Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
satellite_altDaily BriefCyber Threat Daily Brief — October 28, 2026
Today's briefing: 9 critical and 29 high-severity threats. A total of 45 detailed analyses covering vulnerabilities, threat actors, and geopolitical context.
Latest Reports
28 / 1716 results
criticalbug_reportVulnerabilityBitget confirms zero-day in third-party security product led to $387M theft
Bitget cryptocurrency exchange; third-party security products (Product A and Product B, vendors unnamed); 11 blockchains including Ethereum, XRP Ledger, Zcash, TRON, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand, and Celestia.
highperson_alertThreat ActorStar Blizzard deploys CosmicPulse backdoor via new RedFlick technique
Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor active since 2017. The group is attributed to Russian intelligence services and is motivated by espionage objectives aligned with R…
highbug_reportVulnerabilityZammad zero-days CVE-2026-102489/102490 exploited in AI-driven breach
Zammad open-source ticketing system, all versions prior to version 7. Both self-hosted and hosted deployments affected. Over 2,000 customers and 55,000 users globally, including enterprise and nonprofit organizations.
highbug_reportVulnerabilityZimbra CVE-2026-73570 exploited to deploy web shells, steal credentials
Zimbra Collaboration Suite (ZCS) versions prior to 10.1.20. Exploitation requires SNMP notifications enabled and the optional zimbra-snmp package installed. Unauthenticated remote code execution via crafted SMTP requests.
highbug_reportVulnerabilityPhishing campaign abuses legitimate MSP360 RMM to deploy ScreenConnect
Organizations using Windows endpoints. Attackers distribute legitimate MSP360 RMM v2.5.0.67 installer via phishing emails with deceptive filenames (meeting invites, PDF readers, Zoom installers). ScreenConnect deployed as secondary RMM.
criticalbug_reportVulnerabilityCritical pre-auth RCE in MikroTik RouterOS (CVE-2026-84411)
MikroTik RouterOS versions below 7.24. Vulnerability exists in web management service HTTP request handling. Widely deployed in critical infrastructure and enterprise networks.
criticalbug_reportVulnerabilityCisco SD-WAN Manager zero-day exploited: auth bypass grants admin API access
Cisco Catalyst SD-WAN Manager, all configurations. Affected versions: all releases prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. Releases earlier than 20.9 require migration.
highperson_alertThreat ActorUnidentified Actors Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
The threat actors behind this campaign remain unidentified. Their motivation appears to be financially driven, leveraging trusted AI platforms (ChatGPT Custom GPTs) to conduct social engineering attacks that deliver remote access trojans.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager zero-day exploited for admin escalation
Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage): all versions prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. All deployments affected regardless of configuration.
highbug_reportVulnerabilityZimbra CVE-2026-73570: Unauthenticated RCE exploited in the wild
Zimbra Collaboration Suite versions prior to 10.1.20, when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Internet-facing mail servers are at risk. Exploitation requires no authentication or user interaction.
highbug_reportVulnerabilityTeamViewer patches RCE and privilege escalation flaws in client software
TeamViewer Full Client and Host software for Windows, Linux, and macOS. Vulnerabilities resolved in version 15.82 and supported maintenance/legacy releases.
criticalbug_reportVulnerabilityBitget crypto exchange breached via zero-day in security appliances
Bitget cryptocurrency exchange. Two unnamed third-party security appliances (referred to as "Product A" and "security appliance B") compromised via zero-day vulnerabilities.
highperson_alertThreat ActorCSuite Campaign Steals M365 Sessions, Deploys RMM Tools via Phishing
CSuite is a phishing campaign targeting C-suite executives and high-value business users, primarily in the United States. The campaign was analyzed across 351 sandbox submissions, with 51% originating from the US, followed by India (18%), and additio…
criticalbug_reportVulnerabilityCitrix NetScaler CVE-2026-88772 exploited for root access, web shells
Citrix NetScaler ADC and NetScaler Gateway appliances. CVE-2026-88772 (CVSS 9.5) is a memory overflow in DTLS protocol handling in the NetScaler Packet Processing Engine (NSPPE). CVE-2026-88771 also mentioned as exploited.
