Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 57 results
highbug_reportVulnerabilityAttackers hijacked 300+ Tor exit relays to intercept SSH credentials
Over 300 Tor exit relays compromised October 1-5, 2026. Users connecting to SSH servers via Tor during this window were at risk. Attack peaked at 7.46% of Tor's exit capacity. Primarily affected Linux-based Tor relay hosts.
highbug_reportVulnerabilityGo 1.27.3 and 1.26.10 block eight eMudhra CA keys over undisclosed risk
Go versions 1.27.3 and 1.26.10 (released October 20, 2026). All Go programs must be rebuilt with these versions to enforce the block. Eight intermediate CA keys from eMudhra (six TLS, two code-signing) under emSign Root TLS CA - G3 and emSign Root CS…
criticalbug_reportVulnerabilityNGINX heap buffer overflow enables RCE; patch immediately
NGINX Plus and NGINX Open Source (specific vulnerable versions not disclosed in available data). Heap-based buffer overflow vulnerabilities affect both commercial and open source editions.
criticalbug_reportVulnerabilityCitrix NetScaler RCE vulnerability requires immediate patching
Citrix NetScaler (specific versions not disclosed in available data). Scope and affected product lines (ADC, Gateway, etc.) not specified in source material.
criticalbug_reportVulnerabilityHPE AOS-Switch auth bypass and buffer overflow require immediate patching
HPE Networking AOS-Switch (AOS-S) products. Specific affected versions not provided in source material. Vulnerabilities enable authentication bypass and buffer overflow leading to unauthorized access and arbitrary code execution.
highbug_reportVulnerabilityApache HTTP Server vulnerabilities require immediate patching
Apache HTTP Server - specific versions not provided in advisory. All organizations running Apache HTTP Server should verify their version against latest security bulletins.
criticalbug_reportVulnerabilityFortinet FortiMail zero-day CVE-2026-104286 exploited for file writes
Fortinet FortiMail versions 7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6, and 8.0.0-8.0.1. Unauthenticated remote attackers can write arbitrary files via path traversal and null byte injection flaws in HTTP/HTTPS handlers.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager auth bypass exploited in the wild
Cisco Catalyst SD-WAN Manager, all vulnerable versions prior to patched releases. The vulnerability (CVE-2026-76504) affects the API authentication mechanism due to improper URI encoding handling in HTTP requests.
criticalbug_reportVulnerabilityCritical pre-auth RCE in MikroTik RouterOS (CVE-2026-84411)
MikroTik RouterOS versions below 7.24. Vulnerability exists in web management service HTTP request handling. Widely deployed in critical infrastructure and enterprise networks.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager zero-day exploited for admin escalation
Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage): all versions prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. All deployments affected regardless of configuration.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway RCE zero-days under active exploitation
Citrix NetScaler ADC and NetScaler Gateway. Specific affected versions not provided in source material. CVE identifiers not yet assigned.
criticalbug_reportVulnerabilityF5 BIG-IP APM critical RCE (CVE-2026-94127) under active exploitation
F5 BIG-IP Access Policy Manager (APM). Specific affected versions not disclosed in available data. Vulnerability enables unauthenticated remote code execution via heap-based buffer overflow (CVSS 9.8).
highbug_reportVulnerabilityNetwork management systems under active attack via critical flaws
Network management platforms including Cisco Secure Firewall Management Center (FMC), Cisco Identity Services Engine (ISE), SonicWall SMA 1000, Check Point VPN gateways, HPE Fabric Composer, EdgeConnect SD-WAN Orchestrator, NVIDIA Unified Fabric Mana…
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator zero-day CVE-2026-93952 exploited in wild
Arista VeloCloud Orchestrator (VCO) On-Prem deployments with certificate-based authentication enabled. Hosted deployments running VCO versions below 5.2.3.16 (5.x branch), below 6.4.2.8 (6.x branch), 6.1.3.7 and below, and 7.0.0.2 and below are vulne…
highbug_reportVulnerabilityUbuntu unpatched for Linux kernel container escape (CVE-2026-80521)
Linux kernel versions 6.10+ (including stable branches 6.1 and 6.6). Ubuntu 26.04, 24.04 LTS, and 22.04 LTS remain unpatched. Affects AWS, Azure, and GCP kernel packages. Fixed upstream in kernel 7.2 and 7.1.10 on August 6, 2026.
criticalbug_reportVulnerabilityMikroTik RouterOS pre-auth RCE chain enables full device takeover
MikroTik RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. All unpatched RouterOS devices with SSH enabled are vulnerable to unauthenticated remote takeover when CVE-2026-67279 and CVE-2026-86060 are chained together.
