Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 730 results
criticalperson_alertThreat ActorAPT41 Deploys BlackX UEFI Bootkit Against Central Asian Diplomats
APT41 (also tracked as Wicked Panda, Brass Typhoon, BARIUM) is a China-linked state-sponsored advanced persistent threat group attributed by Kaspersky to the BlackX bootkit campaign.
highperson_alertThreat ActorINC & The Gentlemen Affiliates Deploy AI-Driven Phantom Framework
INC and The Gentlemen are Russian-speaking ransomware affiliate groups operating an AI-driven intrusion ecosystem. These actors function both as intrusion and data-extortion operators and as infrastructure providers supporting multiple partners acros…
highpublicGeopoliticalQuest Diagnostics breach exposes patient data via Quanum LSM platform
The breach at Quest Diagnostics, which serves approximately one-third of U.S. adults annually, underscores the persistent vulnerability of critical healthcare infrastructure to unauthorized access.
highperson_alertThreat ActorSandworm and UAC-0099 Deploy Mesh Network Backdoor in Ukraine Wiper Attack
Sandworm is a Russian state-sponsored APT group known for destructive cyber operations, particularly against Ukrainian critical infrastructure. In this operation, Sandworm collaborated with UAC-0099 (aka Earth Sirrush), another Russia-aligned threat…
highbug_reportVulnerability11 critical flaws in CGM CLININET enable RCE and data theft
CGM CLININET healthcare software: all versions before 2026.MS3 affected by most vulnerabilities. CVE-2025-30049 fixed in 2026.MS1 and 2026.MS3. Multiple vulnerabilities (CVE-2025-30045, CVE-2025-30046, CVE-2025-30052, CVE-2025-30053, CVE-2025-30054,…
highpublicGeopoliticalCapcom breach exposes 11.7M accounts; Japan gaming sector targeted again
The breach of Capcom's CAPCOM ID service represents the second significant compromise of the Japanese gaming giant in six years, following a 2020 Ragnar Locker ransomware incident.
criticalbug_reportVulnerabilityeMudhra CA exits SSL/TLS business after 8 intermediate keys found guessable
eMudhra certificate authority: 8 intermediate CA private keys compromised (6 for TLS). Approximately 30,800 unexpired certificates chained to emSign ECC Root CA - G3, 99.9% issued through InCommon (higher education).
highpublicGeopoliticalNew Mexico Court Orders Meta to Pay $25B for Cambridge Analytica Violations
The ruling represents a significant escalation in U.S. state-level enforcement against major technology platforms, following federal actions that resulted in a $5 billion FTC fine in 2019 and an $18 billion multi-state settlement in August 2026.
criticalbug_reportVulnerabilityGitLab unauthenticated RCE vulnerability requires immediate patching
GitLab (specific versions not disclosed in available information). Vulnerability allows unauthenticated remote code execution. No CVE assigned yet or not publicly disclosed.
criticalbug_reportVulnerabilityFortinet releases critical security updates across multiple products
Multiple Fortinet products affected. Specific product names, versions, and CVE identifiers not disclosed in available advisory. CERT.BE has issued urgent patching guidance.
highbug_reportVulnerabilityCleanShot X deserialization flaw enables code execution via malicious files
MTW CleanShot X for macOS versions 4.0.0 through 4.5.2. Fixed in versions 4.5.2, 4.6.3, 4.7.8, and 4.8.10. Affects users who open .cleanshot project files from untrusted sources.
highbug_reportVulnerabilityINTERPOL disrupts 10,909 cybercrime networks, arrests 1,462 in 21 countries
Global cybercrime infrastructure across 21 African and international countries. Targeted networks include phishing operations, business email compromise (BEC), investment fraud schemes, illegal cryptocurrency mining, and botnet infrastructure.
criticalbug_reportVulnerabilityCritical PHP vulnerabilities enable remote code execution
PHP (specific versions not disclosed in advisory). All systems running vulnerable PHP installations are affected. CERT.BE issued critical-severity warning for multiple RCE vulnerabilities.
highbug_reportVulnerabilityOperation Serengeti III disrupts 10,909 networks, arrests 1,462 in Africa
Cybercriminal infrastructure across 21 African countries, including business email compromise operations, ransomware networks, phishing infrastructure, fraudulent mobile lending apps, illegal cryptocurrency mining operations, and online investment sc…
highpublicGeopoliticalJapanese VPS Provider Onamae Desktop Cloud Breached, 27,000 Servers Hit
The compromise of Onamae Desktop Cloud, operated by GMO Internet Group—one of Japan's largest domain registrars and internet infrastructure providers—represents a significant supply-chain style attack on Japan's digital economy.
