Real-time global intelligence

© 2026 OpenWatch. All rights reserved.

Proudly using no third-party tracking

Illustrative, not investment advice. OpenWatch aggregates public signals for research and information only — it is not personalized financial, legal, or tax advice, and nothing here is a recommendation to buy or sell any security.

Platform

Brief
Signals
Cascade
Trajectories
Prediction Markets
Track Record
Forecast Ledger
Play Crowd Prophet
Countries
Companies
Industries
Themes
Rankings
Activity
Compare

Tools

Globe
Analytics
Crises
Clusters
Supply Chain
Alliances
Screener
Watchlist
Portfolio
Status

Sources

View all sources →

1,000+ tracked sources

Signals updated every 15 minutes

Data & Map Attribution

Data providers: GDELT · ACLED · USGS · WHO · SEC EDGAR · HKEX · UK Companies House · Japan EDINET · UN OCHA · Reuters · FRED · IMF · World Bank · OpenStreetMap / Nominatim · GDACS · IODA · Mapbox · Databento.

Maps © Mapbox © OpenStreetMap contributors — map and place-name data licensed under ODbL.

Not investment advice. OpenWatch is provided for informational and entertainment purposes only. While we strive for accuracy, precision, and source attribution in all intelligence assessments, geopolitical analysis involves inherent uncertainty and our conclusions may be incomplete, delayed, or incorrect. Nothing on this platform constitutes financial, investment, legal, or professional advice of any kind. Forward-looking scenarios and probability estimates are analytical hypotheses — not independently validated forecasts. Any actions taken based on information found here are solely your responsibility. Always consult a qualified financial advisor before making investment decisions. Past signal patterns do not guarantee future outcomes.

Methodology
Privacy Policy
Terms of Use

openwatch.io

v·b483583

Search

Congressional trades, bills, prediction markets, hearings, and intelligence signals. Signal search supports: AND OR "exact phrase" -exclude

Keywords

Threat Layer

Military Cyber Economic Disaster Political Criminal Health Supply Chain

Signal Type

Any Crisis Update Resolution

Region

Country

Min. Severity

Any ≥ 3 ≥ 5 ≥ 7 ≥ 9

Date Range

Clear all filters

Sort by

Severity Newest

↓Export CSV (requires API key)

Themes:🧠AI Chip Bottleneck 🛡US Defense Surge ⚓Shipping Lane Fragmentation 🔌Taiwan Semiconductor Risk

740 signals for Cyber+Health+Supply Chain · Mali

Page 1 of 30

CyberCrisis🇺🇸United States 🇲🇱

Mali

63d ago

Researchers at Microsoft Security discovered a major npm supply chain attack that compromised over 90 versions of @redhat-cloud-services packages with credential-stealing malware. The malicious code silently infiltrated CI/CD environments and developer machines, exfiltrating credentials from GitHub, cloud platforms, and local systems before self-replicating by republishing trusted packages.

7.5/10·Microsoft Security Blog

Primary Source ↗Details →

HealthCrisis🇸🇴Somalia 🇪🇹Ethiopia 🇲🇱Mali84d ago

More than 6.5 million Somalis — roughly one in four — are facing acute food insecurity as four consecutive failed rainy seasons devastate harvests and water supplies, while Somalia's 2026 humanitarian response plan sits at just 10.9% funded. The World Food Programme has cut emergency food assistance from 2 million to around 600,000 recipients, over 70 health facilities in Puntland have closed, and MSF says its Baidoa facility is already overwhelmed treating severely malnourished children at the very start of the lean season.

7.0/10·Doctors Without Borders (MSF)·Baidoa, South West

Primary Source ↗Details →

CyberCrisis🇺🇸United States 🇲🇱Mali 🇹🇩Chad60d ago

Mandiant has documented a financially motivated extortion campaign by the threat cluster UNC3753 (also known as Luna Moth, Chatty Spider, or Silent Ransom Group) targeting dozens of U.S. legal, financial, and professional services organizations from January through May 2026. The group uses voice phishing and social engineering to trick employees into enabling remote access via screen-sharing tools and remote monitoring software, then searches for and steals highly sensitive data—including client agreements, tax documents, and personal identifiable information—within hours. After exfiltration, attackers issue aggressive three-day extortion demands threatening to notify employees, clients, and regulators and publish stolen files on the LEAKEDDATA leak site. A notable escalation involves suspected UNC3753 actors conducting in-person intrusions, posing as IT technicians to steal data directly from corporate endpoints using USB storage media.

