Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 41 results
criticalbug_reportVulnerabilityCritical RCE flaws in PHP affect 22.6M+ exposed instances globally
PHP (all widely-deployed versions; specific affected versions not disclosed in advisory). Over 22.6 million exposed instances identified via Cortex Xpanse telemetry. Affects web servers and content management systems globally.
criticalbug_reportVulnerabilityCritical PHP RCE flaws affect 70% of websites, active exploitation
PHP versions 5.4 and later (all versions released in the last decade). Affects approximately 2.58 million Internet-facing hosts and 54.9 million web properties. Impacts sites running Drupal, Magento, Joomla, WordPress, and other PHP-based platforms.
criticalbug_reportVulnerabilityPHP releases emergency patches for critical PHP2Shell RCE flaws
All PHP installations serving web requests: PHP 8.5 below 8.5.12, PHP 8.4 below 8.4.27, PHP 8.3 below 8.3.36, PHP 8.2 below 8.2.35, and all versions back to PHP 5.4.
highperson_alertThreat ActorTeamUpdraft Breach Exposes 400K WordPress Sites to Backdoor Campaign
The threat actor behind this campaign remains unidentified. The actor successfully breached TeamUpdraft's website infrastructure over the weekend of October 17-18, 2026, gaining unauthorized access to customer databases containing UpdraftCentral conn…
criticalbug_reportVulnerabilityRank Math PRO WordPress plugin compromised with self-restoring backdoor
Rank Math PRO (paid WordPress SEO plugin) version 3.0.123 downloaded or auto-updated from rankmath.com between 20:02 UTC October 15 and 07:12 UTC October 16, 2026. Free version on WordPress.org (4M+ installs) not affected.
criticalbug_reportVulnerabilityNGINX heap buffer overflow enables RCE; patch immediately
NGINX Plus and NGINX Open Source (specific vulnerable versions not disclosed in available data). Heap-based buffer overflow vulnerabilities affect both commercial and open source editions.
criticalbug_reportVulnerabilityDrupal patches two critical RCE flaws in all supported versions
All supported versions of Drupal CMS. Specific version numbers and CVE identifiers not provided in available data. Both vulnerabilities enable remote code execution.
highbug_reportVulnerabilityNGINX 1.30.6 and 1.31.7 fix 5 flaws including 3 memory bugs with RCE risk
NGINX versions 0.1.29 to 1.31.6 (varies by CVE). Five vulnerabilities affect specific configurations: CVE-2026-15176 (alias + rewrite, since 0.1.29), CVE-2026-93479 (regex map, 1.30.0+), CVE-2026-97205 (AIO + SSI, 0.8.11+), CVE-2026-95101 (HTTP/3, 1.…
highbug_reportVulnerabilityApache HTTP Server vulnerabilities require immediate patching
Apache HTTP Server - specific versions not provided in advisory. All organizations running Apache HTTP Server should verify their version against latest security bulletins.
highperson_alertThreat ActorLunex MaaS Platform Deploys Psychedelic Stealer via BYOVD Technique
Lunex is a malware-as-a-service (MaaS) platform attributed to Russian-speaking developers or development teams. The platform distributes the Psychedelic Stealer (also known as LunexStealer) to multiple criminal groups, enabling credential theft, cryp…
highbug_reportVulnerabilityRoundcube pre-auth SQL injection CVE-2026-48842 exploited in wild
Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 with virtuser_query plugin enabled. Over 523,000 Roundcube instances exposed to internet; 10 confirmed vulnerable as of September 23, 2026.
criticalbug_reportVulnerabilitycPanel CalDAV flaw allows hosting account holders to execute code as root
cPanel & WHM version 120 and later (CVE-2026-87899, CVE-2026-68490); WP Toolkit 6.11.2-10794 and older (CVE-2026-87900). Affects shared hosting environments where cPanel is deployed. WP Squared also affected.
criticalbug_reportVulnerabilityWordPress Click2Shell and Comment2Shell RCE flaws require immediate patch
WordPress core installations vulnerable to Click2Shell and Comment2Shell remote code execution flaws. Specific affected versions not disclosed in advisory. All unpatched WordPress sites at risk of full compromise.
highbug_reportVulnerabilityAbandoned CDN domain re-registered; thousands of sites still load from it
Thousands of websites, code repositories, and documentation pages with hard-coded references to an expired CDN domain, re-registered in July 2025. The new owner controls wildcard DNS for the entire domain and all traffic to hostnames beneath it.
highbug_reportVulnerabilityAcronis cPanel Backup plugin privilege escalation exploited in wild
Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021 and Acronis Backup extension for Plesk (Linux) before build 1.8.11.638. Affects Linux-based web hosting control panel deployments.
