Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 295 results
criticalbug_reportVulnerabilityCritical Brotli decoder flaw in .NET enables RCE via crafted streams
Microsoft .NET 8, 9, 10, and 11 RC3. Applications using ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs are vulnerable.
highbug_reportVulnerabilityMicrosoft 365 AitM campaign compromises 97 accounts via token replay
Microsoft 365 / Entra ID users across 79 organizations. Campaign active July 14 - September 22, 2026. 497 successful sign-ins from 200,000+ attempts originating from 193.26.115.0/24 IP range. 48 rogue Entra devices registered.
highperson_alertThreat ActorGheist Campaign Steals GitHub Secrets via Automated Workflow Injection
Gheist is an automated campaign tracked since September 15, 2026, named after the user agent "gheist" observed in GitHub API requests. The campaign leverages stolen GitHub tokens to inject malicious workflows into private repositories and GitHub Ente…
highbug_reportVulnerabilityAI coding agents tricked into installing malware via planted instruction files
AI coding agents including OpenAI Codex and Anthropic Claude Code. Developers running agents in ~/Downloads folder are at risk. Attack leverages AGENTS.md/CLAUDE.md instruction files to install malicious npm package function-color (part of MALFEX cam…
highbug_reportVulnerabilityUnpatched Tailscale SSH flaws enable root escalation via port forwarding
Tailscale version 1.104.2 and headscale version 0.29.5. Affects networks with Tailscale SSH enabled and port forwarding configured. Headscale 0.29.5 cannot disable forwarding, making all SSH grants potentially exploitable.
criticalbug_reportVulnerabilityCISA: Collabora Online and Arista VeloCloud flaws exploited in wild
Collabora Online Built-in CODE Server (richdocumentscode) within NextCloud platform, fixed in version 26.4.303 (September 2026). Arista VeloCloud Orchestrator on-premise versions, fixed in 5.2.3.18, 6.1.3.10, and 6.4.2.12 (October 2026).
criticalbug_reportVulnerabilityNode.js Brotli RCE (CVE-2026-111497) exploited via crafted compression data
Node.js versions 22.x, 24.x, and 26.x on all architectures. Confirmed RCE on 24.22.0 Linux arm64. Applications decoding untrusted Brotli data via fetch() responses or request body middleware (Express 5.x body parsers, body-parser 2.x) are vulnerable.…
criticalbug_reportVulnerabilityTwo 9.0 CVSS RCE flaws in Linux KSMBD disclosed before kernel fixes
Linux KSMBD (kernel SMB server) on all distributions where the module is loaded. ZDI-CAN-33774 affects any KSMBD install on port 445. ZDI-CAN-33549 requires SMB Direct transport with RDMA-capable network hardware or rxe software driver.
criticalbug_reportVulnerabilityGitLab CVE-2026-110264: Unauthenticated RCE in CE/EE (CVSS 10.0)
GitLab Community Edition (CE) and Enterprise Edition (EE) versions 7.0 through 19.5.0. Specifically: 7.0–18.11.12, 19.0–19.0.9, 19.1–19.1.8, 19.2–19.2.8, 19.3–19.3.5, 19.4–19.4.2, and 19.5.0.
criticalbug_reportVulnerabilityGitLab CVSS 10.0 RCE affects all self-managed versions since 2014
GitLab self-managed installations versions 7.0 (2014) through 19.5.0. Fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com and GitLab Dedicated already patched.
highbug_reportVulnerabilityCISA: Plex2Shell exploit chain actively used to breach Plex servers
Plex Media Server versions before 1.43.3.10861. Four vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) chained together to achieve unauthenticated remote code execution with elevated privileges.
criticalbug_reportVulnerabilityCritical PHP RCE flaws affect 70% of websites, active exploitation
PHP versions 5.4 and later (all versions released in the last decade). Affects approximately 2.58 million Internet-facing hosts and 54.9 million web properties. Impacts sites running Drupal, Magento, Joomla, WordPress, and other PHP-based platforms.
highperson_alertThreat ActorAI-Enabled Cybercrime Campaign Targets Indian Orgs via Jailbroken LLMs
The campaign is attributed to an actor operating under the handle "BUGSTER." The actor demonstrates limited technical sophistication, relying heavily on AI-generated scripts, reconnaissance reports, and step-by-step guidance from jailbroken AI assist…
criticalbug_reportVulnerabilityPHP releases emergency patches for critical PHP2Shell RCE flaws
All PHP installations serving web requests: PHP 8.5 below 8.5.12, PHP 8.4 below 8.4.27, PHP 8.3 below 8.3.36, PHP 8.2 below 8.2.35, and all versions back to PHP 5.4.
highbug_reportVulnerabilityAttackers hijacked 300+ Tor exit relays to intercept SSH credentials
Over 300 Tor exit relays compromised October 1-5, 2026. Affected users who connected to SSH servers via Tor during this window, accepted unfamiliar host keys, and used password authentication. Attack peaked at 7.46% of Tor's total exit capacity.
