Curated Cyber Threat Intelligence

Threat Feed

Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.

scheduleUpdated 2026-10-28 · 04:17 UTC
articleTotal: 1890 reports

Filtered Reports

10 / 25 results
Active filter:vendor: f5✕ clear
F5 patches critical NGINX RCE flaws in HTTP/3 module and map directivecriticalbug_reportVulnerability
bug_reportVulnerability

F5 patches critical NGINX RCE flaws in HTTP/3 module and map directive

NGINX Open Source, NGINX Plus, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. Three critical CVEs: CVE-2026-15176 and CVE-2026-97205 (ngx_http_v3_module), CVE-2026-93479 (map directive).

F519 Oct · 11:49 UTC
NGINX 1.30.6 and 1.31.7 fix 5 flaws including 3 memory bugs with RCE riskhighbug_reportVulnerability
bug_reportVulnerability

NGINX 1.30.6 and 1.31.7 fix 5 flaws including 3 memory bugs with RCE risk

NGINX versions 0.1.29 to 1.31.6 (varies by CVE). Five vulnerabilities affect specific configurations: CVE-2026-15176 (alias + rewrite, since 0.1.29), CVE-2026-93479 (regex map, 1.30.0+), CVE-2026-97205 (AIO + SSI, 0.8.11+), CVE-2026-95101 (HTTP/3, 1.…

NGINX15 Oct · 10:58 UTC
F5 BIG-IP APM critical RCE (CVE-2026-94127) under active exploitationcriticalbug_reportVulnerability
bug_reportVulnerability

F5 BIG-IP APM critical RCE (CVE-2026-94127) under active exploitation

F5 BIG-IP Access Policy Manager (APM). Specific affected versions not disclosed in available data. Vulnerability enables unauthenticated remote code execution via heap-based buffer overflow (CVSS 9.8).

CVE-2026-9412723 Sep · 13:05 UTC
F5 BIG-IP APM zero-day enables unauthenticated RCE on OAuth serverscriticalbug_reportVulnerability
bug_reportVulnerability

F5 BIG-IP APM zero-day enables unauthenticated RCE on OAuth servers

F5 BIG-IP Access Policy Manager (APM) versions 21.1.0, 17.5.0–17.5.1, and 17.1.0–17.1.3, when configured as OAuth authorization servers with APM access policy and OAuth authorization server profile on the same virtual server.

CVE-2026-9412723 Sep · 06:29 UTC
F5 BIG-IP APM heap overflow (CVE-2026-94127) exploited in the wildcriticalbug_reportVulnerability
bug_reportVulnerability

F5 BIG-IP APM heap overflow (CVE-2026-94127) exploited in the wild

F5 BIG-IP APM versions 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0 when configured with an access policy and OAuth profile on a virtual server. Unauthenticated remote code execution possible.

F522 Sep · 16:52 UTC
Sophos Analyzes Memory-Resident PHP Web Shell in F5 BIG-IP APMhighperson_alertThreat Actor
person_alertThreat Actor

Sophos Analyzes Memory-Resident PHP Web Shell in F5 BIG-IP APM

Sophos is a cybersecurity vendor that published technical analysis on September 7, 2026, examining malware targeting F5 BIG-IP Access Policy Manager (APM) appliances. Sophos is the researcher/defender in this context, not the threat actor.

F59 Sep · 05:36 UTC
Critical NGINX heap overflow enables RCE via crafted HTTP requestscriticalbug_reportVulnerability
bug_reportVulnerability

Critical NGINX heap overflow enables RCE via crafted HTTP requests

NGINX open source versions prior to 1.30.4 and 1.31.3, and NGINX Plus versions prior to 37.0.3.1. All deployments accepting HTTP requests from untrusted networks are at risk.

CVE-2026-4253319 Jul · 18:42 UTC
F5 patches high-severity flaws in NGINX Open Source and Gateway Fabrichighbug_reportVulnerability
bug_reportVulnerability

F5 patches high-severity flaws in NGINX Open Source and Gateway Fabric

NGINX Open Source and NGINX Gateway Fabric (specific versions not provided). Four CVEs: CVE-2026-11311, CVE-2026-42055, CVE-2026-42530, CVE-2026-50107. Affects organizations running NGINX web servers, reverse proxies, API gateways, and Kubernetes ing…

CVE-2026-1131119 Jun · 06:24 UTC
NGINX Open Source RCE via HTTP/3 use-after-free (CVE-2026-42530)criticalbug_reportVulnerability
bug_reportVulnerability

NGINX Open Source RCE via HTTP/3 use-after-free (CVE-2026-42530)

NGINX Open Source versions with ngx_http_v3_module enabled. Specific vulnerable versions not provided in summary. F5 NGINX products potentially affected.

CVE-2026-4253018 Jun · 15:32 UTC
F5 BIG-IP Exploitation Leads to Confluence Compromise and Lateral Movementhighperson_alertThreat Actor
person_alertThreat Actor

F5 BIG-IP Exploitation Leads to Confluence Compromise and Lateral Movement

The threat actor behind this campaign remains unattributed. Motivation appears to be credential theft and network persistence within enterprise environments.

F522 May · 14:53 UTC