Global Threat Intelligence
Threat Intelligence Feed
Live-sourced cyber threat news, vulnerability alerts, and active malware tracking, updated daily from open-source intelligence.
Last updated: 09:02 AM
Current Threat Landscape
As of November 4, 2026, the global cyber threat landscape is defined by the rapid integration of AI and automation, which has compressed the time-to-exploit for new vulnerabilities from days to mere hours [9]. Notable threat actors, including the China-linked VAPOR PANDA and North Korean groups, are actively leveraging AI-enabled frameworks and language models to enhance reconnaissance, social engineering, and endpoint security evasion [1, 2, 3]. Public administration, government, and research sectors remain the most at-risk, frequently targeted by a combination of ransomware, credential theft, and ideologically driven DDoS attacks [6, 8].
Recent Cyberattacks & Breaches
5 itemsEuropean Supermarket Refrigeration Cyberattacks
criticalCoordinated cyberattacks targeted internet-connected refrigeration and freezer systems across at least 10 European countries, including Sweden, Belgium, and Ireland. Attackers remotely manipulated temperature settings, forcing supermarkets to discard large quantities of spoiled food.
Chainstack Production Systems Breach
criticalBlockchain infrastructure provider Chainstack disclosed a security breach where an unauthorized party gained access to parts of its infrastructure. The incident is linked to a large-scale, AI-powered attack campaign that resulted in the exposure of customer data and password hashes.
DHS Employee Data Leak
criticalSensitive data belonging to over 41,000 employees and contractors of the U.S. Department of Homeland Security was leaked online. The incident has raised concerns regarding the security of government personnel information.
Poryadok Retail Cyberattack
highRussian home goods retailer Poryadok suffered a cyberattack that forced the company to suspend operations across multiple stores and its online platform for five days. The incident left customers unable to access loyalty accounts or contact support services.
Northflank Security Breach
highCloud platform Northflank suffered a security breach that led to the unauthorized use of customer AI API keys. The company has urged all users to rotate their credentials and secrets to prevent potential data theft or unauthorized actions.
Vulnerability Alerts & CVEs
5 itemsWordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
highThis vulnerability in WordPress Core involves a race condition that can be exploited by malicious actors. It was added to the CISA KEV catalog due to evidence of active exploitation in the wild.
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
criticalThis vulnerability allows a local authenticated attacker to escalate privileges on affected Ivanti Connect Secure appliances. It has been actively exploited in the wild as part of an attack chain.
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
mediumThis vulnerability allows a remote authenticated attacker to upload attacker-controlled content to a known location on disk. It is part of an exploit chain used in active attacks against Ivanti devices.
GitLab Community and Enterprise Edition Integer Overflow or Wraparound Vulnerability
criticalThis vulnerability in GitLab allows for an integer overflow or wraparound, which can be leveraged by attackers. CISA added this to the KEV catalog following confirmation of active exploitation.
Cisco Secure Firewall ASA and FTD Software Unchecked Return Value to NULL Pointer Dereference
criticalThis vulnerability in Cisco Secure Firewall software can lead to a denial of service condition. It has been identified as being actively exploited in the wild.
Active Malware & Threat Campaigns
5 itemsMirai
A persistent botnet that continues to see significant growth in activity, primarily targeting IoT devices. It is frequently used for large-scale distributed denial-of-service attacks and has seen a 133% increase in sample volume recently.
Agent Tesla
A long-running .NET-based keylogger and infostealer typically distributed via phishing campaigns. It remains highly active, focusing on exfiltrating browser credentials, session cookies, and other sensitive user data.
Formbook
An information stealer that has seen a sharp rise in activity, often delivered through malicious email attachments. It is designed to harvest credentials from various web browsers and applications.
AsyncRAT
An open-source remote access trojan that provides attackers with full control over compromised systems. Its ease of use and extensibility have made it a staple tool for threat actors conducting espionage and data theft.
VOLTA
A newly identified infostealer that integrates generative AI to analyze stolen data and rank victims by financial value. This allows attackers to prioritize high-value targets for subsequent ransomware or extortion attacks.