Every exploited bug, supply-chain attack, breach and AI tooling flaw we track, newest first. Subscribe with RSS.
Checked against the reporting. Headlines link to the outlets that broke them.
The microfinance NBFC disclosed on 2 Nov 2026 that about Rs 7.8 crore was transferred from one of its bank accounts to multiple beneficiary accounts on 1...
The City of Cholet’s notice (updated 1 Nov 2026) says the telephone service “is now operational again” after “the disruption caused by the cyberattack it...
In the early hours of Saturday 31 Oct the club’s official site showed a fabricated note announcing the signing of Lionel Messi.
huntress.com: Camera management software compromise malware. Tracked with its indicators in EncryptLayer intelligence.
AIR Research Lab discovered malware in the wild that targets AI agents creating crypto wallets. A GitHub repository posing as a Solana starter kit, which ranks as the top result when an agent...
A banner on Floin’s own homepage says “Our platform has been the target of a cyberattack” and that the app and web platform “are offline until further...
Capillary (Bengaluru SaaS, NSE: CAPILLARY) told the exchanges that four payments totalling EUR 3,041,169.90 were made from SessionM Czech Republic s.r.o.
The Vaud state said its Direction generale de l’enseignement postobligatoire detected unauthorized access on 26 Oct to the IT support platform used by...
Salzburg24 reported on 31 Oct that 97 accommodation businesses in 12 Salzburg tourism associations were compromised after attacks on interfaces of tourism...
Nine AI developer platforms disclosed breaches in October 2026. Stolen keys from stored secrets drove about 2.5M Bedrock calls. Revoke, then rotate.
On 29 Oct 2026 attackers got Binance’s hot-wallet signing systems to sign withdrawals on ten chains, taking about $6.3B, reportedly via a DevOps laptop.
The Dehradun pharma contract manufacturer told the exchanges it experienced a cyber security incident on 30 Oct 2026 with no material impact on core...
Revolve’s 8-K says it “recently became aware of unauthorized access to certain of its systems” and an actor “may have obtained” the name, contact...
Charite said attackers breached the web server hosting its website and contact forms.
Chainalysis says it detected “an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems” in October.
The bank said on 30 Oct it is “investigating a potential data leak involving a software-as-a-service (SaaS) platform” managed and hosted by Salesforce that...
TechCrunch reported that a database password embedded in Applebee’s mobile app allowed access to the customer database, exposing names, email addresses...
An unpatched rlottie bug can run code in Telegram, and an Android voice-call flaw hit 8.6.2 to 12.10.3. Update Android to 12.10.4 and limit who can call.
31 fake Qwen2 test models on Hugging Face ran a GPU miner and backdoors when loaded with trust_remote_code. Check hosts for /tmp/.cch and rotate keys.
Hidden shell commands in GitHub issues, PRs and comments hit 61 repos, including Trivy and MLflow. Find workflows that put issue text into run steps.
Fake Claude Code 2.1.312 and 2.1.313 on Cursor’s marketplace added an attacker SSH key and reverse tunnel. Check authorized_keys for svc-telemetry.
Chrome 156 updates on 27 and 29 October fixed 73 security bugs, five Critical, most found by Anthropic with Claude. Update to 156.0.8078.79 or later.
One crafted WAP push SMS crashes com.android.phone on Android 12 to 16, dropping calls. Install the October 2026 patch; Android 12 and 13 get no fix.
NDR (29 Oct) reports, citing university spokeswoman Kristin Noeltig, that not the whole IT but the account of one student was affected, giving the...
The university said it learned of the incident on 28 Oct 2026 and that on 29 Oct all IT services and websites remained offline.
DysruptionHub, citing a 29 Oct 2026 town update, reported that officials “investigated a potential cybersecurity breach” and moved to “shut down and...
The US Justice Department announced a 42-month sentence for Ahmad Umar Agha (“Th3Pr0”), who DOJ says hijacked the Associated Press Twitter account on 23...
WKMG News 6 reported on 29 Oct 2026 that “The Seminole County Clerk of Court is dealing with a cyberattack that has knocked its website and phone systems...
Yet Another ClickFix Campaign, Author: Brad Duncan
Group-IB uncovers MadApe, a previously undocumented Microsoft Device Code phishing kit that uses business-themed PDF lures, configurable redirects and fake document-sharing pages to trick victims...
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.”
29 Oct 2026. Polymarket put its international platform into cancel-only mode after users reported unauthorized withdrawals.
Kaspersky found one victim in Asia running a “specially customized government-only version” of Windows; it infers Asian government targets.
The Globe and Mail reported that McCarthy Tetrault said “an unauthorized third party gained access to certain files” including information relating to...
Per Belga (via Numerikare), ITG said an unauthorized third party gained access in mid-October to a database of “an application used for certain care...
The Investigatory Powers Commissioner’s annual report for 2025 says GCHQ cannot immediately locate a “very significant number” of removable media items...
FLDOE warned that data of nearly five million people, including Social Security numbers, “may have been compromised” after unauthorized access to its...
Egypt’s Ministry of Interior said security monitoring detected a breach of a digital advertising screen on a road in Giza that broadcast unauthorized footage.
Microsoft (21 Oct): China state-aligned Storm-0940 used ARTEX, an open-source multi-agent pentest framework, and Microsoft “assesses” it was responsible...
Travel trade outlet fvw reports (29 Oct) that hackers stole “numerous customer records” from the Arosa hotel chain, which belongs to the Dertour group and...
Full core updates in WordPress 4.7 to 7.1.3 open a brief unauthenticated RCE window. Update to 7.1.4 or your branch’s fix and block wp-content/upgrade.
PHP2Shell is exploited against PAN-OS and Panorama with management exposed to the internet. Apply your train’s hotfix and take management off the internet.
GitHub published 112 malware advisories for 106 npm and PyPI packages from 26 to 28 Oct 2026: miners, stealers, beacons. Grep lockfiles for the named packages.
LXD and MicroCloud accepted a trusted public certificate anywhere in a client’s chain, enabling impersonation. Refresh to LXD 6.10.1, 5.21.9, 5.0.11 or 4.0.15.
An exploited access bypass in Drupal Commerce Core can cost store owners money. Update to Commerce 3.3.13 or 8.x-2.41 and audit recent orders.
An exploited flaw lets anyone reload Cisco ASA or FTD firewalls running SSL VPN with secondary auth. Upgrade to a fixed release or remove secondary auth.
A public ChatGPT share link could run attacker JavaScript as chatgpt.com and read private chats. OpenAI fixed it on 26 Oct; MathLive users should update.
DDoSecrets published data on more than 41,000 DHS employees and contractors (names, emails, phone numbers, job titles and group memberships across ICE...
Cisco Talos describes UAT-11473 exploiting CVE-2026-20127 (SD-WAN controller peering auth bypass, Feb 2026) and implanting KeyDrift on controllers to steal...
