Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 171 results
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator SQL injection zero-day under active exploit
Arista VeloCloud Orchestrator (VCO) versions before 5.2.3.18, 6.1.3.10, and 6.4.2.12. On-premises deployments affected; Hosted and Dedicated orchestrators already patched. VeloCloud Gateway and Edge devices not affected.
criticalbug_reportVulnerabilityArista VeloCloud Orchestrator SQL injection zero-day under active exploit
Arista VeloCloud Orchestrator (VCO) On-Prem deployments. Patched versions: 5.2.3.18+, 6.1.3.10+, 6.4.2.12+. Hosted VCO instances already patched. Unpatched on-prem deployments remain vulnerable.
highperson_alertThreat ActorAPT28 Breaches NATO Naval Shipbuilders with HOOKEDGE Backdoor
APT28 (also known as Fancy Bear, Forest Blizzard, BlueDelta, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, and Group 74) is a Russian state-sponsored threat actor attributed to Russia's military intelligence service (GRU).
highpublicGeopoliticalBurger King Japan breach exposes 11M records amid rising Japan cyber wave
The Burger King Japan incident is consistent with a broader pattern of cyber intrusions targeting Japanese commercial infrastructure throughout 2026. According to open-source reporting, at least 119 cybersecurity incidents involving personal informat…
criticalbug_reportVulnerabilityBeyondTrust Remote Support zero-day exploited by China APT Armory Castle
BeyondTrust Remote Support (formerly Bomgar) versions 24.3.1 through 26.2.3. Self-hosted deployments exposed to the internet are at highest risk. SaaS customers were patched automatically as of October 9, 2026.
criticalbug_reportVulnerabilityBeyondTrust Remote Support zero-day exploited by China-nexus APT since August
BeyondTrust Remote Support (RS) version 26.2.3 and earlier; Privileged Remote Access (PRA) shares affected code. SaaS customers patched October 8, 2026; self-hosted installations require manual patching if auto-update disabled.
criticalbug_reportVulnerabilityPalo Alto PAN-OS RCE zero-day CVE-2026-0322 exploited in the wild
PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2 on PA-Series and VM-Series firewalls, Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access not affected. Requires authenticated access to management interface.
criticalbug_reportVulnerabilityCisco SEG zero-day CVE-2026-76519 exploited for root command execution
Cisco Secure Email Gateway (SEG) appliances with File Reputation service enabled and Content Scanner Tools version earlier than 25.3.0.5525. Approximately 300 instances exposed online. Cloud instances already mitigated by Cisco.
criticalbug_reportVulnerabilityIvanti Connect Secure zero-day CVE-2026-104935 exploited since Oct 1
Ivanti Connect Secure (ICS) versions prior to 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2. Over 5,600 Internet-exposed ICS hosts identified globally. All unpatched ICS appliances are vulnerable to unauthenticated remote code execution.
highbug_reportVulnerabilityIvanti Connect Secure auth bypass exploited in wild; CISA orders patching
Ivanti Connect Secure (ICS) versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. All organizations running affected ICS VPN appliances are at risk of unauthenticated remote code execution.
criticalbug_reportVulnerabilityIvanti Connect Secure zero-day under active exploitation (RCE)
Ivanti Connect Secure (formerly Pulse Secure) - specific affected versions not disclosed in advisory. Remote code execution vulnerability with no CVE assigned yet.
highbug_reportVulnerabilityMicrosoft patches 1,400+ vulnerabilities; one zero-day exploited in wild
Windows 10, Windows 11, Windows Server (multiple versions), .NET Framework, and other Microsoft software products. Over 1,400 CVEs addressed, including 78 critical-severity flaws.
highbug_reportVulnerabilityMicrosoft patches 1,411 flaws including 1 exploited zero-day bypass
Microsoft Windows (all supported versions), .NET Framework, and MessagePack-CSharp. Notably, Windows 11 24H2 Home/Pro and Windows 10 Enterprise LTSB 2016 reached end of support October 13, 2026.
criticalbug_reportVulnerabilityIvanti Connect Secure zero-day chain enables root RCE; third flaw unpatched
Ivanti Connect Secure VPN appliances before version 25.1.3.0 are affected. Versions 22.7R2.14 and earlier are not affected. Versions 22.8R2.5, 25.1.3.0, and 25.1.3.1 are patched for two of three flaws.
criticalbug_reportVulnerabilityIvanti Connect Secure zero-day CVE-2026-104935 exploited since Oct 3
Ivanti Connect Secure (ICS) versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Over 5,500 ICS instances exposed online. Affects SSL VPN appliances used for remote access to corporate and cloud resources.
highperson_alertThreat ActorFBI arrests Canadian suspect tied to ShinyHunters FBI breach
ShinyHunters is an extortion group specializing in data theft from web applications and cloud-based SaaS platforms, demanding ransom payments under threat of public data leaks.
