Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 733 results
criticalbug_reportVulnerabilityCISA: Three Linux kernel CVEs actively exploited in the wild
Linux kernel across all distributions. CVE-2025-39682 affects TLS receive path (CVSS 9.8), CVE-2026-53266 affects ebtables SNAT/ARP (CVSS 8.8), CVE-2025-39964 affects AF_ALG socket handling (CVSS 7.8). All require local authenticated access.
criticalbug_reportVulnerabilityWSO2 API Management JWT auth bypass under active exploitation
WSO2 API Management products with JWT authentication enabled. Specific affected versions not disclosed in available data. Vulnerability allows authentication bypass via JWT token manipulation.
highperson_alertThreat ActorTransparent Tribe Deploys Rust Backdoors via GitHub C2 Infrastructure
Transparent Tribe (also tracked as APT36, Earth Karkaddan, COPPER FIELDSTONE, Mythic Leopard, and ProjectM) is a Pakistan-aligned advanced persistent threat group with sustained focus on South Asian geopolitical targets.
criticalbug_reportVulnerabilityCasdoor authorization bypass allows attackers to circumvent access controls
Casdoor identity and access management platform. Specific affected versions not disclosed in advisory. Authorization controls can be bypassed by attackers.
highbug_reportVulnerability13 malicious npm packages deliver WeaselBiscuit stealer targeting Chrome data
13 npm packages (@biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, @biz44/runtime-utils, engin1, id79-client, process-lhpm, process-mite, process-tail…
criticalbug_reportVulnerabilityCERT.BE warns of critical Cisco vulnerabilities requiring urgent patching
Cisco products (specific products, versions, and CVE identifiers not disclosed in available advisory text)
criticalbug_reportVulnerabilityCheck Point Security Management unauthenticated RCE requires immediate patching
Check Point Security Management servers. Specific affected versions not disclosed in available information. Vulnerability allows unauthenticated remote code execution.
highperson_alertThreat ActorHandala Hack Deploys HEAVYGRAM Telegram Backdoor for Surveillance
Handala Hack is an Iran-linked hacktivist persona attributed to VOID MANTICORE (also tracked as COBALT MYSTIQUE, Banished Kitten, Red Sandstorm, and Storm-0842), a threat actor affiliated with Iran's Ministry of Intelligence and Security (MOIS).
highperson_alertThreat ActorFamousSparrow Deploys SparroWocky Backdoor in Latin America Campaign
FamousSparrow is a China-aligned state-sponsored threat actor assessed to be active since at least 2019. The group shares some level of overlap with Earth Estries and Salt Typhoon.
highperson_alertThreat ActorFamousSparrow deploys SparroWocky backdoor in Latin America espionage
FamousSparrow is a China-linked APT group conducting espionage operations primarily targeting government organizations. Attributed by ESET, the group demonstrates strong knowledge of anti-analysis techniques and Windows internals, indicating a well-r…
highperson_alertThreat ActorNightEagle, Hacking Cat, and Toy Ghouls Target Russian Enterprises
Three distinct threat activity clusters are actively targeting Russian enterprises. NightEagle (APT-Q-95) is a sophisticated threat actor active since at least 2023, employing advanced persistence and lateral movement techniques.
criticalbug_reportVulnerabilityHPE Aruba EdgeConnect SD-WAN auth bypass and RCE flaws require patching
HPE Aruba Networking EdgeConnect SD-WAN appliances. Specific affected versions not disclosed in available data. Vulnerabilities enable authentication bypass and remote code execution.
highperson_alertThreat ActorN0va Targets US and EU Orgs with Token-Theft Phishing Campaigns
N0va is a threat actor conducting phishing campaigns targeting organizations across North America and Europe. The actor's motivation appears to be financially driven, with objectives including payment fraud, invoice manipulation, and access to sensit…
highbug_reportVulnerabilitySix critical flaws in WNC T-Mobile 5G Box IDU routers enable RCE
WNC T-Mobile 5G Box IDU routers running firmware versions before 1.1.0.651412. All six CVEs affect the same product and version range. Vulnerabilities include authentication bypass (CVE-2026-40854), three OS command injection flaws (CVE-2026-40855, C…
criticalbug_reportVulnerabilitySAP Extended Passport Processing memory corruption flaw patched
SAP Extended Passport Processing (EPP) component across SAP products. Specific affected versions not disclosed in available information. Organizations running SAP systems with EPP functionality should assume exposure.
