Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1058 results
highpublicGeopoliticalSouth Korea issues record $409M fine to Coupang for 37M-user breach
The unprecedented fine against Coupang reflects South Korea's increasingly assertive regulatory posture on data protection, aligning Seoul with global trends toward stringent enforcement of privacy frameworks.
highpublicGeopoliticalCISA mandates 3-day patching for exploited flaws in federal agencies
The directive represents a significant tightening of federal cybersecurity posture in response to persistent exploitation of known vulnerabilities by both state-sponsored and criminal actors.
highperson_alertThreat ActorOceanLotus Targets Vietnamese Infrastructure with SPECTRALVIPER Backdoor
OceanLotus (also tracked as APT32, SeaLotus, APT-C-00, and Canvas Cyclone) is a Vietnam-aligned advanced persistent threat group attributed by multiple vendors to conducting cyber espionage operations.
highpublicGeopoliticalUniversity of Nottingham breach exposes 450,000+ student records
The breach at the University of Nottingham represents a significant compromise of a major UK higher education institution, affecting a substantial population of current and former students.
highbug_reportVulnerabilitynpm v12 disables install scripts by default to block supply chain attacks
npm version 12 and later. All Node.js projects using npm for package management. Breaking change affects packages that legitimately rely on install/postinstall lifecycle hooks.
highbug_reportVulnerabilityActive exploitation of path traversal in Langflow AI platform
Langflow AI development platform. Specific affected versions not disclosed. Impacts internet-exposed Langflow servers vulnerable to arbitrary file write via path traversal (CVE-2026-5027).
highbug_reportVulnerabilityMiasma credential-stealing framework source code leaked on GitHub
Open-source software ecosystems and their supply chains. Organizations consuming packages from public repositories (npm, PyPI, RubyGems, etc.) are at increased risk. No specific vendor or product version affected; threat is ecosystem-wide.
highperson_alertThreat ActorShinyHunters Targets Oracle PeopleSoft Servers in Mass Data Theft
ShinyHunters is a financially motivated cybercrime group known for large-scale data theft and extortion operations. The group has gained notoriety for breaching numerous organizations and exfiltrating sensitive data, which is then used for extortion…
highperson_alertThreat ActorChina-Nexus Actors Expand JDY Botnet to 1,500+ IoT/SOHO Devices
China-nexus state-sponsored threat actors operating the JDY botnet infrastructure. The actors leverage compromised small office/home office (SOHO) routers and IoT devices to build a distributed scanning platform for cyber reconnaissance operations.
highperson_alertThreat ActorVolt Typhoon Expands JDY Botnet Operations Against U.S. Military
Volt Typhoon (also tracked as BRONZE SILHOUETTE, Vanguard Panda, DEV-0391, and UNC3236) is a Chinese state-sponsored APT group attributed to conducting cyber espionage operations targeting critical infrastructure.
highbug_reportVulnerabilityCisco Catalyst SD-WAN Manager actively exploited (CVE-2026-20245)
Cisco Catalyst SD-WAN Manager. Specific affected versions not disclosed. Vulnerability involves improper encoding or escaping of output (CVSS 7.8). Also affects products from Google and Arista (details not provided).
highperson_alertThreat ActorThe Gentlemen Ransomware: Aggressive Affiliate Model Drives Rapid Growth
The Gentlemen is a ransomware-as-a-service (RaaS) operation that has rapidly ascended to become the second most active ransomware group by victim count.
highbug_reportVulnerabilityMicrosoft patches actively exploited XSS zero-day in Exchange Server OWA
Microsoft Exchange Server (all versions with Outlook Web Access enabled). Specific patched versions not provided. Affects organizations exposing OWA to users.
highbug_reportVulnerabilityAix-DB missing authentication flaw allows unauthorized critical access
Aix-DB software (vendor: Aix-DB). Specific affected versions not disclosed. Vulnerability allows unauthenticated access to critical functions (CWE-306).
highbug_reportVulnerabilityServiceNow patches actively exploited auth bypass on hosted instances
ServiceNow hosted customer instances (specific versions not disclosed). On-premise deployments may also be affected pending vendor guidance.