highbug_reportVulnerabilityAcronis cPanel/Plesk backup plugin flaw exploited for Linux privilege escalation
Acronis Backup plugin for cPanel & WHM (builds < 1.9.3.1021) and Acronis Backup extension for Plesk (builds < 1.8.11.638). Affects Linux servers running these backup integrations in web hosting environments.
criticalbug_reportVulnerabilityLiteSpeed Enterprise pre-6.3.7 privilege escalation grants root on shared hosts
LiteSpeed Web Server Enterprise versions before 6.3.7 on shared hosting environments. The vulnerability bypasses isolation controls including CageFS. OpenLiteSpeed status unknown; no matching update released as of September 15.
criticalbug_reportVulnerabilityCritical RCE flaws in cPanel WHM and ConfigServer CSF enable root access
cPanel WHM (Web Host Manager) and ConfigServer Security & Firewall (CSF). Specific vulnerable versions not disclosed in available data. Affects hosting providers and servers using these control panel and firewall management tools.
criticalbug_reportVulnerabilitycPanel SQL injection flaw allows mail users to escalate to root
All supported versions of cPanel and WHM (release lines 11.110, 11.134, 11.136, 11.138, and WP Squared). Fixed in builds 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and 11.138.1.9 (WP Squared).
highbug_reportVulnerabilityTrojanized HAProxy builds intercept traffic at two South Korean orgs
Two South Korean organizations in automotive and media sectors running compromised HAProxy load balancer binaries. The "ted" backdoor is compiled directly into trojanized HAProxy builds, not a vulnerability in legitimate HAProxy software.
criticalbug_reportVulnerabilityAll-in-One WP Migration plugin SQL injection enables site takeover
All-in-One WP Migration and Backup plugin for WordPress, versions through 7.109. Over 5 million active installations, with approximately 3.25 million sites (65%) still running vulnerable versions. Fixed in version 7.110.
highbug_reportVulnerabilityAttackers abuse npm mirrors as free hosting for Cloudflare phishing pages
npm registry and public mirrors (UNPKG, npmmirror). Organizations using these mirrors to serve package content. At least 24 malicious packages identified hosting fake Cloudflare CAPTCHA pages.
highbug_reportVulnerability24 npm packages abuse unpkg mirrors as phishing infrastructure
24 malicious npm packages (e.g., bgzxcuite2, prezdentkxheiw, egair0810) hosted on npm registry and mirrored on unpkg.com and similar CDN services. Affects users who click links to these mirrored HTML pages, not developers installing packages directly…
highbug_reportVulnerabilityXecurify miniOrange SAML plugin flaws exploited for WordPress admin access
Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin, Standard edition versions prior to 17.0.6. CVE-2026-61979 (CVSS 8.1) fixed in 17.0.5; CVE-2026-15981 (CVSS 9.8) fixed in 17.0.6.
criticalbug_reportVulnerabilityminiOrange SAML SSO plugin flaws actively exploited for WordPress admin access
miniOrange SAML 2.0 Single Sign On plugin for WordPress. Vulnerable versions: Free <5.4.5, Premium single-site <13.0.4, Standard single-site <17.06, Premium/Enterprise/All-Inclusive multisite <20.2.8, Enterprise/All-Inclusive single-site <26.0.3, VIP…
criticalbug_reportVulnerabilityCritical sandbox escape in isolated-vm ≤7.0.0 enables RCE on host
isolated-vm library versions ≤7.0.0. Patched in versions 6.2.0 and 7.0.1. Affects Node.js environments using isolated-vm for sandboxing untrusted JavaScript. Package has ~1 million weekly npm downloads.
highbug_reportVulnerabilitySpectre attack on Cloudflare Workers leaks JWT at 12 bits/sec
Cloudflare Workers running on AMD EPYC Zen 2 and Zen 3 processors (Linux). Attack targets V8 isolates within shared Worker processes. Affects multi-tenant serverless environments relying on language-level isolation.
highbug_reportVulnerabilityApache Traffic Server vulnerabilities require immediate patching
Apache Traffic Server - specific versions not disclosed in available advisory. All users running Apache Traffic Server should verify their version against Apache security bulletins.
highbug_reportVulnerabilityNodeBB forum software patches 8 high-severity flaws with public exploits
NodeBB forum software, all versions before 4.14.0. Fixes available in version 4.14.2 and later. Five of eight flaws affect only forums with ActivityPub federation enabled (default in v4 fresh installs, disabled in v3 upgrades).
highbug_reportVulnerabilityAdobe Acrobat Chrome extension flaw exposed WhatsApp Web chats
Adobe Acrobat extension for Chrome versions 26.5.2.1 and below. Affects approximately 329 million browser installations. Exploitation requires victim to visit attacker-controlled webpage while extension is installed and WhatsApp Web is in use.