Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
satellite_altDaily BriefCyber Threat Daily Brief — October 28, 2026
Today's briefing: 9 critical and 29 high-severity threats. A total of 45 detailed analyses covering vulnerabilities, threat actors, and geopolitical context.
Latest Reports
26 / 1692 results
criticalbug_reportVulnerabilityRejetto HFS session forgery flaw under active exploitation for RCE
Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0. Version 3.2.1 (released July 2026) contains the patch. All unpatched instances exposed to the internet are at risk.
highbug_reportVulnerabilityCitrix NetScaler zero-day CVE-2026-88779 exploited in SAML attacks
Citrix NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.41, 13.1-64.28, 14.1-FIPS 14.1-73.41, and 13.1-FIPS/13.1-NDcPP 13.1-37.282. Only deployments configured as SAML service provider (SP) or SAML identity provider (IdP) are vulnerable.
criticalbug_reportVulnerabilityCitrix NetScaler SAML zero-day CVE-2026-88779 exploited for DoS, RCE suspected
Citrix NetScaler ADC and NetScaler Gateway appliances with SAML authentication enabled (Gateway or AAA functionality). Vulnerable versions include all releases prior to 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282 (NDcPP/FIPS).
highperson_alertThreat ActorShinyHunters Member "Rey" Detained in Jordan, Cooperating with FBI
ShinyHunters is a prolific cybercriminal group specializing in data theft, extortion, and breach operations. Originating around April-May 2020, the group evolved from earlier extortion-focused collectives TheDarkOverlord and GnosticPlayers.
highperson_alertThreat ActorTA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
TA419 is a China-aligned, espionage-motivated threat actor attributed by Proofpoint. Active since at least April 2025, the group conducts credential phishing campaigns targeting individuals at U.S.
highperson_alertThreat ActorShinyHunters Member "Rey" Detained in Jordan, Cooperating with FBI
ShinyHunters is a cybercrime group specializing in data theft and extortion operations. The group has gained notoriety for breaching organizations, exfiltrating sensitive data, and either selling stolen databases on underground forums or leveraging t…
highperson_alertThreat ActorChina MSS Funded 100+ U.K. Academics via CGTRI Front Company
China's Ministry of State Security (MSS) is the principal civilian intelligence agency of the People's Republic of China, responsible for counterintelligence, foreign intelligence, and political security.
criticalperson_alertThreat ActorWarlock exploits SharePoint flaws to deploy ransomware in Iberia
Warlock (also tracked as Gold Salem, Longlegs, Storm-2603) is a suspected China-linked threat actor that gained prominence in mid-2025 through zero-day exploitation of Microsoft SharePoint vulnerabilities dubbed "ToolShell." The group is attributed b…
highpublicGeopoliticalDTU breach exposes 200,000 records via compromised IAM credentials
The breach at Denmark's Technical University (DTU) represents a significant compromise of a critical research and education institution within a NATO member state and key European Union partner.
highperson_alertThreat ActorWarlock: China-Linked Ransomware Group Targets Critical Infrastructure
Warlock is a China-linked ransomware group that has demonstrated a focus on critical infrastructure and public sector targets. The actor's motivation appears to align with both financial gain through ransomware operations and potential strategic inte…
criticalbug_reportVulnerabilityGitLab AI Gateway RCE flaw (CVE-2026-90970) affects self-hosted instances
GitLab AI Gateway versions 18.1.6 through 19.4.0 on self-hosted deployments. Authenticated users with Duo Agent Platform access can exploit. GitLab.com, GitLab Dedicated, and self-managed instances using GitLab-hosted gateways are NOT affected.
highperson_alertThreat ActorChina-Nexus Actor UAT-11587 Deploys Antino Backdoor Across Asia
UAT-11587 is a China-nexus threat actor tracked by Cisco Talos, first detected in September 2025 targeting Taiwan's academic, think tank, and civil society policy community.