6.5/10·Mandiant Threat Intelligence

Primary Source ↗Details →

CyberCrisis🇺🇸United States 🇲🇱Mali76d ago

GitHub confirmed that attackers breached 3,800 of its internal repositories by exploiting a malicious version of the Nx Console VS Code extension, which was itself compromised during last week's TanStack npm supply-chain attack.

6.5/10·Bleeping Computer

Primary Source ↗Details →

CyberCrisis🇺🇸United States 🇲🇱Mali76d ago

Microsoft disrupted a malware-signing-as-a-service (MSaaS) operation attributed to threat actor Fox Tempest that exploited Microsoft's Artifact Signing system to deliver ransomware and other malicious code, compromising thousands of machines and networks worldwide.

6.5/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇺🇸United States 🇲🇱Mali76d ago

GitHub confirmed that approximately 3,800 of its internal repositories were breached after an employee installed a malicious Visual Studio Code extension, marking a supply-chain compromise of one of the world's largest code hosting platforms.

6.5/10·Bleeping Computer·San Francisco, California

Primary Source ↗Details →

CyberCrisis🇺🇸United States 🇲🇱Mali106d ago

CISA has issued an alert after attackers compromised two versions of the widely-used Axios npm package on March 31, 2026, injecting a malicious dependency that downloads a remote access trojan — urging developers and organizations to downgrade, rotate credentials, and audit any pipelines that ran the affected versions.

6.5/10·CISA Current Activity·Mali

Primary Source ↗Details →

CyberCrisis🇧🇷Brazil 🇲🇱Mali96d ago

KrebsOnSecurity reported that a Brazilian cybersecurity firm specializing in DDoS protection has been compromised and used to launch botnet-powered distributed denial-of-service attacks against rival network operators in Brazil. The company's CEO attributed the malicious activity to a security breach, claiming a competitor may have infiltrated their systems to damage their reputation.

6.2/10·Krebs on Security·Mali

Primary Source ↗Details →

CyberCrisis🇨🇷CR 🇲🇱Mali 🇴🇲Oman+1yesterday

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info @fastify/rate-limit--@fastify/rate-limit @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in different forms. Applications that use @fastify/rate-limit to protect endpoints such as authentication, password reset, OTP delivery, or expensive API calls can be bypassed by IPv6 clients behind a proxy that surfaces IPv6 to the origin when trustProxy is enabled.

6.1/10·US-CERT Bulletins

Primary Source ↗Details →

HealthCrisis🇲🇱Mali 🇴🇲Oman 🇵🇰Pakistan3d ago

Field teams actively track children under five years of age every three months to closely observe health trajectories and vital events. Expectant mothers within the target areas are systematically registered and followed up with | AKU & CHAMPS programme At first glance, the Changan Karvaan parked outside one of Aga Khan University’s (AKU) field sites in Karachi’s Bhains Colony looks like an ordinary white minivan. Boxy, tinted windows, no markings to set it apart.

6.1/10·Dawn (Pakistan)

Primary Source ↗Details →

Supply ChainCrisis🇶🇦Qatar 🇮🇷Iran 🇲🇱Mali+14d ago

The government on Friday reduced the prices of petrol and high-speed diesel (HSD) by 12 paisas and 66 paisas per litre, respectively. Following the revision, petrol will retail at Rs336.03 per litre, while HSD will cost Rs392.38 per litre. The government continues to levy Rs110 per litre in taxes and duties on petrol and Rs96 per litre on diesel.

