Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
10 / 10 results
highbug_reportVulnerabilityCISA: Plex2Shell exploit chain actively used to breach Plex servers
Plex Media Server versions before 1.43.3.10861. Four vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) chained together to achieve unauthenticated remote code execution with elevated privileges.
highbug_reportVulnerabilityCandiru spyware deployed via zero-click malicious ads at Al Jazeera
Al Jazeera Media Network devices (Windows confirmed, likely mobile); 45+ devices compromised 2024-2025. Broader campaign placed 3.77 billion ad bids across 75,373 Android/iOS apps and 120,768 websites (March-June 2026).
highpublicGeopoliticalNikkei discloses dual email account breaches, phishing campaign
The breach of Nikkei, one of the world's largest financial media corporations with global reach and over 1,500 journalists worldwide, represents a significant compromise of a strategic information node.
highperson_alertThreat ActorIranian State-Linked Hackers Deploy CHOSEN BRICK Malware
Iranian state-linked threat actors conducting espionage operations targeting dissidents, activists, and journalists globally. The activity is attributed to Iranian intelligence services and is assessed to support regime repression efforts against per…
highperson_alertThreat ActorIran MOIS Uses Telegram-Controlled Malware to Target Dissidents
Iran's Ministry of Intelligence and Security (MOIS), the country's primary intelligence agency, is attributed by the FBI, UK NCSC, and Netherlands AIVD as the operator behind this espionage campaign.
highperson_alertThreat ActorUAT-10147 Deploys AI-Assisted Attacks and SPECTRE Malware Globally
UAT-10147 is a Chinese-speaking cybercrime group conducting large-scale attacks against Windows and Linux web servers globally. The actor's primary motivation appears to be SEO fraud and data theft.
highbug_reportVulnerabilityPhishing campaign targets marketing professionals via fake job interviews
Marketing professionals with Google accounts; campaign impersonates 30+ brands including Adobe, Netflix, Coca-Cola, OpenAI. Credential theft targeting Google accounts specifically.
highbug_reportVulnerabilityFFmpeg 'PixelSmash' flaw enables RCE on Jellyfin, DoS on multiple apps
FFmpeg (version details not specified). Downstream impact: Jellyfin (remote code execution), Kodi, Emby, Nextcloud, PhotoPrism, OBS Studio (denial-of-service). Affects media processing and streaming applications using vulnerable FFmpeg libraries.
highbug_reportVulnerabilityAI finds 21 zero-days in FFmpeg; Chrome 149 patches 429 bugs
FFmpeg media library (all versions prior to upcoming patch release); Google Chrome versions prior to 149 (all platforms). FFmpeg is embedded in countless applications, browsers, media players, and server-side processing pipelines.
highpublicGeopoliticalItaly Dismantles CINEMAGOAL Piracy Network Targeting Streaming Platforms
The disruption of the CINEMAGOAL piracy ecosystem represents a law enforcement action against organized digital piracy infrastructure rather than a state-sponsored cyber operation.