Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1161 results
highbug_reportVulnerabilityMicrosoft distrusts eMudhra CA after weak key compromise
Windows 10 (21H2, 22H2) and Windows 11 (24H2, 25H2, 26H2). Affects systems without automatic Certificate Trust List updates, air-gapped networks, and devices without internet access.
highbug_reportVulnerabilityTailscale SSH flaws enable root escalation; patches due Oct 27
Tailscale v1.104.2 and earlier, headscale v0.29.5 and earlier (self-hosted control server). Affects Tailscale SSH, app connectors, DERP relay client, headscale control server, and tailscale serve features.
highbug_reportVulnerabilityGoAhead web server fails to enforce certificate revocation in mTLS setups
GoAhead embedded web server versions 3.4.5 through 6.1.0 using OpenSSL backend with mutual-TLS and certificate revocation lists configured. Hundreds of millions of devices potentially affected (routers, printers, gateways, industrial controllers from…
highbug_reportVulnerabilityApple patches exploited CoreGraphics flaw in older iPhones and iPads
CVE-2026-86950 affects CoreGraphics in older Apple devices now patched in iOS 18.7.11 and iPadOS 18.7.11 (iPhone XS/XS Max/XR, iPad 7th gen, iPad Air 4th gen+, iPad 9th gen+, iPad mini 6th gen+).
highbug_reportVulnerabilityMicrosoft Authenticator Android flaw let apps steal work account tokens
Microsoft Authenticator for Android versions prior to 6.2606.4246. Affects work accounts signed into the app; personal accounts not impacted. Exploitation requires a malicious app installed on the same Android device.
highbug_reportVulnerabilityAI-generated fake login pages bypass MFA via session hijacking
All organizations using web-based authentication portals. Threat actors leverage generative AI to create convincing phishing pages that capture credentials, MFA codes, and session tokens.
criticalbug_reportVulnerabilityApple backports CoreGraphics zero-day fix to older iPhones and iPads
CVE-2026-86950 affects iPhone XS, iPhone XS Max, iPhone XR, iPad 7th gen, iPad Air 4th gen and later, iPad 9th gen and later, iPad mini 6th gen and later.
highbug_reportVulnerabilityOpenAI compaction flaw bypassed hidden reasoning protections (fixed Oct 23)
OpenAI reasoning models, specifically gpt-5.6-sol confirmed affected. GPT-6 Astra status unknown. Vulnerability exploited the compaction feature to extract encrypted reasoning output as plain text. Fixed server-side by OpenAI on October 23, 2026.
highbug_reportVulnerabilityeMudhra certificate software vulnerabilities require immediate patching
eMudhra certificate software (specific versions not disclosed in advisory). Affects organizations using eMudhra digital certificate solutions for authentication and signing operations.
criticalbug_reportVulnerabilityVMware VeloCloud Orchestrator under active exploit, patch immediately
VMware VeloCloud Orchestrator (VCO). Specific affected versions not disclosed in available information. VeloCloud Orchestrator is VMware's SD-WAN management platform used by enterprises and service providers.
criticalbug_reportVulnerabilityLiteLLM v1.107.0 compromised in supply chain attack
LiteLLM version 1.107.0 is compromised. Organizations that installed or upgraded to this specific release are affected. LiteLLM is a proxy/gateway for LLM API calls used in AI application infrastructure.
highbug_reportVulnerabilityPHP Windows builds ship Brotli RCE flaw exploitable via cURL extension
PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 official Windows packages (pre-rebuild). Affects systems using cURL extension with automatic HTTP response decompression enabled (CURLOPT_ENCODING).
criticalbug_reportVulnerabilityCritical Brotli buffer overflow (CVE-2026-111497) enables RCE in Node.js
Brotli C decoder library versions 1.0.3–1.0.9, 1.1.0, and 1.2.0. Affects Node.js (versions prior to 22.23.4, 24.22.1, 26.12.1), Python HTTP clients (urllib3[brotli], requests, httpx, aiohttp[speedups]), .NET, and any application using vulnerable bund…
criticalbug_reportVulnerabilityCritical Brotli decoder flaw in .NET enables RCE via crafted streams
Microsoft .NET 8, 9, 10, and 11 RC3. Affects applications using ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs.
criticalbug_reportVulnerabilityWasmtime sandbox escape flaws allow malicious WebAssembly code execution
Wasmtime WebAssembly runtime: CVE-2026-115889 affects all architectures in versions before 36.0.19 and 37.0.0–42.x; CVE-2026-115893 affects ARM64/aarch64 only in versions before 36.0.19, 37.0.0–47.x, 48.0.0–48.0.6, and 49.0.0–49.0.3.
