Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
12 / 12 results
highbug_reportVulnerabilityWeb3-based C2 in supply chain attacks targets cloud credentials via npm
Enterprise cloud environments using open-source dependencies from npm, Go modules, and Packagist registries. Specifically impacts developer workstations and CI/CD pipelines with access to cloud IAM tokens, service account keys, and deployment secrets…
highbug_reportVulnerabilityZimbra CVE-2026-73570 exploited to deploy web shells, steal credentials
Zimbra Collaboration Suite (ZCS) versions prior to 10.1.20. Exploitation requires SNMP notifications enabled and the optional zimbra-snmp package installed. Unauthenticated remote code execution via crafted SMTP requests.
highperson_alertThreat ActorStorm-3168 (JADEPUFFER) conducts agentic Azure cloud attacks
Storm-3168 is Microsoft's tracking designation for JADEPUFFER, a threat actor first documented by Sysdig in July 2026 as the first known agentic ransomware operation.
criticalbug_reportVulnerabilityJFrog Artifactory flaws exploited to deploy Rust backdoor on servers
JFrog Artifactory self-hosted servers with unpatched critical and high-severity vulnerabilities. Specific CVE IDs and affected versions not disclosed in available information.
highbug_reportVulnerabilityPasskey-themed phishing campaign targets cloud identities via AiTM
Microsoft 365 / Entra ID users across multiple organizations. Campaign active since May 2024 (likely typo in source stating "May 2026"). Targets include SharePoint, OneDrive, Exchange, and Microsoft Graph API access.
highbug_reportVulnerability22K Exchange servers unpatched for CVE-2026-62911 auth bypass flaw
Microsoft Exchange Server 2016, 2019, and Subscription Edition (SE). Approximately 21,899 internet-exposed servers remain unpatched globally, with highest concentrations in the United States (6,200) and Germany (5,100).
criticalbug_reportVulnerabilityServiceNow AI Platform: Three CVSS 10.0 flaws enable unauthenticated RCE
ServiceNow AI Platform versions: Xanadu (before Patch 11 HF 7a), Yokohama (before Patch 12 HF 3b / Patch 13 HF 4), Zurich (before Patch 7b HF 3 through Patch 12 depending on branch), Australia (before Patch 2 HF 3 through Patch 5).
highbug_reportVulnerability.NET Framework August 2026 updates break WPF printing and PDF export
.NET Framework cumulative updates released August 2026 Patch Tuesday. Affects Windows Presentation Foundation (WPF) applications on Windows 10, Windows 11, Windows Server 2012 through Windows Server 2025.
criticalbug_reportVulnerabilitySonicWall GMS unauthenticated RCE flaws require immediate patching
SonicWall Global Management System (GMS). Specific affected versions not disclosed in available data. Both CVE-2026-66145 and CVE-2026-66147 enable unauthenticated remote code execution.
criticalbug_reportVulnerabilityVMware vCenter, ESXi critical flaws enable auth bypass and VM escapes
VMware vCenter Server (versions prior to 9.1.0.0300, 9.0.2.0100, 8.0 U3k), VMware ESXi (versions prior to 9.1.0.0200, 9.0.2.0100, 8.0 U3k), VMware Workstation and Fusion (25H2 and earlier), VMware Cloud Foundation 5.x, VMware vSphere Foundation, VMwa…
highbug_reportVulnerabilitySpring Authorization Server authentication bypass requires immediate patch
Spring Authorization Server (part of Spring Security framework by VMware/Pivotal). Specific affected versions not disclosed in available information. Authentication mechanism is impacted.
highperson_alertThreat ActorROADtools Framework Misused in Nation-State Cloud Intrusions
Multiple threat actors, including nation-state groups, are misusing the open-source ROADtools framework for cloud intrusions. ROADtools is a legitimate Azure AD reconnaissance toolkit designed for security assessments, but has been co-opted by advers…