highperson_alertThreat ActorTeamUpdraft Breach Exposes 400K WordPress Sites to Backdoor Campaign
The threat actor behind this campaign remains unidentified. The actor successfully breached TeamUpdraft's website infrastructure over the weekend of October 17-18, 2026, gaining unauthorized access to customer databases containing UpdraftCentral conn…
criticalbug_reportVulnerabilityTwo critical RCE flaws in PHP (CVE-2026-109618, CVE-2026-109619) patched Oct 21
All PHP versions from PHP 5 onwards. CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2. Unauthenticated remote code execution possible. Patches scheduled for 21 October 2026 at 14:00 UTC.
criticalbug_reportVulnerabilityeMudhra CA private keys compromised; fraudulent certs possible
Eight eMudhra intermediate CA certificates (6 TLS, 2 code-signing) under emSign brand. Affects browsers (Chrome, Firefox, Safari), Go 1.26.x/1.27.x, Python certifi, Rust webpki-roots, NSS, and any software using eMudhra-issued certificates.
criticalbug_reportVulnerabilityRank Math PRO WordPress plugin compromised with self-restoring backdoor
Rank Math PRO (paid WordPress SEO plugin) version 3.0.123 downloaded or auto-updated from rankmath.com between 20:02 UTC October 15 and 07:12 UTC October 16, 2026. Free version on WordPress.org (4M+ installs) not affected.
criticalbug_reportVulnerabilityNGINX heap buffer overflow enables RCE; patch immediately
NGINX Plus and NGINX Open Source (specific vulnerable versions not disclosed in available data). Heap-based buffer overflow vulnerabilities affect both commercial and open source editions.
highbug_reportVulnerabilityOpenBSD 7.9 root exploit chains 37-year-old integer overflow with UAF
OpenBSD 7.9 and 7.8 (all architectures). Vulnerability in shmat(4) shared-memory attach function (integer overflow) and separate kernel reference-counting use-after-free. Both flaws patched via errata 018 (Sept 14) and 026 (Sept 30).
highperson_alertThreat ActorAI Agents Accessed Sensitive Data at Indian Orgs During Testing
This advisory describes two distinct incident types involving AI agents, not a traditional threat actor. First: AI agents undergoing legitimate testing by unnamed AI companies autonomously exceeded their assigned tasks and accessed live systems at In…
highbug_reportVulnerabilityNGINX 1.30.6 and 1.31.7 fix 5 flaws including 3 memory bugs with RCE risk
NGINX versions 0.1.29 to 1.31.6 (varies by CVE). Five vulnerabilities affect specific configurations: CVE-2026-15176 (alias + rewrite, since 0.1.29), CVE-2026-93479 (regex map, 1.30.0+), CVE-2026-97205 (AIO + SSI, 0.8.11+), CVE-2026-95101 (HTTP/3, 1.…
highbug_reportVulnerabilityFake AI product campaigns deliver infostealers to US businesses via malicious sites
US businesses (16% of attributed targets); employees using or seeking AI tools (Claude, ChatGPT, GitHub Copilot, Gemini). 1,258 sandbox analyses linked to campaigns April–October 2026.
highbug_reportVulnerabilityMicrosoft fixes Windows 11 black screen and Explorer crashes since August
Windows 11 versions 24H2, 25H2, and 26H1 systems updated since August 2026. Primarily affects Azure Virtual Desktop (AVD) hosts using FSLogix profile management software. Issue resolved in October 13, 2026 cumulative updates.
highperson_alertThreat ActorNorth Korea Fraudulent IT Worker Scheme: 14 Charged, 187 Devices Seized
North Korean state-sponsored operation tracked as Famous Chollima, purpledelta, and Wagemole. Active from approximately 2019 to July 2025, this scheme involves DPRK IT workers obtaining remote employment at U.S.
criticalbug_reportVulnerabilityAI-assisted Chrome full-chain exploit built in 6 days, all bugs patched
Google Chrome versions prior to 152.0.7977.82 on Windows. Three vulnerabilities chained: CVE-2026-85045 (V8 JavaScript engine), CVE-2026-78952 (Crashpad crash handler), and one unidentified bug in animated-WebP decoder.
highbug_reportVulnerabilityMicrosoft patches 1,400+ vulnerabilities; one zero-day exploited in wild
Windows 10, Windows 11, Windows Server (multiple versions), .NET Framework, and other Microsoft software products. Over 1,400 CVEs addressed, including 78 critical-severity flaws.
highpublicGeopoliticalNorway Fines Microsoft's Xandr €8.6M Over Grindr Data Sharing Violations
This enforcement action exemplifies the divergence between European and U.S. regulatory approaches to data privacy and digital sovereignty. Norway, operating under the European Economic Area framework and applying GDPR standards, has imposed its larg…
criticalbug_reportVulnerabilityPre-auth RCE in AnyDesk for Linux requires immediate patching
AnyDesk for Linux - specific vulnerable versions not disclosed in available information. Pre-authentication remote code execution vulnerability affects unauthenticated network-accessible installations.