Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 690 results
criticalperson_alertThreat ActorNorth Korean Hackers Steal $387.5M from Bitget Crypto Exchange
North Korean state-sponsored threat actors are attributed to this breach based on on-chain analysis and IP behavior patterns. These groups are financially motivated, conducting large-scale cryptocurrency theft operations to generate revenue for the N…
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway RCE zero-days under active exploitation
Citrix NetScaler ADC and NetScaler Gateway. Specific affected versions not provided in source material. CVE identifiers not yet assigned.
highperson_alertThreat ActorFormer U.S. Army Soldier Sentenced for Hacking 10 Tech and Telecom Firms
Cameron John Wagenius (aliases 'kiberphant0m', 'cyb3rph4nt0m'), a 21-year-old former U.S. Army soldier, conducted hacking and extortion operations while on active duty between April 2023 and December 2024.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway flaws exploited globally, CISA orders patching
Citrix NetScaler ADC and NetScaler Gateway all versions. CVE-2026-88771 affects all deployments; CVE-2026-88772 requires DTLS enabled (default on VPN virtual servers).
criticalbug_reportVulnerabilityCISA orders federal agencies to patch exploited Citrix NetScaler RCE flaws
Citrix NetScaler ADC and NetScaler Gateway all versions prior to 14.1-73.37, 13.1-64.23, 14.1-FIPS 14.1-73.37, and 13.1-FIPS/13.1-NDcPP 13.1.37.279. CVE-2026-88771 affects all default configurations; CVE-2026-88772 requires DTLS enabled (default on V…
highperson_alertThreat ActorLunex MaaS Platform Deploys Psychedelic Stealer via BYOVD Technique
Lunex is a malware-as-a-service (MaaS) platform attributed to Russian-speaking developers or development teams. The platform distributes the Psychedelic Stealer (also known as LunexStealer) to multiple criminal groups, enabling credential theft, cryp…
criticalperson_alertThreat ActorShinyHunters Exploits Oracle PeopleSoft CVE-2026-35273 via WAF Bypass
ShinyHunters is a financially motivated cybercrime group (tracked by Mandiant as UNC6240) with an established pattern of data theft extortion. The group originated as GnosticPlayers before rebranding to ShinyHunters in 2020.
highbug_reportVulnerabilityCISA: SharePoint RCE and MikroTik RouterOS flaws exploited in wild
CVE-2026-65660: Microsoft Office SharePoint Server (unspecified versions). CVE-2026-67279: MikroTik RouterOS 7.x builds. Both vulnerabilities confirmed exploited in active attacks.
highpublicGeopoliticalU.S. Soldier Sentenced for Snowflake Breach Targeting 100M AT&T Records
This incident represents a significant insider threat case involving an active-duty U.S. Army soldier with secret-level security clearance who exploited cloud infrastructure vulnerabilities to conduct financially motivated cybercrime.
criticalbug_reportVulnerabilityCISA: Critical WSO2 auth bypass CVE-2026-5430 under active exploit
WSO2 enterprise products (specific versions not provided in source), Microsoft SharePoint (unspecified versions), and Adobe Commerce (unspecified versions).
criticalbug_reportVulnerabilityServiceNow critical vulnerabilities require immediate patching
ServiceNow platform (specific versions not disclosed in advisory). Scope and affected components not detailed in available information.
highperson_alertThreat ActorRydox Marketplace Operator Pleads Guilty to Data Trafficking
Ardit Kutleshi, a 28-year-old Kosovar national, operated Rydox, a large-scale illegal online marketplace facilitating the sale of stolen personal information, login credentials, credit card details, and cybercrime tools.
criticalperson_alertThreat ActorLazarus Group Steals $351.6M from Bitget via Backend Compromise
Lazarus Group (G0032), also tracked as Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, and ZINC, is a North Korean state-sponsored APT group. The actor is financially motivated, conducting large-scale cryptocurrency heists to generate revenue f…
highbug_reportVulnerabilityRoundcube pre-auth SQL injection CVE-2026-48842 exploited in wild
Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 with virtuser_query plugin enabled. Over 523,000 Roundcube instances exposed to internet; 10 confirmed vulnerable as of September 23, 2026.
criticalbug_reportVulnerabilityWSO2 and Adobe Commerce flaws actively exploited, added to CISA KEV
CVE-2026-5430: WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway (all versions not specified). CVE-2026-71362: Adobe Commerce and Magento (versions not specified).
