Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1065 results
highperson_alertThreat ActorNightEagle, Hacking Cat, and Toy Ghouls Target Russian Enterprises
Three distinct threat activity clusters are actively targeting Russian enterprises. NightEagle (APT-Q-95) is a sophisticated threat actor active since at least 2023, employing advanced persistence and lateral movement techniques.
highbug_reportVulnerabilityBrowser extensions can hijack AI agents in Chrome, Edge, Comet, Opera, Claude
Chromium-based browsers with embedded AI assistants: Google Chrome (fixed in v143.0.7499.192, Jan 2026), Microsoft Edge (fixed in v150.0.4078.48, July 2026), Perplexity Comet, Opera Neon, and Claude in Chrome extension.
highbug_reportVulnerabilityAI coding assistant hijacked to spread Shai-Hulud worm across 100 repos
Unnamed SaaS provider; approximately 100 internal code repositories compromised. Attack vector: AI coding assistant session hijack leading to poisoned PyPI package installation, GitHub OAuth token theft, and Shai-Hulud worm deployment.
highbug_reportVulnerabilityParallels Desktop privilege escalation leaves Intel Macs unpatched
Parallels Desktop for Mac versions below 27.0.0. Fix available only in version 27, which requires Apple silicon; Intel-based Macs running version 26.x remain vulnerable. CVE-2026-90894 (CVSS 7.8).
highperson_alertThreat ActorN0va Targets US and EU Orgs with Token-Theft Phishing Campaigns
N0va is a threat actor conducting phishing campaigns targeting organizations across North America and Europe. The actor's motivation appears to be financially driven, with objectives including payment fraud, invoice manipulation, and access to sensit…
highbug_reportVulnerabilitySix critical flaws in WNC T-Mobile 5G Box IDU routers enable RCE
WNC T-Mobile 5G Box IDU routers running firmware versions before 1.1.0.651412. All six CVEs affect the same product and version range. Vulnerabilities include authentication bypass (CVE-2026-40854), three OS command injection flaws (CVE-2026-40855, C…
highbug_reportVulnerabilityGoogle Pixel modem privilege escalation under limited targeted exploitation
Google Pixel devices with cellular modem component. All devices with security patch level prior to 2026-09-05. CVE-2026-58704 is a logic error enabling remote (proximal/adjacent) privilege escalation without user interaction.
highbug_reportVulnerabilityAcronis cPanel Backup plugin privilege escalation exploited in wild
Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021 and Acronis Backup extension for Plesk (Linux) before build 1.8.11.638. Affects Linux-based web hosting control panel deployments.
highbug_reportVulnerabilityAcronis cPanel/Plesk backup plugin flaw exploited for Linux privilege escalation
Acronis Backup plugin for cPanel & WHM (builds < 1.9.3.1021) and Acronis Backup extension for Plesk (builds < 1.8.11.638). Affects Linux servers running these backup integrations in web hosting environments.
highbug_reportVulnerabilityAdmin Menu Editor Pro supply chain attack backdoors 1,500 WordPress sites
Admin Menu Editor Pro WordPress plugin versions 2.35 and 2.36. At least 230 customers affected across approximately 1,500 WordPress sites. The free version (300,000+ installations) is not affected.
highperson_alertThreat ActorREF9334 Deploys KREMLIN Malware Targeting Brazilian Financial Sector
REF9334 is a Brazilian threat actor tracked by Elastic Security Labs, active since at least May 2025. The actor specializes in banking fraud operations targeting Brazilian financial institutions through sophisticated malware delivery campaigns.
highperson_alertThreat ActorIran MOIS Uses Telegram-Controlled Malware to Target Dissidents
Iran's Ministry of Intelligence and Security (MOIS), the country's primary intelligence agency, is attributed by the FBI, UK NCSC, and Netherlands AIVD as the operator behind this espionage campaign.
highbug_reportVulnerabilityBambooToken malware uses MQTT protocol to target Windows and Linux systems
Windows and Linux systems, particularly organizations in Asia and South America. Targets include financial, government, mobile app developers, and various enterprises. Campaign active since February 2023 through July 2026.
highbug_reportVulnerabilityCisco Secure Email Gateway SQL injection requires urgent patching
Cisco Secure Email Gateway (formerly IronPort). Specific affected versions not disclosed in available information. SQL injection vulnerability allows potential unauthorized database access.
highperson_alertThreat ActorIranian State Actors Deploy CHOSEN BRICK Against Dissidents Globally
Iranian state cyber actors are attributed by NCSC UK, FBI, and AIVD to deploying CHOSEN BRICK malware against dissidents, activists, and journalists perceived as threats to the Iranian regime.
