The top cyber threats from the last 24 hours — aggregated from 32 authoritative sources, deduplicated, ranked by priority, and refreshed every 5 minutes.
7 critical and 8 high-severity threats active now.
7 critical and 8 high-severity threats active now.
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP…
PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately. On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of…
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing…
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64,…
Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be…
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was the SDKs' default client, which set no spending limit until…
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the…
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. [...]
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously…
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining…
A critical Signal flaw could keep calls active after hang-up, exposing microphone or camera. Update to a fixed version immediately. A critical vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 of 10), in Signal ’s calling library could allow a…
“Adversaries are clearly spending time (and tokens) on this bug,” researcher says.
PHP maintainers have released fixes for two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who…
Japanese video games giant Capcom confirmed unauthorized access to its online account system
TI News Feed is a live threat intel news feed — a single dashboard that aggregates the world's most authoritative cyber threat intelligence (TI) sources. Track zero-day vulnerabilities, critical CVEs, ransomware campaigns, data breaches and advanced persistent threat (APT) activity from the last 24 hours — automatically deduplicated and ranked by priority, refreshed every 5 minutes. It is the fastest way to stay on top of breaking threat intel without checking dozens of sources by hand.
Severity, recency and source authority combine into a single 0–100 priority score so the most urgent threats rise to the top automatically.
Near-duplicate coverage of the same CVE or breach is collapsed to one representative story — no noise, no repeats.
Only threat activity from the last 24 hours, refreshed every 5 minutes, so the board always reflects the current state of play.
Government CERTs, vendor threat-research teams and the most trusted security newsrooms — all in one console.
Security teams are flooded with cyber threat intelligence from hundreds of sources. The challenge is not access to information — it is signal. TI News Feed solves the noise problem by scoring every story against the signals that drive real-world risk: is the vulnerability being actively exploited in the wild, does it allow unauthenticated remote code execution, is it tied to a known ransomware operator or nation-state actor, and how recently was it disclosed. The result is a clear, continuously updated view of the threats that actually demand attention right now.
Whether you run a security operations center, hunt threats, manage vulnerabilities, or simply want to stay ahead of breaking cybersecurity news, TI News Feed gives you a single pane of glass. The Top Threats column ranks the highest-priority intelligence, while the Latest Intel column delivers a live chronological stream — both filtered to the last 24 hours and free of duplicate reporting. Every item links straight to the original source for full context and verification.
Threat intel — short for threat intelligence (TI) — is curated, evidence-based information about current and emerging cyber threats: newly disclosed vulnerabilities (CVEs), zero-day exploits, ransomware campaigns, data breaches, malware and nation-state (APT) activity. TI News Feed turns that raw threat intel into a single, live, priority-ranked news feed so you can see what matters at a glance.
TI stands for Threat Intelligence. TI News Feed is a free threat intel news feed that aggregates the most authoritative cyber threat intelligence sources, removes duplicate reporting, and ranks every story by priority — refreshed every 5 minutes.
A threat intelligence feed is a continuously updated stream of information about emerging cyber threats — newly disclosed vulnerabilities (CVEs), zero-day exploits, ransomware campaigns, data breaches, malware, and nation-state (APT) activity. TI News Feed aggregates dozens of the most authoritative threat intelligence feeds into a single real-time dashboard so security teams can see what matters without checking every source individually.
Every story is scored from 0 to 100 by blending three signals: severity (weighted keywords such as zero-day, actively exploited, remote code execution, critical, ransomware and supply chain), recency within the last 24 hours, and the authority of the publishing source (CERTs and vendor research teams rank highest). The highest-scoring stories surface in the Top Threats column.
TI News Feed refreshes automatically every 5 minutes. The server re-aggregates all sources on a 5-minute cache, and the dashboard polls for fresh intelligence in the background so you always see threat activity from the last 24 hours without reloading the page.
Yes. The same breach or CVE is often reported by many outlets within minutes. TI News Feed detects near-duplicate stories using canonical-URL matching, shared CVE identifiers and title-similarity analysis, then keeps only the single highest-priority copy so the feed stays clean and signal-dense.
TI News Feed pulls from government CERTs (CISA, NCSC), incident responders (SANS ISC), vendor threat-research teams (Cisco Talos, Palo Alto Unit 42, Microsoft MSRC, Google Project Zero, Check Point, SentinelLabs, ESET) and leading security newsrooms (Krebs on Security, BleepingComputer, The Record, Dark Reading and more).
Yes. TI News Feed is a free, open threat-intelligence dashboard. It links directly to each original source so you can read the full report and verify details first-hand.
32 authoritative cyber threat intelligence feeds — government CERTs, vendor threat-research teams and trusted security newsrooms — aggregated in real time.