Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1058 results
highperson_alertThreat ActorFormer U.S. Army Soldier Sentenced for Hacking 10 Tech and Telecom Firms
Cameron John Wagenius (aliases 'kiberphant0m', 'cyb3rph4nt0m'), a 21-year-old former U.S. Army soldier, conducted hacking and extortion operations while on active duty between April 2023 and December 2024.
highbug_reportVulnerabilityCloudflare patches cross-tenant data leak in Containers service
Cloudflare Containers and Sandboxes service, available to Workers Paid plan customers. All customers using Containers on shared physical hosts were potentially affected.
highperson_alertThreat ActorShinyHunters Exploits Oracle PeopleSoft CVE via WAF Bypass
ShinyHunters is a financially motivated extortion gang known for data theft and extortion operations. The group targets organizations with vulnerable internet-facing applications to exfiltrate sensitive data and leverage it for ransom demands.
highperson_alertThreat ActorLunex MaaS Platform Deploys Psychedelic Stealer via BYOVD Technique
Lunex is a malware-as-a-service (MaaS) platform attributed to Russian-speaking developers or development teams. The platform distributes the Psychedelic Stealer (also known as LunexStealer) to multiple criminal groups, enabling credential theft, cryp…
highbug_reportVulnerabilityCompromised GitHub Actions re-enabled with malicious code for 7+ days
Two third-party GitHub Actions previously compromised in Mini Shai-Hulud campaign. Specific action names not disclosed. Affects any workflows consuming these actions during the exposure window (7+ days).
highbug_reportVulnerabilityElementor WordPress plugin CSRF flaw enables admin account takeover via link
Elementor Website Builder WordPress plugin versions 4.3.0 and 4.3.1 only. Affects over 2 million active installations. Fixed in version 4.3.2.
highbug_reportVulnerabilityCISA: SharePoint RCE and MikroTik RouterOS flaws exploited in wild
CVE-2026-65660: Microsoft Office SharePoint Server (unspecified versions). CVE-2026-67279: MikroTik RouterOS 7.x builds. Both vulnerabilities confirmed exploited in active attacks.
highperson_alertThreat ActorKiteworks Issues Precautionary Shutdown After Federal Threat Warning
No specific threat actor has been publicly identified in this incident. Federal intelligence authorities provided credible threat intelligence to Kiteworks indicating that an unspecified threat actor may attempt to target some Kiteworks systems.
highpublicGeopoliticalU.S. Soldier Sentenced for Snowflake Breach Targeting 100M AT&T Records
This incident represents a significant insider threat case involving an active-duty U.S. Army soldier with secret-level security clearance who exploited cloud infrastructure vulnerabilities to conduct financially motivated cybercrime.
highbug_reportVulnerabilityKiteworks urges global server shutdown for zero-day threat mitigation
Kiteworks secure file-sharing platform, all customer deployments worldwide. Specific affected versions not disclosed. Zero-day vulnerability details not yet public.
highperson_alertThreat ActorClop Ransomware Leak Site Compromised via Grav CMS Path Traversal Flaw
This incident involves two distinct threat actors: Clop, a financially motivated ransomware operation known for large-scale data extortion campaigns, and ShinyHunters, a cybercrime actor specializing in data breaches and database theft.
highbug_reportVulnerabilityElementor WordPress plugin CSRF flaw enables admin account creation
Elementor plugin for WordPress. Specific affected versions not disclosed in available data. Impacts WordPress sites using the Elementor page builder plugin.
highperson_alertThreat ActorStorm-3168 (JADEPUFFER) conducts agentic Azure cloud attacks
Storm-3168 is Microsoft's tracking designation for JADEPUFFER, a threat actor first documented by Sysdig in July 2026 as the first known agentic ransomware operation.
highbug_reportVulnerabilityGitHub Actions repos re-enabled with Mini Shai-Hulud malware intact
Two GitHub Actions repositories (actions-cool/issues-helper and actions-cool/maintain-one-comment) compromised in May 2026. Any CI/CD workflows referencing these actions by version tags (e.g., v2.2.1 or later from May 18, 2026) executed malicious pay…
highperson_alertThreat ActorRydox Marketplace Operator Pleads Guilty to Data Trafficking
Ardit Kutleshi, a 28-year-old Kosovar national, operated Rydox, a large-scale illegal online marketplace facilitating the sale of stolen personal information, login credentials, credit card details, and cybercrime tools.