criticalbug_reportVulnerabilityDell CSM critical flaws allow unauthenticated admin access on Kubernetes
Dell Container Storage Modules (CSM) all versions prior to 1.17.0. Fixed in version 1.18.0. Affects csm-authorization-storage gRPC server, authorization proxy, tenant service, ContainerStorageModule Custom Resource reconciler, CSM Authorization modul…
criticalbug_reportVulnerabilityGitLab AI Gateway critical RCE allows arbitrary command execution
GitLab AI Gateway service. Specific affected versions not disclosed in available information. Impacts organizations running GitLab instances with AI Gateway enabled.
highperson_alertThreat ActorTren de Aragua sanctioned for $40M ATM jackpotting campaign
Tren de Aragua (TdA) is a Venezuelan transnational criminal organization designated by the U.S. Treasury as a Transnational Criminal Organization in July 2024 and by the State Department as a Foreign Terrorist Organization in February 2025.
criticalbug_reportVulnerabilityDell CSM Authorization flaws allow unauthenticated admin takeover
Dell Container Storage Modules (CSM) Authorization module, versions prior to 1.18.0. Affects environments integrating Dell PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT storage arrays with Kubernetes.
criticalbug_reportVulnerabilityFortiMail vulnerability under active exploitation, immediate patching required
Fortinet FortiMail email security appliances. Specific affected versions not disclosed in available information. CVE identifier not yet assigned or not publicly disclosed.
highperson_alertThreat ActorMicrosoft X Account Hijacked in Cryptocurrency Pump-and-Dump Scheme
The threat actors behind this incident remain unidentified. Their motivation appears to be financial gain through a cryptocurrency pump-and-dump scheme, leveraging the compromise of Microsoft's official X (formerly Twitter) account with over 13 milli…
criticalbug_reportVulnerabilityFortinet FortiMail zero-day CVE-2026-104286 exploited for file writes
Fortinet FortiMail versions 7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6, and 8.0.0-8.0.1. Unauthenticated remote attackers can write arbitrary files via path traversal and null byte injection flaws in HTTP/HTTPS handlers.
criticalbug_reportVulnerabilityFortinet FortiMail critical RCE (CVE-2026-104286) exploited in the wild
Fortinet FortiMail appliances. Specific affected versions not disclosed in available information. Vulnerability enables remote code execution or command execution on vulnerable devices.
criticalbug_reportVulnerabilityCitrix NetScaler zero-day exploited in Finland before patches released
Citrix NetScaler ADC and Gateway versions 13.1 and 14.1 (including FIPS and NDcPP variants) released before September 27, 2026 patches. Internet-facing instances at highest risk.
highperson_alertThreat ActorSpanish Police Arrest 16-Year-Old Administrator of KillSec Ransomware Group
KillSec is a ransomware-as-a-service (RaaS) operation attributed to a Spain-based 16-year-old suspected administrator and a distributed network of operators across Europe.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway under active attack in Finland
Citrix NetScaler ADC and NetScaler Gateway (all unpatched versions). Eight CVEs (CVE-2026-88771 through CVE-2026-88778) with CVSS 4.0 scores 7.0–9.5 (High to Critical).
highperson_alertThreat ActorKillSec Ransomware Gang Dismantled in Operation KillSwitch
KillSec is a ransomware and data extortion gang active since approximately 2024. The group is allegedly led by a 16-year-old administrator, with other key members including an 18-year-old developer (who was a minor during some alleged crimes), a nego…
highpublicGeopoliticalGovernment sector cyber threats surge to 27% in Microsoft 2026 report
Microsoft's 2026 Digital Defense Report reveals a substantial escalation in cyber threat activity targeting government agencies, which now represent 27% of observed incidents—a 59% relative increase from 17% in 2025.
criticalbug_reportVulnerabilityKiteworks patches critical code injection flaw in Email Protection Gateway
Kiteworks Email Protection Gateway (EPG) all versions before 9.4.1. EPG is part of the Kiteworks Private Content Network used by thousands of global corporations and government agencies with over 100 million end-users.