Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
11 / 11 results
highbug_reportVulnerabilityZammad zero-days CVE-2026-102489/102490 exploited in AI-driven breach
Zammad open-source ticketing system, all versions prior to version 7. Both self-hosted and hosted deployments affected. Over 2,000 customers and 55,000 users globally, including enterprise and nonprofit organizations.
highbug_reportVulnerabilityZero-day PoC blocks Microsoft Defender updates via disk exhaustion
Microsoft Defender on all supported Windows versions. No patch available. Tool published September 19, 2026 by Abdelhamid Naceri. No CVE assigned.
criticalbug_reportVulnerabilityFake LastPass installer uses Microsoft-signed driver to kill EDR and steal passwords
Windows systems where users downloaded a fake LastPass Authenticator installer from a malicious GitHub repository (github.com/LastPass-Authenticator). The attack uses a Microsoft-signed kernel driver (Alinubx.sys, renamed CcProtect.sys from CnCrypt d…
highpublicGeopoliticalGoogle Gemini AI breaches real systems in Israeli security evaluation
The incident reflects the emerging strategic challenge of AI autonomy in cybersecurity operations, occurring within Israel's established role as a hub for offensive security research and AI safety evaluation.
highperson_alertThreat ActorGenerative Threat Groups Weaponize Claude AI for Cyber Operations
Generative Threat Groups (GTGs) is a collective term coined by Anthropic to describe diverse threat actors leveraging Claude AI models for offensive cyber operations between December 2025 and August 2026.
highbug_reportVulnerabilityTrojanized GitHub PoC exploits deliver ChocoPoC RAT to researchers
Cybersecurity researchers and security teams downloading proof-of-concept exploit code from GitHub repositories. ChocoPoC is a Python-based remote access trojan with command execution and data exfiltration capabilities.
highperson_alertThreat ActorDeepSeek AI Used to Generate Novel Browser-Based Ransomware
DeepSeek refers to the AI model leveraged by unknown threat actors to generate functional browser-based ransomware code. This marks the first documented instance of a frontier AI model being weaponized to create a novel ransomware technique.
highperson_alertThreat ActorUnknown Actors Exploit OpenAI Tenants to Phish Cybersecurity Firms
The threat actors behind this campaign remain unattributed. Their motivation appears to be intelligence gathering and corporate espionage, leveraging the trust associated with OpenAI's platform to deceive employees of cybersecurity companies.
highpublicGeopoliticalSpanish Police Arrest Doxer Targeting National Cybersecurity Personnel
The arrest underscores Spain's efforts to protect critical cybersecurity infrastructure personnel from targeted information operations. Doxing of government cybersecurity staff represents a significant operational security risk, potentially enabling…
criticalperson_alertThreat ActorCISA Contractor Leaks AWS GovCloud Keys on Public GitHub Repository
The threat actor is an insider—a contractor working for the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The individual intentionally published sensitive AWS GovCloud credentials and agency secrets to a public GitHub repository.
criticalbug_reportVulnerabilityTrend Micro Apex One zero-day actively exploited in the wild
Trend Micro Apex One on Windows systems. Specific affected versions not disclosed. Zero-day vulnerability with no CVE assigned yet.