Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 576 results
criticalbug_reportVulnerabilityLiteLLM PyPI and Docker supply chain attack delivers credential stealer
LiteLLM version 1.107.0 on PyPI (all seven .whl packages for Windows, Linux, macOS) and Docker images (v1.107.0, latest, main-latest, main-stable) on Docker Hub and GHCR. Attack window: October 21, 2026, 11:39–14:20 UTC.
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator SQL injection zero-day under active exploit
Arista VeloCloud Orchestrator (VCO) versions before 5.2.3.18, 6.1.3.10, and 6.4.2.12. On-premises deployments affected; Hosted and Dedicated orchestrators already patched. VeloCloud Gateway and Edge devices not affected.
criticalbug_reportVulnerabilityeMudhra CA exits SSL/TLS market after 8 intermediate keys found guessable
eMudhra certificate authority: 8 intermediate CA private keys compromised (6 for TLS). Primary impact: ~30,800 unexpired certificates chained to emSign ECC Root CA - G3, 99.9% issued through InCommon (higher education).
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator SQL injection zero-day under active exploit
Arista VeloCloud Orchestrator (VCO) On-Prem deployments. Patched in hosted VCO versions 5.2.3.18+, 6.1.3.10+, and 6.4.2.12+. On-prem customers must apply updates manually.
criticalbug_reportVulnerabilityeMudhra CA private keys compromised; MitM attacks possible via rogue certs
Eight intermediate Certificate Authority private keys from eMudhra Limited (Indian CA). Affects any TLS/SSL certificates issued under these intermediates, including public-facing services, VPNs, APIs, and internal PKI infrastructure.
criticalbug_reportVulnerabilityTwo 9.0 RCE flaws in Linux KSMBD disclosed before kernel fixes available
Linux KSMBD (kernel SMB server) on all distributions where the module is loaded. ZDI-CAN-33774 affects any KSMBD installation exposed on port 445. ZDI-CAN-33549 requires SMB Direct transport with RDMA-capable network hardware or rxe software driver.
criticalbug_reportVulnerabilityCritical PHP vulnerabilities enable remote code execution
PHP (specific versions not disclosed in advisory). All systems running vulnerable PHP installations are affected. CERT.BE has issued critical-severity warning for multiple RCE-capable vulnerabilities.
criticalbug_reportVulnerabilityGitLab max severity RCE flaw allows unauthenticated code execution
GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Vulnerability tracked as CVE-2026-110264 affects the Regular Expression Compiler component.
criticalbug_reportVulnerabilityGitLab CVE-2026-110264: Unauthenticated RCE in CE/EE (CVSS 10.0)
GitLab Community Edition (CE) and Enterprise Edition (EE) versions 7.0 through 19.5.0. Specifically: 7.0–18.11.12, 19.0–19.0.9, 19.1–19.1.8, 19.2–19.2.8, 19.3–19.3.5, 19.4–19.4.2, and 19.5.0.
criticalbug_reportVulnerabilityLiteLLM supply chain attack: malicious v1.107.0 steals credentials via PyPI
LiteLLM Python package v1.107.0 on PyPI (Oct 21, 2026, 11:39-13:23 UTC) and Docker images v1.107.0, latest, main-latest, main-stable on Docker Hub and GHCR (11:46-14:20 UTC).
criticalbug_reportVulnerabilityGitLab CVSS 10.0 RCE affects all self-managed versions since 2014
GitLab self-managed installations versions 7.0 (2014) through 19.5.0. Fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com and GitLab Dedicated already patched.
criticalbug_reportVulnerabilityChina-linked Storm-0940 used AI framework to breach ConnectWise supply chain
ConnectWise multi-tenant application compromised; downstream victims across Microsoft 365 environments in aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, softwar…
criticalbug_reportVulnerabilityLiteLLM 1.107.0 supply chain attack delivers credential stealer via PyPI
LiteLLM Python package version 1.107.0 distributed via PyPI wheels (all platforms: macOS x86_64/ARM64, Linux x86_64/aarch64, Windows AMD64) and Docker images. Compromised through stolen GitHub CLI OAuth tokens from three engineer accounts.
criticalbug_reportVulnerabilityCritical RCE flaws in PHP affect 22.6M+ exposed instances globally
PHP (all widely-deployed versions; specific affected versions not disclosed in advisory). Over 22.6 million exposed instances identified via Cortex Xpanse telemetry. Affects web servers and content management systems globally.
criticalbug_reportVulnerabilityCritical PHP RCE flaws affect 70% of websites, active exploitation
PHP versions 5.4 and later (all versions released in the last decade). Affects approximately 2.58 million Internet-facing hosts and 54.9 million web properties. Impacts sites running Drupal, Magento, Joomla, WordPress, and other PHP-based platforms.
