Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
5 / 5 results
highbug_reportVulnerabilityAWS AgentCore Harness default shell tool enables credential exfiltration
AWS AgentCore Harness, all versions using default configurations with built-in shell and file_operations tools enabled. Affects deployments using AWS AgentCore Identity for credential management and downstream MCP server integrations.
highbug_reportVulnerabilityMass-scanning campaign exploits Vite dev servers to steal AWS/Azure creds
Vite versions 7.1.0 through 7.3.2 and 8.x before 8.0.5. Internet-exposed Vite development servers (typically port 5173) running with --host flag, server.host configuration, or misconfigured Docker port mappings.
highbug_reportVulnerabilityAWS Kiro IDE vulnerability allowed RCE via hidden web text injection
AWS Kiro agentic coding IDE (specific versions not disclosed). Vulnerability has been patched by AWS. Users who installed Kiro before the patch are potentially affected.
highperson_alertThreat ActorNadMesh Botnet Targets AI Services for AWS and Kubernetes Credential Theft
NadMesh is a Go-based botnet operation discovered in early July that specializes in compromising cloud infrastructure credentials through exploitation of exposed AI and automation services.
criticalbug_reportVulnerabilityCompromised @antv npm packages deploy credential-stealing malware
Multiple @antv npm packages compromised with Mini Shai-Hulud malware. Affects Linux-based CI/CD pipelines using npm install. Targets credentials from GitHub, AWS, Kubernetes, HashiCorp Vault, npm, and 1Password.