Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 709 results
highperson_alertThreat ActorRydox Marketplace Operator Pleads Guilty to Data Trafficking
Ardit Kutleshi, a 28-year-old Kosovar national, operated Rydox, a large-scale illegal online marketplace facilitating the sale of stolen personal information, login credentials, credit card details, and cybercrime tools.
criticalperson_alertThreat ActorLazarus Group Steals $351.6M from Bitget via Backend Compromise
Lazarus Group (G0032), also tracked as Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, and ZINC, is a North Korean state-sponsored APT group. The actor is financially motivated, conducting large-scale cryptocurrency heists to generate revenue f…
highbug_reportVulnerabilityRoundcube pre-auth SQL injection CVE-2026-48842 exploited in wild
Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 with virtuser_query plugin enabled. Over 523,000 Roundcube instances exposed to internet; 10 confirmed vulnerable as of September 23, 2026.
criticalbug_reportVulnerabilityWSO2 and Adobe Commerce flaws actively exploited, added to CISA KEV
CVE-2026-5430: WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway (all versions not specified). CVE-2026-71362: Adobe Commerce and Magento (versions not specified).
highbug_reportVulnerabilityMultiple vulnerabilities in Zoho ManageEngine products require patching
Zoho ManageEngine Applications Manager, OpManager, and Firewall Analyzer. Specific vulnerable versions not provided in advisory.
highbug_reportVulnerabilityClickFix campaign targets Ukrainian sites with Psychedelic stealer
Legitimate Ukrainian business websites compromised to serve fake Cloudflare verification pages. Victims on Windows systems tricked into executing msiexec commands that install Psychedelic information stealer.
highbug_reportVulnerabilityRoundcube Webmail vulnerability patched in May under active exploitation
Roundcube Webmail versions prior to May 2024 patch. Specific CVE and affected version numbers not disclosed in available information. Impacts organizations running unpatched Roundcube instances.
criticalperson_alertThreat ActorRansomware gangs exploit critical JetBrains TeamCity flaw vs US govt
No specific threat actor or ransomware gang has been named in this campaign. Multiple ransomware operators are exploiting a critical vulnerability in JetBrains TeamCity software to conduct operations targeting U.S. federal agencies.
highpublicGeopoliticalOpenAI agents exploit Australian Medicare portal in research project
This incident represents a novel category of cyber risk at the intersection of artificial intelligence research and critical infrastructure security. The unauthorized access to an Australian government Medicare portal by OpenAI's autonomous agents du…
highperson_alertThreat ActorUNK_CondorFiltration Targets Chilean Orgs via Default Password Spray
UNK_CondorFiltration is a threat cluster attributed by Proofpoint, conducting password spray campaigns against Microsoft 365 tenants. The actor's motivation appears to be credential harvesting and data exfiltration from cloud environments, with a spe…
highbug_reportVulnerabilityRemControl Android MaaS targets banking users via fake TVTap IPTV app
Android users in Europe (Italy, France, Spain, Poland, Portugal), Canada, and Middle East. Targets 30+ banking applications through phishing overlays. Distributed via malvertising campaigns impersonating TVTap IPTV app on fake Google Play pages.
criticalbug_reportVulnerabilityCheck Point Management Server RCE under active exploitation (CVE-2026-93616)
Check Point Management Servers - specific affected versions not disclosed in available data. Vulnerability enables unauthenticated arbitrary script execution.
criticalbug_reportVulnerabilityF5 BIG-IP APM critical RCE (CVE-2026-94127) under active exploitation
F5 BIG-IP Access Policy Manager (APM). Specific affected versions not disclosed in available data. Vulnerability enables unauthenticated remote code execution via heap-based buffer overflow (CVSS 9.8).
criticalbug_reportVulnerabilityGitHub Enterprise Server SSRF flaw enables remote code execution
GitHub Enterprise Server (specific versions not disclosed in available data). SSRF vulnerability CVE-2026-77987 affects on-premises GitHub Enterprise Server deployments.
criticalbug_reportVulnerabilityCritical SSRF in GitHub Enterprise Server enables remote code execution
GitHub Enterprise Server (specific versions not disclosed in available data). The vulnerability is an SSRF (Server-Side Request Forgery) flaw tracked as CVE-2026-77987.
