Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
13 / 13 results
criticalbug_reportVulnerabilityVMware VeloCloud Orchestrator under active exploit, patch immediately
VMware VeloCloud Orchestrator (VCO). Specific affected versions not disclosed in available information. VeloCloud Orchestrator is VMware's SD-WAN management platform used by enterprises and service providers.
highbug_reportVulnerabilityThreat actor k0t exploits Fortinet and Palo Alto firewalls, exposes 70K creds
Fortinet FortiGate and FortiWeb firewalls, Palo Alto Networks GlobalProtect, PAN-OS, and Prisma Access. Exploited vulnerabilities: CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (PAN-OS/Prisma Access authentication bypass).
criticalbug_reportVulnerabilityPEERSTITCH malware deployed on 500+ FortiGate firewalls via FortiManager
Fortinet FortiManager and 500+ managed FortiGate firewalls. Initial compromise via CVE-2024-47575 (FortiJump) on FortiManager FMG-Access service (TCP 541).
criticalbug_reportVulnerabilityFive critical RCE flaws in Cisco NX-OS allow root takeover of Nexus switches
Cisco Nexus 3000 and 9000 Series switches running NX-OS in standalone mode. Exploitation requires NX-API, Next Generation OAM (NGOAM), or MPLS OAM features to be enabled. Nexus 7000 and Nexus 9000 in ACI mode are not affected.
criticalbug_reportVulnerabilityCitrix Netscaler ADC/Gateway HTTP smuggling flaws require immediate patch
Citrix Netscaler ADC, Netscaler Gateway, and Netscaler FIPS appliances. Specific affected versions not provided in advisory; consult Citrix security bulletin for version details.
highbug_reportVulnerabilityLinux backdoors mimic email security tools to target telecom in Korea, Taiwan
Telecom and network appliances in South Korea and Taiwan. Specific targets: systems running SpamSniper (Korean email security), ShareTech appliances, and Oracle-backed telecom platforms.
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway DoS flaw requires immediate patching
Citrix NetScaler ADC and NetScaler Gateway (specific versions not disclosed in available data). Remote attackers can trigger denial of service conditions.
highbug_reportVulnerabilityCitrix NetScaler zero-day CVE-2026-88779 exploited in SAML attacks
Citrix NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.41, 13.1-64.28, 14.1-FIPS 14.1-73.41, and 13.1-FIPS/13.1-NDcPP 13.1-37.282. Only deployments configured as SAML service provider (SP) or SAML identity provider (IdP) are vulnerable.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway: 2 critical RCE flaws under active exploit
Citrix NetScaler ADC and NetScaler Gateway versions 13.1 before 13.1-64.23, 14.1 before 14.1-73.37, and FIPS editions. CVE-2026-88771 affects all deployments (no preconditions).
highperson_alertThreat ActorSophos Analyzes Memory-Resident PHP Web Shell in F5 BIG-IP APM
Sophos is a cybersecurity vendor that published technical analysis on September 7, 2026, examining malware targeting F5 BIG-IP Access Policy Manager (APM) appliances. Sophos is the researcher/defender in this context, not the threat actor.
highperson_alertThreat ActorFire Ant Expands Espionage to Cisco Routers and TACACS Servers
Fire Ant is a China-linked cyber espionage actor that has conducted long-running campaigns targeting network infrastructure and virtualization platforms.
criticalbug_reportVulnerabilityCisco patches nine flaws in Crosswork and Secure Workload; five rated 10.0
Cisco Crosswork Data Gateway, Crosswork Network Controller, Crosswork Planning (Release 7.2.1 and earlier); Cisco Secure Workload SaaS and on-premises (Release 3.10 and earlier, Release 4.0).
criticalbug_reportVulnerabilityUbiquiti UniFi OS vulnerable to RCE via chained patched vulnerabilities
Ubiquiti UniFi OS server (specific versions not provided). Vulnerability chain affects systems running outdated UniFi OS versions containing three previously patched flaws.