Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 593 results
criticalbug_reportVulnerabilityCritical Brotli buffer overflow (CVE-2026-111497) enables RCE in Node.js
Brotli C decoder library versions 1.0.3–1.0.9, 1.1.0, and 1.2.0. Affects Node.js (versions prior to 22.23.4, 24.22.1, 26.12.1), Python HTTP clients (urllib3[brotli], requests, httpx, aiohttp[speedups]), .NET, and any application decompressing attacke…
criticalbug_reportVulnerabilityCritical Brotli decoder flaw in .NET enables RCE via crafted streams
Microsoft .NET 8, 9, 10, and 11 RC3. Applications using ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs are vulnerable.
criticalbug_reportVulnerabilityWasmtime sandbox escape flaws allow malicious WebAssembly code execution
Wasmtime WebAssembly runtime: CVE-2026-115889 affects all architectures in versions before 36.0.19 and 37.0.0–42.x; CVE-2026-115893 affects ARM64/aarch64 only in versions before 36.0.19, 37.0.0–47.x, 48.0.0–48.0.6, and 49.0.0–49.0.3.
criticalbug_reportVulnerabilityPHP2Shell RCE flaws (CVE-2026-109618/109619) confirmed exploited in wild
PHP 8.4.26 and likely earlier versions. Affects approximately 70% of websites globally (~5.1 million exposed PHP hosts). Confirmed exploitation against Apache mod_php installations.
criticalbug_reportVulnerabilityCritical RCE in ISC BIND 9 DNS software requires immediate patching
ISC BIND 9 DNS software. Specific vulnerable versions not disclosed in available information. Affects organizations running BIND DNS servers.
criticalperson_alertThreat ActorBlackX UEFI bootkit exploits Baton Drop to bypass Secure Boot
BlackX is a UEFI bootkit malware family deployed in an espionage campaign in early 2026. The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group also tracked as Brass Typhoon, Wicked Panda, and Barium…
criticalbug_reportVulnerabilityCritical vulnerabilities in HPE Networking AOS require immediate patching
HPE Networking AOS (ArubaOS-Switch). Specific affected versions not disclosed in available information. Multiple critical-severity vulnerabilities reported by CERT.BE.
criticalbug_reportVulnerabilityLiteLLM supply chain attack via leaked master key compromised v1.107.0
LiteLLM Python package version 1.107.0 (published October 21, 2026 to PyPI, Docker Hub, and GHCR). Threat actor gained owner-level access to BerriAI GitHub organization via unrevoked master key exposed May 27, 2026.
criticalbug_reportVulnerabilityCISA: Collabora Online and Arista VeloCloud flaws exploited in wild
Collabora Online Built-in CODE Server (richdocumentscode) within NextCloud platform, fixed in version 26.4.303 (September 2026). Arista VeloCloud Orchestrator on-premise versions, fixed in 5.2.3.18, 6.1.3.10, and 6.4.2.12 (October 2026).
criticalperson_alertThreat ActorAPT41 Deploys BlackX UEFI Bootkit Against Central Asian Diplomats
APT41 (also tracked as Wicked Panda, Brass Typhoon, BARIUM) is a China-linked state-sponsored advanced persistent threat group attributed by Kaspersky to the BlackX bootkit campaign.
criticalbug_reportVulnerabilityLiteLLM 1.107.0 supply chain attack steals credentials via Python hooks
LiteLLM version 1.107.0 distributed via PyPI and official container images on October 21, 2026. Affects any Python environment where the compromised package was installed, including developer workstations, CI/CD agents, test systems, containers, and…
criticalbug_reportVulnerabilityRuby patches Onigmo regex RCE flaws exploited via GitLab untrusted input
Ruby versions 4.0.0–4.0.8, 3.4.0–3.4.11, and 3.3.0–3.3.12. Ruby 3.2 and earlier (EOL) will not receive patches. GitLab versions 7.0+ were affected; patched in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13.
criticalbug_reportVulnerabilityHPE patches 8 critical auth bypass and RCE flaws in ArubaOS
Aruba Operating System (ArubaOS) versions AOS-8 and AOS-10, affecting Aruba Networking mobility conductors, access points, controllers, and gateway devices.
criticalbug_reportVulnerabilityPillow library RCE via EPS filename injection; upgrade to 13.0.0 required
Pillow versions 2.6.0 through 12.3.0. Affects Python applications processing EPS images with Ghostscript installed, particularly web upload endpoints that accept user-controlled filenames.
criticalbug_reportVulnerabilityNode.js Brotli RCE (CVE-2026-111497) exploited via crafted compression data
Node.js versions 22.x, 24.x, and 26.x on all architectures. Confirmed RCE on 24.22.0 Linux arm64. Applications decoding untrusted Brotli data via fetch() responses or request body middleware (Express 5.x body parsers, body-parser 2.x) are vulnerable.…
criticalbug_reportVulnerabilityLiteLLM PyPI and Docker supply chain attack delivers credential stealer
LiteLLM version 1.107.0 on PyPI (all seven .whl packages for Windows, Linux, macOS) and Docker images (v1.107.0, latest, main-latest, main-stable) on Docker Hub and GHCR. Attack window: October 21, 2026, 11:39–14:20 UTC.
