Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 61 results
highbug_reportVulnerabilityMalware pre-installed on low-cost Android phones enables ad fraud and proxies
Low-cost Android smartphones with MediaTek chipsets, including Doogee S200 X, Cubot KINGKONG X, and Doogee Fire 3 Max. Thousands of devices affected across 150+ countries over two years, with highest concentrations in Mexico, France, Italy, US, Germa…
highbug_reportVulnerabilityLinux backdoors mimic email security tools to target telecom in Korea, Taiwan
Telecom and network appliances in South Korea and Taiwan. Specific targets: systems running SpamSniper (Korean email security), ShareTech appliances, and Oracle-backed telecom platforms.
highperson_alertThreat ActorWarlock: China-Linked Ransomware Group Targets Critical Infrastructure
Warlock is a China-linked ransomware group that has demonstrated a focus on critical infrastructure and public sector targets. The actor's motivation appears to align with both financial gain through ransomware operations and potential strategic inte…
criticalbug_reportVulnerabilityFortiMail vulnerability under active exploitation, immediate patching required
Fortinet FortiMail email security appliances. Specific affected versions not disclosed in available information. CVE identifier not yet assigned or not publicly disclosed.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager auth bypass under active exploitation
Cisco Catalyst SD-WAN Manager (specific versions not disclosed in source). Vulnerability allows unauthenticated remote attackers to gain administrative API access.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager auth bypass exploited in the wild
Cisco Catalyst SD-WAN Manager, all vulnerable versions prior to patched releases. The vulnerability (CVE-2026-76504) affects the API authentication mechanism due to improper URI encoding handling in HTTP requests.
criticalbug_reportVulnerabilityCritical pre-auth RCE in MikroTik RouterOS (CVE-2026-84411)
MikroTik RouterOS versions below 7.24. Vulnerability exists in web management service HTTP request handling. Widely deployed in critical infrastructure and enterprise networks.
highperson_alertThreat ActorFormer U.S. Army Soldier Sentenced for Hacking 10 Tech and Telecom Firms
Cameron John Wagenius (aliases 'kiberphant0m', 'cyb3rph4nt0m'), a 21-year-old former U.S. Army soldier, conducted hacking and extortion operations while on active duty between April 2023 and December 2024.
highpublicGeopoliticalU.S. Soldier Sentenced for Snowflake Breach Targeting 100M AT&T Records
This incident represents a significant insider threat case involving an active-duty U.S. Army soldier with secret-level security clearance who exploited cloud infrastructure vulnerabilities to conduct financially motivated cybercrime.
criticalbug_reportVulnerabilityMikroTik RouterOS SSH chain grants unauthenticated admin access
MikroTik RouterOS versions prior to 6.49.21, 7.23.4, and 7.24.2. Affects devices with SSH service exposed to untrusted networks or the Internet. Default home configurations are not exposed, but custom firewall rules may create exposure.
highbug_reportVulnerabilityToll fraud campaign uses Meta ads and 17 Google Play apps to steal via SMS
Polish mobile users targeted via 1,235 Meta advertisements promoting 17 malicious Android applications on Google Play. Confirmed apps include Messenger Pro (com.messages.sms.messenger.textmessage.owyo v9.0) and Phone Cleaner Master.
criticalbug_reportVulnerabilityIssabel Framework hard-coded JWT key enables unauthenticated RCE
Issabel Framework (all versions prior to August 1, 2026 patch). Issabel is a web-based framework for open-source unified communications PBX software built on Asterisk.
criticalbug_reportVulnerabilityHPE Aruba EdgeConnect SD-WAN auth bypass and RCE flaws require patching
HPE Aruba Networking EdgeConnect SD-WAN appliances. Specific affected versions not disclosed in available data. Vulnerabilities enable authentication bypass and remote code execution.
highbug_reportVulnerabilitySix critical flaws in WNC T-Mobile 5G Box IDU routers enable RCE
WNC T-Mobile 5G Box IDU routers running firmware versions before 1.1.0.651412. All six CVEs affect the same product and version range. Vulnerabilities include authentication bypass (CVE-2026-40854), three OS command injection flaws (CVE-2026-40855, C…
highbug_reportVulnerabilityCisco Secure Email Gateway SQL injection requires urgent patching
Cisco Secure Email Gateway (formerly IronPort). Specific affected versions not disclosed in available information. SQL injection vulnerability allows potential unauthorized database access.
highperson_alertThreat Actor3BB Broadband Intrusion: MeshCentral Backdoor Used for Root Access
The threat actor behind this intrusion remains unattributed. The operation targeted 3BB, Thailand's largest broadband provider, with the apparent objective of exfiltrating subscriber credential databases.
