Curated Cyber Threat Intelligence

Threat Feed

Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.

scheduleUpdated 2026-07-20 · 02:03 UTC
articleTotal: 593 reports
Cyber Threat Daily Brief — July 20, 2026satellite_altDaily Brief
Threat Intel Brief·Daily Summary

Cyber Threat Daily Brief — July 20, 2026

Today's briefing: 3 critical and 4 high-severity threats. A total of 10 detailed analyses covering vulnerabilities, threat actors, and geopolitical context.

3 Critical4 High10 analyses
schedule02:03 UTC
Read briefarrow_forward

Latest Reports

18 / 588 results
Multiple critical vulnerabilities in Fortinet products require patchingcriticalbug_reportVulnerability
bug_reportVulnerability

Multiple critical vulnerabilities in Fortinet products require patching

Fortinet products: FortiSandbox, FortiOS, FortiAP, FortiAnalyzer, and FortiManager. Specific affected versions not provided in advisory. Multiple vulnerabilities ranging from critical to medium severity.

Fortinet05:08 UTC
Code Runner MCP Server missing authentication flaw allows unauthorized accesshighbug_reportVulnerability
bug_reportVulnerability

Code Runner MCP Server missing authentication flaw allows unauthorized access

Code Runner MCP Server (all versions not specified). The vulnerability affects critical functions within the server, allowing unauthenticated access to protected operations. Specific version ranges have not been disclosed by CERT.PL.

CVE-2026-502908:55 UTC
3onedata GW1101 Modbus gateway vulnerable to OS command injectionhighbug_reportVulnerability
bug_reportVulnerability

3onedata GW1101 Modbus gateway vulnerable to OS command injection

3onedata GW1101-1D(RS-485)-TB-P Modbus gateways. Specific affected firmware versions not disclosed. These are industrial IoT devices used for Modbus protocol conversion in OT/ICS environments.

CVE-2025-1360512:55 UTC
NCSC UK Issues Guidance on China-Nexus Covert Device Networkshighperson_alertThreat Actor
person_alertThreat Actor

NCSC UK Issues Guidance on China-Nexus Covert Device Networks

China-nexus threat actors are state-sponsored groups linked to the People's Republic of China. These actors are motivated by strategic intelligence collection, espionage, and maintaining persistent access to foreign networks.

NCSC UK10:00 UTC
NCSC UK Issues Advisory on China-Linked Covert Network Tacticshighperson_alertThreat Actor
person_alertThreat Actor

NCSC UK Issues Advisory on China-Linked Covert Network Tactics

China-linked threat actors employing covert network tactics to conceal malicious cyber activity. These actors are characterized by their use of sophisticated techniques to maintain persistent, stealthy access to compromised networks.

NCSC UK10:00 UTC
UK NCSC Issues Guidance on China-Linked Covert Device NetworkshighpublicGeopolitical
publicGeopolitical

UK NCSC Issues Guidance on China-Linked Covert Device Networks

The UK National Cyber Security Centre's release of defensive guidance targeting China-nexus covert networks reflects ongoing strategic competition between Western democracies and Beijing in cyberspace.

NCSC UK10:00 UTC
Orca heat pumps lack authentication, transmit cleartext data to servershighbug_reportVulnerability
bug_reportVulnerability

Orca heat pumps lack authentication, transmit cleartext data to servers

Orca heat pumps (specific models and versions not disclosed). Vulnerability affects device-to-server communication and server-side data processing.

CVE-2026-2559903:11 UTC
MikroTik RouterOS auth bypass via certificate validation flawhighbug_reportVulnerability
bug_reportVulnerability

MikroTik RouterOS auth bypass via certificate validation flaw

MikroTik RouterOS - versions not specified. Affects OpenVPN, CAPsMAN (wireless management), and 802.1X (Dot1x) services that rely on certificate-based authentication.