criticalbug_reportVulnerabilityPHP releases emergency patches for PHP2Shell RCE flaws in all versions
All PHP installations serving web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Highest risk for mod_php deployments. Affects PHP 8.x (fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35) and all PHP 7.x and earlier (minimal backports av…
criticalbug_reportVulnerabilityPHP releases emergency patches for critical PHP2Shell RCE flaws
All PHP installations serving web requests: PHP 8.5 below 8.5.12, PHP 8.4 below 8.4.27, PHP 8.3 below 8.3.36, PHP 8.2 below 8.2.35, and all versions back to PHP 5.4.
criticalbug_reportVulnerabilityCritical PHP RCE flaws (CVE-2026-109618/109619) affect all versions
All versions of PHP are affected. CVE-2026-109618 and CVE-2026-109619 enable unauthenticated remote code execution via out-of-memory conditions causing memory corruption. Third-party products and appliances bundling PHP are also impacted.
criticalbug_reportVulnerabilityPHP2Shell RCE flaws (9.2/10) patch due Oct 21 14:00 UTC, no workaround
PHP versions 8.2 through 8.5 (exact affected versions to be disclosed with patch). All internet-facing PHP deployments are at risk. PHP-FPM, mod_php, and CGI/FastCGI runtimes are affected.
criticalperson_alertThreat ActorSafePay Ransomware Breaches 600+ Critical Infrastructure Orgs
SafePay is a private ransomware operation that emerged in August 2024, operating without an affiliate model. The group has rapidly become one of the most active ransomware operations globally, targeting critical infrastructure organizations across No…
criticalbug_reportVulnerabilityeMudhra CA issued 8 certificates with instantly crackable private keys
eMudhra intermediate certificates issued April 2025 using P-384 keys with values <256. Affects systems using Mozilla NSS, Go (pre-1.27.3/1.26.10), Python certifi, Rust webpki, Electron, and other software with embedded certificate stores.
criticalbug_reportVulnerabilityTwo critical RCE flaws in PHP (CVE-2026-109618, CVE-2026-109619) patched Oct 21
All PHP versions from PHP 5 onwards. CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2. Unauthenticated remote code execution possible. Patches scheduled for 21 October 2026 at 14:00 UTC.
criticalbug_reportVulnerabilityPHP emergency patches for two critical RCE flaws due Oct 21, 14:00 UTC
PHP versions 5, 6, 7, and 8 (all major versions). CVE-2026-109618 and CVE-2026-109619. Affects websites, CMS platforms, e-commerce systems, and custom web applications running PHP.
criticalbug_reportVulnerabilityeMudhra CA private keys compromised; fraudulent certs possible
Eight eMudhra intermediate CA certificates (6 TLS, 2 code-signing) under emSign brand. Affects browsers (Chrome, Firefox, Safari), Go 1.26.x/1.27.x, Python certifi, Rust webpki-roots, NSS, and any software using eMudhra-issued certificates.
criticalbug_reportVulnerabilityFortinet FortiSIEM CVE-2026-106173: PoC exploit for unauthenticated RCE
Fortinet FortiSIEM version 7.5.0. FortiSIEM 7.6 is not affected. The vulnerability targets the gRPC service on TCP port 27918.
criticalbug_reportVulnerabilityRank Math PRO WordPress plugin compromised in supply-chain attack
Rank Math PRO version 3.0.123 downloaded from the official vendor website between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC (11-hour window). Free version of Rank Math SEO unaffected.
criticalbug_reportVulnerabilityRank Math PRO WordPress plugin compromised with self-restoring backdoor
Rank Math PRO (paid WordPress SEO plugin) version 3.0.123 downloaded or auto-updated from rankmath.com between 20:02 UTC October 15 and 07:12 UTC October 16, 2026. Free version on WordPress.org (4M+ installs) not affected.
criticalbug_reportVulnerabilityF5 patches critical NGINX RCE flaws in HTTP/3 module and map directive
NGINX Open Source, NGINX Plus, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. Three critical CVEs: CVE-2026-15176 and CVE-2026-97205 (ngx_http_v3_module), CVE-2026-93479 (map directive).
criticalbug_reportVulnerabilityBeyondTrust Remote Support critical flaw requires immediate patching
BeyondTrust Remote Support software. Specific affected versions not disclosed in available advisory. Remote support/privileged access management deployments at risk.
criticalbug_reportVulnerabilityNGINX heap buffer overflow enables RCE; patch immediately
NGINX Plus and NGINX Open Source (specific vulnerable versions not disclosed in available data). Heap-based buffer overflow vulnerabilities affect both commercial and open source editions.