Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1068 results
highbug_reportVulnerabilityAbandoned CDN domain re-registered; thousands of sites still load from it
Thousands of websites, code repositories, and documentation pages with hard-coded references to an expired CDN domain, re-registered in July 2025. The new owner controls wildcard DNS for the entire domain and all traffic to hostnames beneath it.
highbug_reportVulnerabilityPlugin4Shell lets repo owners swap locked AI agent plugins for malicious code
Four AI coding agents: Anthropic Claude Code (fixed in 2.1.179), OpenAI Codex (fixed in 0.146.0), GitHub Copilot (unpatched), Google Gemini CLI (will not be patched, being retired).
highbug_reportVulnerability13 malicious npm packages deliver WeaselBiscuit stealer targeting Chrome data
13 npm packages (@biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, @biz44/runtime-utils, engin1, id79-client, process-lhpm, process-mite, process-tail…
highbug_reportVulnerabilityAWS AgentCore Harness default shell tool enables credential exfiltration
AWS AgentCore Harness, all versions using default configurations with built-in shell and file_operations tools enabled. Affects deployments using AWS AgentCore Identity for credential management and downstream MCP server integrations.
criticalbug_reportVulnerabilityCheck Point critical flaw allows root RCE on management servers
Check Point Security Management Server and Log Server (all deployments, regardless of configuration). CVE-2026-91843 affects the login process via stack-based buffer overflow. All versions prior to latest LivePatch are vulnerable.
highbug_reportVulnerabilityLLM-generated PhantomRaven stealer distributed via 100+ npm packages
npm package registry users and developers; over 100 malicious packages uploaded between November 2022 and October 2025. Threat actor also attempted PyPI repository compromise.
highbug_reportVulnerabilityRatHat Android malware uses AI to automate remote device control
Android devices (all versions implied; specific version range not disclosed). No CVE assigned. Threat actor campaign targeting Android users with AI-enhanced remote access trojan.
criticalbug_reportVulnerabilityCheck Point Management flaw allows unauthenticated remote code execution
Check Point Security Management Server and Log Server: R82.20 (all builds), R82.10 (Jumbo Hotfix Take ≤44), R82 (Take ≤126), R81.20 (Take ≤166), R81.10 (Take ≤190), and R81, R80.40, R80.30, R80.20, R80.10, R80 (end-of-support).
criticalbug_reportVulnerabilityBrevo supply-chain attack: stolen Cloudflare API key injected malware
Brevo CRM/marketing platform and up to 100,000 customer websites embedding Brevo forms, Conversations widget, or SDK loader scripts. Affected domains: brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, sibforms.com.
criticalbug_reportVulnerabilityCERT.BE warns of critical Cisco vulnerabilities requiring urgent patching
Cisco products (specific products, versions, and CVE identifiers not disclosed in available advisory text)
criticalbug_reportVulnerabilityDocker Sandboxes VM escape on macOS allows host file access via symlinks
Docker Sandboxes versions 0.28.0 through 0.41.9 on macOS. CVE-2026-77179 (Critical, CVSS 9.4) affects virtio-fs in versions 0.28.0–0.41.9. CVE-2026-79994 (High, CVSS 8.7) affects Unix socket relay in versions 0.37.0–0.41.9.
criticalbug_reportVulnerabilityCheck Point Security Management unauthenticated RCE requires immediate patching
Check Point Security Management servers. Specific affected versions not disclosed in available information. Vulnerability allows unauthenticated remote code execution.
criticalbug_reportVulnerabilityCritical RCE flaw in Unbound DNS resolver affects all versions before 1.26.1
Unbound DNS resolver versions up to and including 1.26.0. All deployments are affected regardless of configuration. The vulnerability exists in the DNSSEC validator component and can be triggered by an attacker controlling a malicious DNS zone.
highbug_reportVulnerabilityWindows 11 Sept 2026 updates break domain login via Machine Identity Isolation
Windows 11 versions 24H2, 25H2, and 26H1 after installing September 2026 security updates (KB5124008, KB5124012). Affects enterprise environments with domain-joined devices NOT connected to Windows Server 2025 domain controllers.
highbug_reportVulnerabilityBIND 9 patches 14 flaws, including DoH crash via malformed SIG(0) request
ISC BIND 9 DNS server software. Critical DoH crash affects 9.20.0–9.20.27 and 9.21.0–9.21.25. Other flaws affect 9.11.0–9.18.50 (EOL), 9.20.0–9.20.27, and 9.21.0–9.21.25. Fixed in 9.20.29 and 9.21.26.
