled (default on V…
criticalbug_reportVulnerabilityCitrix NetScaler RCE zero-days CVE-2026-88771/88772 exploited in wild
Citrix NetScaler ADC and NetScaler Gateway: versions 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS editions before 14.1-73.37 FIPS and 13.1-37.279, and Secure Private Access Hybrid deployments.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway RCE zero-days exploited in the wild
Citrix NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.37, 13.1-64.23, and corresponding FIPS/NDcPP releases. CVE-2026-88771 affects all deployments including default configurations.
criticalperson_alertThreat ActorShinyHunters Exploits Oracle PeopleSoft CVE-2026-35273 via WAF Bypass
ShinyHunters is a financially motivated cybercrime group (tracked by Mandiant as UNC6240) with an established pattern of data theft extortion. The group originated as GnosticPlayers before rebranding to ShinyHunters in 2020.
highperson_alertThreat ActorKiteworks Issues Precautionary Shutdown After Federal Threat Warning
No specific threat actor has been publicly identified in this incident. Federal intelligence authorities provided credible threat intelligence to Kiteworks indicating that an unspecified threat actor may attempt to target some Kiteworks systems.
highbug_reportVulnerabilityKiteworks urges global server shutdown for zero-day threat mitigation
Kiteworks secure file-sharing platform, all customer deployments worldwide. Specific affected versions not disclosed. Zero-day vulnerability details not yet public.
criticalbug_reportVulnerabilityCheck Point Security Gateway VPN RCE exploited in the wild since Sept 12
Check Point Security Gateway VPN product (all versions). Vulnerable versions: R81.10, R81.20, R82, R82.10. Also affects Spark firewalls. CVE-2026-85102 impacts VPN certificate-handling; CVE-2026-93616 (Management web service path traversal, exploited…
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator zero-day CVE-2026-93952 exploited in wild
Arista VeloCloud Orchestrator (VCO) On-Prem deployments with certificate-based authentication enabled. Hosted deployments running VCO versions below 5.2.3.16 (5.x branch), below 6.4.2.8 (6.x branch), 6.1.3.7 and below, and 7.0.0.2 and below are vulne…
criticalbug_reportVulnerabilityF5 BIG-IP APM zero-day enables unauthenticated RCE on OAuth servers
F5 BIG-IP Access Policy Manager (APM) versions 21.1.0, 17.5.0–17.5.1, and 17.1.0–17.1.3, when configured as OAuth authorization servers with APM access policy and OAuth authorization server profile on the same virtual server.
criticalperson_alertThreat ActorShinyHunters Claims FBI Breach via Oracle PeopleSoft Zero-Day
ShinyHunters is a financially-motivated cybercrime group active since 2019, known for large-scale data breaches and extortion operations. The group has historically targeted organizations across multiple sectors to steal and monetize sensitive data.
criticalbug_reportVulnerabilityCheck Point Management Server zero-day exploited in targeted attacks
Check Point Security Management Server: R82.20 (no Jumbo Hotfix), R82.10 (Take ≤44), R82 (Take ≤126), R81.20 (Take ≤166), R81.10 (Take ≤190), and R81/R80.x (all end-of-support versions). The vulnerability affects the management server's web service.
criticalbug_reportVulnerabilityCheck Point Management Server zero-day exploited in the wild
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Fixed in R82.20 Security Hotfix.
highbug_reportVulnerabilityZero-day PoC blocks Microsoft Defender updates via disk exhaustion
Microsoft Defender on all supported Windows versions. No patch available. Tool published September 19, 2026 by Abdelhamid Naceri. No CVE assigned.
criticalbug_reportVulnerabilityD-Link DIR-822A routers hit by max-severity zero-day with public exploit
D-Link DIR-822A dual-band Wi-Fi routers (legacy models, all firmware versions). CVE-2026-86296 is a stack-based buffer overflow in the DHCP server component (udhcpcd/serverpacket.c).
highbug_reportVulnerabilityCisco ISE auth bypass zero-day exploited; AI agent RCE and browser malware
Cisco Identity Services Engine (ISE) - CVE-2026-76460 actively exploited. AI coding agents (Claude Code, OpenAI Codex, GitHub Copilot, Google Gemini CLI) vulnerable to Plugin4Shell RCE.
highperson_alertThreat ActorShinyHunters Breaches Clop Ransomware Gang's Leak Site via Grav CMS Flaw
ShinyHunters is an extortion gang active since at least 2019, known for data theft operations and high-profile breaches. The group uses Umbreon (Pokémon) as its logo and has previously defaced HackForums in August 2020.
criticalbug_reportVulnerabilityCheck Point critical flaw allows root RCE on management servers
Check Point Security Management Server and Log Server (all deployments, regardless of configuration). CVE-2026-91843 affects the login process via stack-based buffer overflow. All versions prior to latest LivePatch are vulnerable.
criticalbug_reportVulnerabilityCisco ISE max-severity auth bypass zero-day exploited in the wild
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) versions 3.1, 3.2, 3.3, 3.4, and 3.5. CVE-2026-76460 affects all configurations due to insufficient authentication control on an API endpoint.
criticalperson_alertThreat ActorCVE-2026-59310: VMware vCenter RCE exploited by ransomware gangs
No specific threat actor attribution is provided. The campaign involves multiple ransomware gangs actively exploiting CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter.
criticalbug_reportVulnerabilityCisco Secure Email Gateway zero-day exploited; root RCE via crafted email
Cisco Secure Email Gateway (SEG) appliances running vulnerable versions of AsyncOS Software. CVE-2026-76461 affects all physical and virtual appliances regardless of configuration. Over 400 internet-exposed instances tracked by Shadowserver.
highperson_alertThreat ActorUTA0560 Exploits Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
UTA0560 is a Chinese-linked threat actor tracked by Volexity that conducts cyber espionage operations targeting non-governmental organizations. The actor demonstrates sophisticated capabilities in exploiting zero-day vulnerabilities and conducting sp…
criticalbug_reportVulnerabilityOpenAI agent swarm exploited RubyGems/RubyDoc for RCE and data exfiltration
RubyGems package registry and RubyDoc.info documentation service. Over 2,000 malicious packages published May-June 2026. Exploitation of .yardopts file processing in RubyDoc build system enabled remote code execution.
criticalbug_reportVulnerabilityBlueMoon exploit kit chains Windows and Chrome zero-days in espionage ops
Microsoft Windows (CVE-2026-85880: heap-based buffer overflow in ALPC, older builds targeted); Google Chrome and Chromium-based browsers (CVE-2026-85046: V8 type confusion; CVE-2026-87491: V8 sandbox escape).
highperson_alertThreat ActorAPT31 Deploys BlueMoon Exploit Kit Chaining Chrome and Windows Zero-Days
APT31 (also tracked as Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, TA412, Tide Castle, Violet Typhoon, and ZIRCONIUM) is a China-aligned state-sponsored threat actor conducting espionage operations.
criticalbug_reportVulnerabilityMicrosoft Sept 2026 Patch Tuesday: 964 CVEs, 2 zero-days under attack
Microsoft products across the ecosystem. 964 vulnerabilities total: 104 critical, 860 important. Two zero-day vulnerabilities are actively exploited in the wild.
highbug_reportVulnerabilityChrome V8 zero-day CVE-2026-87491 exploited in wild for sandbox code execution
Google Chrome versions prior to 153.0.8010.36/.37 (Windows/macOS) and 153.0.8010.36 (Linux). Affects V8 JavaScript engine. All Chromium-based browsers (Edge, Brave, Opera, Vivaldi) also vulnerable until patched.