Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
satellite_altDaily BriefCyber Threat Daily Brief — October 28, 2026
Today's briefing: 9 critical and 29 high-severity threats. A total of 45 detailed analyses covering vulnerabilities, threat actors, and geopolitical context.
Latest Reports
29 / 1786 results
highperson_alertThreat ActorUAC-0099 Deploys ASHVEIN RAT Against Ukrainian Government Targets
UAC-0099 is a Russia-aligned threat actor first documented by CERT-UA in June 2023, actively targeting Ukrainian government, defense, border guard, and logistics entities since at least mid-2022 following Russia's full-scale invasion of Ukraine.
criticalbug_reportVulnerabilityFive critical RCE flaws in Cisco NX-OS allow root takeover of Nexus switches
Cisco Nexus 3000 and 9000 Series switches running NX-OS in standalone mode. Exploitation requires NX-API, Next Generation OAM (NGOAM), or MPLS OAM features to be enabled. Nexus 7000 and Nexus 9000 in ACI mode are not affected.
highbug_reportVulnerabilityARTEX AI pentesting tool used in data theft attacks on South Korean banks
South Korean financial organizations targeted between late September and early October 2026. ARTEX open-source AI pentesting tool (now closed-source) leveraged with DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 LLMs.
highpublicGeopoliticalMaryland Man Convicted for $53M Uranium Finance Cryptocurrency Heist
This case represents a significant milestone in U.S. law enforcement's evolving approach to decentralized finance (DeFi) crime. The conviction of Jonathan Spalletta for exploiting smart contract vulnerabilities in Uranium Finance underscores the Just…
highperson_alertThreat ActorChina-Linked Actors Target Global Networks via Integrity Tech
China-linked malicious cyber actors enabled by Integrity Technology Group (Integrity Tech), a China-based company with links to the Chinese Government. The company was sanctioned by the UK government in 2025 for malicious cyber activity against the U…
highperson_alertThreat ActorASOS Data Breach: Social Engineering and Credential Theft Campaign
The threat actor behind this incident identifies themselves as "Xuanye Group." No attribution to known APT groups or established cybercrime syndicates has been made.
highbug_reportVulnerabilityWazza phishing kit uses multi-stage routing to evade detection
Banking, government, and manufacturing organizations in the US, EU, and Australia. The kit uses wildcard domains (e.g., boegl-krysl[.]eu) and Cloudflare Workers infrastructure (beacon-surge-sync[...]workers[.]dev) to deliver Adobe-themed Device Code…
highbug_reportVulnerability16 malicious Firefox extensions steal crypto wallet keys and recovery phrases
Mozilla Firefox users who installed any of 16 malicious extensions impersonating Rabby Wallet (4 extensions) and OKX Wallet (12 extensions). Extensions masqueraded as wallet portals, desktop utilities, and browser tools.
criticalbug_reportVulnerabilityHPE ClearPass Policy Manager RCE and admin access flaws require patching
HPE Networking ClearPass Policy Manager - specific affected versions not disclosed in available information. Product is a network access control (NAC) solution used for policy management and authentication.
highperson_alertThreat ActorU.S. offers $10M reward for HAFNIUM actor Zhang Yu in Exchange attacks
HAFNIUM (also tracked as Silk Typhoon, Operation Exchange Marauder) is a Chinese state-sponsored APT group attributed by Microsoft and the U.S. government to China's Ministry of State Security (MSS).
highperson_alertThreat ActorZohar Pinhasi Charged with $19M Ransomware Victim Fraud Scheme
Zohar Pinhasi (also known as Zack Silver and Zack Green) is a 50-year-old U.S. and Israeli national who owned and operated MonsterCloud, a Florida-based company purporting to offer ransomware recovery services. Pinhasi is charged by the U.S.
criticalbug_reportVulnerabilityTensorlake npm package 0.5.144 compromised with Shai-Hulud worm
npm package "tensorlake" version 0.5.144 (TypeScript SDK for Tensorlake applications). Malicious version no longer available on npm registry. Affects users who installed this specific version, particularly those with access to CI/CD pipelines, cloud…
highbug_reportVulnerabilityWeb3-based C2 in supply chain attacks targets cloud credentials via npm
Enterprise cloud environments using open-source dependencies from npm, Go modules, and Packagist registries. Specifically impacts developer workstations and CI/CD pipelines with access to cloud IAM tokens, service account keys, and deployment secrets…
highperson_alertThreat ActorFortiBleed Campaign Exploits Leaked Credentials to Compromise FortiGate VPNs
FortiBleed refers to a large-scale credential-harvesting and access-brokering campaign discovered in June 2026, when attackers inadvertently exposed a server containing usernames and plaintext passwords for 73,932 Fortinet FortiGate firewall URLs acr…
highbug_reportVulnerabilityHackers hijack Google domains via compromised ccTLD registries for Ghana, AS, SL
Domains under .GH (Ghana), .AS (American Samoa), and .SL (Sierra Leone) ccTLDs. Google domains and multiple global brands affected. Third-party registry operators for these ccTLDs were compromised.
