Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 51 results
highbug_reportVulnerabilityPalo Alto PAN-OS RCE (CVE-2026-0322) under active exploitation
PAN-OS on PA-Series, VM-Series firewalls, and Panorama (virtual and M-Series). All versions prior to patched releases: 10.2.x, 11.1.x, 11.2.x, 12.1.x, 12.2.x. Cloud NGFW and Prisma Access are not affected.
highperson_alertThreat ActorFamous Chollima DPRK IT Worker Scheme Disrupted in Texas Raids
Famous Chollima (also tracked as WageMole) is a North Korean state-sponsored threat actor conducting fraudulent IT worker schemes to generate revenue for the DPRK regime.
criticalbug_reportVulnerabilityCisco Secure Email Gateway under active attack via file write RCE flaw
Cisco Secure Email Gateway (physical and virtual appliances) running AsyncOS versions prior to 15.5.5-014 or 16.5.0-780, with File Reputation service enabled and Content Scanner Tools package older than version 25.3.0.5525.
criticalbug_reportVulnerabilityCritical Fortinet vulnerabilities in FortiSIEM, FortiAnalyzer, FortiManager
Fortinet FortiSIEM, FortiAnalyzer, and FortiManager products. Specific affected versions not provided in source material. Multiple high and critical severity vulnerabilities reported by CERT.BE.
criticalbug_reportVulnerabilityCritical RCE flaw in Splunk Enterprise requires immediate patching
Splunk Enterprise (specific versions not disclosed in available data). Multiple vulnerabilities reported including at least one critical-severity remote code execution flaw.
criticalbug_reportVulnerabilityCitrix Netscaler ADC/Gateway HTTP smuggling flaws require immediate patch
Citrix Netscaler ADC, Netscaler Gateway, and Netscaler FIPS appliances. Specific affected versions not provided in advisory; consult Citrix security bulletin for version details.
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway DoS flaw requires immediate patching
Citrix NetScaler ADC and NetScaler Gateway (specific versions not disclosed in available data). Remote attackers can trigger denial of service conditions.
criticalbug_reportVulnerabilityCitrix NetScaler CVE-2026-88772: Pre-auth RCE via DTLS overflow exploited
Citrix NetScaler ADC and NetScaler Gateway (vulnerable versions not specified in advisory). Affects the NetScaler Packet Processing Engine (NSPPE) DTLS protocol handler. Pre-authentication attack surface.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway: 2 critical RCE flaws under active exploit
Citrix NetScaler ADC and NetScaler Gateway versions 13.1 before 13.1-64.23, 14.1 before 14.1-73.37, and FIPS editions. CVE-2026-88771 affects all deployments (no preconditions).
highbug_reportVulnerabilityCISA: SharePoint RCE and MikroTik RouterOS flaws exploited in wild
CVE-2026-65660: Microsoft Office SharePoint Server (unspecified versions). CVE-2026-67279: MikroTik RouterOS 7.x builds. Both vulnerabilities confirmed exploited in active attacks.
criticalbug_reportVulnerabilityCheck Point Management Server zero-day exploited in targeted attacks
Check Point Security Management Server: R82.20 (no Jumbo Hotfix), R82.10 (Take ≤44), R82 (Take ≤126), R81.20 (Take ≤166), R81.10 (Take ≤190), and R81/R80.x (all end-of-support versions). The vulnerability affects the management server's web service.
highbug_reportVulnerabilityZero-day PoC blocks Microsoft Defender updates via disk exhaustion
Microsoft Defender on all supported Windows versions. No patch available. Tool published September 19, 2026 by Abdelhamid Naceri. No CVE assigned.
highperson_alertThreat ActorJade Sleet Breaches Indian IT Provider Using FLATROOF and ROOFDECK
Jade Sleet (also tracked as PUKCHONG, Slow Pisces, TraderTraitor, UNC4899) is a North Korean state-sponsored threat actor with a history of targeting the Web3 and cryptocurrency sectors for financial gain.
criticalbug_reportVulnerabilityCheck Point Security Management unauthenticated RCE requires immediate patching
Check Point Security Management servers. Specific affected versions not disclosed in available information. Vulnerability allows unauthenticated remote code execution.
highbug_reportVulnerabilityWindows 11 Sept 2026 updates break domain login via Machine Identity Isolation
Windows 11 versions 24H2, 25H2, and 26H1 after installing September 2026 security updates (KB5124008, KB5124012). Affects enterprise environments with domain-joined devices NOT connected to Windows Server 2025 domain controllers.
