Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 37 results
criticalbug_reportVulnerabilityLiteLLM supply chain attack via leaked master key compromised v1.107.0
LiteLLM Python package version 1.107.0 (published October 21, 2026 to PyPI, Docker Hub, and GHCR). Threat actor gained owner-level access to BerriAI GitHub organization via unrevoked master key exposed May 27, 2026.
highbug_reportVulnerabilityCISA: Plex2Shell exploit chain actively used to breach Plex servers
Plex Media Server versions before 1.43.3.10861. Four vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) chained together to achieve unauthenticated remote code execution with elevated privileges.
highperson_alertThreat ActorAI-Enabled Cybercrime Campaign Targets Indian Orgs via Jailbroken LLMs
The campaign is attributed to an actor operating under the handle "BUGSTER." The actor demonstrates limited technical sophistication, relying heavily on AI-generated scripts, reconnaissance reports, and step-by-step guidance from jailbroken AI assist…
highperson_alertThreat ActorTeamUpdraft Breach Exposes 400K WordPress Sites to Backdoor Campaign
The threat actor behind this campaign remains unidentified. The actor successfully breached TeamUpdraft's website infrastructure over the weekend of October 17-18, 2026, gaining unauthorized access to customer databases containing UpdraftCentral conn…
highperson_alertThreat ActorConnectWise App Identity Compromise Enables M365 Tenant Takeovers
The threat actor behind this campaign remains unattributed. Motivation appears to be espionage or persistent access establishment, evidenced by targeting of policy, national security, trade, and critical mineral sectors in a secondary wave.
highperson_alertThreat ActorCompromised ConnectWise M365 Credential Exposes 173 Tenants
The threat actor behind this campaign remains unattributed. The adversary demonstrated operational sophistication by compromising a Microsoft 365 application credential belonging to ConnectWise Cloud Backup (formerly SkyKick), a cloud-based backup se…
highbug_reportVulnerabilityFortinet FortiOS path traversal flaw exploited to deploy PEERSTITCH malware
Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager vulnerable to CVE-2025-61624 (CVSS 5.4), a path traversal flaw in the command line interpreter. Patched by Fortinet in April 2026.
criticalbug_reportVulnerabilityNextcloud Collabora CODE app RCE exploited in wild since September 10
Collabora Online - Built-in CODE Server (richdocumentscode) versions before 26.4.303, used with Nextcloud. Standalone Collabora Online servers not affected. Nextcloud instances using only richdocuments app (external Collabora server) not affected.
highperson_alertThreat ActorGhostAction Campaign Injects Credential-Stealing Workflows into 340+ Repos
GhostAction is a large-scale supply chain attack campaign first identified in September 2025, focused on compromising GitHub maintainer accounts to inject malicious GitHub Actions workflows.
highperson_alertThreat ActorASOS Data Breach: Social Engineering and Credential Theft Campaign
The threat actor behind this incident identifies themselves as "Xuanye Group." No attribution to known APT groups or established cybercrime syndicates has been made.
highperson_alertThreat ActorMicrosoft X Account Hijacked in Cryptocurrency Pump-and-Dump Scheme
The threat actors behind this incident remain unidentified. Their motivation appears to be financial gain through a cryptocurrency pump-and-dump scheme, leveraging the compromise of Microsoft's official X (formerly Twitter) account with over 13 milli…
criticalbug_reportVulnerabilityCitrix NetScaler CVE-2026-88772 exploited for root access, web shells
Citrix NetScaler ADC and NetScaler Gateway appliances. CVE-2026-88772 (CVSS 9.5) is a memory overflow in DTLS protocol handling in the NetScaler Packet Processing Engine (NSPPE). CVE-2026-88771 also mentioned as exploited.
highbug_reportVulnerabilityMemTensor npm and PyPI packages compromised to deliver sckit credential stealer
MemTensor packages: npm package @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, 0.1.25; PyPI package MemoryOS version 2.0.34 (now quarantined). Malicious Go-based credential stealer targets Windows, Linux, and macOS systems.
highbug_reportVulnerabilityAI coding assistant hijacked to spread Shai-Hulud worm across 100 repos
Unnamed SaaS provider; approximately 100 internal code repositories compromised. Attack vector: AI coding assistant session hijack leading to poisoned PyPI package installation, GitHub OAuth token theft, and Shai-Hulud worm deployment.
highperson_alertThreat Actor3BB Broadband Intrusion: MeshCentral Backdoor Used for Root Access
The threat actor behind this intrusion remains unattributed. The operation targeted 3BB, Thailand's largest broadband provider, with the apparent objective of exfiltrating subscriber credential databases.