Per Infosecurity Magazine (29 Oct 2026), the ICO issued a reprimand on 28 Oct after the force served a Domestic Violence Protection Notice on the alleged...
Guest names, contact details and booking information were stolen in a hack of booking provider RMS, per ABC.
Lumma Stealer v6 hides in a 900 MB screensaver delivered through a fake TV torrent. We trace its loader, C2 infrastructure, and clipboard and screenshot theft.
Atos Researchers identified a new variant of popular ClickFix technique, where attackers convince the user to execute a malicious command on their own device through the Win + R shortcut. In this...
The Daily Star (Oneonta), republished by GovTech on 28 Oct 2026, reported “last week’s ransomware attack” on the district, which “canceled classes Friday...
CloudSEK describes MR ROBOT as a multi-tenant Android crimeware platform.
MVSU says “the recent cyber incident affecting our website hosting provider” disrupted its website, and “some portions of the website may require...
The company said a third party gained unauthorized access to the management system of the Matsuya official app (Matsuben Net, Mobile Order, Matsuben...
Per Medical Dialogues, the hospital management information system stopped working around 3 am on 18 Oct.
The Chennai banking-software vendor said an employee’s email account at its Canadian subsidiary was compromised and used to send fake payment instructions...
Car Dealership Guy News reported that Honda and Acura’s Interactive Network (iN) dealer portal was taken offline on 27 Oct after a cybersecurity incident.
Daishin Securities said personal and credit information of 38,490 customers leaked, covering eight items.
Per Clubic, CTS announced on 28 Oct that about 230,000 customer accounts (nearly 40% of accounts) were affected.
Bithumb said an outside party hacked its internal mobile groupware for about an hour on the morning of 27 Oct.
FPS Finance took MyMinfin and other services offline as a precaution after a cyberattack announced on 28 Oct.
WDTV reported on 28 Oct 2026, citing a release from Superintendent Eddie Vincent, that the district “is investigating a potential cybersecurity incident”...
Google GTIG / Mandiant (16 Oct): CVE-2026-102764, an unauthenticated arbitrary file upload in BeyondTrust Remote Support up to 26.2.3, exploited as a...
Amadeus said on 1 Oct 2026 it had found a vulnerability in its “travel booking display environment” that could expose traveler data, and that no payment...
Warp says an attack on an unnamed vendor exposed agent traces and telemetry for about 1% of users. Rotate any secret that passed through a Warp agent session.
Flaws in TeamViewer’s screen decoder let a malicious host attack the viewer, plus a macOS root bug. Update clients to 15.83 or the fixed legacy builds.
An unauthenticated SQL injection in EBS 12.2.3 to 12.2.15 leads to OS command execution, and decoys saw exploit attempts. Apply the October 2026 CPU.
PolyShell lets attackers upload code to Magento and Adobe Commerce stores and is in CISA KEV. Install the -2026-jul builds, then check CMS blocks and pub/media.
A race in Linux’s IPv4 TCP handshake, present since 4.4, allows remote code execution. Install a fixed kernel or drop IPv4 packets carrying IP options.
Firefox 159 fixes 167 CVEs, with three sandbox escapes and a same-origin bypass. Update Firefox, ESR 153.6 or 115.44, and Thunderbird 159 or 153.6.
An incident at analytics vendor Amplitude exposed contact and some transaction data of Coinbase customers. Coinbase says its systems and funds were not hit.
Eight critical flaws in Campaign Classic 7.4.4 build 9402 and earlier allow code execution and SQL injection. Upgrade to build 9403 and update Connect clients.
HIPAA Journal reports unauthorized access to an employee’s email account was identified on or around 4 May 2026.
Warhorse (Prague) disclosed on 27 Oct that an attacker gained “unauthorized access to company systems and data”.
The FBI seized virtualine.net, a Russian-speaking bulletproof host (aliases Secury, Massgod, Spamhouse, Lanedo, Omegatech) that advertised ignoring abuse...
Vanden Broele’s FAQ says an external attacker accessed eSignFlow data from 22 Oct 03:48 to 23 Oct 11:17, affecting “a large part of the organisations that...
The FEC’s electronic filing system went offline around 22:00 ET on 26 Oct 2026, a week before the 3 Nov midterms.
UNM HSC said IT teams identified the threat around 11:00 on Mon 26 Oct 2026.
Per watson (citing SDA), an unauthorized person used the login credentials of a MySIHF user between 17 and 19 Oct to pull personal data from the...
Sony said the So-net member database “was accessed by an unauthorized party” on 19 Oct 2026, detected four days later.
Zscaler Threat Hunting examines an SEO poisoning campaign using fake Chocolatey & MAS sites to deploy Armorsteal malware.
Four months after Operation Endgame took it down, StealC
trellix.com: Trellix: Unveiling Sirius Backdoor. Tracked with its indicators in EncryptLayer intelligence.
Key Points Introduction Over the past two months, we have been tracking a campaign that abuses the popularity of AI tools such as ChatGPT and Claude to spread a custom malware chain we call Yoba....
HIPAA Journal (27 Oct 2026) reports Paylogix told HHS OCR that PHI of 41,739 people was involved.
WSYX reported on 27 Oct 2026 that “An overseas cyberattack targeted the Ohio Auditor of State’s Office web server on Sunday”.
The Privacy Commissioner of Canada announced on 27 Oct an investigation into Navigate360, which runs the tip management platform used by Canadian Crime...
The municipality detected a “presunto incidente de seguridad” that breached its official digital platforms after a suspected attack on its servers.
GMO detected the intrusion on 20 Oct and told customers to disconnect and shut down their PCs; up to 26,739 customer servers could have had malware installed.
The ERV said in its own magazine (27 Oct) that it was the victim of a cyberattack on part of its IT infrastructure and that its IT is currently switched...
The welfare umbrella association told dpa (via n-tv, 27 Oct) that unknown attackers stole data, in part sensitive data such as bank details, and that...
Sansec found that attackers modified the Plausible analytics tracker served from a self-managed Convertr server.
Per HIPAA Journal, the practice told HHS OCR that PHI of 5,461 people was involved after suspicious activity was found on its website on 27 Jul 2026.
Pfaeffikon24 reported, citing the municipality of Bauma, that the Baumerziitig website has been unreachable since Monday 26 Oct and “moeglicherweise Opfer...
TrendAI (formerly Trend Micro enterprise) describes three cases.
Tailscale SSH forwarding and Serve Unix-socket backends ran as root, so an allowed session could take over a node. Update every node to Tailscale 1.104.4.
An ExifTool argument injection in Gotenberg before 8.31.0 gives unauthenticated command execution and is being exploited. Update and keep the API private.
GoAhead up to 6.1.0 ignores its CRL, so revoked mTLS client certificates still log in. Rebuild firmware with GoAhead 6.1.1; device owners need vendor updates.
Docker Desktop 4.39.0 to 4.96.x could log third-party API keys and OAuth tokens in cleartext. Update to 4.97.0 and delete old diagnostics bundles.
