Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
27 / 27 results
highperson_alertThreat Actor953 E-Commerce Stores Compromised in Long-Running Magento Campaign
An unknown threat actor has been conducting a sustained campaign since July 2025 targeting e-commerce platforms, primarily Magento-based online stores. The actor demonstrates sophisticated operational security through scanner-evasion techniques and i…
criticalbug_reportVulnerabilityAdobe Commerce/Magento template injection enables remote code execution
Adobe Commerce and Magento Open Source (specific versions not disclosed in available data). Template injection vulnerability affecting web-facing e-commerce platforms.
criticalbug_reportVulnerabilityCritical RCE in Adobe Commerce/Magento allows arbitrary PHP execution
Adobe Commerce and Magento installations. Specific affected versions not disclosed in available information. Vulnerability resides in BlockStrap component.
highperson_alertThreat ActorCyberXero: AI-Augmented IAB Targets Ukraine with Claude Code
CyberXero is a Russian-speaking, financially motivated initial access broker (IAB) active since at least July 2026. The actor operates a sophisticated dual-pipeline operation: a global automated campaign against WordPress and e-commerce platforms for…
highperson_alertThreat ActorASOS Data Breach: Social Engineering and Credential Theft Campaign
The threat actor behind this incident identifies themselves as "Xuanye Group." No attribution to known APT groups or established cybercrime syndicates has been made.
highbug_reportVulnerabilityNinja Forms and WPC Product Bundles XSS flaws under active exploit
Ninja Forms plugin versions 3.15.3 and older (500,000+ sites); WPC Product Bundles for WooCommerce versions 8.6.6 and older (30,000+ sites). Tracked as CVE-2026-93836 and CVE-2026-94504. Both are authenticated stored XSS vulnerabilities.
highpublicGeopoliticalASOS confirms breach via compromised push notification system
The incident represents a continuation of opportunistic cybercriminal activity targeting cloud infrastructure providers, particularly Snowflake environments, which have been subject to a sustained campaign since mid-2024.
criticalbug_reportVulnerabilityWSO2 and Adobe Commerce flaws actively exploited, added to CISA KEV
CVE-2026-5430: WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway (all versions not specified). CVE-2026-71362: Adobe Commerce and Magento (versions not specified).
criticalperson_alertThreat ActorAI-Powered Payment Skimmer Campaign Steals 600K+ Credit Cards
A financially motivated threat actor, believed to be Chinese-speaking based on operational indicators, is conducting large-scale automated attacks against online retailers using open-source AI agent frameworks.
criticalbug_reportVulnerabilityWooCommerce Wholesale Lead Capture flaw exploited for PHP backdoor uploads
WooCommerce Wholesale Lead Capture WordPress plugin, all versions up to and including 2.0.3.1. Approximately 6,000+ active installations. CVE-2026-27540 (CVSS 9.8) - arbitrary file upload due to missing validation in wwlc_file_upload_handler AJAX act…
criticalbug_reportVulnerabilityWooCommerce Wholesale Lead Capture plugin under active exploitation
WooCommerce Wholesale Lead Capture premium plugin for WordPress, versions 2.0.3.1 and older. CVE-2026-27540: unauthenticated arbitrary file upload vulnerability allowing PHP webshell deployment.
highbug_reportVulnerabilitySQL Injection flaws in Alior Bank PrestaShop module expose backoffice data
Alior Bank "raty" module for PrestaShop. CVE-2026-7848 affects versions 8.0.0 to 8.1.11 (fixed in 8.1.11 and 9.0.7). CVE-2026-15600 affects versions 8.1.9 to 8.1.12 (fixed in 8.1.12 and 9.0.8).
highperson_alertThreat ActorDoppelCart: 119,000+ Fake E-Commerce Domains Used for Card Theft
DoppelCart is a large-scale fraud operation attributed to coordinated threat actors conducting payment card theft through fraudulent e-commerce infrastructure.
