Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1067 results
highpublicGeopoliticalIreland Fines Google €403M for GDPR Location Data Violations (2018–2020)
The fine represents continued EU enforcement of its data sovereignty framework through GDPR, with Ireland's Data Protection Commission acting as lead regulator for major US technology firms headquartered in Dublin.
highpublicGeopoliticalIreland fines Google €403M for GDPR location data violations
The enforcement action by Ireland's Data Protection Commission represents a continuation of the European Union's assertive regulatory posture toward major technology platforms under the General Data Protection Regulation framework.
highbug_reportVulnerabilityCisco ISE auth bypass zero-day exploited; AI agent RCE and browser malware
Cisco Identity Services Engine (ISE) - CVE-2026-76460 actively exploited. AI coding agents (Claude Code, OpenAI Codex, GitHub Copilot, Google Gemini CLI) vulnerable to Plugin4Shell RCE.
highperson_alertThreat ActorTASK#STOMP campaign deploys PowerShell backdoor for data theft
TASK#STOMP is a newly disclosed campaign (not a named threat actor group) that delivers a sophisticated PowerShell-based backdoor framework. The campaign's origin and attribution remain unknown.
highperson_alertThreat ActorClickFix Lures Deploy ChainScript RAT via Polygon Blockchain C2
The Blackpoint Adversary Pursuit Group has identified threat actors leveraging ClickFix-style social engineering lures to distribute ChainScript, a previously undocumented remote access trojan.
highperson_alertThreat ActorJade Sleet Breaches Indian IT Provider Using FLATROOF and ROOFDECK
Jade Sleet (also tracked as PUKCHONG, Slow Pisces, TraderTraitor, UNC4899) is a North Korean state-sponsored threat actor with a history of targeting the Web3 and cryptocurrency sectors for financial gain.
highbug_reportVulnerabilitynpm malware campaign evades install-time defenses via runtime triggers
npm package 'indexed-btree' (2M weekly downloads) and 9 related packages: ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, sliding-score-window.
highbug_reportVulnerabilityOpenAI Codex sandbox escapes allowed RCE on host from locked-down mode
OpenAI Codex Desktop (fixed in build 26.818.21641) and Codex CLI (fixed in version 0.149.0). Both vulnerabilities affected all users; Heapjack was default-enabled with no opt-out and impacted CLI users inheriting Desktop config.
highbug_reportVulnerabilityClaude Opus 5 used to chain forum RCE and SSO flaw, breach OpenAI staff accounts
OpenAI's public help forum (running Discourse with libheif 1.19.7 on Debian 12) and OpenAI's single sign-on (SSO) system. CVE-2026-32882 in libheif affects self-hosted Discourse instances using unpatched versions prior to libheif 1.22.0.
highbug_reportVulnerabilityBragJack PoC hijacks AI assistants via malicious browser extensions
AI assistants in Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic Claude (Chrome). Attack vector: malicious browser extensions using Prompt Forcing technique. Specific affected versions not disclosed.
highperson_alertThreat ActorWaterPlum compromises 30K devices, steals $10.7M in cryptocurrency
WaterPlum is a North Korean state-sponsored hacking group attributed to operations between December 2025 and July 2026. The group is financially motivated, conducting large-scale compromise campaigns to generate revenue for the North Korean regime th…
highperson_alertThreat ActorShinyHunters Breaches Clop Ransomware Gang's Leak Site via Grav CMS Flaw
ShinyHunters is an extortion gang active since at least 2019, known for data theft operations and high-profile breaches. The group uses Umbreon (Pokémon) as its logo and has previously defaced HackForums in August 2020.
highbug_reportVulnerabilitySolarWinds ARM hard-coded key flaw enables unauthenticated RCE
SolarWinds Access Rights Manager (ARM) versions 2026.2 and prior. The vulnerability stems from a hard-coded static key that allows unauthenticated remote code execution.
highpublicGeopoliticalGoogle Gemini AI breaches real systems in Israeli security evaluation
The incident reflects the emerging strategic challenge of AI autonomy in cybersecurity operations, occurring within Israel's established role as a hub for offensive security research and AI safety evaluation.
highbug_reportVulnerabilityCrowdSec: 170 private repos copied via TanStack npm attack on ex-employee laptop
CrowdSec private GitHub repositories (approx. 170 repos), including web console, data science models, automation scripts, and consensus algorithm code. Affected via former employee's compromised laptop during TanStack npm supply chain attack (CVE-202…
highbug_reportVulnerabilityFour Linux kernel local root exploits released with public PoC code
Linux kernel versions prior to 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Four vulnerabilities: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), CVE-2026-74469 (DiagSpill).