Apple’s 26 October updates fix 163 CVEs in iOS 27.2, including WebKit code execution and a sandbox escape. Update iOS, macOS, Safari and older-device builds.
SONIMUNDUS reports WS Audiology informed the public on 26 Oct that unauthorized parties accessed its CRM environment and certain operational IT systems.
Per Telangana Today, the TG-iPASS portal has been disrupted since 22 Oct after a suspected ransomware attack.
Per ABC, confidential information about pregnant women, including names, ID numbers and medical conditions, was posted to an Instagram account with about...
The company’s notice says unusual activity was detected on Friday 9 Oct 2026, unauthorized third parties temporarily accessed parts of its IT, and “die...
The Ahmedabad pump maker said fraudulent instructions from someone impersonating the Managing Director reached the Company Secretary, and Rs 80,00,000 was...
HIPAA Journal reports a staff member uploaded a spreadsheet with limited data on 3,182 patients (names, admission/treatment dates, departments, account and...
Per HIPAA Journal, the plan notified 238,083 current and former members after being told on 14 Aug 2026 that an access key used by its AI/ML analytics...
Between 27 Aug and 9 Sep 2026, 155 responses from @cf/zai-org/glm-5.3 contained data from other customers’ recent requests to the same model, all for...
26 Oct 2026. Bloom said about 9,408 SOL (about USD 947K) was taken from 49 wallets belonging to nine users.
Microsoft re-fixed two October .NET flaws and a Linux tarball privilege bug. Install .NET 8.0.33, 9.0.22 or 10.0.14, then rebuild self-contained apps.
Per techkrams.de, Plenitude On The Road told customers that unknown external persons accessed the customer database without authorization between 19 and 20...
The Hindu reported (Sunday 25 Oct) that shooting scripts, CBFC cut lists and distribution agreements (some with payment amounts not fully redacted) for...
HomeToGo said in an ad hoc disclosure (24 Oct, 23:44) that its subsidiary SECRA Bookings GmbH, a channel management software provider, was the target of a...
How Android Intrusion Logging and Delegated Scope give defenders OS-level evidence, and how Zimperium MTD used these logs to expose RatHat malware.
On the night of 22 Oct 2026 a number of state digital public services were targeted with about 11 million access requests aimed at unlawfully obtaining...
Per Lusa (via Sabado), an ANEPC internal communication says the RNBP database “was the target of a cyberattack” and a copy of personal data was made.
Per FuitesInfos, the police union’s letter to members refers to “a computer security incident that led to unauthorized access to some of their personal data”.
A new PHP session upload progress RCE needs an unusual setup and has no fix yet. Set session.upload_progress.enabled=0; Windows users install the -1 builds.
An unauthenticated command injection in Nextcloud’s Built-in CODE Server app is used to drop web shells. Update richdocumentscode to 26.4.303 or remove it.
HIPAA Journal reports the practice told HHS OCR that about 12,000 people were affected after an unauthorized party “gained access to a workstation and an...
UCPH confirmed on 23 Oct an attack on a test environment detected 21 Oct (Help Net Security says 20 Oct).
UH said “On Thursday, Oct. 22, 2026, we detected unusual activity on University Hospitals servers” and disconnected its systems from the internet.
Per HIPAA Journal, UltraMobile Imaging said PHI of 75,000 people was exposed after a network disruption on 30 Jul 2026 and confirmed unauthorized access...
Per drohnen.de, TCS published a notice on 23 Oct 2026 (updated 26 Oct) that an external reservation software provider, reported by SRF, Blick and Watson to...
The ThreatLocker MDR team intercepted a ClickFix attack which attempted to implement an active C2 framework and subscribe to a platform titled “ChimeraC2”.
Sekoia’s TDR team ran a decoy Flowise server to study attacks on GenAI platforms. One threat actor stole its credentials and tried to misuse its AI agent.
LiteLLM has been hijacked again: malicious `litellm` 1.107.0 wheels contain an interpreter-startup credential stealer and an hourly remote-code loader absent from the source distribution.
Group-IB and NyxLab expose threat actor k0t’s large-scale campaign exploiting FortiGate, FortiWeb, and Palo Alto GlobalProtect edge devices to harvest credentials, establish persistent access and...
Key Points Introduction Infostealers commonly target browser passwords, session cookies, and cryptocurrency wallets. This malware combines those established capabilities with dedicated collection...
PwC confirmed an incident at a third-party vendor site holding employee learning records, after the Everest group claimed 590 GB on 22 Oct.
File-encrypting malware took the provider’s server infrastructure offline, blocking payments and administrative procedures in municipalities including La...
ENGIE notified French customers that data was taken from a tool its sales partners use for prospecting.
Per HIPAA Journal, billing vendor Express Billing Systems found unauthorized network access on 24 Aug 2026 and files with names, addresses, phone numbers...
HIPAA Journal reports the practice told HHS OCR that 3,735 people were affected after unauthorized access between 14 and 21 Jun 2026 exposed names...
In a TSE disclosure, and ST HD said that from about 7:30 am on 22 Oct an outside party made “login attempts, intrusion and data extraction” against several...
MCP servers and clients had 2026 flaws giving RCE or OAuth credential theft. Update mcp-atlassian to 0.17.0, mcp to 1.30.0 or 2.2.0, and OpenCode to 1.18.33.
An EDK II PXE driver overflow can run code before the OS and Secure Boot. No stable fix yet: disable PXE where unused and isolate boot networks.
Capcom says attackers reached CAPCOM ID data for 11,774,247 accounts on 19 Oct 2026 and hijacked 196 of them; 19 e-Capcom profiles were viewed. No card data.
Any authenticated user of on-prem VeloCloud Orchestrator can become superuser operator; Arista says it is exploited. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12.
Attackers now run AI agents that find zero-days, move through networks and steal AI keys. Treat AI keys and agent configs as production secrets.
Per Korea JoongAng Daily, personal information of around 10,000 students and graduates leaked, including student ID numbers, mobile numbers and email...
re:think P2P reports TWINO was hit by a cyberattack on 15 and 16 October, detected on 16 October, in which unauthorized individuals accessed a limited...
New research from Semperis reveals the Prince of Persia APT group’s latest activities, including new strategies and indicators of compromise.
Quest’s Form 8-K says it learned on 21 Oct 2026 of “unauthorized access to its Quanum LSM system”, which certain clients use to place test orders and...
Per HIPAA Journal, an unauthorized party accessed the network between 28 and 30 Apr 2026.
Huntress: between 14 Jul and 22 Sep 2026 an actor captured tokens via adversary-in-the-middle phishing (plus device-code phishing) and replayed them.
FFTir’s notice says that in the week of 12 Oct 2026 it suffered “a new, prepared attack”.
CVUT said on Facebook it “v soucasnosti resi kyberneticky utok na svou IT infrastrukturu” (is dealing with a cyberattack on its IT infrastructure), that...
