Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1071 results
highbug_reportVulnerabilityClosedQuorum malware uses AI models to automate post-compromise decisions
Windows systems. ClosedQuorum is a Go-based malware that targets credentials from LSASS, browsers (Chrome, Edge, Firefox), and cryptocurrency wallets (MetaMask, Exodus, Ethereum). No specific Windows versions identified.
criticalbug_reportVulnerabilityWordPress path traversal flaw enables unauthenticated RCE on some servers
WordPress core versions 4.7.0 through 7.1.1. All installations are vulnerable to path traversal; remote code execution depends on active theme having a folder starting with "page-" and server configuration (register_argc_argv enabled, presence of exp…
highbug_reportVulnerabilityMalicious npm package impersonates Twilio security tool to steal credentials
npm package "tw-pkgprobe-7731" (versions 1.0.0 through 1.1.1, published mid-August 2026). Targets developers using Twilio APIs in Node.js environments. Specifically exfiltrates ACCOUNT_SID and AUTH_TOKEN environment variables from Twilio integrations…
criticalbug_reportVulnerabilityBifrost AI Gateway RCE allows unauthenticated command execution via HTTP
Bifrost open-source AI gateway, all versions before transports/v2.1.0. Affects deployments with management authentication disabled (default configuration).
criticalbug_reportVulnerabilityCheck Point Management Server zero-day exploited in the wild
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Fixed in R82.20 Security Hotfix.
highbug_reportVulnerabilityZero-day PoC blocks Microsoft Defender updates via disk exhaustion
Microsoft Defender on all supported Windows versions. No patch available. Tool published September 19, 2026 by Abdelhamid Naceri. No CVE assigned.
highbug_reportVulnerabilityVMware VeloCloud Orchestrator input validation flaw requires patching
VMware VeloCloud Orchestrator - specific affected versions not disclosed in advisory. VeloCloud Orchestrator is a centralized management platform for SD-WAN deployments.
highbug_reportVulnerabilityEvilTokens PhaaS platform disrupted after enabling 12,000+ inbox compromises
Organizations worldwide using Microsoft 365 and OAuth device code authentication. Over 12,000 inboxes compromised across 10,000+ organizations since February 2026.
criticalbug_reportVulnerabilityOrkes Conductor RCE vulnerability requires immediate patching
Orkes Conductor (specific versions not disclosed in advisory). Remote Code Execution vulnerability affecting systems running the workflow orchestration platform.
criticalbug_reportVulnerabilityMikroTik RouterOS pre-auth RCE chain enables full device takeover
MikroTik RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. All unpatched RouterOS devices with SSH enabled are vulnerable to unauthenticated remote takeover when CVE-2026-67279 and CVE-2026-86060 are chained together.
criticalbug_reportVulnerabilityD-Link DIR-822A routers hit by max-severity zero-day with public exploit
D-Link DIR-822A dual-band Wi-Fi routers (legacy models, all firmware versions). CVE-2026-86296 is a stack-based buffer overflow in the DHCP server component (udhcpcd/serverpacket.c).
criticalbug_reportVulnerabilityCVSS 10.0 VeloCloud Orchestrator flaw actively exploited in wild
Arista VeloCloud Orchestrator (VCO) on-premises deployments using certificate-based Edge authentication. Affected versions: 5.2.3.15 and earlier, 6.1.3.7 and earlier, 6.4.2.7 and earlier, 7.0.0.2 and earlier.
criticalbug_reportVulnerabilityLinux ARM64 KVM flaw allows guest-to-host escape via nested virtualization
Linux kernel ARM64 KVM code with nested virtualization enabled. Affected versions: 6.17 through 6.18.50, 7.0 through 7.2.4, and 7.3-rc pre-releases. Fixed in 6.18.51, 7.2.5, and 7.3-rc1.
criticalbug_reportVulnerabilityThree Linux kernel flaws under active exploitation, CISA orders patching
Linux kernel across distributions. CVE-2025-39964 (critical, 14-year-old race condition in AF_ALG cryptographic socket interface), CVE-2026-53266 (out-of-bounds write in ebtables SNAT), CVE-2025-39682 (TLS receive-path logic flaw with kTLS).
highbug_reportVulnerabilityWordPress Core CSRF flaw (Click2Shell) enables RCE via theme preview
WordPress Core versions 7.1.0 and earlier. Fixed in version 7.1.1 released last week. Affects all WordPress installations running vulnerable versions where administrators can be socially engineered to click malicious links.
