Skip to content
Threat Feed
Subscribe

Actor

Red Heron

2 briefs RSS
critical threat

Zyxel GS1900 Series: Unauthenticated Remote Command Execution (CVE-2026-107441)

Zyxel GS1900 series switches are vulnerable to unauthenticated remote code execution due to an out-of-bounds write in the web management interface that persists in previously patched firmware, facilitating credential theft and configuration harvesting by the Red Heron threat actor.

PoC GS1900-24E +15 Red Heron vulnerability network-security rce root-access
3t 2c updated
high threat

WordPress Exploitation and Data Exfiltration by Red Heron Affiliate

An adversary linked to the Red Heron group is exploiting multiple vulnerabilities in WordPress, Ubiquiti, and ZyXEL devices to conduct reconnaissance, gain persistence, and exfiltrate sensitive records, including over 18,000 government documents.

WordPress +2 Red Heron data-theft exfiltration vulnerability-exploitation
1r 2t 5c 3i