Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1048 results
criticalbug_reportVulnerabilityCitrix NetScaler zero-day CVE-2026-88772 exploited for web shells, root access
Citrix NetScaler ADC and Gateway appliances with DTLS enabled. CVE-2026-88772 is a memory overflow vulnerability leading to remote code execution. CVE-2026-88771 (unauthenticated RCE) also disclosed alongside it.
criticalbug_reportVulnerabilityWatchGuard RCE vulnerabilities require immediate patching per CERT.BE
WatchGuard products (specific models and versions not disclosed in available information). Two remote code execution vulnerabilities identified.
highbug_reportVulnerabilityNew Spectre-v2 BTR variant bypasses defenses, leaks Linux kernel memory
JIT engines in Mozilla Firefox (SpiderMonkey), GraalVM, and Linux kernel cBPF JIT across Intel, AMD, and other CPU vendors. Affects systems with speculative execution despite existing Spectre-v2 mitigations.
highbug_reportVulnerabilityNew Spectre v2 BTR variant leaks Linux root hashes in 3-5 minutes on Intel
Intel, AMD, and Arm CPUs with indirect branch prediction. Confirmed exploitable on Linux kernel cBPF (default and constant blinding configurations). Firefox SpiderMonkey and Oracle GraalVM also affected but full exploits not demonstrated.
criticalbug_reportVulnerabilityKiteworks patches critical flaw found during precautionary shutdown
Kiteworks secure file transfer platform; specific versions not disclosed. Vulnerability confined to a capability enabled for less than 1% of customer base. Other Kiteworks products unaffected.
highbug_reportVulnerabilityDas U-Boot out-of-bounds write allows code execution via fragmented IP
Das U-Boot versions 2009.08 through 2026.07 (pre-fix) when compiled with CONFIG_IP_DEFRAG=y. Das U-Boot is a widely-deployed open-source bootloader used in embedded systems, IoT devices, and network equipment.
highbug_reportVulnerabilityMCP Python SDK flaw lets malicious servers steal OAuth credentials
Anthropic MCP Python SDK versions 1.9.1–1.29.1 (1.x line) and 2.0.0–2.1.1 (2.x line). Affects MCP clients using HTTP with OAuth providers (OAuthClientProvider, ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider, RFC7523OAuthClientProvider) th…
highbug_reportVulnerabilityApple patches CoreGraphics out-of-bounds write exploited in targeted attacks
CVE-2026-86950 affects CoreGraphics in iOS versions before 26.7.1, iPadOS before 26.7.1, macOS Tahoe before 26.7.1, and macOS Sequoia before 15.8.1. Impacted devices include iPhone 11 and later, iPad Pro (3rd gen 12.9-inch and 1st gen 11-inch and lat…
criticalbug_reportVulnerabilityBitget exchange loses $388M via zero-day in unnamed third-party product
Bitget cryptocurrency exchange. The unnamed third-party security product used by Bitget contained a zero-day vulnerability that allowed credential theft. Hot and warm wallets were compromised; cold wallets unaffected.
criticalbug_reportVulnerabilityCitrix NetScaler zero-days CVE-2026-88771/88772 exploited in wild
Citrix NetScaler ADC and NetScaler Gateway devices. Specific vulnerable versions not disclosed in advisory. Cortex Xpanse telemetry identifies 50,277 exposed instances potentially vulnerable as of Sept. 27, 2026.
highbug_reportVulnerabilityZimbra XSS vulnerabilities require immediate patching per CERT.BE
Zimbra Collaboration Suite - specific affected versions not disclosed in available advisory. Multiple Cross-site Scripting (XSS) vulnerabilities identified.
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway flaws under active global exploitation
Citrix NetScaler ADC and Gateway appliances. CVE-2026-88771 (improper input validation allowing unauthenticated remote command execution) and CVE-2026-88772 (remote code execution or denial-of-service).