highperson_alertThreat ActorREF9334 Deploys KREMLIN Malware Targeting Brazilian Financial Sector
REF9334 is a Brazilian threat actor tracked by Elastic Security Labs, active since at least May 2025. The actor specializes in banking fraud operations targeting Brazilian financial institutions through sophisticated malware delivery campaigns.
highperson_alertThreat ActorIran MOIS Uses Telegram-Controlled Malware to Target Dissidents
Iran's Ministry of Intelligence and Security (MOIS), the country's primary intelligence agency, is attributed by the FBI, UK NCSC, and Netherlands AIVD as the operator behind this espionage campaign.
highbug_reportVulnerabilityBambooToken malware uses MQTT protocol to target Windows and Linux systems
Windows and Linux systems, particularly organizations in Asia and South America. Targets include financial, government, mobile app developers, and various enterprises. Campaign active since February 2023 through July 2026.
highbug_reportVulnerabilityCisco Secure Email Gateway SQL injection requires urgent patching
Cisco Secure Email Gateway (formerly IronPort). Specific affected versions not disclosed in available information. SQL injection vulnerability allows potential unauthorized database access.
criticalperson_alertThreat ActorCVE-2026-59310: VMware vCenter RCE exploited by ransomware gangs
No specific threat actor attribution is provided. The campaign involves multiple ransomware gangs actively exploiting CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter.
highperson_alertThreat ActorIranian State Actors Deploy CHOSEN BRICK Against Dissidents Globally
Iranian state cyber actors are attributed by NCSC UK, FBI, and AIVD to deploying CHOSEN BRICK malware against dissidents, activists, and journalists perceived as threats to the Iranian regime.
highperson_alertThreat ActorIranian State Actors Deploy CHOSEN BRICK Spyware Against Dissidents
Iranian state-sponsored cyber actors conducting surveillance operations against individuals perceived as threats to the Iranian regime. The NCSC assesses that Iran almost certainly uses cyber activity to support repression of dissidents, activists, a…
highperson_alertThreat ActorBlack Axe Leaders Extradited to US for Wire Fraud and Money Laundering
Black Axe is a transnational cybercrime syndicate founded in 1977 in Nigeria, now recognized as one of the world's most dangerous and far-reaching criminal organizations.
highperson_alertThreat ActorUTA0560 Exploits Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
UTA0560 is a Chinese-linked threat actor tracked by Volexity that conducts cyber espionage operations targeting non-governmental organizations. The actor demonstrates sophisticated capabilities in exploiting zero-day vulnerabilities and conducting sp…
highpublicGeopoliticalVPN flaw exposes 246,000 Japanese government personnel records
Japan's Digital Agency disclosed a breach affecting its Government Solution Service (GSS) infrastructure, exposing personnel records of government employees, public officials, and associated entities.
highperson_alertThreat Actor3BB Broadband Intrusion: MeshCentral Backdoor Used for Root Access
The threat actor behind this intrusion remains unattributed. The operation targeted 3BB, Thailand's largest broadband provider, with the apparent objective of exfiltrating subscriber credential databases.
highperson_alertThreat ActorRed Heron Exploits Gitea RCE to Compromise 13 Organizations
Red Heron is a suspected Chinese threat actor attributed with moderate confidence to operating within a China-linked context. Attribution is based on the use of Simplified Chinese labels for target classification, consistent classification of Taiwan…
criticalbug_reportVulnerabilityCheck Point VPN unauthenticated RCE requires immediate patching
Check Point VPN products (specific versions not disclosed in available data). Vulnerability allows unauthenticated remote code execution. No CVE assigned yet.
highbug_reportVulnerabilitySQL Injection flaws in Alior Bank PrestaShop module expose backoffice data
Alior Bank "raty" module for PrestaShop. CVE-2026-7848 affects versions 8.0.0 to 8.1.11 (fixed in 8.1.11 and 9.0.7). CVE-2026-15600 affects versions 8.1.9 to 8.1.12 (fixed in 8.1.12 and 9.0.8).
highbug_reportVulnerabilityCompromised IP cameras exploited for espionage and DDoS attacks
IP cameras across multiple vendors and models. Organizations with internet-exposed camera infrastructure are at risk. Specific affected vendors and firmware versions not disclosed in CERT.BE advisory.