highperson_alertThreat ActorGermany arrests alleged Qilin ransomware core member after extradition
Qilin is a notorious ransomware-as-a-service (RaaS) operation that emerged in August 2022 under the name Agenda. The group operates a double-extortion model, exfiltrating sensitive data before encrypting victim systems.
highbug_reportVulnerabilityAhsayCBS backup flaws exploited to deploy XMRig miners and web shells
Ahsay AhsayCBS backup utility, all versions including the latest 10.3.4. Two vulnerabilities: CVE-2026-105133 (CVSS v4 5.5, improper authentication) and CVE-2026-105134 (CVSS v4 9.3, OS command injection).
highperson_alertThreat ActorFlax Typhoon Exploits Five KEV Flaws for Initial Access
Flax Typhoon is a China-linked advanced persistent threat (APT) group attributed to conducting cyber espionage operations. The actor is assessed to be affiliated with the Chinese government and has been observed positioning itself within critical inf…
criticalbug_reportVulnerabilityCitrix NetScaler RCE flaw (CVE-2026-107406) requires immediate patching
Citrix NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Provider (IdP) or Service Provider (SP). Vulnerable versions: NetScaler ADC/Gateway 14.1 prior to 14.1-73.46, 13.1 prior to 13.1-64.29; NetScaler ADC 14.1-FIPS prior to…
highbug_reportVulnerability98 zero-days disclosed at Pwn2Own Ireland 2026 across mobile, AI, IoT
Samsung Galaxy S26, Google Pixel 10, OpenAI Codex, Oracle Autonomous AI Database, and unspecified AI infrastructure, messaging apps, smart home devices, printers, and healthcare wellness devices.
highperson_alertThreat ActorU.S. offers $10M reward for HAFNIUM actor Zhang Yu in Exchange attacks
HAFNIUM (also tracked as Silk Typhoon, Operation Exchange Marauder) is a Chinese state-sponsored APT group attributed by Microsoft and the U.S. government to China's Ministry of State Security (MSS).
highperson_alertThreat ActorShinyHunters Leader Detained in Jordan, Cooperating with FBI
ShinyHunters is a prolific data theft and extortion group attributed to multiple high-profile breaches. The suspected leader, a teenager from Amman, Jordan operating under the handle "Rey" (identified as Saif Al-din Khader), was detained by Jordanian…
criticalbug_reportVulnerabilitySonicWall SMA1000 gateways vulnerable to unauthenticated SSRF flaw
SonicWall SMA1000 series appliances: models 6210, 7210, and 8200v. The vulnerability (CVE-2026-102255) affects the Appliance WorkPlace interface. SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected.
highbug_reportVulnerability32 zero-days exploited at Pwn2Own Ireland 2026, Samsung Galaxy S26 hacked
Samsung Galaxy S26, Philips Hue Bridge Pro, Oracle Autonomous AI Database, LiteLLM, Lexmark CX532adwe, Canon imageFORCE 1643F, OpenAI Codex, Sonos Era 300. Multiple zero-day vulnerabilities demonstrated in controlled competition environment.
highbug_reportVulnerabilityCitrix NetScaler zero-day CVE-2026-88779 exploited in SAML attacks
Citrix NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.41, 13.1-64.28, 14.1-FIPS 14.1-73.41, and 13.1-FIPS/13.1-NDcPP 13.1-37.282. Only deployments configured as SAML service provider (SP) or SAML identity provider (IdP) are vulnerable.
criticalbug_reportVulnerabilityCitrix NetScaler SAML zero-day CVE-2026-88779 exploited for DoS, RCE suspected
Citrix NetScaler ADC and NetScaler Gateway appliances with SAML authentication enabled (Gateway or AAA functionality). Vulnerable versions include all releases prior to 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282 (NDcPP/FIPS).
criticalperson_alertThreat ActorWarlock exploits SharePoint flaws to deploy ransomware in Iberia
Warlock (also tracked as Gold Salem, Longlegs, Storm-2603) is a suspected China-linked threat actor that gained prominence in mid-2025 through zero-day exploitation of Microsoft SharePoint vulnerabilities dubbed "ToolShell." The group is attributed b…
criticalbug_reportVulnerabilityFortinet FortiMail zero-day CVE-2026-104286 exploited for file writes
Fortinet FortiMail versions 7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6, and 8.0.0-8.0.1. Unauthenticated remote attackers can write arbitrary files via path traversal and null byte injection flaws in HTTP/HTTPS handlers.
criticalbug_reportVulnerabilityFortinet FortiMail critical RCE (CVE-2026-104286) exploited in the wild
Fortinet FortiMail appliances. Specific affected versions not disclosed in available information. Vulnerability enables remote code execution or command execution on vulnerable devices.