Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
satellite_altDaily BriefCyber Threat Daily Brief — October 28, 2026
Today's briefing: 9 critical and 29 high-severity threats. A total of 45 detailed analyses covering vulnerabilities, threat actors, and geopolitical context.
Latest Reports
29 / 1755 results
criticalbug_reportVulnerabilityCritical XSS vulnerability in Rancher Kubernetes platform requires patching
Rancher Kubernetes management platform. Specific affected versions not disclosed in available information.
criticalbug_reportVulnerabilityCitrix NetScaler zero-day CVE-2026-88772 exploited for web shells, root access
Citrix NetScaler ADC and Gateway appliances with DTLS enabled. CVE-2026-88772 is a memory overflow vulnerability leading to remote code execution. CVE-2026-88771 (unauthenticated RCE) also disclosed alongside it.
criticalbug_reportVulnerabilityWatchGuard RCE vulnerabilities require immediate patching per CERT.BE
WatchGuard products (specific models and versions not disclosed in available information). Two remote code execution vulnerabilities identified.
highperson_alertThreat ActorFormer US Air Force Members Sentenced for Multi-Year BEC Fraud
Chijioke Timothy Odimegwu (25) and Harafat Mogaji (26) are former United States Air Force members who conducted business email compromise (BEC) scams and phishing campaigns while stationed at Dover Air Force Base in Delaware.
highpublicGeopoliticalFrench Tax Breach Exposes 600K Records via Stolen Credentials, Weak Controls
The seven-week breach of France's Direction Générale des Finances Publiques (DGFIP) represents a significant compromise of sovereign fiscal infrastructure, exposing tax data on approximately 350,000 individuals and 250,000 businesses.
highbug_reportVulnerabilityNew Spectre-v2 BTR variant bypasses defenses, leaks Linux kernel memory
JIT engines in Mozilla Firefox (SpiderMonkey), GraalVM, and Linux kernel cBPF JIT across Intel, AMD, and other CPU vendors. Affects systems with speculative execution despite existing Spectre-v2 mitigations.
highperson_alertThreat ActorStar Blizzard Deploys CosmicPulse Backdoor via Fake Event Invitations
Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor attributed by U.S., U.K., Australian, Canadian, and New Zealand security agencies to Center 18 of Russia's Federal Security Service…
highbug_reportVulnerabilityNew Spectre v2 BTR variant leaks Linux root hashes in 3-5 minutes on Intel
Intel, AMD, and Arm CPUs with indirect branch prediction. Confirmed exploitable on Linux kernel cBPF (default and constant blinding configurations). Firefox SpiderMonkey and Oracle GraalVM also affected but full exploits not demonstrated.
highperson_alertThreat ActorStorm-3068 Pivots from Identity Compromise to Cloud Infrastructure
Storm-3068 is a threat actor tracked by Microsoft that demonstrated sophisticated understanding of cloud-native attack paths. In this intrusion, the actor leveraged a compromised user identity obtained through self-service password reset to gain pers…
highperson_alertThreat ActorAutomated AI Agent Breaches Dutch Cybersecurity Nonprofit DIVD
The threat actor employed an automated AI agent to conduct what DIVD characterized as the first observed "agentic AI-powered attack" against their organization. The actor's identity, motivation, and origin remain unknown.
highperson_alertThreat ActorStar Blizzard Adopts RedFlick Delivery Technique in 2026 Campaigns
Star Blizzard (also tracked as SEABORGIUM, Callisto Group, TA446, COLDRIVER) is a Russian state-sponsored threat actor attributed by CISA to the FSB Centre 18.
criticalbug_reportVulnerabilityKiteworks patches critical flaw found during precautionary shutdown
Kiteworks secure file transfer platform; specific versions not disclosed. Vulnerability confined to a capability enabled for less than 1% of customer base. Other Kiteworks products unaffected.
highperson_alertThreat ActorPhantomSub Campaign Abuses npm Packages to Subscribe Devs to WhatsApp
PhantomSub is a supply chain campaign targeting software developers through malicious npm packages. The campaign abuses the Baileys WhatsApp open source project to add victims to WhatsApp groups and channels without consent.
highbug_reportVulnerabilityDas U-Boot out-of-bounds write allows code execution via fragmented IP
Das U-Boot versions 2009.08 through 2026.07 (pre-fix) when compiled with CONFIG_IP_DEFRAG=y. Das U-Boot is a widely-deployed open-source bootloader used in embedded systems, IoT devices, and network equipment.
