Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
satellite_altDaily BriefCyber Threat Daily Brief — October 28, 2026
Today's briefing: 9 critical and 29 high-severity threats. A total of 45 detailed analyses covering vulnerabilities, threat actors, and geopolitical context.
Latest Reports
28 / 1471 results
highpublicGeopoliticalCyberattack disrupts North Carolina port operations, critical infrastructure
The incident at North Carolina Ports Authority facilities represents a significant disruption to U.S. critical maritime infrastructure. Port of Wilmington and Port of Morehead City together constitute key logistics nodes on the U.S.
highbug_reportVulnerabilityWordPress pre-auth XSS on login page enables RCE via admin interaction
WordPress CMS all versions prior to 7.0.3. Patches backported to 4.7 branch and newer. Versions older than 4.7 remain vulnerable and unpatched. Default installations affected; no special hosting configuration required.
criticalbug_reportVulnerability18-year-old Linux SCTP flaw enables local root and container escape
Linux kernel versions since 2.6.25 (2008) through 7.1.5, 6.18.41, 6.12.100, and 6.6.147. Affects systems with SCTP networking enabled. Confirmed vulnerable: Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, OpenCloudOS.
highbug_reportVulnerabilityNatJack attacks hijack TCP sessions via NAT manipulation; Windows & Linux CVEs
Windows NAT (Hyper-V): Windows 11 24H2 <26100.8875, 25H2 <26200.8875, 26H1 <28000.2525, Server 2025 <26100.33158 (CVE-2026-56181, CVSS 8.3). Linux Netfilter conntrack: kernel <5.10.259, <5.15.210, <6.1.176, <6.6.143, <6.12.93, <6.18.35, <7.0.12, <7.1…
highbug_reportVulnerabilityAitM phishing campaign targets Microsoft 365 for payroll email theft
Microsoft 365 accounts across healthcare, education, manufacturing, government, and professional services sectors in the U.S., Canada, and Europe. Hundreds of organizations targeted in July 2026, with focus on payroll, HR, and finance personnel.
highbug_reportVulnerabilityAI system finds HTTP desync techniques; Apache Traffic Server zero-day patched
Apache Traffic Server (CVE-2026-63078, specific versions unknown); 700+ websites vulnerable to HTTP desynchronization including banks, government infrastructure, security products, and airports.
highbug_reportVulnerabilityMalware can abuse Windows Hello for Business keys for persistent Entra ID access
Windows Hello for Business on all Windows versions with Entra ID integration. Affects organizations using Windows Hello for Business as phishing-resistant authentication. TPM-backed and non-TPM deployments both vulnerable.
highbug_reportVulnerabilityClickFix campaign delivers Go-based macOS stealer targeting crypto wallets
macOS users across all versions; targets cryptocurrency wallets (Bitcoin, Ethereum, Litecoin, Dogecoin, Monero, XRP), browser password databases, Apple Keychain, and cached browser credentials.
highbug_reportVulnerabilityChainDrop npm worm infects 400+ packages, steals secrets via blockchain C2
Over 400 npm packages including widely used packages like keyv and cacheable-request. Affects developer workstations, CI/CD pipelines (especially GitHub Actions), cloud environments, and downstream software users.
highperson_alertThreat ActorUNC6671 extortion group targets financial sector via vishing attacks
UNC6671 is a financially motivated extortion group tracked by Google Threat Intelligence Group (GTIG) that operates under multiple public brands including BlackFile, Redact, Pink, Helix, and Falcon.
highpublicGeopoliticalSwiss government SharePoint breach exposes 200 accounts via July flaws
The breach of Switzerland's Federal Office for Information Technology and Telecommunication (BIT) represents a significant compromise of neutral state infrastructure.
highbug_reportVulnerabilityTONTOU attack bypasses Spectre v2 mitigations on Intel and AMD CPUs
Intel and AMD processors with Spectre v2 mitigations (eIBRS on Intel, Safe RET on AMD). Confirmed exploitable on AMD Zen 2 systems running Linux kernel 6.14.0-37-generic. Intel systems also vulnerable but require additional software prerequisites.
highbug_reportVulnerabilityZapscape KVM flaw allows L1 guest escape to host with nested virtualization
Linux kernel KVM/x86 shadow MMU in versions 5.9 through 7.1.5. Fixed in stable releases 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. Affects systems running KVM hosts with nested virtualization exposed to untrusted guests.
criticalbug_reportVulnerabilityCisco patches 12 critical SD-WAN and IOS XE flaws, three rated 9.8+
Cisco Catalyst SD-WAN Software (all versions prior to 20.9, versions 20.9–26.1); Cisco IOS XE Software versions 17.9–26.1 running in autonomous or controller mode; Cisco Integrated Management Controller (IMC) web interface.