6.1/10·Dawn (Pakistan)

Primary Source ↗Details →

CyberUpdate🇵🇰Pakistan 🇮🇳India 🇲🇱Mali11d ago

The government on Friday moved another step towards completing the restructuring of its higher military command initiated under last year’s 27th Constitutional Amendment by appointing Gen Syed Aamer Raza as the country’s first Commander of the National Strategic Command (CNSC), a newly created four-star office that will oversee the operational integration of Pakistan’s strategic forces. Prime Minister Shehbaz Sharif promoted Gen Raza from the rank of lieutenant general and simultaneously appointed him to the new position. The office of Commander NSC was created through the 27th Constitutional Amendment enacted in November last year, which fundamentally altered Pakistan’s higher defence architecture by abolishing the office of the Chairman Joint Chiefs of Staff Committee and creating the new position of chief of defence forces, concurrently held by the chief of army staff.

6.1/10·DAWN Business

Primary Source ↗Details →

CyberCrisis🇮🇳India 🇲🇱Mali23d ago

Jammu:  July 12 : Jammu and Kashmir Chief Minister Omar Abdullah on Sunday said that the Bharatiya Janata Party (BJP) has repeatedly advocated hollow promises of restoring the Statehood of Jammu and Kashmir.  After claims of the BJP attempting to lure one of the Jammu and Kashmir National Conference's (JKNC) MLAs with an offer of Rs 20-30 crore and a ministerial berth to switch sides, he accused the BJP of breaking several political parties, including the Trinamool Congress (TMC), Shiv Sena (UBT), and Aam Aadmi Party (AAP).   While addressing a National Conference rally on the Statehood demand ahead of the 'Delhi Chalo' protest, the J&K Chief Minister called the BJP a "backdoor party", saying that it breaks the ruling parties in States where they fail to secure a majority, using their conflicts as a 'backdoor' to enter the State.  "PM Modi has always promised that Jammu and Kashmir's statehood will be given at the appropriate time. What will be the right time?

6.1/10·Rising Kashmir·Jammu, Jammu and Kashmir

Primary Source ↗Details →

HealthCrisis🇮🇳India 🇲🇱Mali25d ago

DR SAYID ZAMAAN  From Srinagar’s crowded neighbourhoods to once-pristine villages by our lakes and streams, garbage has become a permanent feature of our landscape. What we throw away is coming back to us; in our air, our water, our food, and ultimately, our bodies. This is not just an environmental issue; it is a governance failure, a social challenge, and a test of our collective ethics.

6.1/10·Rising Kashmir·Srinagar, Jammu and Kashmir

Primary Source ↗Details →

CyberCrisis🇯🇵Japan 🇲🇱Mali29d ago

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info @fastify/express--@fastify/express @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms does not match the actual prefixed request path. Applications that use path-scoped middleware for authentication, authorization, rate limiting, or auditing on routes inside a prefixed scope can be bypassed by sending a request to the prefixed route, because Fastify still matches the route but the middleware is skipped.

6.1/10·US-CERT Bulletins

Primary Source ↗Details →

CyberCrisis🇦🇼AW 🇩🇰Denmark 🇲🇱Mali+136d ago

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info abhisheksaha11--URL Preview The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. 2026-06-24 7.2 CVE-2026-12100 adegans--AdRotate Banner Manager The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 5.17.7 via the 'banner' attribute of the adrotate shortcode.

6.1/10·US-CERT Bulletins

Primary Source ↗Details →

HealthCrisis🇵🇸Palestine 🇮🇱Israel 🇲🇱Mali44d ago

I am a doctor in the occupied West Bank. Our hospitals are dying Submitted by Hazim Faisal Abusondos on Sun, 06/21/2026 - 13:01 Cancer patients are being turned away and surgeries postponed as Israel's financial squeeze leaves hospitals without supplies A man transports boxes of medication past an ambulance blocked at the entrance to Turmus Ayya, north of Ramallah in the occupied West Bank, on 6 May 2026 (AFP) Off I am a physician working in the emergency room and oncology ward at Dura Hospital in the occupied West Bank . For the past four years, I have witnessed the slow deterioration of our healthcare system .

6.1/10·Middle East Eye·Ramallah, West Bank

Primary Source ↗Details →

CyberCrisis🇨🇳China 🇨🇦Canada 🇲🇱Mali50d ago

Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting institutions in the North American academic, medical, and military research community. While remaining undetected for over a year, the threat actor compromised externally facing web applications, deployed bespoke malware, pivoted to sensitive internal systems, and abused enterprise administrative tools for covert data exfiltration. The threat actor had broad collection aspirations, including sensitive defense intelligence related to national security, Indo-Pacific command operations, artificial intelligence, uncrewed vehicle systems, cyber offensive programs, and medical research.