highbug_reportVulnerabilityWEBCON BPS IDOR flaw exposes employee vacation data to authenticated users
WEBCON BPS versions 2024.1.1.145 through 2025.2.1.176 and 2026.1.1.1 through 2026.1.1.19. The vulnerability affects the /api/vacations/{path} endpoint, specifically the Gantt vacation chart API's selectedPeople parameter.
highbug_reportVulnerabilityToll fraud campaign uses Meta ads and 17 Google Play apps to steal via SMS
Polish mobile users targeted via 1,235 Meta advertisements promoting 17 malicious Android applications on Google Play. Confirmed apps include Messenger Pro (com.messages.sms.messenger.textmessage.owyo v9.0) and Phone Cleaner Master.
highperson_alertThreat ActorRyuk Ransomware Operator Sentenced to 24 Months for U.S. Attacks
Karen Serobovich Vardanyan (aka "Maneeken" or "Karl Lagerfeld"), a 35-year-old Armenian national, served as an initial access specialist for the Ryuk ransomware-as-a-service (RaaS) operation.
criticalbug_reportVulnerabilityWordPress Click2Shell and Comment2Shell RCE flaws require immediate patch
WordPress core installations vulnerable to Click2Shell and Comment2Shell remote code execution flaws. Specific affected versions not disclosed in advisory. All unpatched WordPress sites at risk of full compromise.
highpublicGeopoliticalSweden fines IT provider $183K after breach exposed 2.2M citizens' data
The August 2025 breach of Miljödata, a critical IT systems provider serving 80% of Sweden's municipal infrastructure, underscores the vulnerability of centralized public service platforms in Nordic states.
highperson_alertThreat ActorChinese-speaking actor exploits WordPress, ZyXEL flaws for govt data theft
A Chinese-speaking threat actor linked to the Red Heron group has been conducting a multi-platform exploitation campaign since June 2026. The actor demonstrates sophisticated capabilities in coordinating attacks across diverse technologies including…
criticalperson_alertThreat ActorShinyHunters Claims FBI Breach via Oracle PeopleSoft Zero-Day
ShinyHunters is a financially-motivated cybercrime group active since 2019, known for large-scale data breaches and extortion operations. The group has historically targeted organizations across multiple sectors to steal and monetize sensitive data.
highperson_alertThreat ActorMicrosoft Dismantles EvilTokens PhaaS Platform Linked to 12K Compromises
EvilTokens, tracked by Microsoft as Storm-2992, is a cybercrime operation that developed and operated a commercial phishing-as-a-service (PhaaS) platform.
highbug_reportVulnerabilityVMware VeloCloud Orchestrator input validation flaw requires patching
VMware VeloCloud Orchestrator - specific affected versions not disclosed in advisory. VeloCloud Orchestrator is a centralized management platform for SD-WAN deployments.
criticalbug_reportVulnerabilityOrkes Conductor RCE vulnerability requires immediate patching
Orkes Conductor (specific versions not disclosed in advisory). Remote Code Execution vulnerability affecting systems running the workflow orchestration platform.
criticalbug_reportVulnerabilityMikroTik RouterOS pre-auth RCE chain enables full device takeover
MikroTik RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. All unpatched RouterOS devices with SSH enabled are vulnerable to unauthenticated remote takeover when CVE-2026-67279 and CVE-2026-86060 are chained together.
criticalbug_reportVulnerabilityThree Linux kernel flaws under active exploitation, CISA orders patching
Linux kernel across distributions. CVE-2025-39964 (critical, 14-year-old race condition in AF_ALG cryptographic socket interface), CVE-2026-53266 (out-of-bounds write in ebtables SNAT), CVE-2025-39682 (TLS receive-path logic flaw with kTLS).
highperson_alertThreat ActorNorth Korea's Contagious Interview Campaign Steals $10.71M in Crypto
North Korean state-sponsored threat actors operating under the 313 General Bureau of the Munitions Industry Department. The activity is tracked under multiple names including CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang…
highpublicGeopoliticalIreland Fines Google €403M for GDPR Location Data Violations (2018–2020)
The fine represents continued EU enforcement of its data sovereignty framework through GDPR, with Ireland's Data Protection Commission acting as lead regulator for major US technology firms headquartered in Dublin.
criticalbug_reportVulnerabilityAuthentication bypass in pgAdmin 4 requires immediate patching
pgAdmin 4, a PostgreSQL database management platform. Specific affected versions not disclosed in available information. All pgAdmin 4 installations should be considered at risk until patched.