Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1135 results
highbug_reportVulnerabilityTime4Popcorn updater flaw enabled RCE with elevated privileges
Time4Popcorn app (Popcorn Time fork), all versions with vulnerable updater mechanism. Millions of devices potentially affected. Application is abandoned and no longer maintained.
criticalbug_reportVulnerabilityLiteLLM 1.107.0 supply chain attack steals credentials via Python hooks
LiteLLM version 1.107.0 distributed via PyPI and official container images on October 21, 2026. Affects any Python environment where the compromised package was installed, including developer workstations, CI/CD agents, test systems, containers, and…
criticalbug_reportVulnerabilityRuby patches Onigmo regex RCE flaws exploited via GitLab untrusted input
Ruby versions 4.0.0–4.0.8, 3.4.0–3.4.11, and 3.3.0–3.3.12. Ruby 3.2 and earlier (EOL) will not receive patches. GitLab versions 7.0+ were affected; patched in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13.
highbug_reportVulnerabilityPHP RCE flaw CVE-2026-115560 affects rare configs, no patch yet
PHP installations with non-default session configuration: session.serialize_handler set to php_binary or php_serialize, then switched to php at runtime via ini_set() before session_start(), and session upload progress enabled.
highbug_reportVulnerabilityThreat actor k0t exploits Fortinet and Palo Alto firewalls, exposes 70K creds
Fortinet FortiGate and FortiWeb firewalls, Palo Alto Networks GlobalProtect, PAN-OS, and Prisma Access. Exploited vulnerabilities: CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (PAN-OS/Prisma Access authentication bypass).
criticalbug_reportVulnerabilityHPE patches 8 critical auth bypass and RCE flaws in ArubaOS
Aruba Operating System (ArubaOS) versions AOS-8 and AOS-10, affecting Aruba Networking mobility conductors, access points, controllers, and gateway devices.
highbug_reportVulnerabilityPHP warns of unpatched RCE flaw affecting uncommon configurations
PHP web applications with specific configuration: session.serialize_handler set to php_binary or php_serialize, then changed to php via ini_set() before session_start(), with session upload progress enabled.
highbug_reportVulnerability11 critical flaws in CGM CLININET enable RCE and data theft
CGM CLININET healthcare software: all versions before 2026.MS3 affected by most vulnerabilities. CVE-2025-30049 fixed in 2026.MS1 and 2026.MS3. Multiple vulnerabilities (CVE-2025-30045, CVE-2025-30046, CVE-2025-30052, CVE-2025-30053, CVE-2025-30054,…
criticalbug_reportVulnerabilityPillow library RCE via EPS filename injection; upgrade to 13.0.0 required
Pillow versions 2.6.0 through 12.3.0. Affects Python applications processing EPS images with Ghostscript installed, particularly web upload endpoints that accept user-controlled filenames.
criticalbug_reportVulnerabilityNode.js Brotli RCE (CVE-2026-111497) exploited via crafted compression data
Node.js versions 22.x, 24.x, and 26.x on all architectures. Confirmed RCE on 24.22.0 Linux arm64. Applications decoding untrusted Brotli data via fetch() responses or request body middleware (Express 5.x body parsers, body-parser 2.x) are vulnerable.…
highbug_reportVulnerabilityx402 SDK flaws let malicious APIs drain AI agent wallets, bypass payments
x402 SDKs (TypeScript, Python, Go) prior to August 18, 2024 releases. Specifically: @x402/core, @x402/svm, @x402/extensions, @x402/fetch, @x402/axios versions before 2.23.0 (TypeScript); Python package before 2.25.0; Go module before v2.28.0.
highbug_reportVulnerabilityPHP2Shell RCE flaws exploited to deploy Mirai botnet, attacks unsuccessful
PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) enable unauthenticated remote code execution via crafted HTTP requests.
criticalbug_reportVulnerabilityLiteLLM PyPI and Docker supply chain attack delivers credential stealer
LiteLLM version 1.107.0 on PyPI (all seven .whl packages for Windows, Linux, macOS) and Docker images (v1.107.0, latest, main-latest, main-stable) on Docker Hub and GHCR. Attack window: October 21, 2026, 11:39–14:20 UTC.
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator SQL injection zero-day under active exploit
Arista VeloCloud Orchestrator (VCO) versions before 5.2.3.18, 6.1.3.10, and 6.4.2.12. On-premises deployments affected; Hosted and Dedicated orchestrators already patched. VeloCloud Gateway and Edge devices not affected.
criticalbug_reportVulnerabilityeMudhra CA exits SSL/TLS business after 8 intermediate keys found guessable
eMudhra certificate authority: 8 intermediate CA private keys compromised (6 for TLS). Approximately 30,800 unexpired certificates chained to emSign ECC Root CA - G3, 99.9% issued through InCommon (higher education).
