Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
satellite_altDaily BriefCyber Threat Daily Brief — October 28, 2026
Today's briefing: 9 critical and 29 high-severity threats. A total of 45 detailed analyses covering vulnerabilities, threat actors, and geopolitical context.
Latest Reports
27 / 1823 results
criticalbug_reportVulnerabilityMicrosoft patches 966 flaws including 2 actively exploited zero-days
Microsoft products (specific products and versions not disclosed in provided data). Two zero-day vulnerabilities are actively exploited; 964 additional flaws patched in September 2026 Patch Tuesday.
highperson_alertThreat ActorShinyHunters Claims Breach of Florida DMV DAVID Database
ShinyHunters is a financially motivated cybercrime extortion gang known for conducting data breaches targeting organizations with large databases of personally identifiable information (PII).
highperson_alertThreat ActorSlim Spider Targets Brazilian Financial Institutions for Crypto Theft
Slim Spider is a previously undocumented, financially motivated threat actor attributed by CrowdStrike to Brazil-based operations targeting Brazilian financial institutions since at least March 2026.
highperson_alertThreat ActorLiquid Hackers Exploit Elements Bug, Return 85% of Stolen Bitcoin
Liquid Hackers is a group that exploited a vulnerability in the Elements software underlying the Liquid Network Bitcoin sidechain on September 6, 2026. The actors self-identify as "white hats" and communicated via on-chain messages, claiming their in…
criticalbug_reportVulnerabilityAdobe Commerce/Magento unauthenticated RCE requires immediate patching
Adobe Commerce and Magento platforms. Specific affected versions not disclosed in available information. Vulnerability allows unauthenticated remote code execution.
highbug_reportVulnerabilityChatGPT prompt injection exfiltrates Gmail data via internal service
ChatGPT users with connected apps (Gmail, other integrations) enabled. All account types affected, including Business, Enterprise, and Edu workspaces. Vulnerability existed in ChatGPT's internal JFrog Artifactory service used for Python/npm package m…
highperson_alertThreat ActorAI-Powered Credential Harvesting Campaign Compromises Thousands in 6 Hours
The campaign involves financially motivated threat actors leveraging autonomous AI agents and multi-agent attack frameworks to conduct large-scale credential harvesting operations.
highbug_reportVulnerabilityWeChat zero-click worm enables account takeover via incoming calls
WeChat versions prior to 8.0.77 (Android) and 8.0.76 (iOS) on iPhone and Android devices. Tested vulnerable versions: WeChat 8.0.76 (Android) and 8.0.75 (iOS). Affects an estimated 1.439 billion monthly active users globally.
highbug_reportVulnerabilityFreeIPA flaw chain allows unauthenticated admin credential creation
FreeIPA versions prior to 4.13.4 and 389 Directory Server (389-ds-base) on Red Hat Enterprise Linux and Red Hat Directory Server. Red Hat Identity Management (ipa package) is affected. Default installations are vulnerable.
criticalbug_reportVulnerabilityAdobe Commerce zero-day CVE-2026-75650 exploited since Sept 4 for backdoors
Adobe Commerce 2.4.4 through 2.4.9 (all 2026-aug and earlier), Adobe Commerce B2B 1.3.3 through 1.5.3 (all 2026-aug and earlier), and Magento Open Source 2.4.6 through 2.4.9 (all 2026-aug and earlier).
highperson_alertThreat ActorBengalSEO Campaign Exploits Bing SEO to Deploy MayaBot Malware
BengalSEO is a financially motivated campaign operating from Rajasthan, India since at least 2015. The operation is driven by IT service providers WeConnect Solutions LLC (formerly iConnect Soft Solutions LLC) and Garage2Global.
highpublicGeopoliticalGrindr Settles U.K. Privacy Lawsuit Over HIV Data Sharing for £26M
This settlement reflects the extraterritorial enforcement reach of European data protection frameworks, particularly GDPR, which has become a de facto global standard for privacy regulation.
