Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 134 results
criticalbug_reportVulnerabilityeMudhra CA private keys compromised; fraudulent certs possible
Eight eMudhra intermediate CA certificates (6 TLS, 2 code-signing) under emSign brand. Roots trusted by Mozilla, Chrome, Apple. Affects Go 1.26.x/1.27.x, Firefox, NSS, Python certifi, Rust webpki-roots, Homebrew ca-certificates.
highbug_reportVulnerabilityOVHcloud CLI tool backdoored on GitHub to steal developer credentials
OVHcloud CLI versions 0.11.0 through 0.15.0 on macOS (Intel/ARM), Linux (x86_64/ARM64), and Windows x86-64. Compromised releases available October 19, 2026 from 14:47 to 16:21 UTC. Version 0.10.0 and earlier, plus 0.16.0 are clean.
criticalbug_reportVulnerabilityRank Math PRO WordPress plugin compromised in supply-chain attack
Rank Math PRO version 3.0.123 downloaded from the official vendor website between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC (11-hour window). Free version of Rank Math SEO unaffected.
highbug_reportVulnerabilityAOMEI update servers compromised to distribute malware via Backupper
AOMEI Backupper (Windows backup software) users who checked for updates during three brief windows between April and July 2026: May 28 (10 min), July 16 (6 min), July 20 (5 min).
criticalbug_reportVulnerabilityRank Math PRO WordPress plugin compromised with self-restoring backdoor
Rank Math PRO (paid WordPress SEO plugin) version 3.0.123 downloaded or auto-updated from rankmath.com between 20:02 UTC October 15 and 07:12 UTC October 16, 2026. Free version on WordPress.org (4M+ installs) not affected.
highbug_reportVulnerabilityGhostAction supply chain attack expands to 94 repos with credential stealer
94 GitHub repositories across 66 owners compromised. Targets open-source developers using GitHub Actions, VS Code, and OAuth device flows. Malware disguised as font file (fa-solid-400.woff2) steals AWS keys, PyPI/npm tokens, Git credentials, Kubernet…
highbug_reportVulnerabilityFake Web3 accelerator spreads malware via npm to steal credentials
npm packages @apexacc/cli and @apexacc/audit (now removed); targets Windows and macOS developer systems. Campaign linked to Apex Accelerator/Apex Foundation (apexaccs[.]org, apexfdn[.]xyz).
criticalbug_reportVulnerabilityConnectWise shuts down Cloud Backup after M365 tenant compromise
ConnectWise Cloud Backup service (formerly SkyKick Cloud Backup) and connected Microsoft 365 tenants. All customers using the service for backup operations are affected.
highbug_reportVulnerabilityMalicious npm package 'imgdecode' delivers shellcode loader on Windows
npm package 'imgdecode' versions 1.0.0 through 1.0.3, published by user 'malfexteste8'. Part of broader MALFEX campaign targeting Windows systems via npm supply chain. Downloaded 979 times. Package was still available on npm as of October 17, 2026.
criticalbug_reportVulnerabilityAOMEI Backupper update servers compromised to deliver backdoor via tampering
AOMEI Backupper (Windows backup software), at least version 8.3.0 confirmed affected. All installations that checked for updates during three confirmed tampering windows between May 28 and July 20, 2026 (total ~21 minutes across three incidents).
highbug_reportVulnerabilityFortinet FortiOS path traversal flaw exploited to deploy PEERSTITCH malware
Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager vulnerable to CVE-2025-61624 (CVSS 5.4), a path traversal flaw in the command line interpreter. Patched by Fortinet in April 2026.
highbug_reportVulnerabilityMalicious Arch Linux packages impersonate yay and paru AUR helpers
Arch Linux users who installed typosquatted packages from AUR (Arch User Repository) uploaded by user "marchos1as" between October 13-15, 2026. Malicious packages include "yyay" and similar variants impersonating legitimate AUR helpers yay and paru.
criticalbug_reportVulnerabilityPEERSTITCH malware deployed on 500+ FortiGate firewalls via FortiManager
Fortinet FortiManager and 500+ managed FortiGate firewalls. Initial compromise via CVE-2024-47575 (FortiJump) on FortiManager FMG-Access service (TCP 541).
highbug_reportVulnerabilityLedger halts Asia sales after hardware implants steal crypto seed phrases
Ledger hardware wallets purchased from third-party resellers in Southeast Asia (Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia), Hong Kong, and potentially Europe (MediaMarkt).
criticalbug_reportVulnerabilityLedger hardware wallets sold via CryptoBilis contain spy chip implants
Ledger Nano X hardware wallets distributed through Southeast Asian reseller CryptoBilis (Malaysia-based, operating across Southeast Asia). Compromised devices also sold via Amazon Japan and Yahoo! Auctions Japan by China-based sellers shipping from M…
highbug_reportVulnerabilityLedger wallets sold via CryptoBilis contain hardware implants, $86M stolen
Ledger hardware cryptocurrency wallets purchased through reseller CryptoBilis in Southeast Asia within the last 90 days. Confirmed cases involve unauthorized hardware implants in devices sold exclusively through this reseller.