criticalbug_reportVulnerabilityPHP2Shell RCE flaws (CVE-2026-109618, CVE-2026-109619) exploited in wild
PHP 8.4.26 and likely earlier versions. Approximately 70% of websites use PHP, with 5.1 million PHP hosts exposed online. Apache mod_php installations confirmed vulnerable. Patches released October 21, 2026.
highbug_reportVulnerabilityMicrosoft 365 AitM campaign compromises 97 accounts via token replay
Microsoft 365 / Entra ID users across 79 organizations. Campaign active July 14 - September 22, 2026. 497 successful sign-ins from 200,000+ attempts originating from 193.26.115.0/24 IP range. 48 rogue Entra devices registered.
criticalbug_reportVulnerabilityCritical RCE in ISC BIND 9 DNS software requires immediate patching
ISC BIND 9 DNS software, specific vulnerable versions not disclosed in available information. Affects organizations running BIND as authoritative or recursive DNS servers.
highbug_reportVulnerabilityAI coding agents tricked into installing malware via planted instruction files
AI coding agents including OpenAI Codex and Anthropic Claude Code. Developers running agents in Downloads folders or untrusted directories. Attack leverages AGENTS.md/CLAUDE.md instruction files to install malicious npm package function-color (part o…
highbug_reportVulnerabilityUnpatched Tailscale SSH flaws enable root escalation via port forwarding
Tailscale version 1.104.2 and headscale version 0.29.5. Affects networks with Tailscale SSH enabled and port forwarding configured. Headscale 0.29.5 cannot disable forwarding, making all SSH grants potentially exploitable.
highbug_reportVulnerabilityMalicious AGENTS.md files hijack AI coding agents via Downloads folder
AI coding agents including OpenAI Codex, Claude Code, and Cursor CLI when launched from ~/Downloads directory. Browsers Chrome, Edge, and Firefox allow silent file downloads to this location.
criticalbug_reportVulnerabilityCritical vulnerabilities in HPE Networking AOS require immediate patching
HPE Networking AOS (ArubaOS-Switch). Specific affected versions not disclosed in available advisory text. Multiple critical-severity vulnerabilities reported by CERT.BE.
highbug_reportVulnerabilityBrotli decoder memory corruption enables RCE in Node.js, Bun, Python, Envoy
Google Brotli C library 1.0.3–1.2.0; Node.js 22.x, 24.x, 26.x (pre-patch); Bun ≤1.4.3; Envoy 1.36–1.39 (if Brotli enabled); Istio 1.29–1.31 (if Brotli enabled); Python Brotli ≤1.2.0 and brotlicffi ≤1.2.0.x; cdxgen ≤13.4.0/12.8.8.
criticalbug_reportVulnerabilityLiteLLM supply chain attack via leaked master key compromised v1.107.0
LiteLLM Python package version 1.107.0 (published October 21, 2026 to PyPI, Docker Hub, and GHCR). Threat actor gained owner-level access to BerriAI GitHub organization via unrevoked master key exposed May 27, 2026.
highbug_reportVulnerabilityAbandoned Popcorn Time fork updater posed botnet risk to 2-3M systems
Time4Popcorn (abandoned Popcorn Time fork): Windows versions ≤6.2.1.18, Mac ≤6.2.1.17, Android ≤3.5.0.173. Updater.exe ran with SYSTEM/root privileges, checked for updates over unencrypted HTTP to abandoned domains.
criticalbug_reportVulnerabilityCISA: Collabora Online and Arista VeloCloud flaws exploited in wild
Collabora Online Built-in CODE Server (richdocumentscode) within NextCloud platform, fixed in version 26.4.303 (September 2026). Arista VeloCloud Orchestrator on-premise versions, fixed in 5.2.3.18, 6.1.3.10, and 6.4.2.12 (October 2026).
highbug_reportVulnerabilityTime4Popcorn updater flaw enabled RCE with elevated privileges
Time4Popcorn app (Popcorn Time fork), all versions with vulnerable updater mechanism. Millions of devices potentially affected. Application is abandoned and no longer maintained.
criticalbug_reportVulnerabilityLiteLLM 1.107.0 supply chain attack steals credentials via Python hooks
LiteLLM version 1.107.0 distributed via PyPI and official container images on October 21, 2026. Affects any Python environment where the compromised package was installed, including developer workstations, CI/CD agents, test systems, containers, and…
criticalbug_reportVulnerabilityRuby patches Onigmo regex RCE flaws exploited via GitLab untrusted input
Ruby versions 4.0.0–4.0.8, 3.4.0–3.4.11, and 3.3.0–3.3.12. Ruby 3.2 and earlier (EOL) will not receive patches. GitLab versions 7.0+ were affected; patched in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13.
highbug_reportVulnerabilityPHP RCE flaw CVE-2026-115560 affects rare configs, no patch yet
PHP installations with non-default session configuration: session.serialize_handler set to php_binary or php_serialize, then switched to php at runtime via ini_set() before session_start(), and session upload progress enabled.