Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1068 results
highbug_reportVulnerabilityZimbra XSS vulnerabilities require immediate patching per CERT.BE
Zimbra Collaboration Suite - specific affected versions not disclosed in available advisory. Multiple Cross-site Scripting (XSS) vulnerabilities identified.
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway flaws under active global exploitation
Citrix NetScaler ADC and Gateway appliances. CVE-2026-88771 (improper input validation allowing unauthenticated remote command execution) and CVE-2026-88772 (remote code execution or denial-of-service).
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway under active attack via two RCE flaws
Citrix NetScaler ADC and Gateway on-premises: versions 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS editions before 14.1-73.37 FIPS and 13.1-37.279. Cloud-managed instances not affected.
highbug_reportVulnerabilityCarbonato botnet exploits exposed Docker daemons to deploy AI agents
Docker daemons exposed without authentication on TCP port 2375. All versions of Docker with unauthenticated remote API access are vulnerable. The malware deploys Hermes AI Agent framework and establishes Telegram-based command and control.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway RCE zero-days under active exploitation
Citrix NetScaler ADC and NetScaler Gateway. Specific affected versions not provided in source material. CVE identifiers not yet assigned.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway flaws exploited globally, CISA orders patching
Citrix NetScaler ADC and NetScaler Gateway all versions. CVE-2026-88771 affects all deployments; CVE-2026-88772 requires DTLS enabled (default on VPN virtual servers).
criticalbug_reportVulnerabilityCISA orders federal agencies to patch exploited Citrix NetScaler RCE flaws
Citrix NetScaler ADC and NetScaler Gateway all versions prior to 14.1-73.37, 13.1-64.23, 14.1-FIPS 14.1-73.37, and 13.1-FIPS/13.1-NDcPP 13.1.37.279. CVE-2026-88771 affects all default configurations; CVE-2026-88772 requires DTLS enabled (default on V…
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway: 2 critical RCE flaws under active exploit
Citrix NetScaler ADC and NetScaler Gateway versions 13.1 before 13.1-64.23, 14.1 before 14.1-73.37, and FIPS editions. CVE-2026-88771 affects all deployments (no preconditions).
criticalbug_reportVulnerabilityCitrix NetScaler RCE zero-days CVE-2026-88771/88772 exploited in wild
Citrix NetScaler ADC and NetScaler Gateway: versions 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS editions before 14.1-73.37 FIPS and 13.1-37.279, and Secure Private Access Hybrid deployments.
highbug_reportVulnerabilityCloudflare patches cross-tenant data leak in Containers service
Cloudflare Containers and Sandboxes service, available to Workers Paid plan customers. All customers using Containers on shared physical hosts were potentially affected.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway RCE zero-days exploited in the wild
Citrix NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.37, 13.1-64.23, and corresponding FIPS/NDcPP releases. CVE-2026-88771 affects all deployments including default configurations.
highbug_reportVulnerabilityCompromised GitHub Actions re-enabled with malicious code for 7+ days
Two third-party GitHub Actions previously compromised in Mini Shai-Hulud campaign. Specific action names not disclosed. Affects any workflows consuming these actions during the exposure window (7+ days).
highbug_reportVulnerabilityElementor WordPress plugin CSRF flaw enables admin account takeover via link
Elementor Website Builder WordPress plugin versions 4.3.0 and 4.3.1 only. Affects over 2 million active installations. Fixed in version 4.3.2.
highbug_reportVulnerabilityCISA: SharePoint RCE and MikroTik RouterOS flaws exploited in wild
CVE-2026-65660: Microsoft Office SharePoint Server (unspecified versions). CVE-2026-67279: MikroTik RouterOS 7.x builds. Both vulnerabilities confirmed exploited in active attacks.
highbug_reportVulnerabilityKiteworks urges global server shutdown for zero-day threat mitigation
Kiteworks secure file-sharing platform, all customer deployments worldwide. Specific affected versions not disclosed. Zero-day vulnerability details not yet public.
highbug_reportVulnerabilityElementor WordPress plugin CSRF flaw enables admin account creation
Elementor plugin for WordPress. Specific affected versions not disclosed in available data. Impacts WordPress sites using the Elementor page builder plugin.