highbug_reportVulnerabilityAttackers hijack .gh, .sl, .as registries to issue fraudulent Google certs
All domains under .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTLDs. Confirmed fraudulent certificates issued for Google and YouTube domains between September 22-27, 2026.
highbug_reportVulnerabilityMALFEX campaign: 8 malicious npm packages deliver Overlord RAT, 40K+ downloads
npm ecosystem; 8 malicious packages (tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, function-flag, function-color, cdn-img-fetch) with 40,767 total downloads since August 2023.
criticalbug_reportVulnerabilitySonicWall SMA1000 CVSS 10.0 pre-auth SSRF allows internal access
SonicWall SMA1000 appliances (models 6210, 7210, 8200v) running platform-hotfix versions 12.4.3-03526 and older, or 12.5.0-02952 and older. The critical flaw (CVE-2026-102255) affects the WorkPlace portal.
criticalbug_reportVulnerabilityCritical RCE in LMCache (CVE-2026-105192) allows unauthenticated code execution
LMCache versions 0.3.9 through 0.5.5 (including 0.5.6 release candidates and development branch) when multiprocess mode is configured with routable network addresses. Also affects vLLM deployments using LMCache multiprocess connector.
highperson_alertThreat ActorCanto Incognito Targets AI/LLM Infrastructure for Crypto Mining Botnet
Canto Incognito is a financially motivated threat actor attributed with moderate confidence to an Italian-speaking operator based on Italian-language artifacts and netflow indicators.
highbug_reportVulnerabilityPoeLLM botnet compromises 3,400+ AI servers for cryptomining
Exposed AI services including LiteLLM, Ollama, Gotenberg PDF converter, Gitea development toolkit, and Ivanti Sentry. Over 3,400 servers compromised globally, primarily in the United States and Western Europe.
criticalbug_reportVulnerabilityHPE AOS-Switch auth bypass and buffer overflow require immediate patching
HPE Networking AOS-Switch (AOS-S) products. Specific affected versions not provided in source material. Vulnerabilities enable authentication bypass and buffer overflow leading to unauthorized access and arbitrary code execution.
criticalbug_reportVulnerabilitySonicWall SMA1000 pre-auth SSRF and post-auth RCE require urgent patching
SonicWall SMA1000 series appliances. Specific affected versions not provided in source material. Two vulnerabilities: pre-authentication SSRF and post-authentication RCE.
highperson_alertThreat ActorRansomware Groups Target Backup Infrastructure to Eliminate Recovery
This analysis covers a tactical shift across multiple ransomware groups rather than a single named threat actor. Groups including ALPHV/BlackCat, BlackMatter, and Gunra have adopted backup destruction as a standard component of their operations.
highperson_alertThreat ActorShinyHunters Leader Detained in Jordan, Cooperating with FBI
ShinyHunters is a prolific data theft and extortion group attributed to multiple high-profile breaches. The suspected leader, a teenager from Amman, Jordan operating under the handle "Rey" (identified as Saif Al-din Khader), was detained by Jordanian…
criticalbug_reportVulnerabilityAtlassian CVE-2026-21589 exploited in wild after PoC release
Self-hosted Atlassian Data Center products: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Unauthenticated arbitrary file read vulnerability.
highbug_reportVulnerabilityFBI warns FortiBleed campaign actively harvesting Fortinet credentials
Internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. All versions using legacy SHA-256 password storage are vulnerable. Over 86,644 device credentials compromised across 194 countries as of June 2026.
criticalbug_reportVulnerabilityAtlassian Data Center CVE-2026-21589 exploited within 2 hours of disclosure
Atlassian Data Center products: Bitbucket (versions before 9.4.26, 10.2.8, 10.5.1), Confluence (before 9.2.26, 10.2.19), Jira Service Management and Software (before 5.12.40/9.12.40, 10.3.26, 11.3.12), Bamboo (before 10.2.24, 12.1.12), Crowd (before…
criticalbug_reportVulnerabilitySonicWall SMA1000 gateways vulnerable to unauthenticated SSRF flaw
SonicWall SMA1000 series appliances: models 6210, 7210, and 8200v. The vulnerability (CVE-2026-102255) affects the Appliance WorkPlace interface. SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected.