Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 587 results
criticalbug_reportVulnerabilityCheck Point Security Gateway VPN RCE exploited in the wild since Sept 12
Check Point Security Gateway VPN product (all versions). Vulnerable versions: R81.10, R81.20, R82, R82.10. Also affects Spark firewalls. CVE-2026-85102 impacts VPN certificate-handling; CVE-2026-93616 (Management web service path traversal, exploited…
criticalbug_reportVulnerabilityWordPress CVE-2026-87902 under active exploitation for RCE
WordPress versions 4.7 through 7.1.1. Exploitation requires a theme with a top-level directory starting with 'page-' and a readable local .php file (e.g., pearcmd.php). Official PHP Docker images and cPanel with PHP <8.5 are vulnerable by default.
criticalperson_alertThreat ActorAI-Powered Payment Skimmer Campaign Steals 600K+ Credit Cards
A financially motivated threat actor, believed to be Chinese-speaking based on operational indicators, is conducting large-scale automated attacks against online retailers using open-source AI agent frameworks.
criticalbug_reportVulnerabilityMikroTik RouterOS SSH chain grants unauthenticated admin access
MikroTik RouterOS versions prior to 6.49.21, 7.23.4, and 7.24.2. Affects devices with SSH service exposed to untrusted networks or the Internet. Default home configurations are not exposed, but custom firewall rules may create exposure.
criticalbug_reportVulnerabilityCheck Point Management Server RCE under active exploitation (CVE-2026-93616)
Check Point Management Servers - specific affected versions not disclosed in available data. Vulnerability enables unauthenticated arbitrary script execution.
criticalbug_reportVulnerabilityF5 BIG-IP APM critical RCE (CVE-2026-94127) under active exploitation
F5 BIG-IP Access Policy Manager (APM). Specific affected versions not disclosed in available data. Vulnerability enables unauthenticated remote code execution via heap-based buffer overflow (CVSS 9.8).
criticalbug_reportVulnerabilityGitHub Enterprise Server SSRF flaw enables remote code execution
GitHub Enterprise Server (specific versions not disclosed in available data). SSRF vulnerability CVE-2026-77987 affects on-premises GitHub Enterprise Server deployments.
criticalbug_reportVulnerabilityCritical SSRF in GitHub Enterprise Server enables remote code execution
GitHub Enterprise Server (specific versions not disclosed in available data). The vulnerability is an SSRF (Server-Side Request Forgery) flaw tracked as CVE-2026-77987.
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator zero-day CVE-2026-93952 exploited in wild
Arista VeloCloud Orchestrator (VCO) On-Prem deployments with certificate-based authentication enabled. Hosted deployments running VCO versions below 5.2.3.16 (5.x branch), below 6.4.2.8 (6.x branch), 6.1.3.7 and below, and 7.0.0.2 and below are vulne…
criticalbug_reportVulnerabilitycPanel CalDAV flaw allows hosting account holders to execute code as root
cPanel & WHM version 120 and later (CVE-2026-87899, CVE-2026-68490); WP Toolkit 6.11.2-10794 and older (CVE-2026-87900). Affects shared hosting environments where cPanel is deployed. WP Squared also affected.
criticalbug_reportVulnerabilityF5 BIG-IP APM zero-day enables unauthenticated RCE on OAuth servers
F5 BIG-IP Access Policy Manager (APM) versions 21.1.0, 17.5.0–17.5.1, and 17.1.0–17.1.3, when configured as OAuth authorization servers with APM access policy and OAuth authorization server profile on the same virtual server.
criticalbug_reportVulnerabilityWordPress Click2Shell and Comment2Shell RCE flaws require immediate patch
WordPress core installations vulnerable to Click2Shell and Comment2Shell remote code execution flaws. Specific affected versions not disclosed in advisory. All unpatched WordPress sites at risk of full compromise.
criticalperson_alertThreat ActorShinyHunters Claims FBI Breach via Oracle PeopleSoft Zero-Day
ShinyHunters is a financially-motivated cybercrime group active since 2019, known for large-scale data breaches and extortion operations. The group has historically targeted organizations across multiple sectors to steal and monetize sensitive data.
criticalbug_reportVulnerabilityF5 BIG-IP APM heap overflow (CVE-2026-94127) exploited in the wild
F5 BIG-IP APM versions 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0 when configured with an access policy and OAuth profile on a virtual server. Unauthenticated remote code execution possible.
criticalbug_reportVulnerabilityCheck Point Management Server zero-day exploited in targeted attacks
Check Point Security Management Server: R82.20 (no Jumbo Hotfix), R82.10 (Take ≤44), R82 (Take ≤126), R81.20 (Take ≤166), R81.10 (Take ≤190), and R81/R80.x (all end-of-support versions). The vulnerability affects the management server's web service.