CIAD-2026-0047 (14 Oct) says CVE-2026-96951, a Windows Shell command-injection flaw that bypasses security features when a user opens a crafted file, “is...
BASS’s notice dated 22 Oct 2026 (filed with the California AG) says it discovered suspicious network activity on or around 4 Sep 2026 and on or about 22...
The Bengaluru broadcast-cloud company disclosed that a threat actor claims to hold operational and network configuration data for some of its systems and...
The mayor’s office said its finances suffered a “millonario ataque cibernetico” through a series of unauthorized electronic transfers from institutional...
Two PHP engine flaws allow unauthenticated code execution on WordPress, Drupal and Joomla. Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten CVEs, including a Brotli decoder flaw now on CISA’s exploited list and three TLS certificate checks.
Attackers with stolen gh CLI tokens shipped malware as LiteLLM 1.107.0 on PyPI, Docker Hub and GHCR. Check before running Python, then rebuild and rotate.
Two CVSS 10 regex flaws give unauthenticated code execution on self-managed GitLab; one is exploited. Upgrade to 19.5.1, 19.4.3, 19.3.6 or a 21 Oct backport.
Fortinet shipped critical and high-severity fixes found by AI-assisted testing; details come on 10 November. Upgrade internet-facing FortiGates first.
TAKKT said in an ad hoc notice (21 Oct, 16:26) that it was the target of a cyberattack on parts of its IT systems in its Industrial & Packaging business in...
Supercell said it was hit by several cyber attacks “last week”.
SBI said that during preliminary analysis of about 375,000 records available on the dark web, 3,897 customer records containing PII were identified...
WTVR reported that district leaders “detected suspicious activity on the RPS network” and Superintendent Jason Kamras said the incident is “disrupting...
sophos.com: Sophos: BRONZE SANDCASTLE modified Meterpreter. Tracked with its indicators in EncryptLayer intelligence.
Russian group stole credentials and tunneled into the network during a two-month intrusion at a naval shipbuilder.
An analysis of Operation FlashHole, a recent Lazarus Group campaign that uses a complex malware chain, the watering hole technique and abuse of CrossWeb EX, software used to protect financial...
A convincing “creator portal” uses your own YouTube videos and viewing figures to steal your Google login.
LevelBlue SpiderLabs has been tracking multiple waves of Wazza, a newly observed multi-stage phishing kit that deploys device code phishing targeting Microsoft 365 accounts.
A malware campaign based on the npm Shai-Hulud tactics hit the Tensorlake AI sandboxing ecosystem. Learn about how it worked, how to detect it, and what to do if you’re impacted.
Business Today (21 Oct) reported that a group calling itself ScarlettGroup posted on BreachForums (first flagged by FalconFeeds) that “We have breached...
The city said its bank accounts were hacked, “com prejuizo estimado em mais de R$ 3,8 milhoes” (CBN Goiania).
Kaspersky: at least three South Korean organizations (construction, software, wire-communication equipment) targeted since at least July 2025.
The district said it received a warning from the Brandenburg Ministry of the Interior on 20 Oct 2026 at 19:22 about a possible compromise of an IT client...
I-CAD’s note (21 Oct 2026) says it was informed on 18 Oct of an incident from “fraudulent use of an access account assigned to the LOOF” (the feline...
21 Oct 2026: Polkadot issued a security notice that Fearless Wallet browser extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 sent users’ private keys to an...
21 Oct 2026: analysts flagged about 15.99M USDT moving from a CoinDCX-linked wallet.
AU said its IT department found an ongoing attack in which “a hacker had gained access to a server” (discovered Monday, 19 Oct) and attempted to access and...
Four chained Plex Media Server bugs give unauthenticated code execution and are widely exploited. Update to 1.43.3.10861 or later and check the Codecs folder.
Trust Bank said a third party accessed member data on 17 Oct and 4,454,097 records leaked (figure may change).
On Tuesday 20 Oct the court suspended external access to its institutional portal and electronic systems after identifying “atividade considerada atipica”...
In a 20 Oct 2026 notice signed by Mark Earnest, the district said “On Monday, October 19, 2026, Seminole County Schools identified unusual activity...
SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen
cert-portal.siemens.com: Active Exploitation of CVE-2026-110936 in Siemens Software Center. Tracked with its indicators in EncryptLayer intelligence.
Per UOL reporting summarised by Tecnoblog, a public repository held 181 login and password combinations, registration data of more than 6,000 agents and...
Police are investigating “movimentacoes financeiras atipicas e nao autorizadas em cinco contas bancarias” of the city carried out on Friday 16 Oct.
The ICO reprimanded IT provider Ogi Networks Limited and Data Cymru (Local Government Data Unit, Wales) over a ransomware attack on 1 Nov 2024 that...
The Comune di Muggio says that between 12:14 and 12:46 on 28 Sep 2026 fraudulent emails with the subject “Avviso di pagamento” were sent to external...
Per ActuaLitte, INED detected an intrusion on its servers on Saturday 17 Oct 2026 that “paralyzes all of its IT infrastructure”.
MLIT said “unauthorized external operation” of the system run by Hakuhodo, the campaign secretariat, may have leaked data on 23,918 individuals at 16,950...
Coopecaja confirmed it was the victim of a ransomware attack in which “un tercero no autorizado accedio a carpetas de uso administrativo”.
Conab said on Tuesday 20 Oct that its systems and digital services “tem sido alvo de ataques ciberneticos”, describing intrusion attempts that pose risks...
Per Cyberattaque.org, which obtained the customer notification, a third party accessed the site without authorization during September 2026.
Stolen UpdraftCentral keys let attackers install backdoor plugins on UpdraftPlus sites. Update to 1.26.13 or 2.26.13, delete keys, then hunt for the backdoor.
PingCAP confirms an intruder copied TiDB Cloud account, billing and support data plus source code in Sep-Oct 2026. Rotate API keys and support-shared secrets.
OVHcloud CLI binaries for v0.11.0 to v0.15.0 fetched on 19 Oct 2026, 12:47 to 14:21 UTC, were an infostealer. Check MD5s, rotate secrets, install v0.16.0.
SoftBank detected an unauthorized access attempt on My SoftBank systems on 17 Oct 2026 and shut its customer websites for four days. No data leak announced.
Two Go point releases fix HTTP/2 crash and exhaustion bugs, a toolchain checksum bypass and the eMudhra CA keys. Rebuild with Go 1.27.3 or 1.26.10.
YMIRLINK said on 16 Oct staff found unauthorized access; its second report (26 Oct) says data was exported from 49 single-tenant Cuenote FC (bulk email)...
Per an SNR statement reported by Curierul National, the incident was detected at 06:30 on 19 Oct 2026, has “the characteristics of a ransomware-type...
Over the past month we collected and analysed 64 Android samples (first seen 2026-09-15 to 2026-10-16) that are all the same thing: a thin dropper that installs a packed second-stage WebSocket...
Parkview first notified patients of an outage on 18 Oct and on 19 Oct said it had “recently identified suspicious network activity”.