highbug_reportVulnerabilityOpenSSL DTLS flaw leaks heap memory, crashes programs (CVE-2026-84782)
OpenSSL versions 4.0 (before 4.0.3), 3.6 (before 3.6.5), 3.5 (before 3.5.9), 3.4 (before 3.4.8), 3.0, 1.1.1, and 1.0.2. Only affects software using OpenSSL for DTLS connections (e.g., WebRTC, VoIP).
criticalbug_reportVulnerabilityCitrix NetScaler CVE-2026-88772: Pre-auth RCE via DTLS overflow exploited
Citrix NetScaler ADC and NetScaler Gateway (vulnerable versions not specified in advisory). Affects the NetScaler Packet Processing Engine (NSPPE) DTLS protocol handler. Pre-authentication attack surface.
highbug_reportVulnerabilityPhishing campaign abuses MSP360 RMM and ScreenConnect for persistent access
Organizations across multiple industries targeted via phishing. Legitimate MSP360 RMM v2.5.0.67 installer abused to deploy ConnectWise ScreenConnect, creating redundant remote-access channels.
highbug_reportVulnerabilityMalicious custom ChatGPTs in Google ads deliver RAT via ClickFix attacks
Users searching for ChatGPT via Google Search who click sponsored results. Campaign leverages OpenAI's custom GPT feature (retiring December 11, 2026) and Google Sites infrastructure.
highperson_alertThreat ActorFBI warns ShinyHunters members to surrender after Dutch arrest
ShinyHunters is a financially motivated cybercrime group linked to extortion activities targeting organizations in the United States, Netherlands, and globally.
criticalbug_reportVulnerabilityCritical XSS vulnerability in Rancher Kubernetes platform requires patching
Rancher Kubernetes management platform. Specific affected versions not disclosed in available information.
criticalbug_reportVulnerabilityCitrix NetScaler zero-day CVE-2026-88772 exploited for web shells, root access
Citrix NetScaler ADC and Gateway appliances with DTLS enabled. CVE-2026-88772 is a memory overflow vulnerability leading to remote code execution. CVE-2026-88771 (unauthenticated RCE) also disclosed alongside it.
criticalbug_reportVulnerabilityWatchGuard RCE vulnerabilities require immediate patching per CERT.BE
WatchGuard products (specific models and versions not disclosed in available information). Two remote code execution vulnerabilities identified.
highperson_alertThreat ActorFormer US Air Force Members Sentenced for Multi-Year BEC Fraud
Chijioke Timothy Odimegwu (25) and Harafat Mogaji (26) are former United States Air Force members who conducted business email compromise (BEC) scams and phishing campaigns while stationed at Dover Air Force Base in Delaware.
highpublicGeopoliticalFrench Tax Breach Exposes 600K Records via Stolen Credentials, Weak Controls
The seven-week breach of France's Direction Générale des Finances Publiques (DGFIP) represents a significant compromise of sovereign fiscal infrastructure, exposing tax data on approximately 350,000 individuals and 250,000 businesses.
highbug_reportVulnerabilityNew Spectre-v2 BTR variant bypasses defenses, leaks Linux kernel memory
JIT engines in Mozilla Firefox (SpiderMonkey), GraalVM, and Linux kernel cBPF JIT across Intel, AMD, and other CPU vendors. Affects systems with speculative execution despite existing Spectre-v2 mitigations.
highperson_alertThreat ActorStar Blizzard Deploys CosmicPulse Backdoor via Fake Event Invitations
Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor attributed by U.S., U.K., Australian, Canadian, and New Zealand security agencies to Center 18 of Russia's Federal Security Service…
highbug_reportVulnerabilityNew Spectre v2 BTR variant leaks Linux root hashes in 3-5 minutes on Intel
Intel, AMD, and Arm CPUs with indirect branch prediction. Confirmed exploitable on Linux kernel cBPF (default and constant blinding configurations). Firefox SpiderMonkey and Oracle GraalVM also affected but full exploits not demonstrated.
highperson_alertThreat ActorStorm-3068 Pivots from Identity Compromise to Cloud Infrastructure
Storm-3068 is a threat actor tracked by Microsoft that demonstrated sophisticated understanding of cloud-native attack paths. In this intrusion, the actor leveraged a compromised user identity obtained through self-service password reset to gain pers…