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator SQL injection zero-day under active exploit
Arista VeloCloud Orchestrator (VCO) On-Prem deployments. Patched versions: 5.2.3.18+, 6.1.3.10+, 6.4.2.12+. Hosted VCO instances already patched. Unpatched on-prem deployments remain vulnerable.
criticalbug_reportVulnerabilityeMudhra CA private keys compromised; MitM attacks possible via rogue certs
Eight intermediate Certificate Authority (CA) private keys from eMudhra Limited (Indian CA). Affects any TLS/SSL certificates issued by these compromised intermediates, including public-facing services, VPNs, APIs, and internal infrastructure relying…
criticalbug_reportVulnerabilityTwo 9.0 CVSS RCE flaws in Linux KSMBD disclosed before kernel fixes
Linux KSMBD (kernel SMB server) on all distributions where the module is loaded. ZDI-CAN-33774 affects any KSMBD install on port 445. ZDI-CAN-33549 requires SMB Direct transport with RDMA-capable network hardware or rxe software driver.
criticalbug_reportVulnerabilityGitLab unauthenticated RCE vulnerability requires immediate patching
GitLab (specific versions not disclosed in available information). Vulnerability allows unauthenticated remote code execution. No CVE assigned yet or not publicly disclosed.
highbug_reportVulnerabilityMultiple high-severity vulnerabilities in Node.js require immediate patching
Node.js - specific versions not provided in advisory. All Node.js deployments should be evaluated for patch applicability.
criticalbug_reportVulnerabilityFortinet releases critical security updates across multiple products
Multiple Fortinet products affected. Specific product names, versions, and CVE identifiers not disclosed in available advisory. CERT.BE has issued urgent patching guidance.
highbug_reportVulnerabilityCleanShot X deserialization flaw enables code execution via malicious files
MTW CleanShot X for macOS versions 4.0.0 through 4.5.2. Fixed in versions 4.5.2, 4.6.3, 4.7.8, and 4.8.10. Affects users who open .cleanshot project files from untrusted sources.
highbug_reportVulnerabilityINTERPOL disrupts 10,909 cybercrime networks, arrests 1,462 in 21 countries
Global cybercrime infrastructure across 21 African and international countries. Targeted networks include phishing operations, business email compromise (BEC), investment fraud schemes, illegal cryptocurrency mining, and botnet infrastructure.
highbug_reportVulnerabilityPHP2Shell flaws exploited 4 days before patches; 5.1M hosts exposed
PHP (all versions prior to October 21, 2026 patches). Affects up to 80% of websites including WordPress, Drupal, Joomla. VirusTotal tracks 5.1 million exposed PHP hosts, ~3.8 million with open ports.
criticalbug_reportVulnerabilityCritical PHP vulnerabilities enable remote code execution
PHP (specific versions not disclosed in advisory). All systems running vulnerable PHP installations are affected. CERT.BE issued critical-severity warning for multiple RCE vulnerabilities.
criticalbug_reportVulnerabilityGitLab patches max severity RCE flaw in Regular Expression Compiler
GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Vulnerability tracked as CVE-2026-110264. Over 2,700 GitLab CE instances exposed online.
criticalbug_reportVulnerabilityGitLab CVE-2026-110264: Unauthenticated RCE in CE/EE (CVSS 10.0)
GitLab Community Edition (CE) and Enterprise Edition (EE) versions 7.0 through 19.5.0. Specifically: 7.0–18.11.12, 19.0–19.0.9, 19.1–19.1.8, 19.2–19.2.8, 19.3–19.3.5, 19.4–19.4.2, and 19.5.0.
highbug_reportVulnerabilityOpenCode AI agent flaw allows MCP server code execution on Windows/WSL
OpenCode AI coding agent versions 1.0.137 through 1.18.32 on Windows and Windows Subsystem for Linux (WSL). macOS and Linux are not affected. Fixed in version 1.18.33 released September 28, 2024.
criticalbug_reportVulnerabilityLiteLLM supply chain attack: malicious v1.107.0 steals credentials via PyPI
LiteLLM Python package v1.107.0 on PyPI (Oct 21, 2026, 11:39-13:23 UTC) and Docker images v1.107.0, latest, main-latest, main-stable on Docker Hub and GHCR (11:46-14:20 UTC).
highbug_reportVulnerabilityOperation Serengeti III disrupts 10,909 networks, arrests 1,462 in Africa
Cybercriminal infrastructure across 21 African countries, including business email compromise operations, ransomware networks, phishing infrastructure, fraudulent mobile lending apps, illegal cryptocurrency mining operations, and online investment sc…