Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 684 results
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager auth bypass exploited in the wild
Cisco Catalyst SD-WAN Manager, all vulnerable versions prior to patched releases. The vulnerability (CVE-2026-76504) affects the API authentication mechanism due to improper URI encoding handling in HTTP requests.
criticalpublicGeopoliticalPentagon DMDC breach exposes 3M military personnel records
The breach of the Defense Manpower Data Center represents a significant compromise of U.S. military human capital data, affecting nearly 3 million service members over a nine-month period from October 2025 to July 2026.
criticalbug_reportVulnerabilityWatchGuard Fireware OS critical RCE flaw requires immediate patching
WatchGuard Fireware OS - specific versions not disclosed in available data. Affects WatchGuard firewall appliances running vulnerable Fireware OS versions.
highperson_alertThreat ActorStar Blizzard deploys CosmicPulse backdoor via new RedFlick technique
Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor active since 2017. The group is attributed to Russian intelligence services and is motivated by espionage objectives aligned with R…
highbug_reportVulnerabilityZammad zero-days CVE-2026-102489/102490 exploited in AI-driven breach
Zammad open-source ticketing system, all versions prior to version 7. Both self-hosted and hosted deployments affected. Over 2,000 customers and 55,000 users globally, including enterprise and nonprofit organizations.
criticalbug_reportVulnerabilityCritical pre-auth RCE in MikroTik RouterOS (CVE-2026-84411)
MikroTik RouterOS versions below 7.24. Vulnerability exists in web management service HTTP request handling. Widely deployed in critical infrastructure and enterprise networks.
highperson_alertThreat ActorCSuite Campaign Steals M365 Sessions, Deploys RMM Tools via Phishing
CSuite is a phishing campaign targeting C-suite executives and high-value business users, primarily in the United States. The campaign was analyzed across 351 sandbox submissions, with 51% originating from the US, followed by India (18%), and additio…
criticalbug_reportVulnerabilityCitrix NetScaler CVE-2026-88772 exploited for root access, web shells
Citrix NetScaler ADC and NetScaler Gateway appliances. CVE-2026-88772 (CVSS 9.5) is a memory overflow in DTLS protocol handling in the NetScaler Packet Processing Engine (NSPPE). CVE-2026-88771 also mentioned as exploited.
highperson_alertThreat ActorFBI warns ShinyHunters members to surrender after Dutch arrest
ShinyHunters is a financially motivated cybercrime group linked to extortion activities targeting organizations in the United States, Netherlands, and globally.
criticalbug_reportVulnerabilityCritical XSS vulnerability in Rancher Kubernetes platform requires patching
Rancher Kubernetes management platform. Specific affected versions not disclosed in available information.
criticalbug_reportVulnerabilityWatchGuard RCE vulnerabilities require immediate patching per CERT.BE
WatchGuard products (specific models and versions not disclosed in available information). Two remote code execution vulnerabilities identified.
highperson_alertThreat ActorFormer US Air Force Members Sentenced for Multi-Year BEC Fraud
Chijioke Timothy Odimegwu (25) and Harafat Mogaji (26) are former United States Air Force members who conducted business email compromise (BEC) scams and phishing campaigns while stationed at Dover Air Force Base in Delaware.
highpublicGeopoliticalFrench Tax Breach Exposes 600K Records via Stolen Credentials, Weak Controls
The seven-week breach of France's Direction Générale des Finances Publiques (DGFIP) represents a significant compromise of sovereign fiscal infrastructure, exposing tax data on approximately 350,000 individuals and 250,000 businesses.
highperson_alertThreat ActorStar Blizzard Deploys CosmicPulse Backdoor via Fake Event Invitations
Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor attributed by U.S., U.K., Australian, Canadian, and New Zealand security agencies to Center 18 of Russia's Federal Security Service…
highperson_alertThreat ActorAutomated AI Agent Breaches Dutch Cybersecurity Nonprofit DIVD
The threat actor employed an automated AI agent to conduct what DIVD characterized as the first observed "agentic AI-powered attack" against their organization. The actor's identity, motivation, and origin remain unknown.
