Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
17 / 17 results
criticalbug_reportVulnerabilityChina-linked Storm-0940 used AI framework to breach ConnectWise supply chain
ConnectWise multi-tenant application compromised; downstream impact to hundreds of organizations using Microsoft 365 across aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semi…
highperson_alertThreat ActorConnectWise App Identity Compromise Enables M365 Tenant Takeovers
The threat actor behind this campaign remains unattributed. Motivation appears to be espionage or persistent access establishment, evidenced by targeting of policy, national security, trade, and critical mineral sectors in a secondary wave.
criticalbug_reportVulnerabilityConnectWise shuts down Cloud Backup after M365 tenant compromise
ConnectWise Cloud Backup service (formerly SkyKick Cloud Backup) and connected Microsoft 365 tenants. All customers using the service for backup operations are affected.
highperson_alertThreat ActorCompromised ConnectWise M365 Credential Exposes 173 Tenants
The threat actor behind this campaign remains unattributed. The adversary demonstrated operational sophistication by compromising a Microsoft 365 application credential belonging to ConnectWise Cloud Backup (formerly SkyKick), a cloud-based backup se…
criticalbug_reportVulnerabilityBeyondTrust Remote Support zero-day exploited by China APT Armory Castle
BeyondTrust Remote Support (formerly Bomgar) versions 24.3.1 through 26.2.3. Self-hosted deployments exposed to the internet are at highest risk. SaaS customers were patched automatically as of October 9, 2026.
highperson_alertThreat ActorNorth Korea Fraudulent IT Worker Scheme: 14 Charged, 187 Devices Seized
North Korean state-sponsored operation tracked as Famous Chollima, purpledelta, and Wagemole. Active from approximately 2019 to July 2025, this scheme involves DPRK IT workers obtaining remote employment at U.S.
criticalbug_reportVulnerabilityGitLab CE/EE critical RCE (CVE-2026-97229) allows unauthenticated code execution
GitLab Community Edition (CE) and Enterprise Edition (EE) self-managed instances: versions before 19.4.2, before 19.3.4, and before 19.2.8. The critical vulnerability CVE-2026-97229 (CVSS 10.0) affects the CI/CD regular expression compiler.
criticalbug_reportVulnerabilityCritical RCE flaws in Ivanti Neurons for ITSM require immediate patching
Ivanti Neurons for ITSM (specific versions not disclosed in available data). Two vulnerabilities: missing authorization and insecure deserialization enabling remote code execution.
criticalbug_reportVulnerabilityN-able N-central RCE flaw (CVE-2026-86218) exploited in wild
N-able N-central RMM platform: all on-premises builds below version 2026.3.1.14, including servers patched with Hotfix 3 (2026.3.1.13) released hours earlier. Hosted N-central (NCOD) instances already patched by vendor.
criticalbug_reportVulnerabilityN-able N-central RCE flaw (CVE-2026-86218) exploited in the wild
N-able N-central on-premises deployments prior to version 2026.3 Hotfix 4. Approximately 1,500 instances exposed online, primarily in the US and Europe. Used by IT departments and MSPs for remote monitoring and management.
criticalbug_reportVulnerabilityVeeam ONE authentication bypass requires immediate patching
Veeam ONE backup management platform. Specific affected versions not disclosed in available information. Authentication bypass vulnerability allows unauthorized access.
highperson_alertThreat ActorSandworm deploys trojanized WireGuard VPN via fake IT job offers
Sandworm (also tracked as APT44, UAC-0145 sub-cluster) is a Russian-linked advanced persistent threat group notorious for targeting critical infrastructure and government entities, particularly in Ukraine and other countries.
criticalbug_reportVulnerabilityN-able N-central exploited; attackers persist via Cloudflare tunnels
N-able N-central RMM product, all versions prior to 2026.3.1.7. CVE-2026-18577 (CVSS 8.2) is an incomplete fix for CVE-2026-18556 (CVSS 8.2), both enabling authentication bypass and account takeover. On-premise deployments are affected.
criticalbug_reportVulnerabilityN-able N-central auth bypass exploited; incomplete patch requires upgrade
N-able N-central builds prior to 2026.3.1.7. All versions before the August 2 emergency hotfix are vulnerable. Affects MSPs and IT teams using N-central for remote monitoring and management of customer endpoints.
criticalbug_reportVulnerabilityBeyondTrust Remote Support/PRA critical auth bypass (CVE-2026-40138)
BeyondTrust Remote Support and Privileged Remote Access (PRA) products. Specific affected versions not provided in available data. CVE-2026-40138 is a pre-authentication vulnerability with CVSS 9.2.
highperson_alertThreat ActorIran-linked MOIS group deploys Cavern C2 framework against Israel
An Iranian threat actor affiliated with Iran's Ministry of Intelligence and Security (MOIS), tracked by Check Point Research. The group operates in support of Iranian state intelligence objectives, focusing on espionage operations against adversary n…
highbug_reportVulnerabilitySimpleHelp OIDC flaw allows unauthenticated account creation
SimpleHelp remote management software servers with OpenID Connect (OIDC) authentication enabled. Specific affected versions not disclosed. All SimpleHelp deployments using OIDC for technician authentication are potentially vulnerable.