Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1104 results
criticalbug_reportVulnerabilityUnpatched Broadcom Wi-Fi WPS flaw enables remote code execution as root
Broadcom Wi-Fi Protected Setup (WPS) implementation in routers and access points. Vulnerable chip families: older eCos-based models (BCM3380, BCM3383, BCM33834) - unpatchable "forever day"; newer Linux-based models (BCM3390, BCM65xx, BCM68xx) - patch…
highbug_reportVulnerabilitySiteGuard WAF flaw CVE-2026-106931 exploited for root/SYSTEM RCE
SiteGuard Server Edition for Apache httpd, Nginx, and IIS (excluding FreeBSD) versions 2.20 through 8.00 Update 4; FreeBSD editions 2.20 through 7.00 Update 5. Vulnerability requires statistics function to be enabled (default).
criticalbug_reportVulnerabilityConnectWise shuts down Cloud Backup after M365 tenant compromise
ConnectWise Cloud Backup service (formerly SkyKick Cloud Backup) and connected Microsoft 365 tenants. All customers using the service for backup operations are affected.
criticalbug_reportVulnerabilityDrupal patches two critical RCE flaws in all supported versions
All supported versions of Drupal CMS. Specific version numbers and CVE identifiers not provided in available data. Both vulnerabilities enable remote code execution.
highbug_reportVulnerabilityMalicious npm package 'imgdecode' delivers shellcode loader on Windows
npm package 'imgdecode' versions 1.0.0 through 1.0.3, published by user 'malfexteste8'. Part of broader MALFEX campaign targeting Windows systems via npm supply chain. Downloaded 979 times. Package was still available on npm as of October 17, 2026.
criticalbug_reportVulnerabilityCritical RCE in Adobe Commerce/Magento allows arbitrary PHP execution
Adobe Commerce and Magento installations. Specific affected versions not disclosed in available information. Vulnerability resides in BlockStrap component.
highbug_reportVulnerabilityOpenBSD 7.9 root exploit chains 37-year-old integer overflow with UAF
OpenBSD 7.9 and 7.8 (all architectures). Vulnerability in shmat(4) shared-memory attach function (integer overflow) and separate kernel reference-counting use-after-free. Both flaws patched via errata 018 (Sept 14) and 026 (Sept 30).
highbug_reportVulnerabilityCandiru spyware deployed via zero-click malicious ads at Al Jazeera
Al Jazeera Media Network devices (Windows confirmed, likely mobile); 45+ devices compromised 2024-2025. Broader campaign placed 3.77 billion ad bids across 75,373 Android/iOS apps and 120,768 websites (March-June 2026).
criticalbug_reportVulnerabilityMultiple critical vulnerabilities in Juniper Junos OS require urgent patching
Juniper Networks Junos OS - specific affected versions not disclosed in available advisory. All organizations running Junos OS on network devices should assume potential exposure until vendor guidance is reviewed.
criticalbug_reportVulnerabilityAOMEI Backupper update servers compromised to deliver backdoor via tampering
AOMEI Backupper (Windows backup software), at least version 8.3.0 confirmed affected. All installations that checked for updates during three confirmed tampering windows between May 28 and July 20, 2026 (total ~21 minutes across three incidents).
criticalbug_reportVulnerabilityBeyondTrust Remote Support zero-day exploited by China APT Armory Castle
BeyondTrust Remote Support (formerly Bomgar) versions 24.3.1 through 26.2.3. Self-hosted deployments exposed to the internet are at highest risk. SaaS customers were patched automatically as of October 9, 2026.
criticalbug_reportVulnerabilityBeyondTrust Remote Support zero-day exploited by China-nexus APT since August
BeyondTrust Remote Support (RS) version 26.2.3 and earlier; Privileged Remote Access (PRA) shares affected code. SaaS customers patched October 8, 2026; self-hosted installations require manual patching if auto-update disabled.
criticalbug_reportVulnerabilityPalo Alto PAN-OS RCE under active exploitation, patch immediately
Palo Alto Networks PAN-OS. Specific affected versions not disclosed in available information. Remote code execution vulnerability actively exploited in the wild.
criticalbug_reportVulnerabilityCisco Secure Email Gateway under active exploit for file write/RCE
Cisco Secure Email Gateway (formerly IronPort). Specific vulnerable versions not disclosed in available data. Affects on-premises appliances.
highbug_reportVulnerabilityFortinet FortiOS path traversal flaw exploited to deploy PEERSTITCH malware
Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager vulnerable to CVE-2025-61624 (CVSS 5.4), a path traversal flaw in the command line interpreter. Patched by Fortinet in April 2026.