criticalbug_reportVulnerabilityBGP hijack delivers malicious Virtualizor updates to VPS management systems
Virtualizor VPS management software (all versions prior to 3.2.9.9) from Softaculous. Attack window: August 28, 2026 20:57 UTC to August 30, 2026 06:10 UTC.
highperson_alertThreat Actor155x surge in password spraying exploits MFA gaps and legacy OAuth flows
The threat actor behind the LSHIY campaign remains unattributed. Motivation appears financially driven, likely focused on credential validation for resale on dark web markets rather than immediate post-compromise exploitation.
criticalperson_alertThreat ActorChina-Nexus APT Exploits VMware vCenter Flaws, Deploys Babuk Ransomware
A suspected China-nexus advanced persistent threat actor, assessed with moderate confidence by QUIRSO to be Chinese-speaking and operating in the UTC+08:00 time zone.
criticalbug_reportVulnerabilityMalicious LiteLLM PyPI packages stole credentials from 2,100+ orgs
LiteLLM versions 1.82.7 and 1.82.8 published on PyPI on March 24, 2026 (10:39-11:19 UTC, treat installs through 16:00 UTC as suspect). Any system that installed these versions or pulled them as transitive dependencies via agent frameworks or orchestr…
criticalbug_reportVulnerabilityNearly 800 malicious npm packages deliver cross-platform RAT via typosquatting
npm registry: ~800 packages using typosquatting and AI-generated names. Targets all Node.js developers on Windows, macOS (x64/ARM64), and Linux (x64/ARM64). Delivers WEL1DROPPER leading to Sliver C2 framework and platform-specific infostealers.
highperson_alertThreat ActorHollowFrame Loader and Matryoshka Backdoor Target Law Firms
The threat actor behind this campaign remains unattributed. The operation demonstrates sophisticated tradecraft, deploying a previously undocumented Go-based loader framework (HollowFrame) and a Rust-based backdoor (Matryoshka) in targeted spear-phis…
highperson_alertThreat ActorFraudulent Sparrow Wallet App on Apple App Store Steals $1.8M in Bitcoin
The threat actor behind this campaign remains unidentified. The operation involved publishing fraudulent cryptocurrency wallet applications on Apple's App Store that impersonated the legitimate Sparrow Wallet.
highperson_alertThreat ActorHermes AI Agent Used for Post-Exploitation at Thai Finance Ministry
The threat actor behind this intrusion remains unattributed. Hunt.io assesses with low-to-medium confidence that the operator is Chinese-speaking or fluent in Chinese, based on linguistic artifacts (password containing "Leishen," meaning thunder god)…
highperson_alertThreat ActorGitHub Actions Abused to Scan and Exploit cPanel/WHM Servers
The threat actor behind this campaign remains unattributed. The operation demonstrates sophisticated understanding of GitHub Actions infrastructure and supply chain attack vectors.
highperson_alertThreat ActorVishing Campaign Targets Microsoft 365 Users with Entra Passkey Scam
The threat actor behind this campaign remains unattributed. The operation demonstrates sophistication in social engineering tactics, specifically targeting Microsoft 365 environments through voice-based phishing (vishing).
highperson_alertThreat ActorMassive SEO-Poisoned Campaign Distributes AsyncRAT via ScreenConnect
The threat actor behind this campaign remains unattributed. Motivation appears to be financially driven, consistent with commodity RAT deployment for access brokering, credential theft, or follow-on ransomware operations.
highperson_alertThreat ActorPre-Planned Fraud Campaign Targets FIFA World Cup 2026 Across Sectors
The threat actor behind this campaign remains unattributed. Motivation appears financially driven, leveraging the global interest in FIFA World Cup 2026 to conduct fraud operations.
criticalbug_reportVulnerabilitySimpleHelp OpenID auth bypass (CVE-2026-48558) exploited in wild
SimpleHelp remote support software, all versions using OpenID Connect authentication. CVE-2026-48558 is a critical authentication bypass (CVSS 10.0) in the OpenID Connect flow.
highperson_alertThreat ActorMalicious Chrome Extension Impersonates Perplexity AI to Intercept Searches
The threat actor behind this campaign remains unattributed. The operation demonstrates a financially or espionage-motivated adversary leveraging social engineering through brand impersonation of Perplexity AI, a popular search technology.
highbug_reportVulnerabilityCisco Catalyst SD-WAN zero-day exploited in wild for two months
Cisco Catalyst SD-WAN Manager. Specific affected versions not disclosed. Requires authenticated local access for exploitation.