criticalperson_alertThreat ActorCanadian Cybercriminal Connor Moucka Pleads Guilty to Snowflake Breach
Connor Riley Moucka (aliases "Judische," "Waifu") is a 26-year-old Canadian software engineer from Kitchener, Ontario, who operated as a cybercriminal since at least 2020.
criticalbug_reportVulnerabilityCritical Cisco Catalyst SD-WAN flaws require immediate patching
Cisco Catalyst SD-WAN Software (specific versions not disclosed in advisory). Scope: SD-WAN infrastructure components used for enterprise WAN connectivity and management.
highbug_reportVulnerabilityInterrupt injection bypasses Spectre v2 defenses on Intel, AMD CPUs
Intel CPUs (Cascade Lake Refresh, Arrow Lake) and AMD Zen 1-4 processors running Linux. AMD Safe-RET mitigation vulnerable; Intel eIBRS/BHI defenses also affected. Requires local code execution on shared Linux systems.
highbug_reportVulnerabilityCisco IOS/IOS XE vulnerabilities require immediate patching per CERT.BE
Cisco IOS and IOS XE platforms. Specific affected versions not provided in advisory. Multiple vulnerabilities of high severity impact network infrastructure devices including routers and switches running these operating systems.
highbug_reportVulnerability4,407 Rockwell PLCs exposed online; 22 in cities hit by water attacks
Rockwell Automation programmable logic controllers (PLCs) globally: 4,407 exposed devices (2,844 in US). Primary models: MicroLogix 1400 (50%) and MicroLogix 1100 (8%).
criticalbug_reportVulnerabilityCryptoJS weak RNG drained $5.7M from five crypto wallets over 12 years
CryptoJS versions below 4.0.0 (except 3.2.0 and 3.2.1). Five confirmed affected wallet apps: RRWallet (discontinued), Bexo Wallet (fixed in 20.1.0, builds pending), NanChat (fixed in 1.3.0), Bitcoin Libre (fixed in v4, July 2024), and Milo (discontin…
highbug_reportVulnerabilityApple iCloud Private Relay leaks real IP via WebKit proxy bypasses
Apple iCloud Private Relay on iOS 15+, macOS, and iPadOS. Affects Safari and all WebKit-based browsers (Chrome, Edge, Firefox, Brave) on Apple platforms. Impacts users with iCloud+ subscriptions using Private Relay for privacy protection.
highperson_alertThreat ActorCybercriminals Steal AI API Keys via Token Jacking for Resale
Cybercriminals targeting the AI development ecosystem are motivated by financial gain through the theft and resale of API keys (tokens) for premium AI platforms.
highbug_reportVulnerabilityAWS, Google, Vercel agent flaws allow tool execution without model checks
Amazon Bedrock AgentCore InvokeHarness API (fixed July 31, 2026; CVE-2026-18830, CVSS 8.6), open-source Strands Python library (unpatched resume path remains), Google Agent Development Kit (ADK) for Python <2.5.0 (CVE-2026-18236, CVSS 9.3), Vercel AI…
highperson_alertThreat ActorRansom Cartel Creator Maksim Silnikau Sentenced to 16 Years
Maksim Silnikau is a 40-year-old Belarusian national who created and administered the Ransom Cartel ransomware-as-a-service (RaaS) operation. Active on Russian-speaking cybercrime forums since at least 2005, Silnikau operated under aliases including…
highperson_alertThreat ActorCanadian Cybercriminal Pleads Guilty to Snowflake Data Theft Campaign
Connor Riley Moucka (also known as Alexander Moucka and "Waifu"), a 26-year-old Canadian national, operated as a cybercriminal targeting cloud storage environments for financial gain.
highbug_reportVulnerabilityOracle SQL injection exploited to deploy khunt toolkit inside database
Oracle databases with Java Virtual Machine enabled, particularly those connected to public-facing Java applications (Apache Tomcat observed). Specific Oracle versions not disclosed.
highperson_alertThreat ActorClickFix Campaign Uses Browser Fingerprinting to Target macOS Users
ClickFix is a macOS-focused social engineering campaign tracked by Microsoft Threat Intelligence. The operators remain unidentified, but the campaign demonstrates sophisticated evasion capabilities through server-side browser fingerprinting across mo…
highperson_alertThreat ActorPoipet Scam Network Leveraged ChatGPT for Multi-Scheme Fraud Operations
The Poipet scam network is a Cambodia-based organized criminal operation originating from Poipet, a city with extensive ties to scam compounds and human trafficking.