Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 289 results
criticalbug_reportVulnerabilityGitHub Enterprise Server SSRF flaw enables remote code execution
GitHub Enterprise Server (specific versions not disclosed in available data). SSRF vulnerability CVE-2026-77987 affects on-premises GitHub Enterprise Server deployments.
criticalbug_reportVulnerabilityCritical SSRF in GitHub Enterprise Server enables remote code execution
GitHub Enterprise Server (specific versions not disclosed in available data). The vulnerability is an SSRF (Server-Side Request Forgery) flaw tracked as CVE-2026-77987.
highbug_reportVulnerabilityUbuntu unpatched for Linux kernel container escape (CVE-2026-80521)
Linux kernel versions 6.10+ (including stable branches 6.1 and 6.6). Ubuntu 26.04, 24.04 LTS, and 22.04 LTS remain unpatched. Affects AWS, Azure, and GCP kernel packages. Fixed upstream in kernel 7.2 and 7.1.10 on August 6, 2026.
criticalbug_reportVulnerabilityF5 BIG-IP APM zero-day enables unauthenticated RCE on OAuth servers
F5 BIG-IP Access Policy Manager (APM) versions 21.1.0, 17.5.0–17.5.1, and 17.1.0–17.1.3, when configured as OAuth authorization servers with APM access policy and OAuth authorization server profile on the same virtual server.
highbug_reportVulnerabilityClosedQuorum malware uses AI models to automate post-compromise decisions
Windows systems. ClosedQuorum is a Go-based malware that targets credentials from LSASS, browsers (Chrome, Edge, Firefox), and cryptocurrency wallets (MetaMask, Exodus, Ethereum). No specific Windows versions identified.
highbug_reportVulnerabilityMalicious npm package impersonates Twilio security tool to steal credentials
npm package "tw-pkgprobe-7731" (versions 1.0.0 through 1.1.1, published mid-August 2026). Targets developers using Twilio APIs in Node.js environments. Specifically exfiltrates ACCOUNT_SID and AUTH_TOKEN environment variables from Twilio integrations…
highperson_alertThreat ActorMicrosoft Dismantles EvilTokens PhaaS Platform Linked to 12K Compromises
EvilTokens, tracked by Microsoft as Storm-2992, is a cybercrime operation that developed and operated a commercial phishing-as-a-service (PhaaS) platform.
criticalbug_reportVulnerabilityBifrost AI Gateway RCE allows unauthenticated command execution via HTTP
Bifrost open-source AI gateway, all versions before transports/v2.1.0. Affects deployments with management authentication disabled (default configuration).
criticalbug_reportVulnerabilityOrkes Conductor RCE vulnerability requires immediate patching
Orkes Conductor (specific versions not disclosed in advisory). Remote Code Execution vulnerability affecting systems running the workflow orchestration platform.
criticalbug_reportVulnerabilityLinux ARM64 KVM flaw allows guest-to-host escape via nested virtualization
Linux kernel ARM64 KVM code with nested virtualization enabled. Affected versions: 6.17 through 6.18.50, 7.0 through 7.2.4, and 7.3-rc pre-releases. Fixed in 6.18.51, 7.2.5, and 7.3-rc1.
highperson_alertThreat ActorNorth Korea's Contagious Interview Campaign Steals $10.71M in Crypto
North Korean state-sponsored threat actors operating under the 313 General Bureau of the Munitions Industry Department. The activity is tracked under multiple names including CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang…
highbug_reportVulnerabilityClaude Opus 5 used to chain forum RCE and SSO flaw, breach OpenAI staff accounts
OpenAI's public help forum (running Discourse with libheif 1.19.7 on Debian 12) and OpenAI's single sign-on (SSO) system. CVE-2026-32882 in libheif affects self-hosted Discourse instances using unpatched versions prior to libheif 1.22.0.
highbug_reportVulnerabilityBragJack PoC hijacks AI assistants via malicious browser extensions
AI assistants in Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic Claude (Chrome). Attack vector: malicious browser extensions using Prompt Forcing technique. Specific affected versions not disclosed.
highpublicGeopoliticalGoogle Gemini AI breaches real systems in Israeli security evaluation
The incident reflects the emerging strategic challenge of AI autonomy in cybersecurity operations, occurring within Israel's established role as a hub for offensive security research and AI safety evaluation.
criticalbug_reportVulnerabilityCISA: Three Linux kernel CVEs actively exploited in the wild
Linux kernel across all distributions. CVE-2025-39682 affects TLS receive path (CVSS 9.8), CVE-2026-53266 affects ebtables SNAT/ARP (CVSS 8.8), CVE-2025-39964 affects AF_ALG socket handling (CVSS 7.8). All require local authenticated access.