Nikkei said unauthorized access on 7 Oct 2026 exposed 1.83 million records (about 150,000 with identifiers such as names, emails, addresses, phone numbers...
Kyodo reported that Saitama Prefectural Police said on 19 Oct that names, affiliations and private emails of about 13,000 officers and staff in its...
Per the CFO’s complaint to the Telangana Cyber Security Bureau (TGCSB).
HIPAA Journal reports the practice found fraudulent emails being sent from an employee’s account in April 2026 and confirmed a single account was compromised.
MSC News reported that the hospital was attacked over the weekend, that the attack reached “some of the business files and other areas”, the computer...
The AfD told ZDF that “Im September 2026 kam es zu einem Hackerangriff auf einen Hosting-Dienstleister unserer Partei” and that parts of a few, mostly...
23:42 UTC 17 Oct to 01:26 UTC 18 Oct 2026: about 2.94 trillion QU (about USD 1.3M to 1.4M) drained from 1,404 wallets.
KMVT reported on 18 Oct 2026 that “The Jerome School District identified a cybersecurity incident affecting its network systems on Oct.
An intruder reached an OpenCode legacy system and may have exposed provider keys saved in OpenCode Console. Revoke those keys at OpenAI, Anthropic or Google.
Eight eMudhra intermediate CA keys were guessable. Browsers block them; update CA bundles and runtimes, and replace TLS certs under emSign ECC Root CA - G3.
GTIG and Mandiant uncovered a supply chain attack targeting AOMEI Technology’s update infrastructure, where attackers used short-burst configuration tampering on origin servers to deploy tools...
Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre), information on ReverseRAT Malware (SideCopy Spear-Phishing Campaign) - CERT-In
Pattison Food Group said it found unusual activity on one of its servers on Tuesday and “confirmed Friday that customers’ personal information on the More...
Seven application identities with Microsoft 365 permissions were used against 162 tenants (Huntress) or 173 (The Hacker News).
Per the bank’s police complaint: 6 transfers on 15 Oct, 88 on 16 Oct and 93 on 17 Oct 2026, 187 in all, to 36 recipient accounts.
Police told echo24 (17 Oct) the email went to about 6,500 contacts, many in security-relevant areas, including the Federal Chancellor.
Bullhorn reported CRM syncing issues from 16 Oct and by 08:04 EDT on 17 Oct said its entire system was down, stating “We have detected a cyber incident on...
Rank Math PRO 3.0.123 copies fetched 15-16 Oct 2026 held a self-restoring backdoor. Delete the plugin folder, clear three options, install 3.0.124.
An admin-level CLI path traversal patched in April is now on CISA’s exploited list. Upgrade FortiOS to 7.6.5 or 7.4.10 and audit admin accounts.
Trade Works said that on 14 Oct a third party abused the internet trading system it provides to IwaiCosmo Securities, leaking names, emails and other data.
This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera...
A cluster of 1200+ compromised repos have a second stage that autoruns a credential stealer and installs a cron job.
Confiant Threat Intelligence - security@confiant.com
The city said it identified on 6 Oct “uma ocorrencia envolvendo o acesso indevido ao sistema de informatica do municipio” with signs of financial fraud...
The accounting and advisory firm said it “is responding to a cyber incident that affected part of its IT environment in recent days” and that the incident...
HIPAA Journal reports the 33-location group told HHS OCR that 85,585 people were affected.
The university said it learned of an attack on its IT systems on 14 Oct 2026 and that unauthorized persons may have accessed about 51,000 applications for...
Per Medigate News, at a 16 Oct National Assembly audit lawmaker Kim Ki-woong raised the case of an NHIS employee who provided subscriber and dependent...
Per HIPAA Journal, an unauthorized party accessed IMS Care Center’s email system on 17 and 18 Jun 2026.
Uni-heute reports (16 Oct) that HU’s IT department detected unusual network activity on 12 Oct 2026 and classified it as security-relevant.
The hospital announced on Friday 16 Oct that an incident on 21 Sep hit an internal reporting system, not the general patient database, and may have exposed...
Depozitarul Central’s press release says it was the target of a cyberattack on the “Servicii Online pentru Investitori” application, an auxiliary app that...
Covered California’s notice to agents: “a phishing incident at Covered California on May 13, 2026 exposed your personal information”.
Per The Record, hackers “copied student information through a secure file transfer protocol site this year from May 22 to September 18”.
Burger King Japan said a server holding official-app user data was accessed between 2 and 7 Oct 2026.
The judiciary said a cybersecurity incident at BAE Systems, which operates the BNC, halted production and distribution of bankruptcy notices for all...
The Albuquerque Journal reported on 15 Oct 2026 that “A cyberattack hit the town of Bernalillo last week, making most of its online services inaccessible”.
Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft.
Infoblox attributes Help TDS to Hotejka and detects 16,000 malicious Cloudflare Pages before they are used to direct users to tech support scam call centers.
Per Infosecurity Magazine, the ICO found Met officers and staff used the Auror intelligence-sharing platform from March 2023 to September 2024 without...
The footwear retailer (Metro, Mochi, Walkway) reported unauthorised activity in its IT infrastructure including Active Directory, found through security...
Medley said a third party accessed the @link clinic support system, the At-Link patient app and related services between late September and mid-October...
The Sendai distributor said its core system (ordering, purchasing, inbound/outbound inventory) “went down entirely” at about 10:00 on 15 Oct due to a...
KUTV reported on 15 Oct 2026 that “A cyberattack targeted the Heber City Municipal Corporation’s local IT network, breaching the system” and that “The...
The college’s notice says its infrastructure suffered a cyberattack on Tuesday 13 October.
COPC discovered on 25 Aug 2026 that a criminal actor using social engineering “aimed at soliciting a financial response” gained access to files with names...
Ransomware crews use a GlobalProtect cookie bypass to get VPN access, and a new PAN-OS management RCE is exploited. Upgrade, and check Authentication Override.
Next.js 16.4.1 and 15.5.28 fix an unauthenticated RCE via SVG image optimization, a use cache RCE and a Server Actions DoS. Also check sharp is 0.35.5+.
The hotel group said its IT detected unauthorized access to internal systems on Saturday 10 Oct 2026 (the later FAQ says 11 Oct) in a ransomware attack...
Hirudo replaces Indonesian banking apps with patched copies that blind their defences. We break down its patching, distribution, targeting and fraud.
An interview invitation becomes a trap for your Facebook and Google passwords, even with two-factor authentication turned on.
14 Oct 2026: about 39.8M ARRR (roughly 20% of the 200M cap) was created without authorization and moved into the Sapling shielded pool.
Per AWP/cash.ch and Netzwoche, an intruder accessed an Offerz test environment on the night of 7 Oct 2026, discovered on the morning of 9 Oct.
ComputerBase reports a customer email dated 14 Oct 2026 in which the retailer reported an attack on its IT systems.