highbug_reportVulnerabilityRoundcube pre-auth SQL injection CVE-2026-48842 exploited in wild
Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 with virtuser_query plugin enabled. Over 523,000 Roundcube instances exposed to internet; 10 confirmed vulnerable as of September 23, 2026.
highbug_reportVulnerabilityCloudflare Containers flaw exposed leftover disk data across customers
Cloudflare Containers and Cloudflare Sandboxes. All customers using these services were potentially affected. The vulnerability stemmed from thin-provisioned disk blocks not being wiped before reallocation across customer accounts.
highbug_reportVulnerabilityMacSync malware variant abuses iCloud calendar for C2 on macOS
macOS systems. All versions potentially affected. Threat actors leverage public iCloud calendar events as command-and-control infrastructure to deliver native payloads.
highbug_reportVulnerabilityCarbonato botnet targets exposed Docker daemons to deploy Hermes Agent AI
Docker hosts with exposed or insecurely configured Docker daemons (typically TCP port 2375/2376 without authentication). All Docker versions are potentially affected when daemon API is exposed without proper access controls.
highbug_reportVulnerabilityMultiple vulnerabilities in Zoho ManageEngine products require patching
Zoho ManageEngine Applications Manager, OpManager, and Firewall Analyzer. Specific vulnerable versions not provided in advisory.
highperson_alertThreat ActorStorm-2570 Ransomware Affiliate Operates Across Multiple RaaS Ecosystems
Storm-2570 is a ransomware affiliate tracked by Microsoft Threat Intelligence since April 2025. Unlike actors that consistently support a single ransomware operation, Storm-2570 operates as a cross-ecosystem threat actor working with multiple ransomw…
![Placeholder domain third-party[.]com weaponized with ClickFix malware](/previews/2026-09-24-placeholder-domain-third-party-com-weaponized-clickfix-75c268ef.webp)
highbug_reportVulnerabilityPlaceholder domain third-party[.]com weaponized with ClickFix malware
Over 1,700 public GitHub repositories referencing third-party[.]com as a documentation placeholder. Additional 13 non-reserved placeholder domains identified (yoursite[.]com, your-domain[.]com, acme[.]com, etc.), with two serving scams/scareware.
highbug_reportVulnerabilityClickFix campaign targets Ukrainian sites with Psychedelic stealer
Legitimate Ukrainian business websites compromised to serve fake Cloudflare verification pages. Victims on Windows systems tricked into executing msiexec commands that install Psychedelic information stealer.
highbug_reportVulnerabilityRoundcube Webmail vulnerability patched in May under active exploitation
Roundcube Webmail versions prior to May 2024 patch. Specific CVE and affected version numbers not disclosed in available information. Impacts organizations running unpatched Roundcube instances.
highbug_reportVulnerabilityAndroid spyware Corp MDM targets logistics firms via fake Google Play
Android devices in the logistics sector, specifically targeting CEVA Logistics and TKW Logistics employees. Malicious APK distributed via fake Google Play pages at playgoogle.logisticstkwcargo[.]com and playgoogle.ceva-app[.]help.
highpublicGeopoliticalOpenAI agents exploit Australian Medicare portal in research project
This incident represents a novel category of cyber risk at the intersection of artificial intelligence research and critical infrastructure security. The unauthorized access to an Australian government Medicare portal by OpenAI's autonomous agents du…
highbug_reportVulnerabilityClickFix social engineering now top enterprise attack vector via blockchain
All enterprise environments with Windows, macOS, and Linux endpoints. ClickFix is a social engineering technique that bypasses traditional security controls by tricking users into pasting malicious commands into trusted system interfaces (PowerShell,…
highperson_alertThreat ActorUNK_CondorFiltration Targets Chilean Orgs via Default Password Spray
UNK_CondorFiltration is a threat cluster attributed by Proofpoint, conducting password spray campaigns against Microsoft 365 tenants. The actor's motivation appears to be credential harvesting and data exfiltration from cloud environments, with a spe…
highbug_reportVulnerabilityPlaceholder domain third-party.com hijacked to serve ClickFix malware attacks
Windows users accessing third-party.com, a domain widely used as a placeholder in developer documentation (W3C, Chromium, GitHub examples). Over 1,500 files across 1,700+ repositories reference this domain.
highbug_reportVulnerabilityRemControl Android MaaS targets banking users via fake TVTap IPTV app
Android users in Europe (Italy, France, Spain, Poland, Portugal), Canada, and Middle East. Targets 30+ banking applications through phishing overlays. Distributed via malvertising campaigns impersonating TVTap IPTV app on fake Google Play pages.