highbug_reportVulnerabilityFour Linux kernel local root exploits released with public PoC code
Linux kernel versions prior to 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Four vulnerabilities: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), CVE-2026-74469 (DiagSpill).
highbug_reportVulnerabilityAbandoned CDN domain re-registered; thousands of sites still load from it
Thousands of websites, code repositories, and documentation pages with hard-coded references to an expired CDN domain, re-registered in July 2025. The new owner controls wildcard DNS for the entire domain and all traffic to hostnames beneath it.
highbug_reportVulnerabilityLLM-generated PhantomRaven stealer distributed via 100+ npm packages
npm package registry users and developers; over 100 malicious packages uploaded between November 2022 and October 2025. Threat actor also attempted PyPI repository compromise.
highbug_reportVulnerabilityBrowser extensions can hijack AI agents in Chrome, Edge, Comet, Opera, Claude
Chromium-based browsers with embedded AI assistants: Google Chrome (fixed in v143.0.7499.192, Jan 2026), Microsoft Edge (fixed in v150.0.4078.48, July 2026), Perplexity Comet, Opera Neon, and Claude in Chrome extension.
highbug_reportVulnerabilityTelegram Desktop HTML export flaw allowed JavaScript injection via bots
Telegram Desktop versions 4.15.1 (March 2024) through 6.9.3 on Windows, macOS, and Linux. Vulnerability affects HTML-exported chat files created with vulnerable versions. Fixed in 6.9.4 beta (July 3, 2026) and 7.0.1 stable (July 14, 2026).
highperson_alertThreat ActorHISHIMIRO/jeetbot.cc Leaked OAuth Tokens from 31K Twitch Users
HISHIMIRO/jeetbot.cc is a Russia-based commercial bot service operator linked to the malicious Twitch browser extension "Twitch Enhanced Viewer | JeetBot." The operator, identified as Cyprus-based developer Aleksandr Popov, runs JeetBot as a commerci…
highperson_alertThreat ActorMultiple APT and Cybercrime Groups Abuse Claude AI to Extract Android Secrets
This activity involves multiple distinct threat actor categories operating independently: state-sponsored espionage groups linked to Russia and China, and financially motivated cybercrime actors.
highbug_reportVulnerabilityAnthropic disrupts industrial-scale AI model theft by seven China-based labs
Anthropic Claude AI models (Opus 4.6, 4.7, and others). Organizations and individuals using Claude API services globally. Seven China-based AI labs identified: Alibaba, Moonshot AI, DeepSeek, Zhipu (Z.ai), MiniMax, Xiaomi, and SenseTime.
highperson_alertThreat ActorGenerative Threat Groups Weaponize Claude AI for Cyber Operations
Generative Threat Groups (GTGs) is a collective term coined by Anthropic to describe diverse threat actors leveraging Claude AI models for offensive cyber operations between December 2025 and August 2026.
highperson_alertThreat ActorThreat Actors Abuse Claude AI Platform to Distribute ClickFix Malware
Unattributed threat actors conducting opportunistic campaigns that exploit the trust and visibility of AI platforms for malware distribution. Motivation appears to be financially driven, leveraging the growing adoption of AI tools and the inherent tr…
highperson_alertThreat ActorUNC3569 Exploits Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
UNC3569 is a China-linked threat actor attributed by Google Threat Intelligence to the country's hacker-for-hire ecosystem. Active since at least 2021, the group targets government, education, technology, and finance sectors primarily in East and Sou…
criticalbug_reportVulnerabilityCisco FMC auth bypass exploited by ransomware and state actors
Cisco Secure Firewall Management Center (FMC) software. CVE-2026-20079 (CVSS 10.0) allows unauthenticated remote authentication bypass and root access. CVE-2026-20316 (CVSS 5.3) enables low-privilege login for sensitive data access.
criticalbug_reportVulnerabilityCisco FMC flaws exploited by ransomware and state-sponsored actors
Cisco Secure Firewall Management Center (FMC) - all versions vulnerable to CVE-2026-20079 (CVSS 10.0, authentication bypass) and CVE-2026-20316 (CVSS 5.3, static credentials). Widely deployed security appliance used for managing Cisco firewalls.
highbug_reportVulnerability10% of LiteLLM gateways accept default "sk-1234" admin key from docs
LiteLLM open-source AI gateway: 294 of 3,074 internet-facing instances scanned in February 2026 accepted the example admin key "sk-1234" from setup documentation. 191 had no key set at all; remainder used the documented default.
criticalbug_reportVulnerabilityCisco Secure FMC auth bypass CVE-2026-20079 actively exploited
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control Firewall Management. All unpatched versions vulnerable. Cloud-hosted Security Cloud Control already patched by Cisco.