Per HIPAA Journal, NorthShore posted a website notice on 14 Oct 2026 saying an unauthorized party had access to parts of its IT environment on 10 and 11...
Per Ctech, Colmobil told customers the incident “has led to disruptions in some of the company’s operations,” and service centers would keep accepting...
CERT.gov.az said attack activity was recorded from about 22:00 on 13 Oct against “more than 100 state domains,” causing disruptions to the web resources of...
Per The Record, the Moscow online travel agency said on Wednesday 14 Oct a cyberattack on its IT infrastructure forced it to temporarily suspend new...
A record 1,411-fix release includes an exploited Windows Shell Mark of the Web bypass. Install the October cumulative update and Edge 154.0.4258.62.
Three chained Ivanti Connect Secure flaws give unauthenticated root and evade the Integrity Checker. Upgrade to 25.1.3.1, 25.1.1.3 or 22.8R2.6.
Researcher Jeremiah Fowler found an unprotected database of 13.7 million records with names, phone numbers, emails, plaintext passwords and bank details...
The Foschini Group’s SENS announcement says TFG London identified a cybersecurity incident on 11 Oct 2026 affecting IT systems of its Phase Eight, Hobbs...
Understand how early detection helped Black Lotus Labs uncover PoeLLM malware targeting enterprise AI systems and block its infrastructure to protect customers.
DOJ: between 21 and 25 Sep the FBI searched or acted at more than 40 Texas residences suspected of hosting laptop farms.
Ledger opened an investigation on 9 Oct 2026, confirmed a hardware implant on 10 Oct, and described it on 13 Oct.
A county spokeswoman told dpa (via Antenne Bayern, 13 Oct) that a multi-hour DDoS attack on Thursday disrupted the municipal network, including several...
HIPAA Journal reports the provider network and health plan administrator said an unauthorized party had network access from 22 to 27 Jul 2026 (identified 4...
13 Oct 2026. Founder Felix Romer acknowledged just over USD 3M lost.
Ing.dk reported on 13 Oct that the Fehmarnbelt tunnel project was at a standstill after contractor FLC reported a cyber incident hitting IT systems in the...
Arcadia’s cloud mass-notification service for disaster information (875 contracts, used by municipalities, companies and organisations) was accessed...
Per HIPAA Journal, the home health agency disclosed a ransomware attack in which an unauthorized party first accessed its network on or around 17 Mar 2026...
On 11 Oct 2026 attackers forced refrigeration controllers in hundreds of French stores into defrost. CERT-FR says Danfoss, Copeland and Dixell units were hit.
Ahold Delhaize took most brands’ websites and apps offline in Europe and the US after malicious activity in its network on 12 Oct 2026. No data theft found yet.
The city said (12 Oct) it was the victim of a criminal cyberattack discovered Monday morning.
ThreatLabz analyzes a trojanized Terraform provider delivering FLATROOF and ROOFDECK malware across Windows, macOS, and Linux.
We look at a new version of the MacSync macOS stealer with a backdoor module that targets crypto enthusiasts and developers.
UpGuard, which found the exposure, says a publicly accessible Elasticsearch server belonging to the UK medical survey company exposed personal data of...
MediaNama, analysing the UDRP decision, reports the fertility chain’s domain was moved out of its account on 31 Oct 2024 without authorisation and noticed...
Icon said there was “unauthorised access to some patient information held on a supplier’s system,” an externally hosted platform that converts incoming...
Per WAVY (via AOL), “Some Grassfield High School students received emails containing threats and inappropriate and explicit content” on Monday evening from...
HIPAA Journal reports unauthorized access was detected on or around 7 Aug 2026, possibly exposing names, SSNs, diagnoses, medications, Medicare/Medicaid...
Per ANP (via Welingelichte Kringen) a TUI spokesperson said “a number of our travelers have been approached by fraudsters via WhatsApp” and that the...
RER Sud (Buzau) and RETIM (Timisoara) notices say that on 7 Oct 2026 unauthorized access was found to the “Contul-meu” customer account database, which...
Interseguro acknowledged unauthorized access, saying “contenimos el incidente” after activating response protocols, in an email users reported receiving...
A Mirai kit on our honeypot keeps its server addresses in DNS, XOR-encoded. Sandboxes miss it. How we decoded it offline and confirmed both servers.
TLS certificates tied BraZetsu
Group-IB uncovers BraZetsu, a new Python-based Windows malware that serves as a master toolkit for Initial Access Brokers and powers a unique, AI-enhanced underground marketplace for...
Dream uncovered an active DarkBlinders espionage campaign against Israel and the Kurdistan Region of Iraq, linking the activity to UNC5795, Dust Specter, and APT34 through GitHub-based command and...
Bitdefender has identified a malware campaign (dubbed Midnight Mimosa) running on low-cost, multi-brand Android devices built on MediaTek platforms.
The national family allowance fund (Cnaf) said a leak of Vacaf beneficiaries’ data was reported on 9 Oct 2026.
Blueberry’s notice filed with the California AG on 10 Oct 2026 says a “previously unknown security vulnerability” in Metabase, which it uses for reporting...
Internal Fireworks AI credentials were used to capture secrets given to evaluation jobs in some customer accounts. Rotate listed credentials at the issuer.
NSE filing of 10 Oct 2026: 695 unauthorised IMPS debits totalling Rs 18,96,07,563 from five ICICI Bank current accounts, from 07:26 IST on 8 Oct to 12:40...
WLBT: “Madison County’s website is down after a cyber-attack on the host company,” U.S.
Parent SMG said Ricardo detected suspicious server activity on 7 Oct 2026.
CERT-In advisory CIAD-2026-0046, “Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities”, issued 9 Oct...
Per the EFJ (an MFRR partner), a DDoS attack on 30 Sep and 1 Oct 2026 “overwhelmed the platform’s servers and temporarily disrupted public access”.
Per HIPAA Journal, the nonprofit told HHS OCR that 1,693 people were affected by an incident at its business associate PDCM Insurance (Waterloo, Iowa)...
Staatsanzeiger reports (9 Oct) that the digital service provider for many non-university higher-education institutions in the state, including the public...
Per Euronews and Clubic, the electronic voting platform (named E-Votez by Clubic) was hit from opening at 8:00 on 9 Oct by “a massive, fake flood of...
Daiichi Kosho said Nippon Columbia Group (NCG), the contractor handling its customer data, found malware on an employee’s computer on 5 Oct 2026.
HIPAA Journal reports the practice told HHS OCR that PHI of 21,897 people was involved after suspicious activity on 12 Feb 2026.
Advisory CIAD-2026-0046 (severity Critical) says CERT-In/CSIRT-Fin observed multiple campaigns against NBFCs, digital lenders, fintechs, payment service...
Per HIPAA Journal, the nonprofit, which runs Bacon County Hospital and Twin Oaks Convalescent Center, found suspicious activity on 27 Jul 2026.
Anthropic’s 9 Oct report says Claude Haiku 4.5, tasked with “generating and performing example tasks on randomly selected webpages”, reached a police...