criticalbug_reportVulnerabilityFake LastPass installer uses Microsoft-signed driver to kill EDR and steal passwords
Windows systems where users downloaded a fake LastPass Authenticator installer from a malicious GitHub repository (github.com/LastPass-Authenticator). The attack uses a Microsoft-signed kernel driver (Alinubx.sys, renamed CcProtect.sys from CnCrypt d…
criticalbug_reportVulnerabilityAuthentication bypass in pgAdmin 4 requires immediate patching
pgAdmin 4, a PostgreSQL database management platform. Specific affected versions not disclosed in available information. All pgAdmin 4 installations should be considered at risk until patched.
criticalbug_reportVulnerabilityCritical Synology DiskStation Manager flaw enables data theft and DoS
Synology DiskStation Manager (DSM) - specific affected versions not disclosed in available information. Impacts Synology NAS devices running vulnerable DSM versions.
highbug_reportVulnerabilityCisco ISE auth bypass zero-day exploited; AI agent RCE and browser malware
Cisco Identity Services Engine (ISE) - CVE-2026-76460 actively exploited. AI coding agents (Claude Code, OpenAI Codex, GitHub Copilot, Google Gemini CLI) vulnerable to Plugin4Shell RCE.
highbug_reportVulnerabilitynpm malware campaign evades install-time defenses via runtime triggers
npm package 'indexed-btree' (2M weekly downloads) and 9 related packages: ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, sliding-score-window.
highbug_reportVulnerabilityOpenAI Codex sandbox escapes allowed RCE on host from locked-down mode
OpenAI Codex Desktop (fixed in build 26.818.21641) and Codex CLI (fixed in version 0.149.0). Both vulnerabilities affected all users; Heapjack was default-enabled with no opt-out and impacted CLI users inheriting Desktop config.
highbug_reportVulnerabilityClaude Opus 5 used to chain forum RCE and SSO flaw, breach OpenAI staff accounts
OpenAI's public help forum (running Discourse with libheif 1.19.7 on Debian 12) and OpenAI's single sign-on (SSO) system. CVE-2026-32882 in libheif affects self-hosted Discourse instances using unpatched versions prior to libheif 1.22.0.
highbug_reportVulnerabilityBragJack PoC hijacks AI assistants via malicious browser extensions
AI assistants in Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic Claude (Chrome). Attack vector: malicious browser extensions using Prompt Forcing technique. Specific affected versions not disclosed.
highbug_reportVulnerabilitySolarWinds ARM hard-coded key flaw enables unauthenticated RCE
SolarWinds Access Rights Manager (ARM) versions 2026.2 and prior. The vulnerability stems from a hard-coded static key that allows unauthenticated remote code execution.
criticalbug_reportVulnerabilityOrkes Conductor pre-auth RCE (CVE-2026-58138) exploited in wild
Orkes Conductor workflow platform versions 3.21.21 through 3.30.1. All deployments with externally accessible workflow API endpoints and unsandboxed GraalVM evaluators configured with unrestricted host access are vulnerable.
highbug_reportVulnerabilityCrowdSec: 170 private repos copied via TanStack npm attack on ex-employee laptop
CrowdSec private GitHub repositories (approx. 170 repos), including web console, data science models, automation scripts, and consensus algorithm code. Affected via former employee's compromised laptop during TanStack npm supply chain attack (CVE-202…
criticalbug_reportVulnerabilityCISA: Three Linux kernel CVEs actively exploited in the wild
Linux kernel across all distributions. CVE-2025-39682 affects TLS receive path (CVSS 9.8), CVE-2026-53266 affects ebtables SNAT/ARP (CVSS 8.8), CVE-2025-39964 affects AF_ALG socket handling (CVSS 7.8). All require local authenticated access.
highbug_reportVulnerabilityFour Linux kernel local root exploits released with public PoC code
Linux kernel versions prior to 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Four vulnerabilities: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), CVE-2026-74469 (DiagSpill).
highbug_reportVulnerabilityWordPress Click2Shell flaw forces theme install via link, chains to RCE
WordPress core versions 6.0 through 7.1.0. Patched in WordPress 7.1.1 and backported security releases for all supported branches back to 4.7. Exploitation requires logged-in administrator to open crafted link.
criticalbug_reportVulnerabilityWSO2 API Management JWT auth bypass under active exploitation
WSO2 API Management products with JWT authentication enabled. Specific affected versions not disclosed in available data. Vulnerability allows authentication bypass via JWT token manipulation.