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator SQL injection zero-day under active exploit
Arista VeloCloud Orchestrator (VCO) versions before 5.2.3.18, 6.1.3.10, and 6.4.2.12. On-premises deployments affected; Hosted and Dedicated orchestrators already patched. VeloCloud Gateway and Edge devices not affected.
criticalbug_reportVulnerabilityeMudhra CA exits SSL/TLS business after 8 intermediate keys found guessable
eMudhra certificate authority: 8 intermediate CA private keys compromised (6 for TLS). Approximately 30,800 unexpired certificates chained to emSign ECC Root CA - G3, 99.9% issued through InCommon (higher education).
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator SQL injection zero-day under active exploit
Arista VeloCloud Orchestrator (VCO) On-Prem deployments. Patched versions: 5.2.3.18+, 6.1.3.10+, 6.4.2.12+. Hosted VCO instances already patched. Unpatched on-prem deployments remain vulnerable.
criticalbug_reportVulnerabilityeMudhra CA private keys compromised; MitM attacks possible via rogue certs
Eight intermediate Certificate Authority (CA) private keys from eMudhra Limited (Indian CA). Affects any TLS/SSL certificates issued by these compromised intermediates, including public-facing services, VPNs, APIs, and internal infrastructure relying…
criticalbug_reportVulnerabilityTwo 9.0 CVSS RCE flaws in Linux KSMBD disclosed before kernel fixes
Linux KSMBD (kernel SMB server) on all distributions where the module is loaded. ZDI-CAN-33774 affects any KSMBD install on port 445. ZDI-CAN-33549 requires SMB Direct transport with RDMA-capable network hardware or rxe software driver.
criticalbug_reportVulnerabilityGitLab unauthenticated RCE vulnerability requires immediate patching
GitLab (specific versions not disclosed in available information). Vulnerability allows unauthenticated remote code execution. No CVE assigned yet or not publicly disclosed.
criticalbug_reportVulnerabilityFortinet releases critical security updates across multiple products
Multiple Fortinet products affected. Specific product names, versions, and CVE identifiers not disclosed in available advisory. CERT.BE has issued urgent patching guidance.
criticalbug_reportVulnerabilityCritical PHP vulnerabilities enable remote code execution
PHP (specific versions not disclosed in advisory). All systems running vulnerable PHP installations are affected. CERT.BE issued critical-severity warning for multiple RCE vulnerabilities.
criticalbug_reportVulnerabilityGitLab patches max severity RCE flaw in Regular Expression Compiler
GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Vulnerability tracked as CVE-2026-110264. Over 2,700 GitLab CE instances exposed online.
criticalbug_reportVulnerabilityGitLab CVE-2026-110264: Unauthenticated RCE in CE/EE (CVSS 10.0)
GitLab Community Edition (CE) and Enterprise Edition (EE) versions 7.0 through 19.5.0. Specifically: 7.0–18.11.12, 19.0–19.0.9, 19.1–19.1.8, 19.2–19.2.8, 19.3–19.3.5, 19.4–19.4.2, and 19.5.0.
criticalbug_reportVulnerabilityLiteLLM supply chain attack: malicious v1.107.0 steals credentials via PyPI
LiteLLM Python package v1.107.0 on PyPI (Oct 21, 2026, 11:39-13:23 UTC) and Docker images v1.107.0, latest, main-latest, main-stable on Docker Hub and GHCR (11:46-14:20 UTC).
criticalbug_reportVulnerabilityGitLab CVSS 10.0 RCE affects all self-managed versions since 2014
GitLab self-managed installations versions 7.0 (2014) through 19.5.0. Fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com and GitLab Dedicated already patched.
criticalbug_reportVulnerabilityChina-linked Storm-0940 used AI framework to breach ConnectWise supply chain
ConnectWise multi-tenant application compromised; downstream victims across Microsoft 365 environments in aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, softwar…
criticalbug_reportVulnerabilityLiteLLM 1.107.0 supply chain attack delivers credential stealer via PyPI
LiteLLM Python package version 1.107.0 distributed via PyPI wheels (all platforms: macOS x86_64/ARM64, Linux x86_64/aarch64, Windows AMD64) and Docker images. Compromised through stolen GitHub CLI OAuth tokens from three engineer accounts.