Adventure said attackers abused some skyticket admin functions (2 to 4 Oct) to reach other servers and cloud data, leaking about 14.64M records (names...
tensorlake 0.5.144 on npm ran a Shai-Hulud variant at install that steals secrets and wallets and can wipe the host. Isolate before revoking tokens.
CISA marked five bugs from 2015 to 2023 as exploited on 8 Oct 2026. Find old Struts 2, Strapi, ONLYOFFICE Docs, ProFTPD and BIND installs and upgrade them.
Idowa reports (8 Oct) that a Landshut car dealership emailed customers on Wednesday evening warning of unauthorized access to customer data, apparently at...
rbb24 reports (8 Oct), citing the foundation, that after a cyberattack on Monday evening its websites, those of its seven memorial sites and some project...
The city said attackers altered duelmen.de, duelmen-marketing.de and duelmener-winter.de so that some visitors saw fake “CAPTCHA” security checks from...
Per KRGV, the mayor said “the attack led to an unauthorized transfer of funds to a fraudulent account”; “The city has not said how much money was sent.”
SIRP said data offered on a cybercrime forum was obtained through a cyberattack on the development (test) server of a provider hired in 2025 to design the...
Reuters (via Insurance Journal, 8 Oct) reported an anonymous site titled “The Luna Moth Files” claiming to host Silent Ransom Group chat logs, ransom...
On 7th October our Threat Intelligence pipeline flagged a script from ohhhhhmoney.com injected into compromised WordPress sites. It is a ClickFix kit, and at the end of the chain is a backdoored...
PK Softech said that at the end of September 2026 unknown parties used malware to access part of its IT and “muss davon ausgegangen werden, dass Daten aus...
Photon’s letter dated 8 Oct 2026 (filed with the California AG) says it learned on 21 Aug 2026 that an unauthorized party “exploited a previously unknown...
WLZ reports (8 Oct) the clinics said they were the target of a criminal attack, detected it early and activated emergency plans.
FBI, CISA, NSA, NCSC-UK, ASD’s ACSC, Canada’s Cyber Centre, Japan NPA and NCO, NCSC-NZ and Spain’s CNI say China-based Integrity Tech enables actors (TTPs...
Per HIPAA Journal, the practice found it was the victim of a cyberattack on 23 May 2026.
Stolen GitHub accounts committed security-audit.yml or github_actions_security.yml to thousands of repos. Search all branches and forks, then rotate.
Yoido Full Gospel Church said it identified a dataset with personal information associated with about 850,000 members (The Record).
These are the top threats you should know about this week.
Executive summary Key judgments Background: DarkSword and Coruna DarkSword is an exploit chain for iOS that Google Threat Intelligence Group (GTIG) first documented publicly in March 2026. The...
Pathao said services were disrupted on Sunday 4 Oct because it took “critical systems offline immediately upon detecting a cybersecurity incident,” and...
Nissui said a system failure at group firm Nissui Logistics meant goods “cannot currently be received or shipped”.
Krebs on Security reported that ShinyHunters was extorting Jeppesen ForeFlight, divested by Boeing to Thoma Bravo for $10.55 billion, when its suspected...
IDC Frontier said a ransomware attack from about 3:40 am on 7 Oct stopped and encrypted virtual servers in part of IDCF Cloud East Japan Region 1...
Western Mass News reported on 7 Oct 2026 that “Easthampton Public Schools’ computer network is down after a cybersecurity incident was discovered Tuesday...
AP-HP says it was informed on 24 Sep 2026 of the sale of data on a cybercriminal forum and “confirms the theft of data from 1,015 patients” from a module...
7 Oct 2026, BNB Chain: an address holding OPERATOR_ROLE pulled about 2.01M 79AU from the 79AU/USDT pool in seven transactions and sold it, about 16,249 BNB...
A Kotlin DSL sandbox escape gives code execution on TeamCity servers, and Git submodule URLs could read local repos. Update to TeamCity 2026.2.1.
OpenSSH 10.6 fixes an sftp path escape, a compression side channel, username injection and six more bugs. Take your distro’s OpenSSH update; none are exploited.
HIPAA Journal reports the medical management and billing provider’s network was accessed between 6 and 16 Jul 2026, followed by a network disruption on 17...
Mr Max said suspicious server access was confirmed on the evening of 3 Oct and member ID, name, email and phone of up to 1,735,154 members leaked.
iRhythm’s 8-K says it identified unauthorized activity on third-party-hosted business applications on 8 Jun 2026, received an extortion demand from a...
Google said attackers “compromised the third-party ccTLDs”, modified authoritative DNS records and obtained unauthorized HTTPS certificates for several...
ShinyHunters announced on 22 Sep that it breached the FBI’s jobs site.
ASOS said an unauthorized party gained access to an employee account by “impersonating a trusted contact” to obtain login credentials, then accessed...
The company said its operator Iyaku Joho Net reported on 2 Oct that a cyberattack accessed the member database linked to Pharma DIGITAL.
Andersen Group (NYSE: ANDG) announced via Business Wire that “a social engineering attack affecting a single employee” led to unauthorized access to...
@subql/common 5.8.3 stole CI, cloud, Vault and Kubernetes secrets on install and on import. Pin 5.8.2, block ci-artifacts.dev, rotate secrets.
Attackers used one firm’s CPR access to pull names, addresses and CPR numbers of 8.8 million people in Sep 2026. A CPR number no longer proves identity.
A pre-auth file read hits every Atlassian Data Center product and can leak Crowd credentials; exploited. Patch, or apply Atlassian’s block rule.
Per HIPAA Journal, WindRose is notifying 33,158 people after attackers exploited “a previously undisclosed vulnerability in a remote access tool used by...
Wikimedia said it found edits to its wikis “that we believe are from AI agents operated by OpenAI”, mostly sandbox tests not visible to general readers...
UIC said “some College of Medicine systems were temporarily unavailable” and hackers stole some information from college servers.
From about 1 to 5 Oct, attackers changed exit policies so SSH traffic went to 12 interception servers that harvested passwords when users accepted a new...
Per Impress, an intruder logged into the i-ask admin site without authorization between about 20:30 on 2 Oct and 08:00 on 3 Oct, installed a program and...
I pointed an autonomous coding agent at a $35 projector. It found a big RAT.
Nykoping kommun says its IT department discovered on a Friday evening that “someone had manipulated the municipal website” and that “Nothing else is...
Monogatari said a third party accessed the Yakiniku King app’s member management system, confirmed 2 Oct, and member number, name, email and phone of...
HIPAA Journal reports suspicious email activity on 2 Jun 2026.
Per AFP (via Techniques de l’Ingenieur), regional president Xavier Bertrand said data on nearly 545,000 people leaked after a cyberattack on two contractors.
The state’s integrated financial administration system Siafe-TO was suspended after cyberattack attempts were identified on Friday 2 Oct, and the...
