~/f4n6 $ adversetrace --feed --since 30d --attributed
// security feed

Security Feed

Curated advisories, threat briefs & field intel — attributed, dated & severity-tagged. Kept deliberately separate from my own writing.

all CVE advisory ransomware DORA / NIS2 APT
26 Oct 2026 Jeff Davies
Brotli RCE CVE-2026-111497 impacts Node.js, Python, Envoy and Istio

1. Executive summary CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, rated CVSS 9.2 CRITICAL, that

→
26 Oct 2026 Jeff Davies
Qilin ransomware group lists German textile firm Hossner-Textil on leak site

1. Executive summary On 2026-10-25 the Qilin ransomware group listed Hossner-Textil GmbH, a German textile manufacturer, as a victim on its

→
25 Oct 2026 Jeff Davies
Ransomware: qilin named ETO (DE)

1. Executive summary The Qilin ransomware group listed ETO, a German victim, on its leak site on 2026-10-25, according to the ransomware.

→
25 Oct 2026 Jeff Davies
LiteLLM supply chain attack delivers RAT and stealer via version 1.107.0

1. Executive summary On 21 October 2026 LiteLLM version 1.107.0 was published to PyPI and Docker Hub carrying a credential stealer and

→
25 Oct 2026 Jeff Davies
Ransomware: qilin named Castle Howard Estate (GB)

1. Executive summary The qilin ransomware group listed Castle Howard Estate, a UK heritage and visitor-attraction operator (castlehoward.co.uk), on its leak

→
24 Oct 2026 Jeff Davies
Emperador ransomware group leaks data from German fuel distributor Frommann Energie

1. Executive summary The ransomware group calling itself emperador listed Frommann Energie GmbH, a German seller and distributor of heating oil, motor fuels and

→
24 Oct 2026 Jeff Davies
Emperador ransomware group publishes data from German logistics firm Phoenix S&S GmbH

1. Executive summary The ransomware group calling itself emperador listed Phoenix S&S GmbH, a Frankfurt am Main company providing building maintenance, construction

→
24 Oct 2026 Jeff Davies
Ransomware: qilin named SLTN Inter Access (NL)

1. Executive summary The qilin ransomware group listed SLTN Inter Access, a Netherlands-based company (sltn.nl), on its leak site on 2026-10-

→
24 Oct 2026 Jeff Davies
Brotli decoder CVE-2026-111497 enables RCE in Bun, Python, and Envoy

1. Executive summary An out-of-bounds write in Google's Brotli decoder (CVE-2026-111497) has been rated CVSS 9.2, critical,

→
24 Oct 2026 Jeff Davies
Autonomous AI agent 'Skynet mode' hijacks exposed models for unattended attacks

1. Executive summary Symantec's Threat Hunter Team captured the full instruction set of an offensive AI agent that hunts for internet-exposed,

→
24 Oct 2026 Jeff Davies
Ransomware: qilin named von Schaewen (DE)

1. Executive summary The qilin ransomware group listed von Schaewen, a German victim, on its leak site on 2026-10-23. The only public

→
24 Oct 2026 Jeff Davies
GlassWorm swaps OVHcloud CLI binaries to steal cloud and AI credentials

1. Executive summary On 19 October 2026, between 12:47 and 14:21 UTC, an attacker using the GitHub account HassenBF replaced the release

→