Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1126 results
highpublicGeopoliticalUniversity of Copenhagen breach exposes 525,000 records in test environment
The breach at Denmark's oldest and most prominent research university represents a significant data exposure incident within a NATO and EU member state with advanced cybersecurity frameworks.
highperson_alertThreat ActorARTEX AI Operators Arrested After Breaching 90+ South Korean Orgs
ARTEX AI operators is a seven-member cybercrime group led by a 32-year-old self-taught hacker with penetration testing experience. The leader worked at a cybersecurity company between 2019 and 2022 before launching attacks in September 2025.
highperson_alertThreat Actor953 E-Commerce Stores Compromised in Long-Running Magento Campaign
An unknown threat actor has been conducting a sustained campaign since July 2025 targeting e-commerce platforms, primarily Magento-based online stores. The actor demonstrates sophisticated operational security through scanner-evasion techniques and i…
highbug_reportVulnerabilityPHP Windows packages ship Brotli RCE flaw via cURL auto-decompression
PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 official Windows builds (pre-rebuild). Affects systems using cURL extension with CURLOPT_ENCODING enabled or HTTP client libraries like Guzzle (default behavior) that enable automatic Brotli decompression.
highperson_alertThreat ActorMicrosoft Teams External Chat Exploited for IT Support Impersonation
Unknown threat actors conducting a recurring social engineering campaign across hundreds of incidents. The activity shows overlap with STAC4749, a tracked cluster known for creating IT-themed cloud domains under the ".top" TLD and using plausible emp…
highpublicGeopoliticalChinese national extradited from Netherlands for $37M crypto fraud
This case exemplifies the transnational nature of cryptocurrency-enabled financial crime and the growing cooperation between Western jurisdictions in prosecuting such offenses.
highperson_alertThreat ActorOvi Exposes uCreator Android Spyware Targeting Telegram and WeChat
Ovi is a security researcher who discovered and analyzed the uCreator Android spyware kit in October 2026. Ovi is not a threat actor but rather the researcher who exposed this rentable spyware operation.
highbug_reportVulnerabilityMicrosoft 365 AitM campaign compromises 97 accounts via token replay
Microsoft 365 / Entra ID users across 79 organizations. Campaign active July 14 - September 22, 2026. 497 successful sign-ins from 200,000+ attempts originating from 193.26.115.0/24 IP range. 48 rogue Entra devices registered.
highperson_alertThreat ActorGheist Campaign Steals GitHub Secrets via Automated Workflow Injection
Gheist is an automated campaign tracked since September 15, 2026, named after the user agent "gheist" observed in GitHub API requests. The campaign leverages stolen GitHub tokens to inject malicious workflows into private repositories and GitHub Ente…
highbug_reportVulnerabilityAI coding agents tricked into installing malware via planted instruction files
AI coding agents including OpenAI Codex and Anthropic Claude Code. Developers running agents in ~/Downloads folder are at risk. Attack leverages AGENTS.md/CLAUDE.md instruction files to install malicious npm package function-color (part of MALFEX cam…
highbug_reportVulnerabilityUnpatched Tailscale SSH flaws enable root escalation via port forwarding
Tailscale version 1.104.2 and headscale version 0.29.5. Affects networks with Tailscale SSH enabled and port forwarding configured. Headscale 0.29.5 cannot disable forwarding, making all SSH grants potentially exploitable.
highperson_alertThreat ActorNorth Korea Linked to PHP2Shell Scanning Campaign Targeting Global Infra
North Korean threat actors, attributed with moderate confidence to operators within the Lazarus Group ecosystem, are conducting a deliberate, low-and-slow scanning campaign targeting vulnerable PHP infrastructure globally.
highbug_reportVulnerabilityMalicious AGENTS.md files hijack AI coding agents via Downloads folder
AI coding agents including OpenAI Codex, Claude Code, and Cursor CLI when launched from ~/Downloads directory. Browsers Chrome, Edge, and Firefox allow silent file downloads to this location.
highbug_reportVulnerabilityBrotli decoder memory corruption enables RCE in Node.js, Bun, Python, Envoy
Google Brotli C library 1.0.3–1.2.0; Node.js 22.x, 24.x, 26.x (pre-patch); Bun ≤1.4.3; Envoy 1.36–1.39 (if Brotli enabled); Istio 1.29–1.31 (if Brotli enabled); Python Brotli ≤1.2.0 and brotlicffi ≤1.2.0.x; cdxgen ≤13.4.0/12.8.8.
highbug_reportVulnerabilityAbandoned Popcorn Time fork updater posed botnet risk to 2-3M systems
Time4Popcorn (abandoned Popcorn Time fork): Windows versions ≤6.2.1.18, Mac ≤6.2.1.17, Android ≤3.5.0.173. Updater.exe ran with SYSTEM/root privileges, checked for updates over unencrypted HTTP to abandoned domains.