highperson_alertThreat ActorIranian State Actors Deploy CHOSEN BRICK Spyware Against Dissidents
Iranian state-sponsored cyber actors conducting surveillance operations against individuals perceived as threats to the Iranian regime. The NCSC assesses that Iran almost certainly uses cyber activity to support repression of dissidents, activists, a…
highbug_reportVulnerabilityMarimo RCE (CVE-2026-39987) exploited for 8-second pivot to SSH bastion
All versions of Marimo notebook application. CVE-2026-39987 is a pre-authenticated remote code execution vulnerability (CVSS 9.3) actively exploited within hours of public disclosure.
highbug_reportVulnerabilityMass-scanning campaign exploits Vite CVE-2026-39364 for cloud credentials
Vite development servers exposed to the internet via --host flag or server.host configuration. Affects deployments where sensitive files exist in server.fs.allow directories and are matched by server.fs.deny patterns.
highperson_alertThreat ActorBlack Axe Leaders Extradited to US for Wire Fraud and Money Laundering
Black Axe is a transnational cybercrime syndicate founded in 1977 in Nigeria, now recognized as one of the world's most dangerous and far-reaching criminal organizations.
highperson_alertThreat ActorUTA0560 Exploits Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
UTA0560 is a Chinese-linked threat actor tracked by Volexity that conducts cyber espionage operations targeting non-governmental organizations. The actor demonstrates sophisticated capabilities in exploiting zero-day vulnerabilities and conducting sp…
highbug_reportVulnerabilityMicrosoft releases emergency patches for RDS failures after September updates
Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, Windows Server 2019/2022/2025. Remote Desktop Services, Hyper-V (HCS-managed VMs with Plan9 shares), and USB Audio Class 1.0 devices with multichannel audio affected by September 2026 security updates.
highpublicGeopoliticalVPN flaw exposes 246,000 Japanese government personnel records
Japan's Digital Agency disclosed a breach affecting its Government Solution Service (GSS) infrastructure, exposing personnel records of government employees, public officials, and associated entities.
highperson_alertThreat Actor3BB Broadband Intrusion: MeshCentral Backdoor Used for Root Access
The threat actor behind this intrusion remains unattributed. The operation targeted 3BB, Thailand's largest broadband provider, with the apparent objective of exfiltrating subscriber credential databases.
highbug_reportVulnerabilityTelegram Desktop HTML export flaw allowed JavaScript injection via bots
Telegram Desktop versions 4.15.1 (March 2024) through 6.9.3 on Windows, macOS, and Linux. Vulnerability affects HTML-exported chat files created with vulnerable versions. Fixed in 6.9.4 beta (July 3, 2026) and 7.0.1 stable (July 14, 2026).
highperson_alertThreat ActorRed Heron Exploits Gitea RCE to Compromise 13 Organizations
Red Heron is a suspected Chinese threat actor attributed with moderate confidence to operating within a China-linked context. Attribution is based on the use of Simplified Chinese labels for target classification, consistent classification of Taiwan…
highbug_reportVulnerabilityMass-scanning campaign exploits Vite dev servers to steal AWS/Azure creds
Vite versions 7.1.0 through 7.3.2 and 8.x before 8.0.5. Internet-exposed Vite development servers (typically port 5173) running with --host flag, server.host configuration, or misconfigured Docker port mappings.
highbug_reportVulnerabilitySQL Injection flaws in Alior Bank PrestaShop module expose backoffice data
Alior Bank "raty" module for PrestaShop. CVE-2026-7848 affects versions 8.0.0 to 8.1.11 (fixed in 8.1.11 and 9.0.7). CVE-2026-15600 affects versions 8.1.9 to 8.1.12 (fixed in 8.1.12 and 9.0.8).
highbug_reportVulnerabilityCompromised IP cameras exploited for espionage and DDoS attacks
IP cameras across multiple vendors and models. Organizations with internet-exposed camera infrastructure are at risk. Specific affected vendors and firmware versions not disclosed in CERT.BE advisory.
highbug_reportVulnerabilityMicrosoft September 2026 updates break RDS on Windows Server and clients
Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and Windows 10/11 all versions that applied September 2026 Patch Tuesday updates. Impacts Remote Desktop Services (RDS), RDP connections, MMC, RDS Licensing Diagnoser, and File Explorer.
highperson_alertThreat ActorHISHIMIRO/jeetbot.cc Leaked OAuth Tokens from 31K Twitch Users
HISHIMIRO/jeetbot.cc is a Russia-based commercial bot service operator linked to the malicious Twitch browser extension "Twitch Enhanced Viewer | JeetBot." The operator, identified as Cyprus-based developer Aleksandr Popov, runs JeetBot as a commerci…