criticalbug_reportVulnerabilityCritical RCE in Nextcloud Collabora app actively exploited for backdoors
Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. Specific vulnerable versions not disclosed in provided data.
criticalbug_reportVulnerabilityLinux kernel flaw CVE-2026-99999 lets guest VMs read host memory
Linux kernel networking code across all major cloud providers using kernel-based virtualization. Fixed in stable branches: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11.
highbug_reportVulnerabilityProxyjacking campaign exploits D-Link, Ubiquiti devices in 34 countries
D-Link ShareCenter NAS (CVE-2024-3272, CVE-2024-3273), Ubiquiti UniFi Video NVR (CVE-2021-44228), SAP NetWeaver Visual Composer (CVE-2025-31324), and Hikvision/Dahua DVR/NVR devices.
highbug_reportVulnerabilityMalicious Arch Linux packages impersonate yay and paru AUR helpers
Arch Linux users who installed typosquatted packages from AUR (Arch User Repository) uploaded by user "marchos1as" between October 13-15, 2026. Malicious packages include "yyay" and similar variants impersonating legitimate AUR helpers yay and paru.
highbug_reportVulnerabilityNGINX 1.30.6 and 1.31.7 fix 5 flaws including 3 memory bugs with RCE risk
NGINX versions 0.1.29 to 1.31.6 (varies by CVE). Five vulnerabilities affect specific configurations: CVE-2026-15176 (alias + rewrite, since 0.1.29), CVE-2026-93479 (regex map, 1.30.0+), CVE-2026-97205 (AIO + SSI, 0.8.11+), CVE-2026-95101 (HTTP/3, 1.…
criticalbug_reportVulnerabilityNext.js patches two critical RCE flaws in caching and SVG processing
Next.js versions 10.0.0–15.5.27 and 16.0.0–16.4.0. Critical RCE in React Server Components (v16 with Cache Components enabled, use cache functions returning multiple typed arrays).
criticalbug_reportVulnerabilityDrupal Field UI RCE flaw patched; unauthenticated exploit path exists
Drupal core versions 10.6.x, 11.3.x, and 11.4.x with Field UI module enabled. Fixed in 10.6.19, 11.3.19, and 11.4.10. Drupal 8, 9, and older 10.x/11.x branches are end-of-life and unpatched.
highbug_reportVulnerabilityFake AI product campaigns deliver infostealers to US businesses via malicious sites
US businesses (16% of attributed targets); employees using or seeking AI tools (Claude, ChatGPT, GitHub Copilot, Gemini). 1,258 sandbox analyses linked to campaigns April–October 2026.
highbug_reportVulnerabilityPalo Alto PAN-OS RCE (CVE-2026-0322) under active exploitation
PAN-OS on PA-Series, VM-Series firewalls, and Panorama (virtual and M-Series). All versions prior to patched releases: 10.2.x, 11.1.x, 11.2.x, 12.1.x, 12.2.x. Cloud NGFW and Prisma Access are not affected.
criticalbug_reportVulnerabilityCisco Secure Email Gateway RCE exploited in wild; root access via AMP
Cisco Secure Email Gateway (physical and virtual) running AsyncOS 15.5 before 15.5.5-014, all 16.0 versions, and 16.5 before 16.5.0-780, with AMP File Reputation service enabled and Content Scanner Tools earlier than 25.3.0.5525.
highbug_reportVulnerabilityMicrosoft fixes Windows 11 black screen and Explorer crashes since August
Windows 11 versions 24H2, 25H2, and 26H1 systems updated since August 2026. Primarily affects Azure Virtual Desktop (AVD) hosts using FSLogix profile management software. Issue resolved in October 13, 2026 cumulative updates.
criticalbug_reportVulnerabilityPalo Alto PAN-OS RCE zero-day CVE-2026-0322 exploited in the wild
PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2 on PA-Series and VM-Series firewalls, Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access not affected. Requires authenticated access to management interface.
criticalbug_reportVulnerabilityPEERSTITCH malware deployed on 500+ FortiGate firewalls via FortiManager
Fortinet FortiManager and 500+ managed FortiGate firewalls. Initial compromise via CVE-2024-47575 (FortiJump) on FortiManager FMG-Access service (TCP 541).
criticalbug_reportVulnerabilityCisco Secure Email Gateway under active attack via file write RCE flaw
Cisco Secure Email Gateway (physical and virtual appliances) running AsyncOS versions prior to 15.5.5-014 or 16.5.0-780, with File Reputation service enabled and Content Scanner Tools package older than version 25.3.0.5525.
highbug_reportVulnerabilityLedger halts Asia sales after hardware implants steal crypto seed phrases
Ledger hardware wallets purchased from third-party resellers in Southeast Asia (Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia), Hong Kong, and potentially Europe (MediaMarkt).