Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
15 / 15 results
highbug_reportVulnerabilityTailscale SSH flaws enable root escalation from compromised devices
Tailscale version 1.104.2 and headscale version 0.29.5. Affects networks with Tailscale SSH enabled and port forwarding configured. Headscale 0.29.5 cannot disable forwarding, making all SSH grants potentially exploitable.
criticalbug_reportVulnerabilityDell CSM critical flaws allow unauthenticated admin access on Kubernetes
Dell Container Storage Modules (CSM) all versions prior to 1.17.0. Fixed in version 1.18.0. Affects csm-authorization-storage gRPC server, authorization proxy, tenant service, ContainerStorageModule Custom Resource reconciler, CSM Authorization modul…
criticalbug_reportVulnerabilityDell CSM Authorization flaws allow unauthenticated admin takeover
Dell Container Storage Modules (CSM) Authorization module, versions prior to 1.18.0. Affects environments integrating Dell PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT storage arrays with Kubernetes.
criticalbug_reportVulnerabilityCritical XSS vulnerability in Rancher Kubernetes platform requires patching
Rancher Kubernetes management platform. Specific affected versions not disclosed in available information.
highperson_alertThreat ActorStorm-3068 Pivots from Identity Compromise to Cloud Infrastructure
Storm-3068 is a threat actor tracked by Microsoft that demonstrated sophisticated understanding of cloud-native attack paths. In this intrusion, the actor leveraged a compromised user identity obtained through self-service password reset to gain pers…
highbug_reportVulnerabilityCarbonato botnet exploits exposed Docker daemons to deploy AI agents
Docker daemons exposed without authentication on TCP port 2375. All versions of Docker with unauthenticated remote API access are vulnerable. The malware deploys Hermes AI Agent framework and establishes Telegram-based command and control.
highbug_reportVulnerabilityCarbonato botnet targets exposed Docker daemons to deploy Hermes Agent AI
Docker hosts with exposed or insecurely configured Docker daemons (typically TCP port 2375/2376 without authentication). All Docker versions are potentially affected when daemon API is exposed without proper access controls.
highbug_reportVulnerabilityVMware VeloCloud Orchestrator input validation flaw requires patching
VMware VeloCloud Orchestrator - specific affected versions not disclosed in advisory. VeloCloud Orchestrator is a centralized management platform for SD-WAN deployments.
highbug_reportVulnerabilityJFrog Artifactory flaws actively exploited to create admin backdoors
JFrog Artifactory self-hosted instances: CVE-2026-42018 and CVE-2026-42016 (chained, versions below 7.146.8 on multiple branches); CVE-2026-82329 (standalone critical bypass, CVSS 9.8, versions below 7.161.20 across six branches).
criticalbug_reportVulnerabilityBGP hijack delivers malicious Virtualizor updates to VPS management systems
Virtualizor VPS management software (all versions prior to 3.2.9.9) from Softaculous. Attack window: August 28, 2026 20:57 UTC to August 30, 2026 06:10 UTC.
highbug_reportVulnerabilityChainDrop npm worm infects 400+ packages, steals secrets via blockchain C2
Over 400 npm packages including widely used packages like keyv and cacheable-request. Affects developer workstations, CI/CD pipelines (especially GitHub Actions), cloud environments, and downstream software users.
highbug_reportVulnerability24,650 BMCs expose IPMI password hashes via CVE-2013-4786 flaw
36,872 internet-exposed Baseboard Management Controllers (BMCs) running IPMI v2.0 protocol on UDP port 623. Affected vendors include Supermicro, HPE iLO, and Dell.
highbug_reportVulnerability24,000 BMCs leak password hashes via CVE-2013-4786 IPMI flaw
Over 24,000 internet-exposed Baseboard Management Controllers (BMCs) using IPMI 2.0 protocol (introduced 2004). Primarily affects Supermicro and HPE iLO 4 systems. 36,872 hosts found on UDP port 623, with 24,650 leaking authentication material.
criticalbug_reportVulnerabilityArgo CD repo-server RCE enables cluster takeover, no patch available
Argo CD repo-server component, all versions (specific affected versions not disclosed). Exploitation requires access to internal network port where repo-server listens.
criticalbug_reportVulnerabilityCompromised @antv npm packages deploy credential-stealing malware
Multiple @antv npm packages compromised with Mini Shai-Hulud malware. Affects Linux-based CI/CD pipelines using npm install. Targets credentials from GitHub, AWS, Kubernetes, HashiCorp Vault, npm, and 1Password.