highperson_alertThreat ActorStar Blizzard Adopts RedFlick Delivery Technique in 2026 Campaigns
Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor attributed by CISA to the FSB Centre 18.
highbug_reportVulnerabilityDas U-Boot out-of-bounds write allows code execution via fragmented IP
Das U-Boot versions 2009.08 through 2026.07 (pre-fix) when compiled with CONFIG_IP_DEFRAG=y. Das U-Boot is a widely-deployed open-source bootloader used in embedded systems, IoT devices, and network equipment.
highperson_alertThreat ActorDutch Police Arrest 24-Year-Old Linked to ShinyHunters Group
ShinyHunters is a financially-motivated cybercrime group known for large-scale data breaches and extortion operations. The group has historically targeted organizations to steal sensitive data for sale or extortion.
highperson_alertThreat ActorKeio Corporation ransomware attack disrupts Japanese rail operator
No specific threat actor has been identified or claimed responsibility for this incident as of the reporting date. The attack targeted Keio Corporation, a major Japanese private railway operator with 85 km of track, 69 stations, and a hospitality div…
highpublicGeopoliticalTimes Car breach exposes 6.6M accounts in Japan mobility sector
The breach of Times Car, a subsidiary of the Park24 Group operating Japan's largest car-sharing network with 29,000 stations nationwide, represents a significant compromise of critical transportation infrastructure data.
highperson_alertThreat ActorDutch Police Arrest Amsterdam Man in ShinyHunters Investigation
ShinyHunters is a cybercrime group known for large-scale data breaches and extortion operations. The group has been active since at least 2020, targeting organizations across multiple sectors to steal and leak sensitive data.
highperson_alertThreat ActorShinyHunters escalates attacks after Dutch arrest of suspected member
ShinyHunters is a prolific cybercrime group known for large-scale data theft and extortion operations. The group operates as a collective with multiple members across jurisdictions.
highbug_reportVulnerabilityZimbra XSS vulnerabilities require immediate patching per CERT.BE
Zimbra Collaboration Suite - specific affected versions not disclosed in available advisory. Multiple Cross-site Scripting (XSS) vulnerabilities identified.
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway under active attack via two RCE flaws
Citrix NetScaler ADC and Gateway on-premises: versions 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS editions before 14.1-73.37 FIPS and 13.1-37.279. Cloud-managed instances not affected.
criticalperson_alertThreat ActorNorth Korean Hackers Steal $387.5M from Bitget Crypto Exchange
North Korean state-sponsored threat actors are attributed to this breach based on on-chain analysis and IP behavior patterns. These groups are financially motivated, conducting large-scale cryptocurrency theft operations to generate revenue for the N…
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway RCE zero-days under active exploitation
Citrix NetScaler ADC and NetScaler Gateway. Specific affected versions not provided in source material. CVE identifiers not yet assigned.
highperson_alertThreat ActorFormer U.S. Army Soldier Sentenced for Hacking 10 Tech and Telecom Firms
Cameron John Wagenius (aliases 'kiberphant0m', 'cyb3rph4nt0m'), a 21-year-old former U.S. Army soldier, conducted hacking and extortion operations while on active duty between April 2023 and December 2024.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway flaws exploited globally, CISA orders patching
Citrix NetScaler ADC and NetScaler Gateway all versions. CVE-2026-88771 affects all deployments; CVE-2026-88772 requires DTLS enabled (default on VPN virtual servers).
criticalbug_reportVulnerabilityCISA orders federal agencies to patch exploited Citrix NetScaler RCE flaws
Citrix NetScaler ADC and NetScaler Gateway all versions prior to 14.1-73.37, 13.1-64.23, 14.1-FIPS 14.1-73.37, and 13.1-FIPS/13.1-NDcPP 13.1.37.279. CVE-2026-88771 affects all default configurations; CVE-2026-88772 requires DTLS enabled (default on V…
highperson_alertThreat ActorLunex MaaS Platform Deploys Psychedelic Stealer via BYOVD Technique
Lunex is a malware-as-a-service (MaaS) platform attributed to Russian-speaking developers or development teams. The platform distributes the Psychedelic Stealer (also known as LunexStealer) to multiple criminal groups, enabling credential theft, cryp…