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway under active attack via two RCE flaws
Citrix NetScaler ADC and Gateway on-premises: versions 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS editions before 14.1-73.37 FIPS and 13.1-37.279. Cloud-managed instances not affected.
highbug_reportVulnerabilityCarbonato botnet exploits exposed Docker daemons to deploy AI agents
Docker daemons exposed without authentication on TCP port 2375. All versions of Docker with unauthenticated remote API access are vulnerable. The malware deploys Hermes AI Agent framework and establishes Telegram-based command and control.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway RCE zero-days under active exploitation
Citrix NetScaler ADC and NetScaler Gateway. Specific affected versions not provided in source material. CVE identifiers not yet assigned.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway flaws exploited globally, CISA orders patching
Citrix NetScaler ADC and NetScaler Gateway all versions. CVE-2026-88771 affects all deployments; CVE-2026-88772 requires DTLS enabled (default on VPN virtual servers).
criticalbug_reportVulnerabilityCISA orders federal agencies to patch exploited Citrix NetScaler RCE flaws
Citrix NetScaler ADC and NetScaler Gateway all versions prior to 14.1-73.37, 13.1-64.23, 14.1-FIPS 14.1-73.37, and 13.1-FIPS/13.1-NDcPP 13.1.37.279. CVE-2026-88771 affects all default configurations; CVE-2026-88772 requires DTLS enabled (default on V…
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway: 2 critical RCE flaws under active exploit
Citrix NetScaler ADC and NetScaler Gateway versions 13.1 before 13.1-64.23, 14.1 before 14.1-73.37, and FIPS editions. CVE-2026-88771 affects all deployments (no preconditions).
criticalbug_reportVulnerabilityCitrix NetScaler RCE zero-days CVE-2026-88771/88772 exploited in wild
Citrix NetScaler ADC and NetScaler Gateway: versions 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS editions before 14.1-73.37 FIPS and 13.1-37.279, and Secure Private Access Hybrid deployments.
highbug_reportVulnerabilityCloudflare patches cross-tenant data leak in Containers service
Cloudflare Containers and Sandboxes service, available to Workers Paid plan customers. All customers using Containers on shared physical hosts were potentially affected.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway RCE zero-days exploited in the wild
Citrix NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.37, 13.1-64.23, and corresponding FIPS/NDcPP releases. CVE-2026-88771 affects all deployments including default configurations.
highbug_reportVulnerabilityCompromised GitHub Actions re-enabled with malicious code for 7+ days
Two third-party GitHub Actions previously compromised in Mini Shai-Hulud campaign. Specific action names not disclosed. Affects any workflows consuming these actions during the exposure window (7+ days).
highbug_reportVulnerabilityElementor WordPress plugin CSRF flaw enables admin account takeover via link
Elementor Website Builder WordPress plugin versions 4.3.0 and 4.3.1 only. Affects over 2 million active installations. Fixed in version 4.3.2.
highbug_reportVulnerabilityCISA: SharePoint RCE and MikroTik RouterOS flaws exploited in wild
CVE-2026-65660: Microsoft Office SharePoint Server (unspecified versions). CVE-2026-67279: MikroTik RouterOS 7.x builds. Both vulnerabilities confirmed exploited in active attacks.
highbug_reportVulnerabilityKiteworks urges global server shutdown for zero-day threat mitigation
Kiteworks secure file-sharing platform, all customer deployments worldwide. Specific affected versions not disclosed. Zero-day vulnerability details not yet public.
highbug_reportVulnerabilityElementor WordPress plugin CSRF flaw enables admin account creation
Elementor plugin for WordPress. Specific affected versions not disclosed in available data. Impacts WordPress sites using the Elementor page builder plugin.
criticalbug_reportVulnerabilityCISA: Critical WSO2 auth bypass CVE-2026-5430 under active exploit
WSO2 enterprise products (specific versions not provided in source), Microsoft SharePoint (unspecified versions), and Adobe Commerce (unspecified versions).
highbug_reportVulnerabilityGitHub Actions repos re-enabled with Mini Shai-Hulud malware intact
Two GitHub Actions repositories (actions-cool/issues-helper and actions-cool/maintain-one-comment) compromised in May 2026. Any CI/CD workflows referencing these actions by version tags (e.g., v2.2.1 or later from May 18, 2026) executed malicious pay…
criticalbug_reportVulnerabilityServiceNow critical vulnerabilities require immediate patching
ServiceNow platform (specific versions not disclosed in advisory). Scope and affected components not detailed in available information.
highbug_reportVulnerabilityRoundcube pre-auth SQL injection CVE-2026-48842 exploited in wild
Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 with virtuser_query plugin enabled. Over 523,000 Roundcube instances exposed to internet; 10 confirmed vulnerable as of September 23, 2026.