criticalbug_reportVulnerabilityCheck Point VPN unauthenticated RCE requires immediate patching
Check Point VPN products (specific versions not disclosed in available data). Vulnerability allows unauthenticated remote code execution. No CVE assigned yet.
criticalbug_reportVulnerabilityCheck Point VPN flaws allow unauthenticated RCE on gateways and mgmt servers
Check Point Security Gateway, Security Management Server, and Spark Firewall (all versions R80 through R82.10) configured with Remote Access VPN or Site-to-Site VPN.
highbug_reportVulnerabilityWeChat zero-click worm enables account takeover via incoming calls
WeChat versions prior to 8.0.77 (Android) and 8.0.76 (iOS) on iPhone and Android devices. Tested vulnerable versions: WeChat 8.0.76 (Android) and 8.0.75 (iOS). Affects an estimated 1.439 billion monthly active users globally.
highbug_reportVulnerabilityMikroTik RouterOS exploit chain actively hijacks routers via SSH
MikroTik RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Devices with SSH services exposed to the internet are at immediate risk. Approximately 122,500 MikroTik devices have exposed SSH interfaces as of September 5, 2026.
criticalbug_reportVulnerabilityMikroTik RouterOS SSH vulnerabilities actively exploited (MikroTrick)
MikroTik RouterOS all versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Devices with SSH service exposed to the internet are at highest risk. Six vulnerabilities identified, two critical (CVE-2026-67276, CVE-2026-86060) enable full device tak…
criticalbug_reportVulnerabilityCisco NX-OS RCE vulnerability requires immediate patching
Cisco NX-OS operating system. Specific affected versions not disclosed in available information. Impacts Nexus switches and potentially other devices running NX-OS.
criticalbug_reportVulnerabilitySangoma Switchvox SQL injection exploited for remote code execution
Sangoma Switchvox VoIP platform versions prior to 8.4.0.2. Approximately 4,000 internet-exposed instances globally, primarily in the United States. Vulnerability CVE-2026-9586 affects the unauthenticated /pa HTTP endpoint.
criticalbug_reportVulnerabilitySonicWall SMA 1000 VPN zero-days exploited in chained attacks
SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances: models 6210, 7210, and 8200v running versions 12.4.3-03453 and older, or 12.5.0-02835 and older.
highperson_alertThreat ActorFire Ant Expands Espionage to Cisco Routers and TACACS Servers
Fire Ant is a China-linked cyber espionage actor that has conducted long-running campaigns targeting network infrastructure and virtualization platforms.
highbug_reportVulnerabilityCalix GS7 XGS routers expose UPnP on WAN, allow unauthenticated NAT bypass
Calix GS7 XGS (GS5239XG / GigaSpire 7u10txg) residential routers running EXOS/6.6.47 firmware. Deployed by multiple U.S. ISPs including Cox Communications, Brightspeed, ALLO, CityFibre, and Conexon. No patch available.
criticalbug_reportVulnerabilityCisco patches nine flaws in Crosswork and Secure Workload; five rated 10.0
Cisco Crosswork Data Gateway, Crosswork Network Controller, Crosswork Planning (Release 7.2.1 and earlier); Cisco Secure Workload SaaS and on-premises (Release 3.10 and earlier, Release 4.0).
criticalbug_reportVulnerabilityUnisoc modem flaw enables Android kernel takeover via VoLTE video call
Unisoc chipsets T606, T612, and T7250 used in Motorola E13, Realme C33, and Xiaomi Redmi A5. Devices with these chipsets sold across 140+ countries. Confirmed vulnerable on Motorola E13 (February 2025 patch) and Xiaomi Redmi A5 (January 2026 patch).
highbug_reportVulnerabilityEvooo1Bot botnet exploits 18 CVEs to turn edge devices into SOCKS5 proxies
Internet-facing Linux-based edge devices including routers (NETGEAR, Tenda, D-Link, TP-Link, Zyxel), IP cameras (Hikvision), enterprise appliances (Alcatel OmniPCX, Mitsubishi ME-RTU, Telesquare SDT-CW3B1/TLR-2005KSH), and servers running vulnerable…
highbug_reportVulnerabilityEvooo1Bot: Mirai-based botnet targets Linux gateways as SOCKS5 proxies
Internet-facing Linux gateway devices (routers, firewalls, edge appliances). Specific vendors and models not disclosed. Mirai-based malware with modular architecture targeting devices with weak credentials or known vulnerabilities.