CVE-2025-4261107:08 UTC
Cisco SD-WAN Manager auth bypass exploited in wild since 2023criticalbug_reportVulnerability
bug_reportVulnerability

Cisco SD-WAN Manager auth bypass exploited in wild since 2023

Cisco Catalyst SD-WAN controllers and Cisco SD-WAN Manager. Specific affected versions not provided in advisory summary. CVE-2026-20127 allows administrative access compromise.

CVE-2026-2012718:38 UTC
Latvia faces elevated cyber threats amid geopolitical tensions in Q4 2025highpublicGeopolitical
publicGeopolitical

Latvia faces elevated cyber threats amid geopolitical tensions in Q4 2025

Latvia's position as a NATO and EU member state on the eastern flank of the Alliance places it at the intersection of Western institutional security architecture and persistent regional tensions.

CERT.LV (Latvia)11:02 UTC
Ivanti EPMM critical RCE flaws under limited exploitationcriticalbug_reportVulnerability
bug_reportVulnerability

Ivanti EPMM critical RCE flaws under limited exploitation

Ivanti Endpoint Manager Mobile (EPMM) products. Specific affected versions not provided in advisory summary. Two critical vulnerabilities enabling unauthenticated remote code execution.

Ivanti09:09 UTC
Fortinet FortiCloud SSO bypass exploited to extract LDAP passwordshighbug_reportVulnerability
bug_reportVulnerability

Fortinet FortiCloud SSO bypass exploited to extract LDAP passwords

Fortinet FortiGate appliances with FortiCloud SSO enabled. CVE-2025-59718 and CVE-2025-59719 allow authentication bypass. All FortiGate instances share a default static encryption key that enables decryption of LDAP credentials and private keys from…

CVE-2025-5971815:16 UTC
Fortinet FortiCloud SSO auth bypass under active exploitationcriticalbug_reportVulnerability
bug_reportVulnerability

Fortinet FortiCloud SSO auth bypass under active exploitation

Fortinet FortiCloud SSO SAML authentication processing (CVE-2025-59718, CVE-2025-59719). Affects management interfaces of FortiGate and potentially other Fortinet products using FortiCloud SSO.

CVE-2025-5971814:41 UTC
Cisco Secure Email Gateway critical flaw unpatched, check for compromisecriticalbug_reportVulnerability
bug_reportVulnerability

Cisco Secure Email Gateway critical flaw unpatched, check for compromise

Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Specific affected versions not provided in advisory summary. No patch available as of December 17, 2025.

Cisco09:08 UTC
React Server Components RCE flaw enables unauthenticated remote executioncriticalbug_reportVulnerability
bug_reportVulnerability

React Server Components RCE flaw enables unauthenticated remote execution

React Server Components and integrating frameworks (e.g., Next.js, Remix). All versions using React Server Components are potentially affected until patched.

Meta13:50 UTC
Microsoft patches critical WSUS RCE flaw with public PoC exploitcriticalbug_reportVulnerability
bug_reportVulnerability

Microsoft patches critical WSUS RCE flaw with public PoC exploit

Windows Server Update Service (WSUS) on Windows Server. Specific versions not disclosed in out-of-band update. Affects organizations running WSUS infrastructure for Windows update management.

Microsoft16:42 UTC
Fortinet patches high severity FortiOS vulnerabilityhighbug_reportVulnerability
bug_reportVulnerability

Fortinet patches high severity FortiOS vulnerability

FortiOS (specific versions not disclosed in summary). Fortinet advisory published October 14, 2025.

Fortinet18:41 UTC
Ransomware Campaigns Target Slovenia via Email, RDP, and Exploitshighperson_alertThreat Actor
person_alertThreat Actor

Ransomware Campaigns Target Slovenia via Email, RDP, and Exploits

Unattributed ransomware operators targeting Slovenia. Motivation appears financially driven, consistent with commodity ransomware campaigns. No specific actor attribution available; likely represents multiple threat groups employing common ransomware…

SI-CERT (Slovenia)08:32 UTC