highbug_reportVulnerabilityTime4Popcorn updater flaw enabled RCE with elevated privileges
Time4Popcorn app (Popcorn Time fork), all versions with vulnerable updater mechanism. Millions of devices potentially affected. Application is abandoned and no longer maintained.
highperson_alertThreat ActorINC & The Gentlemen Affiliates Deploy AI-Driven Phantom Framework
INC and The Gentlemen are Russian-speaking ransomware affiliate groups operating an AI-driven intrusion ecosystem. These actors function both as intrusion and data-extortion operators and as infrastructure providers supporting multiple partners acros…
highpublicGeopoliticalQuest Diagnostics breach exposes patient data via Quanum LSM platform
The breach at Quest Diagnostics, which serves approximately one-third of U.S. adults annually, underscores the persistent vulnerability of critical healthcare infrastructure to unauthorized access.
highbug_reportVulnerabilityPHP RCE flaw CVE-2026-115560 affects rare configs, no patch yet
PHP installations with non-default session configuration: session.serialize_handler set to php_binary or php_serialize, then switched to php at runtime via ini_set() before session_start(), and session upload progress enabled.
highbug_reportVulnerabilityThreat actor k0t exploits Fortinet and Palo Alto firewalls, exposes 70K creds
Fortinet FortiGate and FortiWeb firewalls, Palo Alto Networks GlobalProtect, PAN-OS, and Prisma Access. Exploited vulnerabilities: CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (PAN-OS/Prisma Access authentication bypass).
highbug_reportVulnerabilityPHP warns of unpatched RCE flaw affecting uncommon configurations
PHP web applications with specific configuration: session.serialize_handler set to php_binary or php_serialize, then changed to php via ini_set() before session_start(), with session upload progress enabled.
highperson_alertThreat ActorSandworm and UAC-0099 Deploy Mesh Network Backdoor in Ukraine Wiper Attack
Sandworm is a Russian state-sponsored APT group known for destructive cyber operations, particularly against Ukrainian critical infrastructure. In this operation, Sandworm collaborated with UAC-0099 (aka Earth Sirrush), another Russia-aligned threat…
highbug_reportVulnerability11 critical flaws in CGM CLININET enable RCE and data theft
CGM CLININET healthcare software: all versions before 2026.MS3 affected by most vulnerabilities. CVE-2025-30049 fixed in 2026.MS1 and 2026.MS3. Multiple vulnerabilities (CVE-2025-30045, CVE-2025-30046, CVE-2025-30052, CVE-2025-30053, CVE-2025-30054,…
highbug_reportVulnerabilityx402 SDK flaws let malicious APIs drain AI agent wallets, bypass payments
x402 SDKs (TypeScript, Python, Go) prior to August 18, 2024 releases. Specifically: @x402/core, @x402/svm, @x402/extensions, @x402/fetch, @x402/axios versions before 2.23.0 (TypeScript); Python package before 2.25.0; Go module before v2.28.0.
highbug_reportVulnerabilityPHP2Shell RCE flaws exploited to deploy Mirai botnet, attacks unsuccessful
PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) enable unauthenticated remote code execution via crafted HTTP requests.
highpublicGeopoliticalCapcom breach exposes 11.7M accounts; Japan gaming sector targeted again
The breach of Capcom's CAPCOM ID service represents the second significant compromise of the Japanese gaming giant in six years, following a 2020 Ragnar Locker ransomware incident.
highpublicGeopoliticalNew Mexico Court Orders Meta to Pay $25B for Cambridge Analytica Violations
The ruling represents a significant escalation in U.S. state-level enforcement against major technology platforms, following federal actions that resulted in a $5 billion FTC fine in 2019 and an $18 billion multi-state settlement in August 2026.
highbug_reportVulnerabilityMultiple high-severity vulnerabilities in Node.js require immediate patching
Node.js - specific versions not provided in advisory. All Node.js deployments should be evaluated for patch applicability.
highbug_reportVulnerabilityCleanShot X deserialization flaw enables code execution via malicious files
MTW CleanShot X for macOS versions 4.0.0 through 4.5.2. Fixed in versions 4.5.2, 4.6.3, 4.7.8, and 4.8.10. Affects users who open .cleanshot project files from untrusted sources.
highbug_reportVulnerabilityINTERPOL disrupts 10,909 cybercrime networks, arrests 1,462 in 21 countries
Global cybercrime infrastructure across 21 African and international countries. Targeted networks include phishing operations, business email compromise (BEC), investment fraud schemes, illegal cryptocurrency mining, and botnet infrastructure.