criticalbug_reportVulnerabilityCisco ISE max-severity auth bypass zero-day exploited in the wild
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) versions 3.1, 3.2, 3.3, 3.4, and 3.5. CVE-2026-76460 affects all configurations due to insufficient authentication control on an API endpoint.
highbug_reportVulnerabilityKREMLIN malware force-installs malicious Chrome/Edge extensions via bypass
Google Chrome and Microsoft Edge browsers on Windows systems. Active campaign since May 2025 with 1,515+ confirmed infections, primarily in Brazil. Affects users who execute malicious JavaScript files disguised as business documents.
criticalbug_reportVulnerabilityIssabel Framework hard-coded JWT key enables unauthenticated RCE
Issabel Framework (all versions prior to August 1, 2026 patch). Issabel is a web-based framework for open-source unified communications PBX software built on Asterisk.
highbug_reportVulnerabilityBrowser extensions can hijack AI agents in Chrome, Edge, Comet, Opera, Claude
Chromium-based browsers with embedded AI assistants: Google Chrome (fixed in v143.0.7499.192, Jan 2026), Microsoft Edge (fixed in v150.0.4078.48, July 2026), Perplexity Comet, Opera Neon, and Claude in Chrome extension.
criticalbug_reportVulnerabilityHPE Aruba EdgeConnect SD-WAN auth bypass and RCE flaws require patching
HPE Aruba Networking EdgeConnect SD-WAN appliances. Specific affected versions not disclosed in available data. Vulnerabilities enable authentication bypass and remote code execution.
highbug_reportVulnerabilityAI coding assistant hijacked to spread Shai-Hulud worm across 100 repos
Unnamed SaaS provider; approximately 100 internal code repositories compromised. Attack vector: AI coding assistant session hijack leading to poisoned PyPI package installation, GitHub OAuth token theft, and Shai-Hulud worm deployment.
highbug_reportVulnerabilityParallels Desktop privilege escalation leaves Intel Macs unpatched
Parallels Desktop for Mac versions below 27.0.0. Fix available only in version 27, which requires Apple silicon; Intel-based Macs running version 26.x remain vulnerable. CVE-2026-90894 (CVSS 7.8).
highbug_reportVulnerabilitySix critical flaws in WNC T-Mobile 5G Box IDU routers enable RCE
WNC T-Mobile 5G Box IDU routers running firmware versions before 1.1.0.651412. All six CVEs affect the same product and version range. Vulnerabilities include authentication bypass (CVE-2026-40854), three OS command injection flaws (CVE-2026-40855, C…
highbug_reportVulnerabilityGoogle Pixel modem privilege escalation under limited targeted exploitation
Google Pixel devices with cellular modem component. All devices with security patch level prior to 2026-09-05. CVE-2026-58704 is a logic error enabling remote (proximal/adjacent) privilege escalation without user interaction.
criticalbug_reportVulnerabilityConnectWise ScreenConnect CVE-2026-84869 actively exploited in wild
ConnectWise ScreenConnect versions prior to 26.6.5. Affects ScreenConnect clients used by MSPs and IT teams for remote access and system management. Over 1,000 unpatched instances exposed online, primarily in North America (758) and Europe (180).
highbug_reportVulnerabilityAcronis cPanel Backup plugin privilege escalation exploited in wild
Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021 and Acronis Backup extension for Plesk (Linux) before build 1.8.11.638. Affects Linux-based web hosting control panel deployments.
criticalbug_reportVulnerabilityWooCommerce Wholesale Lead Capture flaw exploited for PHP backdoor uploads
WooCommerce Wholesale Lead Capture WordPress plugin, all versions up to and including 2.0.3.1. Approximately 6,000+ active installations. CVE-2026-27540 (CVSS 9.8) - arbitrary file upload due to missing validation in wwlc_file_upload_handler AJAX act…
highbug_reportVulnerabilityAcronis cPanel/Plesk backup plugin flaw exploited for Linux privilege escalation
Acronis Backup plugin for cPanel & WHM (builds < 1.9.3.1021) and Acronis Backup extension for Plesk (builds < 1.8.11.638). Affects Linux servers running these backup integrations in web hosting environments.
highbug_reportVulnerabilityAdmin Menu Editor Pro supply chain attack backdoors 1,500 WordPress sites
Admin Menu Editor Pro WordPress plugin versions 2.35 and 2.36. At least 230 customers affected across approximately 1,500 WordPress sites. The free version (300,000+ installations) is not affected.
criticalbug_reportVulnerabilitySAP Extended Passport Processing memory corruption flaw patched
SAP Extended Passport Processing (EPP) component across SAP products. Specific affected versions not disclosed in available information. Organizations running SAP systems with EPP functionality should assume exposure.