highbug_reportVulnerabilityMalware pre-installed on low-cost Android phones enables ad fraud and proxies
Low-cost Android smartphones with MediaTek chipsets, including Doogee S200 X, Cubot KINGKONG X, and Doogee Fire 3 Max. Thousands of devices affected across 150+ countries over two years, with highest concentrations in Mexico, France, Italy, US, Germa…
criticalbug_reportVulnerabilityTensorlake npm package 0.5.144 compromised with Shai-Hulud worm
npm package "tensorlake" version 0.5.144 (TypeScript SDK for Tensorlake applications). Malicious version no longer available on npm registry. Affects users who installed this specific version, particularly those with access to CI/CD pipelines, cloud…
highbug_reportVulnerabilityWeb3-based C2 in supply chain attacks targets cloud credentials via npm
Enterprise cloud environments using open-source dependencies from npm, Go modules, and Packagist registries. Specifically impacts developer workstations and CI/CD pipelines with access to cloud IAM tokens, service account keys, and deployment secrets…
highbug_reportVulnerabilityHackers hijack Google domains via compromised ccTLD registries for Ghana, AS, SL
Domains under .GH (Ghana), .AS (American Samoa), and .SL (Sierra Leone) ccTLDs. Google domains and multiple global brands affected. Third-party registry operators for these ccTLDs were compromised.
highbug_reportVulnerabilityAttackers hijack .gh, .sl, .as registries to issue fraudulent Google certs
All domains under .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTLDs. Confirmed fraudulent certificates issued for Google and YouTube domains between September 22-27, 2026.
highbug_reportVulnerabilityMALFEX campaign: 8 malicious npm packages deliver Overlord RAT, 40K+ downloads
npm ecosystem; 8 malicious packages (tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, function-flag, function-color, cdn-img-fetch) with 40,767 total downloads since August 2023.
criticalbug_reportVulnerabilityBitget confirms zero-day in third-party security product led to $387M theft
Bitget cryptocurrency exchange; third-party security products (Product A and Product B, vendors unnamed); 11 blockchains including Ethereum, XRP Ledger, Zcash, TRON, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand, and Celestia.
criticalbug_reportVulnerabilityBitget crypto exchange breached via zero-day in security appliances
Bitget cryptocurrency exchange. Two unnamed third-party security appliances (referred to as "Product A" and "security appliance B") compromised via zero-day vulnerabilities.
criticalbug_reportVulnerabilityBitget exchange loses $388M via zero-day in unnamed third-party product
Bitget cryptocurrency exchange. The unnamed third-party security product used by Bitget contained a zero-day vulnerability that allowed credential theft. Hot and warm wallets were compromised; cold wallets unaffected.
highbug_reportVulnerabilityCompromised GitHub Actions re-enabled with malicious code for 7+ days
Two third-party GitHub Actions previously compromised in Mini Shai-Hulud campaign. Specific action names not disclosed. Affects any workflows consuming these actions during the exposure window (7+ days).
highbug_reportVulnerabilityGitHub Actions repos re-enabled with Mini Shai-Hulud malware intact
Two GitHub Actions repositories (actions-cool/issues-helper and actions-cool/maintain-one-comment) compromised in May 2026. Any CI/CD workflows referencing these actions by version tags (e.g., v2.2.1 or later from May 18, 2026) executed malicious pay…
![Placeholder domain third-party[.]com weaponized with ClickFix malware](/previews/2026-09-24-placeholder-domain-third-party-com-weaponized-clickfix-75c268ef.webp)
highbug_reportVulnerabilityPlaceholder domain third-party[.]com weaponized with ClickFix malware
Over 1,700 public GitHub repositories referencing third-party[.]com as a documentation placeholder. Additional 13 non-reserved placeholder domains identified (yoursite[.]com, your-domain[.]com, acme[.]com, etc.), with two serving scams/scareware.
highbug_reportVulnerabilityMalicious Terraform providers on HashiCorp Registry deliver DPRK malware
HashiCorp Terraform Registry and Go module repositories. Specific malicious packages: gocommunity-io/dockerd (222 downloads), kreuzwenker/docker (1,449 downloads), gocommunity.io/orderedbtree, gogets.dev/btreex. Related npm packages also identified.
highbug_reportVulnerabilityMemTensor npm and PyPI packages compromised to deliver sckit credential stealer
MemTensor packages: npm package @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, 0.1.25; PyPI package MemoryOS version 2.0.34 (now quarantined). Malicious Go-based credential stealer targets Windows, Linux, and macOS systems.