highperson_alertThreat ActorLazarus deploys post-quantum cryptography in FlashHole campaign
Lazarus Group is a North Korean state-sponsored advanced persistent threat (APT) actor with a long operational history spanning financial cybercrime, espionage, and destructive attacks.
highbug_reportVulnerabilityCISA: Plex2Shell exploit chain actively used to breach Plex servers
Plex Media Server versions before 1.43.3.10861. Four vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) chained together to achieve unauthenticated remote code execution with elevated privileges.
highperson_alertThreat ActorBronze Sandcastle Uses Sandboxie DLL Sideloading for Espionage
Bronze Sandcastle is a China-aligned threat actor cluster disclosed by Sophos in October 2026. Active since mid-2025, the group conducts cyber espionage operations targeting organizations in Asia and Africa.
criticalbug_reportVulnerabilityCritical PHP RCE flaws (CVE-2026-109618/109619) affect all versions
All versions of PHP are affected. CVE-2026-109618 and CVE-2026-109619 enable unauthenticated remote code execution via out-of-memory conditions causing memory corruption. Third-party products and appliances bundling PHP are also impacted.
criticalperson_alertThreat ActorSafePay Ransomware Breaches 600+ Critical Infrastructure Orgs
SafePay is a private ransomware operation that emerged in August 2024, operating without an affiliate model. The group has rapidly become one of the most active ransomware operations globally, targeting critical infrastructure organizations across No…
criticalbug_reportVulnerabilityTwo critical RCE flaws in PHP (CVE-2026-109618, CVE-2026-109619) patched Oct 21
All PHP versions from PHP 5 onwards. CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2. Unauthenticated remote code execution possible. Patches scheduled for 21 October 2026 at 14:00 UTC.
highbug_reportVulnerabilityMultiple high severity vulnerabilities in Apache Camel require patching
Apache Camel - specific versions not provided in advisory. All deployments using affected versions should be considered at risk pending detailed vendor bulletin review.
highpublicGeopoliticalDHS Orders Federal Agencies to Remove DeepSeek AI Products
The Department of Homeland Security's directive to exclude DeepSeek products from federal civilian systems represents an escalation in U.S. efforts to mitigate technology supply chain risks linked to Chinese firms.
highperson_alertThreat ActorNigerian National Sentenced for $3.3M Tax Fraud via Spearphishing
Chukwuemeka Victor Amachukwu (also known as Chukwuemeka Victor Eletuo and So Kwan Leung), a 40-year-old Nigerian national, operated as part of a financially-motivated cybercrime network targeting US tax preparation businesses.
highperson_alertThreat ActorNSO Group's Pegasus Deployed Against Serbian University Rector via Zero-Click
NSO Group is an Israeli commercial surveillance vendor that develops and sells Pegasus spyware exclusively to government clients and state agencies. The company provides mercenary spyware capabilities that enable full device compromise, including acc…
highbug_reportVulnerabilityOVHcloud CLI tool backdoored on GitHub to steal developer credentials
OVHcloud CLI versions 0.11.0 through 0.15.0 on macOS (Intel/ARM), Linux (x86_64/ARM64), and Windows x86-64. Compromised releases available October 19, 2026 from 14:47 to 16:21 UTC. Version 0.10.0 and earlier, plus 0.16.0 are clean.
highperson_alertThreat ActorAPT28 Breaches NATO Naval Shipbuilders with HOOKEDGE Backdoor
APT28 (also known as Fancy Bear, Forest Blizzard, BlueDelta, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, and Group 74) is a Russian state-sponsored threat actor attributed to Russia's military intelligence service (GRU).
highpublicGeopoliticalNikkei Inc. reports third breach in one month, 1.83M records exposed
The repeated compromise of Nikkei Inc.—a major Japanese financial media conglomerate and owner of the Financial Times—represents a significant cybersecurity challenge for a strategically important information infrastructure entity.
highperson_alertThreat ActorShinyHunters Breaches FBI, Linked to Ransomware Negotiation Executives
ShinyHunters is a financially motivated cybercrime group that has claimed credit for dozens of major data breaches since 2019. Originally operated by cybercriminals in France, control of the ShinyHunters brand passed to "Rey," a teenage hacker from A…
criticalbug_reportVulnerabilityNGINX heap buffer overflow enables RCE; patch immediately
NGINX Plus and NGINX Open Source (specific vulnerable versions not disclosed in available data). Heap-based buffer overflow vulnerabilities affect both commercial and open source editions.