highperson_alertThreat ActorDutch Police Arrest 24-Year-Old Linked to ShinyHunters Group
ShinyHunters is a financially-motivated cybercrime group known for large-scale data breaches and extortion operations. The group has historically targeted organizations to steal sensitive data for sale or extortion.
highbug_reportVulnerabilityMCP Python SDK flaw lets malicious servers steal OAuth credentials
Anthropic MCP Python SDK versions 1.9.1–1.29.1 (1.x line) and 2.0.0–2.1.1 (2.x line). Affects MCP clients using HTTP with OAuth providers (OAuthClientProvider, ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider, RFC7523OAuthClientProvider) th…
highperson_alertThreat ActorKeio Corporation ransomware attack disrupts Japanese rail operator
No specific threat actor has been identified or claimed responsibility for this incident as of the reporting date. The attack targeted Keio Corporation, a major Japanese private railway operator with 85 km of track, 69 stations, and a hospitality div…
highpublicGeopoliticalTimes Car breach exposes 6.6M accounts in Japan mobility sector
The breach of Times Car, a subsidiary of the Park24 Group operating Japan's largest car-sharing network with 29,000 stations nationwide, represents a significant compromise of critical transportation infrastructure data.
highperson_alertThreat ActorDutch Police Arrest Amsterdam Man in ShinyHunters Investigation
ShinyHunters is a cybercrime group known for large-scale data breaches and extortion operations. The group has been active since at least 2020, targeting organizations across multiple sectors to steal and leak sensitive data.
highbug_reportVulnerabilityApple patches CoreGraphics out-of-bounds write exploited in targeted attacks
CVE-2026-86950 affects CoreGraphics in iOS versions before 26.7.1, iPadOS before 26.7.1, macOS Tahoe before 26.7.1, and macOS Sequoia before 15.8.1. Impacted devices include iPhone 11 and later, iPad Pro (3rd gen 12.9-inch and 1st gen 11-inch and lat…
criticalbug_reportVulnerabilityBitget exchange loses $388M via zero-day in unnamed third-party product
Bitget cryptocurrency exchange. The unnamed third-party security product used by Bitget contained a zero-day vulnerability that allowed credential theft. Hot and warm wallets were compromised; cold wallets unaffected.
highperson_alertThreat ActorRatHat MaaS Operators Deploy AI-Powered Android Banking Trojan
RatHat operators are cybercriminals running a malware-as-a-service (MaaS) platform focused on Android banking fraud. The operators build and distribute the RatHat Android banking trojan, providing customers with web-based consoles to control infected…
criticalperson_alertThreat ActorJadePuffer Ransomware Targets Azure Tenants with Agentic AI Attacks
JadePuffer (tracked by Microsoft as Storm-3168) is a ransomware operator that emerged in July 2026, specializing in agent-driven attacks against cloud infrastructure.
highperson_alertThreat ActorShinyHunters escalates attacks after Dutch arrest of suspected member
ShinyHunters is a prolific cybercrime group known for large-scale data theft and extortion operations. The group operates as a collective with multiple members across jurisdictions.
criticalbug_reportVulnerabilityCitrix NetScaler zero-days CVE-2026-88771/88772 exploited in wild
Citrix NetScaler ADC and NetScaler Gateway devices. Specific vulnerable versions not disclosed in advisory. Cortex Xpanse telemetry identifies 50,277 exposed instances potentially vulnerable as of Sept. 27, 2026.
highperson_alertThreat ActorNeedyMantis: Modular Post-Compromise Framework in Targeted Intrusions
NeedyMantis is a modular post-compromise malware framework, not a threat actor. It has been observed in use by at least one operator, Storm-3069 (linked to the DAEMON Tools supply chain compromise).
highbug_reportVulnerabilityZimbra XSS vulnerabilities require immediate patching per CERT.BE
Zimbra Collaboration Suite - specific affected versions not disclosed in available advisory. Multiple Cross-site Scripting (XSS) vulnerabilities identified.
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway flaws under active global exploitation
Citrix NetScaler ADC and Gateway appliances. CVE-2026-88771 (improper input validation allowing unauthenticated remote command execution) and CVE-2026-88772 (remote code execution or denial-of-service).
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway under active attack via two RCE flaws
Citrix NetScaler ADC and Gateway on-premises: versions 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS editions before 14.1-73.37 FIPS and 13.1-37.279. Cloud-managed instances not affected.