highbug_reportVulnerabilitySix RCE and DoS flaws found in protobuf.js for Node.js applications
protobuf.js library (JavaScript/TypeScript implementation of Protocol Buffers) used in Node.js applications. Specific vulnerable versions not provided in summary.
highbug_reportVulnerabilityOpenClaw AI email agent vulnerable to phishing attacks
OpenClaw AI email agent (all versions). Scope: AI-powered email processing systems that handle user communications and may access sensitive user data.
highbug_reportVulnerabilityMicrosoft June 2026 Patch Tuesday: 200 flaws, 3 disclosed zero-days
Microsoft products across the ecosystem. 200 vulnerabilities patched, including 3 publicly disclosed zero-day vulnerabilities. Specific affected products and CVE identifiers not yet detailed in available information.
highbug_reportVulnerabilityMicrosoft GitHub repos compromised, 73 disabled for distributing malware
73 repositories across Microsoft's official GitHub organizations (Azure, microsoft, Azure-Samples, MicrosoftDocs). Organizations using Microsoft sample code, Azure templates, or CI/CD pipelines referencing these repositories are potentially affected.
highbug_reportVulnerabilityWinRAR CVE-2025-8088 path traversal exploited by Russian APTs vs Ukraine
WinRAR versions prior to patched release (approximately one year old). Primary targets: Ukrainian organizations. Threat actors: Earth Dahu (Gamaredon) and SHADOW-EARTH-066 (UAC-0226), Russia-aligned APT groups.
highbug_reportVulnerabilityFROST attack enables website-based user tracking via SSD timing analysis
All systems with SSDs accessed via web browsers supporting high-resolution JavaScript timers. Attack affects users across Windows, Linux, and macOS platforms. No specific browser, SSD model, or OS version is immune.
highbug_reportVulnerabilityPyPI supply chain attack: 19 packages with auto-executing credential stealer
PyPI repository: 19 compromised packages containing 37 malicious wheel artifacts. Affects Python developers who installed these packages. Attack uses .pth files for automatic execution during pip install, targeting credential theft via Bun-based stea…
highbug_reportVulnerabilityBerriAI LiteLLM command injection under active exploitation (CISA KEV)
BerriAI LiteLLM - specific vulnerable versions not disclosed in summary. Command injection vulnerability (CVE-2026-42271) affects authenticated users with access to the system.
highbug_reportVulnerabilityNFCShare Android malware distributed via GitHub as fake banking app updates
Android mobile users, particularly customers of targeted banking applications. Malware distributed through GitHub repositories posing as legitimate banking app updates.
highpublicGeopoliticalSoFi Hong Kong reports third-party vendor breach exposing customer data
The incident reflects the persistent vulnerability of financial services supply chains in Hong Kong, a major international financial hub operating under the "One Country, Two Systems" framework.
highbug_reportVulnerabilityPyPI supply-chain attack: 19 science packages compromised with malware
19 science-focused Python packages on PyPI, collectively downloaded hundreds of thousands of times. Specific package names and versions not disclosed in summary. Affects Python developers using PyPI packages in scientific/research workflows.
highperson_alertThreat ActorNSO Group linked to WhatsApp spear-phishing campaigns
NSO Group is an Israeli cyber intelligence firm that develops and sells commercial surveillance technology, primarily the Pegasus spyware platform. The company markets its tools to government clients for lawful interception and intelligence gathering…
highperson_alertThreat ActorMeta blocks NSO Group spear-phishing targeting WhatsApp users
NSO Group is an Israeli commercial surveillance vendor that develops and sells offensive cyber capabilities, primarily the Pegasus spyware platform, to government clients.
highbug_reportVulnerabilityThree high-severity XSS flaws in VMware Telco Cloud and Aria Operations
VMware Telco Cloud/vSphere Foundation and VMware Aria Operations. Specific affected versions not provided in advisory; consult VMware security bulletin for version details.
highpublicGeopoliticalOxford University CareerConnect platform breached via third-party provider
The breach of Oxford University's CareerConnect platform represents a supply chain compromise affecting a high-value target within the United Kingdom's higher education sector.