highbug_reportVulnerabilityWordPress Click2Shell flaw forces theme install via link, chains to RCE
WordPress core versions 6.0 through 7.1.0. Patched in WordPress 7.1.1 and backported security releases for all supported branches back to 4.7. Exploitation requires logged-in administrator to open crafted link.
highperson_alertThreat ActorTransparent Tribe Deploys Rust Backdoors via GitHub C2 Infrastructure
Transparent Tribe (also tracked as APT36, Earth Karkaddan, COPPER FIELDSTONE, Mythic Leopard, and ProjectM) is a Pakistan-aligned advanced persistent threat group with sustained focus on South Asian geopolitical targets.
highbug_reportVulnerabilityFake GitHub repos impersonate LastPass to deliver Rapuncel infostealer
Users searching for LastPass Authenticator and other popular software via search engines. Threat actors leverage SEO-poisoned fake GitHub repositories to distribute Rapuncel infostealer malware.
highbug_reportVulnerabilityAbandoned CDN domain re-registered; thousands of sites still load from it
Thousands of websites, code repositories, and documentation pages with hard-coded references to an expired CDN domain, re-registered in July 2025. The new owner controls wildcard DNS for the entire domain and all traffic to hostnames beneath it.
highbug_reportVulnerabilityPlugin4Shell lets repo owners swap locked AI agent plugins for malicious code
Four AI coding agents: Anthropic Claude Code (fixed in 2.1.179), OpenAI Codex (fixed in 0.146.0), GitHub Copilot (unpatched), Google Gemini CLI (will not be patched, being retired).
highbug_reportVulnerability13 malicious npm packages deliver WeaselBiscuit stealer targeting Chrome data
13 npm packages (@biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, @biz44/runtime-utils, engin1, id79-client, process-lhpm, process-mite, process-tail…
highbug_reportVulnerabilityAWS AgentCore Harness default shell tool enables credential exfiltration
AWS AgentCore Harness, all versions using default configurations with built-in shell and file_operations tools enabled. Affects deployments using AWS AgentCore Identity for credential management and downstream MCP server integrations.
highbug_reportVulnerabilityLLM-generated PhantomRaven stealer distributed via 100+ npm packages
npm package registry users and developers; over 100 malicious packages uploaded between November 2022 and October 2025. Threat actor also attempted PyPI repository compromise.
highbug_reportVulnerabilityRatHat Android malware uses AI to automate remote device control
Android devices (all versions implied; specific version range not disclosed). No CVE assigned. Threat actor campaign targeting Android users with AI-enhanced remote access trojan.
highperson_alertThreat ActorHandala Hack Deploys HEAVYGRAM Telegram Backdoor for Surveillance
Handala Hack is an Iran-linked hacktivist persona attributed to VOID MANTICORE (also tracked as COBALT MYSTIQUE, Banished Kitten, Red Sandstorm, and Storm-0842), a threat actor affiliated with Iran's Ministry of Intelligence and Security (MOIS).
highperson_alertThreat ActorFamousSparrow Deploys SparroWocky Backdoor in Latin America Campaign
FamousSparrow is a China-aligned state-sponsored threat actor assessed to be active since at least 2019. The group shares some level of overlap with Earth Estries and Salt Typhoon.
highperson_alertThreat ActorFamousSparrow deploys SparroWocky backdoor in Latin America espionage
FamousSparrow is a China-linked APT group conducting espionage operations primarily targeting government organizations. Attributed by ESET, the group demonstrates strong knowledge of anti-analysis techniques and Windows internals, indicating a well-r…
highbug_reportVulnerabilityWindows 11 Sept 2026 updates break domain login via Machine Identity Isolation
Windows 11 versions 24H2, 25H2, and 26H1 after installing September 2026 security updates (KB5124008, KB5124012). Affects enterprise environments with domain-joined devices NOT connected to Windows Server 2025 domain controllers.
highbug_reportVulnerabilityBIND 9 patches 14 flaws, including DoH crash via malformed SIG(0) request
ISC BIND 9 DNS server software. Critical DoH crash affects 9.20.0–9.20.27 and 9.21.0–9.21.25. Other flaws affect 9.11.0–9.18.50 (EOL), 9.20.0–9.20.27, and 9.21.0–9.21.25. Fixed in 9.20.29 and 9.21.26.