6.1/10·Mandiant Threat Intelligence

Primary Source ↗Details →

CyberUpdate🇺🇸United States 🇲🇱Mali54d ago

Introduction Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. The activity was observed between May 27, 2026, and June 9, 2026 and is consistent with the exploitation of CVE-2026-35273 , a critical remote code execution vulnerability (CVSS 9.8) in the Environment Management component. The exploitation of this vulnerability directly aligns with the observed targeting of Environment Management Hub (PSEMHUB) endpoints.

6.1/10·Mandiant Threat Intelligence

Primary Source ↗Details →

CyberCrisis🇨🇺Cuba 🇮🇳India 🇮🇹Italy+357d ago

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info 10Web--Photo Gallery by 10Web Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Gallery by 10Web allows Blind SQL Injection. This issue affects Photo Gallery by 10Web: from n/a through 1.8.41. 2026-06-04 7.6 CVE-2026-49771 AAM Plugin--Advanced Access Manager Authentication Bypass by Spoofing vulnerability in AAM Plugin Advanced Access Manager allows URL Encoding.

6.1/10·US-CERT Bulletins

Primary Source ↗Details →

CyberCrisis🇯🇵Japan 🇲🇱Mali71d ago

Written by: Takahiro Sugiyama, Peter Revelant, Mathew Potaczek Introduction In late 2025, Mandiant responded to a security incident involving a compromised web server running KnowledgeDeliver . KnowledgeDeliver is a Learning Management System (LMS) developed by Digital Knowledge commonly used in Japan. Mandiant identified a critical vulnerability that allowed unauthenticated Remote Code Execution (RCE).

6.1/10·Mandiant Threat Intelligence

Primary Source ↗Details →

CyberCrisis🇲🇱Mali78d ago

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info acl--ACL Analytics ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers to execute arbitrary commands by leveraging the EXECUTE function. Attackers can use bitsadmin to download malicious PowerShell scripts and execute them with system privileges to establish reverse shells and gain complete system control. 2026-05-17 9.8 CVE-2018-25320 ExploitDB-44281 Official Product Homepage Product Reference VulnCheck Advisory: ACL Analytics 11.x - 13.0.0.579 Arbitrary Code Execution   gitbucket--GitBucket GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality.

6.1/10·US-CERT Bulletins·Mali

Primary Source ↗Details →

CyberCrisis🇦🇺Australia 🇲🇱Mali81d ago

Written by: Austin Larsen, Tyler McLellan, Genevieve Stark, Dan Ebreo Introduction Google Threat Intelligence Group (GTIG) has continued to track an expansive extortion campaign by UNC6671, a threat actor operating under the "BlackFile" brand, that targets organizations via sophisticated voice phishing (vishing) and single sign-on (SSO) compromise. By leveraging adversary-in-the-middle (AiTM) techniques to bypass traditional perimeter defenses and multi-factor authentication (MFA), UNC6671 gains deep access to cloud environments. The group primarily targets Microsoft 365 and Okta infrastructure, leveraging Python and PowerShell scripts to programmatically exfiltrate sensitive corporate data for subsequent extortion attempts.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇲🇱Mali103d ago

Written by: JP Glab, Tufail Ahmed, Josh Kelley, Muhammad Umair Introduction Google Threat Intelligence Group (GTIG) identified a multistage intrusion campaign by a newly tracked threat group, UNC6692, that leveraged persistent social engineering, a custom modular malware suite, and deft pivoting inside the victim’s environment to achieve deep network penetration. As with many other intrusions in recent years, UNC6692 relied heavily on impersonating IT helpdesk employees, convincing their victim to accept a Microsoft Teams chat invitation from an account outside their organization. The UNC6692 campaign demonstrates an interesting evolution in tactics, particularly the use of social engineering, custom malware, and a malicious browser extension, playing on the victim’s inherent trust in several different enterprise software providers.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇫🇷France 🇲🇱Mali106d ago

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info Grafana--Pyroscope Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API.

6.1/10·US-CERT Bulletins·Mali

Primary Source ↗Details →