criticalbug_reportVulnerabilityWordPress path traversal flaw enables unauthenticated RCE on some servers
WordPress core versions 4.7.0 through 7.1.1. All installations are vulnerable to path traversal; remote code execution depends on active theme having a folder starting with "page-" and server configuration (register_argc_argv enabled, presence of exp…
criticalbug_reportVulnerabilityBifrost AI Gateway RCE allows unauthenticated command execution via HTTP
Bifrost open-source AI gateway, all versions before transports/v2.1.0. Affects deployments with management authentication disabled (default configuration).
criticalbug_reportVulnerabilityCheck Point Management Server zero-day exploited in the wild
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Fixed in R82.20 Security Hotfix.
criticalbug_reportVulnerabilityOrkes Conductor RCE vulnerability requires immediate patching
Orkes Conductor (specific versions not disclosed in advisory). Remote Code Execution vulnerability affecting systems running the workflow orchestration platform.
criticalbug_reportVulnerabilityMikroTik RouterOS pre-auth RCE chain enables full device takeover
MikroTik RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. All unpatched RouterOS devices with SSH enabled are vulnerable to unauthenticated remote takeover when CVE-2026-67279 and CVE-2026-86060 are chained together.
criticalbug_reportVulnerabilityD-Link DIR-822A routers hit by max-severity zero-day with public exploit
D-Link DIR-822A dual-band Wi-Fi routers (legacy models, all firmware versions). CVE-2026-86296 is a stack-based buffer overflow in the DHCP server component (udhcpcd/serverpacket.c).
criticalbug_reportVulnerabilityCVSS 10.0 VeloCloud Orchestrator flaw actively exploited in wild
Arista VeloCloud Orchestrator (VCO) on-premises deployments using certificate-based Edge authentication. Affected versions: 5.2.3.15 and earlier, 6.1.3.7 and earlier, 6.4.2.7 and earlier, 7.0.0.2 and earlier.
criticalbug_reportVulnerabilityLinux ARM64 KVM flaw allows guest-to-host escape via nested virtualization
Linux kernel ARM64 KVM code with nested virtualization enabled. Affected versions: 6.17 through 6.18.50, 7.0 through 7.2.4, and 7.3-rc pre-releases. Fixed in 6.18.51, 7.2.5, and 7.3-rc1.
criticalbug_reportVulnerabilityThree Linux kernel flaws under active exploitation, CISA orders patching
Linux kernel across distributions. CVE-2025-39964 (critical, 14-year-old race condition in AF_ALG cryptographic socket interface), CVE-2026-53266 (out-of-bounds write in ebtables SNAT), CVE-2025-39682 (TLS receive-path logic flaw with kTLS).
criticalbug_reportVulnerabilityFake LastPass installer uses Microsoft-signed driver to kill EDR and steal passwords
Windows systems where users downloaded a fake LastPass Authenticator installer from a malicious GitHub repository (github.com/LastPass-Authenticator). The attack uses a Microsoft-signed kernel driver (Alinubx.sys, renamed CcProtect.sys from CnCrypt d…
criticalbug_reportVulnerabilityAuthentication bypass in pgAdmin 4 requires immediate patching
pgAdmin 4, a PostgreSQL database management platform. Specific affected versions not disclosed in available information. All pgAdmin 4 installations should be considered at risk until patched.
criticalbug_reportVulnerabilityCritical Synology DiskStation Manager flaw enables data theft and DoS
Synology DiskStation Manager (DSM) - specific affected versions not disclosed in available information. Impacts Synology NAS devices running vulnerable DSM versions.
criticalbug_reportVulnerabilityOrkes Conductor pre-auth RCE (CVE-2026-58138) exploited in wild
Orkes Conductor workflow platform versions 3.21.21 through 3.30.1. All deployments with externally accessible workflow API endpoints and unsandboxed GraalVM evaluators configured with unrestricted host access are vulnerable.
criticalbug_reportVulnerabilityCISA: Three Linux kernel CVEs actively exploited in the wild
Linux kernel across all distributions. CVE-2025-39682 affects TLS receive path (CVSS 9.8), CVE-2026-53266 affects ebtables SNAT/ARP (CVSS 8.8), CVE-2025-39964 affects AF_ALG socket handling (CVSS 7.8). All require local authenticated access.
criticalbug_reportVulnerabilityWSO2 API Management JWT auth bypass under active exploitation
WSO2 API Management products with JWT authentication enabled. Specific affected versions not disclosed in available data. Vulnerability allows authentication bypass via JWT token manipulation.