criticalbug_reportVulnerabilityCISA: Critical WSO2 auth bypass CVE-2026-5430 under active exploit
WSO2 enterprise products (specific versions not provided in source), Microsoft SharePoint (unspecified versions), and Adobe Commerce (unspecified versions).
highbug_reportVulnerabilityGitHub Actions repos re-enabled with Mini Shai-Hulud malware intact
Two GitHub Actions repositories (actions-cool/issues-helper and actions-cool/maintain-one-comment) compromised in May 2026. Any CI/CD workflows referencing these actions by version tags (e.g., v2.2.1 or later from May 18, 2026) executed malicious pay…
criticalbug_reportVulnerabilityServiceNow critical vulnerabilities require immediate patching
ServiceNow platform (specific versions not disclosed in advisory). Scope and affected components not detailed in available information.
highbug_reportVulnerabilityRoundcube pre-auth SQL injection CVE-2026-48842 exploited in wild
Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 with virtuser_query plugin enabled. Over 523,000 Roundcube instances exposed to internet; 10 confirmed vulnerable as of September 23, 2026.
highbug_reportVulnerabilityCloudflare Containers flaw exposed leftover disk data across customers
Cloudflare Containers and Cloudflare Sandboxes. All customers using these services were potentially affected. The vulnerability stemmed from thin-provisioned disk blocks not being wiped before reallocation across customer accounts.
criticalbug_reportVulnerabilityWSO2 and Adobe Commerce flaws actively exploited, added to CISA KEV
CVE-2026-5430: WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway (all versions not specified). CVE-2026-71362: Adobe Commerce and Magento (versions not specified).
highbug_reportVulnerabilityMacSync malware variant abuses iCloud calendar for C2 on macOS
macOS systems. All versions potentially affected. Threat actors leverage public iCloud calendar events as command-and-control infrastructure to deliver native payloads.
highbug_reportVulnerabilityCarbonato botnet targets exposed Docker daemons to deploy Hermes Agent AI
Docker hosts with exposed or insecurely configured Docker daemons (typically TCP port 2375/2376 without authentication). All Docker versions are potentially affected when daemon API is exposed without proper access controls.
criticalbug_reportVulnerabilityOnePlus OxygenOS flaws allow installed apps to gain root without permissions
OnePlus devices running OxygenOS 16 (confirmed on OnePlus 15 and OnePlus 12 Pro) and multiple OPPO devices. OnePlus confirmed the vulnerabilities affect many of its own devices and OPPO products but has not disclosed specific model lists.
highbug_reportVulnerabilityMultiple vulnerabilities in Zoho ManageEngine products require patching
Zoho ManageEngine Applications Manager, OpManager, and Firewall Analyzer. Specific vulnerable versions not provided in advisory.
![Placeholder domain third-party[.]com weaponized with ClickFix malware](/previews/2026-09-24-placeholder-domain-third-party-com-weaponized-clickfix-75c268ef.webp)
highbug_reportVulnerabilityPlaceholder domain third-party[.]com weaponized with ClickFix malware
Over 1,700 public GitHub repositories referencing third-party[.]com as a documentation placeholder. Additional 13 non-reserved placeholder domains identified (yoursite[.]com, your-domain[.]com, acme[.]com, etc.), with two serving scams/scareware.
criticalbug_reportVulnerabilityGitLab RCE vulnerabilities require immediate patching per CERT.BE
GitLab (specific versions not provided in advisory). Remote Code Execution vulnerabilities affect GitLab instances. CVE identifiers not specified in available information.
highbug_reportVulnerabilityClickFix campaign targets Ukrainian sites with Psychedelic stealer
Legitimate Ukrainian business websites compromised to serve fake Cloudflare verification pages. Victims on Windows systems tricked into executing msiexec commands that install Psychedelic information stealer.
highbug_reportVulnerabilityRoundcube Webmail vulnerability patched in May under active exploitation
Roundcube Webmail versions prior to May 2024 patch. Specific CVE and affected version numbers not disclosed in available information. Impacts organizations running unpatched Roundcube instances.