Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
10 / 10 results
highperson_alertThreat ActorCyberXero: AI-Augmented IAB Targets Ukraine with Claude Code
CyberXero is a Russian-speaking, financially motivated initial access broker (IAB) active since at least July 2026. The actor operates a sophisticated dual-pipeline operation: a global automated campaign against WordPress and e-commerce platforms for…
criticalbug_reportVulnerabilityWooCommerce Wholesale Lead Capture flaw exploited for PHP backdoor uploads
WooCommerce Wholesale Lead Capture WordPress plugin, all versions up to and including 2.0.3.1. Approximately 6,000+ active installations. CVE-2026-27540 (CVSS 9.8) - arbitrary file upload due to missing validation in wwlc_file_upload_handler AJAX act…
criticalbug_reportVulnerabilityWooCommerce Wholesale Lead Capture plugin under active exploitation
WooCommerce Wholesale Lead Capture premium plugin for WordPress, versions 2.0.3.1 and older. CVE-2026-27540: unauthenticated arbitrary file upload vulnerability allowing PHP webshell deployment.
highbug_reportVulnerability5,400+ compromised sites deliver ClickFix via BNB Smart Chain contracts
Over 5,400 compromised small-business websites used as distribution infrastructure. Targets are end users visiting these sites. ClickFix social engineering payloads hosted on BNB Smart Chain (BSC) smart contracts to evade takedown.
criticalbug_reportVulnerabilityGiveWP WordPress plugin RCE allows unauthenticated server takeover
GiveWP WordPress donation plugin versions 4.16.6 through 4.16.7.1. Over 100,000 active installations. Exploitation requires legacy donation forms without 'formBuilderSettings' (common in upgraded sites or when using option-based form editor).
highperson_alertThreat ActorStopAndProtect Exploits 2,000 Hacked WordPress Sites for Malware Delivery
StopAndProtect is a global cybercrime operation tracked by Check Point Research since mid-May 2026. The operation is named after a ransomware family discovered during initial investigation.
highperson_alertThreat ActorGitHub Actions Abused to Scan and Exploit cPanel/WHM Servers
The threat actor behind this campaign remains unattributed. The operation demonstrates sophisticated understanding of GitHub Actions infrastructure and supply chain attack vectors.
highbug_reportVulnerabilityGravity SMTP WordPress plugin under active exploit for info disclosure
Gravity SMTP WordPress plugin, affecting approximately 100,000 websites. Specific vulnerable versions not disclosed in available data.
highperson_alertThreat ActorSocGholish Infrastructure Disrupted in Operation Endgame Takedown
SocGholish is a threat actor known for compromising web infrastructure, particularly WordPress-based content management systems, to facilitate malware distribution and drive-by download attacks.
highperson_alertThreat ActorEvil Corp SocGholish botnet dismantled: 15,000 sites, 100+ servers
Evil Corp (also tracked as Indrik Spider, Manatee Tempest, DEV-0243, UNC2165) is a financially motivated cybercrime group linked to Russia. The group has operated since at least 2014 and is known for deploying banking trojans and ransomware variants…