Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
8 / 8 results
criticalbug_reportVulnerabilityLiteLLM supply chain attack: malicious v1.107.0 steals credentials via PyPI
LiteLLM Python package v1.107.0 on PyPI (Oct 21, 2026, 11:39-13:23 UTC) and Docker images v1.107.0, latest, main-latest, main-stable on Docker Hub and GHCR (11:46-14:20 UTC).
criticalbug_reportVulnerabilityLiteLLM 1.107.0 supply chain attack delivers credential stealer via PyPI
LiteLLM Python package version 1.107.0 distributed via PyPI wheels (all platforms: macOS x86_64/ARM64, Linux x86_64/aarch64, Windows AMD64) and Docker images. Compromised through stolen GitHub CLI OAuth tokens from three engineer accounts.
highperson_alertThreat ActorBronze Sandcastle Uses Sandboxie DLL Sideloading for Espionage
Bronze Sandcastle is a China-aligned threat actor cluster disclosed by Sophos in October 2026. Active since mid-2025, the group conducts cyber espionage operations targeting organizations in Asia and Africa.
criticalbug_reportVulnerabilityRank Math PRO WordPress plugin compromised with self-restoring backdoor
Rank Math PRO (paid WordPress SEO plugin) version 3.0.123 downloaded or auto-updated from rankmath.com between 20:02 UTC October 15 and 07:12 UTC October 16, 2026. Free version on WordPress.org (4M+ installs) not affected.
highbug_reportVulnerabilityFake Web3 accelerator spreads malware via npm to steal credentials
npm packages @apexacc/cli and @apexacc/audit (now removed); targets Windows and macOS developer systems. Campaign linked to Apex Accelerator/Apex Foundation (apexaccs[.]org, apexfdn[.]xyz).
criticalbug_reportVulnerabilityAOMEI Backupper update servers compromised to deliver backdoor via tampering
AOMEI Backupper (Windows backup software), at least version 8.3.0 confirmed affected. All installations that checked for updates during three confirmed tampering windows between May 28 and July 20, 2026 (total ~21 minutes across three incidents).
criticalbug_reportVulnerabilityHead Mare hacktivists backdoor TrueConf installers via server compromise
TrueConf video conferencing servers (unpatched versions) and client installers distributed from compromised servers. Specific vulnerable versions not disclosed. Affects organizations using TrueConf for video conferencing.
criticalbug_reportVulnerabilitySupply chain attack hits PushEngage, OptinMonster, TrustPulse plugins
WordPress sites using PushEngage, OptinMonster, and TrustPulse plugins. All versions loading compromised JavaScript files from vendor infrastructure are affected.