criticalbug_reportVulnerabilityLinux ARM64 KVM flaw allows guest-to-host escape via nested virtualization
Linux kernel ARM64 KVM code with nested virtualization enabled. Affected versions: 6.17 through 6.18.50, 7.0 through 7.2.4, and 7.3-rc pre-releases. Fixed in 6.18.51, 7.2.5, and 7.3-rc1.
criticalbug_reportVulnerabilityCISA: Three Linux kernel CVEs actively exploited in the wild
Linux kernel across all distributions. CVE-2025-39682 affects TLS receive path (CVSS 9.8), CVE-2026-53266 affects ebtables SNAT/ARP (CVSS 8.8), CVE-2025-39964 affects AF_ALG socket handling (CVSS 7.8). All require local authenticated access.
highbug_reportVulnerabilityFour Linux kernel local root exploits released with public PoC code
Linux kernel versions prior to 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Four vulnerabilities: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), CVE-2026-74469 (DiagSpill).
highbug_reportVulnerabilityBIND 9 patches 14 flaws, including DoH crash via malformed SIG(0) request
ISC BIND 9 DNS server software. Critical DoH crash affects 9.20.0–9.20.27 and 9.21.0–9.21.25. Other flaws affect 9.11.0–9.18.50 (EOL), 9.20.0–9.20.27, and 9.21.0–9.21.25. Fixed in 9.20.29 and 9.21.26.
criticalbug_reportVulnerabilityCritical RCE flaws in cPanel WHM and ConfigServer CSF enable root access
cPanel WHM (Web Host Manager) and ConfigServer Security & Firewall (CSF). Specific vulnerable versions not disclosed in available data. Affects hosting providers and servers using these control panel and firewall management tools.
criticalbug_reportVulnerabilityFortinet FortiOS & FortiSwitchManager RCE requires immediate patching
Fortinet FortiOS and FortiSwitchManager affected by remote code execution vulnerability. Specific affected versions not disclosed in available information. CVE identifier not yet assigned or published.
highpublicGeopoliticalMikroTik Router Exploit Enables Unauthenticated Admin Access via SSH
The exploitation of MikroTik routers—widely deployed in small and medium enterprises, ISPs, and critical infrastructure across Europe and emerging markets—represents a significant supply chain vulnerability with potential strategic implications.
criticalbug_reportVulnerabilityMikroTik RouterOS SSH vulnerabilities actively exploited (MikroTrick)
MikroTik RouterOS all versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Devices with SSH service exposed to the internet are at highest risk. Six vulnerabilities identified, two critical (CVE-2026-67276, CVE-2026-86060) enable full device tak…
criticalbug_reportVulnerabilityHPE patches critical RCE in ArubaOS-CX network switches (CVE-2026-73749)
ArubaOS-CX network operating system on HPE Aruba enterprise switches. Affected versions: 10.18.0001, 10.17.1021 and earlier, 10.16.1051 and earlier, 10.13.1180 and earlier, 10.10.1180 and earlier.
criticalbug_reportVulnerabilityCisco patches critical RCE in Nexus 9000 switches and 7 IOS XR flaws
Cisco Silicon One-based Nexus 9000 switches (10 models including N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O/Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, N9K-C9808) running NX-OS 10.3(1) through 10.6(3s).
criticalbug_reportVulnerabilityCisco NX-OS RCE vulnerability requires immediate patching
Cisco NX-OS operating system. Specific affected versions not disclosed in available information. Impacts Nexus switches and potentially other devices running NX-OS.
criticalbug_reportVulnerabilitySonicWall SMA 1000 SSRF flaw (CVE-2026-83548) exploited in the wild
SonicWall SMA 1000 Appliances. CVE-2026-83548 is a server-side request forgery (SSRF) vulnerability with CVSS 10.0, allowing remote unauthenticated attackers to gain unauthorized access. Specific affected versions not disclosed.
criticalbug_reportVulnerabilityBGP hijack delivers malicious Virtualizor update with root backdoor
Virtualizor hypervisor management software (all versions) from Softaculous. Attack window: August 28, 2026 20:57 UTC to August 30, 2026 06:10 UTC. Any installation that checked for updates during this period may be compromised.
criticalbug_reportVulnerabilityApache Log4j2 deserialization filter bypass enables remote code execution
Apache Log4j2 logging library. Specific affected versions not disclosed in available information. Impacts Java applications using Log4j2 with deserialization features enabled.