criticalbug_reportVulnerabilityAdobe Commerce/Magento unauthenticated RCE requires immediate patching
Adobe Commerce and Magento platforms. Specific affected versions not disclosed in available information. Vulnerability allows unauthenticated remote code execution.
criticalbug_reportVulnerabilityAdobe Commerce zero-day CVE-2026-75650 exploited since Sept 4 for backdoors
Adobe Commerce 2.4.4 through 2.4.9 (all 2026-aug and earlier), Adobe Commerce B2B 1.3.3 through 1.5.3 (all 2026-aug and earlier), and Magento Open Source 2.4.6 through 2.4.9 (all 2026-aug and earlier).
criticalbug_reportVulnerabilityMagento StyleSmuggler zero-day actively exploited to deploy backdoor
All versions of Magento and Adobe Commerce, including latest patched versions. Affects approximately 160,000 websites globally, including 14,000 in the top 1 million sites.
criticalbug_reportVulnerabilityMagento/Adobe Commerce zero-day actively exploited since Sept 4
Magento Open Source and Adobe Commerce all current versions including 2.4.6, 2.4.7, 2.4.8, and 2.4.9. Confirmed exploitation on Magento Open Source; Adobe Commerce impact unconfirmed. Unauthenticated remote code execution via GraphQL.
highperson_alertThreat ActorBreeze Comet Targets Brazilian Financial Sector for Payment Fraud
Breeze Comet (formerly UNC5669, overlaps with Plump Spider and SHADOW-AETHER-064) is a financially motivated threat actor operating out of Brazil since September 2023.
criticalbug_reportVulnerabilityGiveWP WordPress plugin RCE allows unauthenticated server takeover
GiveWP WordPress donation plugin versions 4.16.6 through 4.16.7.1. Over 100,000 active installations. Exploitation requires legacy donation forms without 'formBuilderSettings' (common in upgraded sites or when using option-based form editor).
criticalbug_reportVulnerabilityAdobe Commerce critical vulnerability under active exploitation
Adobe Commerce (formerly Magento). Specific affected versions not disclosed in advisory. All unpatched instances should be considered at risk.
criticalbug_reportVulnerabilitySAP Commerce Cloud RCE flaw (CVE-2026-58231) exploited 3 days post-patch
SAP Commerce Cloud (formerly Hybris), specifically the core Data Hub Adapter extension. All unpatched instances are vulnerable. Shadowserver tracks 4,200+ internet-exposed instances, primarily in Europe and North America.
criticalbug_reportVulnerabilityAdobe Commerce/Magento flaw CVE-2026-71362 exploited to hijack accounts
Adobe Commerce and Magento Open Source e-commerce platforms, all currently supported release lines. The vulnerability affects customer account session handling and requires no authentication to exploit.
criticalbug_reportVulnerabilitySAP Commerce Cloud critical flaw allows unauthenticated RCE (CVSS 10.0)
SAP Commerce Cloud (Data Hub Adapter). All unpatched versions are affected. The vulnerability impacts the default authentication client and certain functions lacking input validation.
highbug_reportVulnerabilityQuick.Cart stores hardcoded admin credentials in plaintext config file
OpenSolution Quick.Cart all versions through 6.7. Vulnerability requires attacker access to server file system to retrieve hardcoded plaintext admin credentials from configuration file.
highbug_reportVulnerabilityShopify Shop app abused for callback phishing via fake order receipts
Shopify Shop order-tracking app users. Threat actors inject fraudulent purchase receipts into legitimate user order histories, leveraging Shopify's trusted platform to deliver phishing lures.
highpublicGeopoliticalSouth Korea issues record $409M fine to Coupang for 37M-user breach
The unprecedented fine against Coupang reflects South Korea's increasingly assertive regulatory posture on data protection, aligning Seoul with global trends toward stringent enforcement of privacy frameworks.
criticalbug_reportVulnerabilitySAP June 2026 patches fix 4 critical flaws in NetWeaver, Commerce Cloud
SAP NetWeaver and SAP Commerce Cloud products. Total of 15 vulnerabilities patched, including 4 critical-severity issues. Specific affected versions not disclosed in summary.