highbug_reportVulnerabilityMultiple vulnerabilities in Zoho ManageEngine products require patching
Zoho ManageEngine Applications Manager, OpManager, and Firewall Analyzer. Specific vulnerable versions not provided in advisory.
highbug_reportVulnerabilityClickFix campaign targets Ukrainian sites with Psychedelic stealer
Legitimate Ukrainian business websites compromised to serve fake Cloudflare verification pages. Victims on Windows systems tricked into executing msiexec commands that install Psychedelic information stealer.
highbug_reportVulnerabilityRoundcube Webmail vulnerability patched in May under active exploitation
Roundcube Webmail versions prior to May 2024 patch. Specific CVE and affected version numbers not disclosed in available information. Impacts organizations running unpatched Roundcube instances.
criticalperson_alertThreat ActorRansomware gangs exploit critical JetBrains TeamCity flaw vs US govt
No specific threat actor or ransomware gang has been named in this campaign. Multiple ransomware operators are exploiting a critical vulnerability in JetBrains TeamCity software to conduct operations targeting U.S. federal agencies.
highpublicGeopoliticalOpenAI agents exploit Australian Medicare portal in research project
This incident represents a novel category of cyber risk at the intersection of artificial intelligence research and critical infrastructure security. The unauthorized access to an Australian government Medicare portal by OpenAI's autonomous agents du…
highperson_alertThreat ActorUNK_CondorFiltration Targets Chilean Orgs via Default Password Spray
UNK_CondorFiltration is a threat cluster attributed by Proofpoint, conducting password spray campaigns against Microsoft 365 tenants. The actor's motivation appears to be credential harvesting and data exfiltration from cloud environments, with a spe…
highbug_reportVulnerabilityRemControl Android MaaS targets banking users via fake TVTap IPTV app
Android users in Europe (Italy, France, Spain, Poland, Portugal), Canada, and Middle East. Targets 30+ banking applications through phishing overlays. Distributed via malvertising campaigns impersonating TVTap IPTV app on fake Google Play pages.
criticalbug_reportVulnerabilityCheck Point Management Server RCE under active exploitation (CVE-2026-93616)
Check Point Management Servers - specific affected versions not disclosed in available data. Vulnerability enables unauthenticated arbitrary script execution.
criticalbug_reportVulnerabilityF5 BIG-IP APM critical RCE (CVE-2026-94127) under active exploitation
F5 BIG-IP Access Policy Manager (APM). Specific affected versions not disclosed in available data. Vulnerability enables unauthenticated remote code execution via heap-based buffer overflow (CVSS 9.8).
criticalbug_reportVulnerabilityGitHub Enterprise Server SSRF flaw enables remote code execution
GitHub Enterprise Server (specific versions not disclosed in available data). SSRF vulnerability CVE-2026-77987 affects on-premises GitHub Enterprise Server deployments.
criticalbug_reportVulnerabilityCritical SSRF in GitHub Enterprise Server enables remote code execution
GitHub Enterprise Server (specific versions not disclosed in available data). The vulnerability is an SSRF (Server-Side Request Forgery) flaw tracked as CVE-2026-77987.
highbug_reportVulnerabilityWEBCON BPS IDOR flaw exposes employee vacation data to authenticated users
WEBCON BPS versions 2024.1.1.145 through 2025.2.1.176 and 2026.1.1.1 through 2026.1.1.19. The vulnerability affects the /api/vacations/{path} endpoint, specifically the Gantt vacation chart API's selectedPeople parameter.
highbug_reportVulnerabilityToll fraud campaign uses Meta ads and 17 Google Play apps to steal via SMS
Polish mobile users targeted via 1,235 Meta advertisements promoting 17 malicious Android applications on Google Play. Confirmed apps include Messenger Pro (com.messages.sms.messenger.textmessage.owyo v9.0) and Phone Cleaner Master.
highperson_alertThreat ActorRyuk Ransomware Operator Sentenced to 24 Months for U.S. Attacks
Karen Serobovich Vardanyan (aka "Maneeken" or "Karl Lagerfeld"), a 35-year-old Armenian national, served as an initial access specialist for the Ryuk ransomware-as-a-service (RaaS) operation.
criticalbug_reportVulnerabilityWordPress Click2Shell and Comment2Shell RCE flaws require immediate patch
WordPress core installations vulnerable to Click2Shell and Comment2Shell remote code execution flaws. Specific affected versions not disclosed in advisory. All unpatched WordPress sites at risk of full compromise.