highbug_reportVulnerabilityPEEP toolkit turns Chrome/Edge into backdoors via malicious extension
Chrome and Edge browsers on Windows and Linux. PEEP is a post-exploitation toolkit requiring prior administrative or code execution access. It masquerades as "Smart Bookmarks" extension (ID: ejkndncpkdcjcikfhiamcdehdoegilbj) and uses native messaging…
criticalbug_reportVulnerabilityMagento StyleSmuggler zero-day actively exploited to deploy backdoor
All versions of Magento and Adobe Commerce, including latest patched versions. Affects approximately 160,000 websites globally, including 14,000 in the top 1 million sites.
highbug_reportVulnerabilityVishing campaign steals M365 tokens via AitM phishing, targets executives
Microsoft 365, SharePoint, OneDrive, Exchange, and Box SaaS platforms. Primarily targets executive-level staff (directors, VPs) in U.S. organizations across construction, engineering, healthcare, pharmaceuticals, real estate, finance, and professiona…
highbug_reportVulnerabilityBigBear 2.0 PhaaS bypasses MFA, steals 5,000+ Microsoft 365 credentials
Microsoft 365 users across 258 organizations in 40+ countries. All authentication methods except FIDO2/WebAuthn hardware tokens are vulnerable. Campaign leverages Evilginx2-based adversary-in-the-middle (AiTM) framework with geo-matched residential p…
highbug_reportVulnerabilitySonicWall Network Security Manager vulnerability requires immediate patching
SonicWall Network Security Manager (NSM). Specific affected versions not disclosed in available advisory. CVE identifier not yet assigned or not publicly disclosed.
criticalbug_reportVulnerabilityMikroTik RouterOS critical vulnerabilities require immediate patching
MikroTik RouterOS - specific versions not provided in advisory. All RouterOS deployments should be considered at risk pending vendor bulletin review.
highbug_reportVulnerabilityTrezor shipping partner breach exposes 81,000 customer records via Metabase
Trezor cryptocurrency hardware wallet customers who placed orders through ShipMonk logistics provider between November 2019 and August 2026. Total of 81,000 customers affected (67,000 U.S.
highbug_reportVulnerabilityWorm-like malware abuses ConnectWise ScreenConnect for lateral spread
ConnectWise ScreenConnect clients (all versions). Attackers deploy rogue ScreenConnect instances via phishing, tech support scams, and fake refund forms.
highbug_reportVulnerabilityTelerik UI for ASP.NET AJAX RCE exploit published, patch available
Telerik UI for ASP.NET AJAX versions 2010.1.309 through 2026.2.519. Exploitation requires non-default configuration: RadAsyncUpload control with custom encryption key and server-side handler reading upload results.
highbug_reportVulnerabilityMikroTik RouterOS exploit chain actively hijacks routers via SSH
MikroTik RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Devices with SSH services exposed to the internet are at immediate risk. Approximately 122,500 MikroTik devices have exposed SSH interfaces as of September 5, 2026.
highbug_reportVulnerabilityConnectWise ScreenConnect file transfer flaw lacks patch, mitigation only
ConnectWise ScreenConnect Remote Access (all versions, both cloud and on-premises deployments). Approximately 6,000 instances exposed online. No CVE ID assigned yet. Affects file transfer behavior in Support and Access sessions.
criticalbug_reportVulnerabilityN-able N-central RCE flaw (CVE-2026-86218) exploited in wild
N-able N-central RMM platform: all on-premises builds below version 2026.3.1.14, including servers patched with Hotfix 3 (2026.3.1.13) released hours earlier. Hosted N-central (NCOD) instances already patched by vendor.
criticalbug_reportVulnerabilityN-able N-central RCE flaw (CVE-2026-86218) exploited in the wild
N-able N-central on-premises deployments prior to version 2026.3 Hotfix 4. Approximately 1,500 instances exposed online, primarily in the US and Europe. Used by IT departments and MSPs for remote monitoring and management.
highpublicGeopoliticalMikroTik Router Exploit Enables Unauthenticated Admin Access via SSH
The exploitation of MikroTik routers—widely deployed in small and medium enterprises, ISPs, and critical infrastructure across Europe and emerging markets—represents a significant supply chain vulnerability with potential strategic implications.
highbug_reportVulnerabilityREVSTEALER Deploys Four Persistent Modules Including Crypto Miner
Windows systems infected with REVSTEALER infostealer (active since February 2026). Four persistent modules (ProManager, WinUpdate, SoftManager, LockAppHost) remain after core stealer self-deletes.