highbug_reportVulnerabilityMicrosoft releases emergency patches for RDS failures after September updates
Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, Windows Server 2019/2022/2025. Remote Desktop Services, Hyper-V (HCS-managed VMs with Plan9 shares), and USB Audio Class 1.0 devices with multichannel audio affected by September 2026 security updates.
highbug_reportVulnerabilityMicrosoft September 2026 updates break RDS on Windows Server and clients
Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and Windows 10/11 all versions that applied September 2026 Patch Tuesday updates. Impacts Remote Desktop Services (RDS), RDP connections, MMC, RDS Licensing Diagnoser, and File Explorer.
highbug_reportVulnerabilityREVSTEALER Deploys Four Persistent Modules Including Crypto Miner
Windows systems infected with REVSTEALER infostealer (active since February 2026). Four persistent modules (ProManager, WinUpdate, SoftManager, LockAppHost) remain after core stealer self-deletes.
criticalbug_reportVulnerabilityCritical VMware Workstation/Fusion integer overflow allows VM escape
VMware Workstation and VMware Fusion versions 25H2 and 26H1. Affects systems with VMXNET3 virtual network adapter (CVE-2026-59346) and HGFS enabled (CVE-2026-59347). Both vulnerabilities require local administrative privileges on the guest VM.
criticalbug_reportVulnerabilityVMware Workstation and Fusion overflow flaws require immediate patching
VMware Workstation and VMware Fusion virtualization products. Specific affected versions not disclosed in available information. Overflow vulnerabilities present significant exploitation risk.
highperson_alertThreat ActorNorth Korean IT Worker Scheme Expands Into Healthcare and Sales Roles
North Korean state-sponsored threat actors, tracked as Famous Chollima, Jasper Sleet, Nickel Tapestry, PurpleDelta (formerly TAG-121), UNC5267, and Wagemole, operate a sophisticated job fraud scheme to generate revenue for the DPRK's nuclear weapons…
criticalbug_reportVulnerabilityPaperCut NG/MF flaws chained for unauthenticated RCE, active exploitation
PaperCut NG and PaperCut MF (all unpatched versions). CVE-2026-81578 (CVSS 8.8, improper access control) and CVE-2026-82078 (CVSS 9.4, unsafe dynamic class loading) are chained to bypass authentication and execute arbitrary Java code.
highbug_reportVulnerabilityWeekly roundup: 296K IoT botnet, water system attacks, SharePoint RCE
Multiple products and sectors: 296,000 IoT devices compromised by Dysphoria botnet; 100+ water systems targeted (details not provided in excerpt); SharePoint RCE vulnerability chain (CVE/version unspecified); Android banking apps targeted by Octagon…
criticalbug_reportVulnerabilityWatchGuard Agent RCE flaws require immediate patching
WatchGuard Agent (specific versions not disclosed in available data). Remote code execution vulnerabilities affecting WatchGuard Agent software used for endpoint management and authentication.
highperson_alertThreat ActorOperation QUICSILVER: China-nexus campaign targets Myanmar with QUICAgent
Operation QUICSILVER is attributed with moderate confidence to a China-nexus threat actor conducting cyber espionage operations against Myanmar. The actor demonstrates sophisticated tradecraft, leveraging social engineering lures themed around govern…
criticalbug_reportVulnerabilityIBM i systems face critical vulnerabilities requiring immediate patching
IBM i systems (formerly AS/400). Specific versions and CVE identifiers not disclosed in advisory. Scope appears to be multiple severe vulnerabilities across the platform.
highperson_alertThreat ActorUAC-0145 Targets Ukrainian IT Workers via Fake Job Recruitment Campaign
UAC-0145 is a threat cluster operating as a subgroup within Sandworm (also tracked as APT44, Seashell Blizzard, UAC-0002, ELECTRUM, Telebots, IRON VIKING), a sophisticated nation-state hacking group affiliated with Russia's GRU military intelligence.…
highbug_reportVulnerabilityCSS attacks bypass webmail sanitizers to steal passwords and tokens
Microsoft Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail webmail interfaces. Attacks exploit CSS and HTML parsing discrepancies to escape message boundaries.
criticalbug_reportVulnerabilityCisco Secure Firewall Management Center under active exploitation
Cisco Secure Firewall Management Center (formerly Firepower Management Center). Specific affected versions not disclosed in available data. Vulnerability details including CVE identifier not yet published.
highbug_reportVulnerability24,650 BMCs expose IPMI password hashes via CVE-2013-4786 flaw
36,872 internet-exposed Baseboard Management Controllers (BMCs) running IPMI v2.0 protocol on UDP port 623. Affected vendors include Supermicro, HPE iLO, and Dell.