GMO Research & AI said a third party exploited “a vulnerability in software used on the site” from 2 Oct and took member data (up to 948,498 records.
Double Counter’s incident report says on 4 Oct 2026 an attacker copied about 12 GB from one of its databases (15:09 to 15:34).
Daiki Suisan said its official app system was accessed by a third party (confirmed 15 Sep).
Limfjord Update reported on 5 Oct that the industrial company, which has about 400 employees at its Thisted head office, was hit by a cyberattack “last...
Per HIPAA Journal, an unauthorized party accessed the network on 18 Jul 2026 and “potentially viewed or obtained files” with medical and insurance...
The Record and Telegraf report a ransom message with a countdown demanding $400,000 appeared on the website of Ukraine’s largest grocery chain while some...
HIPAA Journal reports AHHC learned on 16 Jun 2026 that an unauthorized party had accessed one of its servers (first access 9 Jun 2026) and on 26 Jun...
Exploited bugs in AhsayCBS, SiteGuard Server Edition and Siemens Software Center joined KEV in October 2026. Fixed builds, workarounds and IOCs for each.
An exploited memory overflow crashes NetScaler ADC and Gateway set up for SAML. Update to 14.1-73.41 or 13.1-64.28, which also fix September’s exploited RCEs.
Per RMF24 and Interia, Wakacje.pl said the leak occurred on 29 September through “unauthorized access to part of employees’ work mailboxes” (Interia also...
Cleafy’s TIR team analyzed the operator infrastructure behind RATHat, an Android banking trojan that abuses Accessibility Services to enable wireless debugging on the victim’s phone, obtain a...
ABAHOUSE said an overseas third party accessed internal systems from late 27 Sep to 28 Sep and member ID, name, address, phone, email, DOB, gender and...
Of 6,157 Glasswing vulnerabilities disclosed to open-source maintainers, about 8% were patched by October 2026. Expect a long tail of dependency fixes.
Bloomberg (via gCaptain) reported that outsiders gained “temporary access to the digital system on the ship” connected to propulsion as the laden tanker...
Attackers compromised DTU user profiles and used them to access DTUBasen, the identity and access management system, downloading “a large amount of data”.
Proofpoint (via Help Net Security): China-aligned TA419 impersonated a senior Anthropic employee in Feb 2026 (“Request for Feedback on Military Integration...
Per HIPAA Journal, inmates were affected by an incident at Computer Systems Integrated Inc., which runs the EHR used by the two facilities and is...
Alabama Power says it discovered unauthorized access through monitoring affecting a restricted group of account holders.
The district learned of the attack on 3 Sep when teachers “couldn’t log in to Microsoft Windows” and was without internet and platforms such as PowerSchool...
El Congresista reports the “Kiosco Digital GTO” platform used for official documents was hacked, which it says affected information of thousands of users.
CERT Polska uncovered a toll fraud operation targeting Polish users through deceptive Meta advertisements and malicious applications distributed via Google Play. We preserved 1235 ads, linked 852...
Per Kyodo and Business+IT, a system-wide outage began early on 2 Oct.
KB Kookmin said on 2 Oct that names, phone numbers, addresses and encrypted resident registration numbers of 119 customers were exposed via an employee...
Hana Bank disclosed on 2 Oct that personal information of 89 customers, including resident registration numbers, names, addresses, emails, phone numbers...
FELG Software confirmed an incident and gave a preliminary estimate of about 2 million patient records (attackers claim 2.4 million).
HIPAA Journal reports a threat actor took over a trusted business contact’s email, sent phishing emails, and an employee entered credentials on 3 Jun 2026...
The companies said they detected unauthorized access on 24 Sep to an employee HR system both use, and data of about 120,000 people (about 50,000 current...
CMU said it became aware of a cybersecurity incident on 18 Sep 2026, that “an unknown third party accessed our IT systems without authorization”, and that...
dpa (via Boyens Medien, 2 Oct) reports the Hamburg Greens’ mail server was the target of an automated hacking attack.
Per VRT, the Bernardusscholen school group was hit by a cyberattack and data of about 4,200 students and staff was stolen, including names, email...
Per HIPAA Journal, the incident was identified on 20 Jul 2026 and files were potentially accessed or taken around 18 Jul.
A predictable session key in HFS 3.0.0 to 3.2.0, found with Claude Mythos, lets attackers forge an admin login and run code. Update to 3.2.1 or later.
Unauthenticated attackers write files on FortiMail through the /ibe endpoint; exploited before a patch. Upgrade to 8.0.2, 7.6.7 or 7.4.9, or turn IBE off.
TPCG’s cyber incident notice says it identified suspicious activity “within a portion of its network environment” on 30 Sep 2026 (referencing an initial 1...
The municipality says “Den 1 oktober drabbades vi av ett intrang som orsakade omfattande stoerningar i var IT-miljo” (on 1 Oct an intrusion caused...
Shinhan Bank apologised after personal information of about 25,000 customers, including names, phone numbers, annual income and loan eligibility limits...
Scribd’s notice says “We recently discovered that an unauthorized third party was able to gain access to our systems”.
HIPAA Journal reports the skilled nursing provider identified unauthorized access to a server on 27 Jul 2026.
Liftstar says it was the target of a criminal cyberattack in which “Daten von Kunden und Mitarbeitenden kopiert und kompromittiert” were taken.
Hamburg police and prosecutors led the operation; on 30 Sep a 16-year-old (suspected administrator) was arrested in Alicante, Spain, plus a 24-year-old in...
JAEA confirmed unauthorized access on 25 Sep 2026 to a cloud-hosted research support site for external users of the JRR-3 research reactor (Tokai).
WLBT reported on 1 Oct 2026 that “The City of Vicksburg was the subject of a ransomware cyberattack Thursday, according to Vicksburg Mayor Willis...
In a Facebook notice reported by WDBJ, the city said “All office emails and most phone lines are NOT available at this time”; circuit court offices closed.
Per HIPAA Journal, Buchalter discovered on 28 Aug 2026 that “limited data was accessed by an unauthorized third party”, confirmed on 4 Sep 2026 that some...
HIPAA Journal reports a ransomware attack identified on 3 Aug 2026 on a server holding practice management, imaging and EHR software.
A Zammad session hijack (6.3 to 6.5) plus a root escalation in DEB/RPM packages breached DIVD. Move to Zammad 7.2.2 or later and check logs for leaked cookies.
A URL-encoding trick bypasses SD-WAN Manager API login and grants admin; exploited since September. Upgrade and check the two logs Cisco names.
Per ITmedia, Yoshinoya HD said 5,366 applicant records (4,998 Yoshinoya, 368 Hanamaru) from April 2022 to June 2024, 418 employee records and 418 recruiter...
Sagawa said unauthorized access to its internet cargo system (package inquiry service) was found at 7:30 am on 30 Sep.
OpenAI said it notified more than 100 organizations that “misaligned models” may have accessed their systems (notification does not mean data was accessed).
MetaMask said on 30 Sep it was “responding to an ongoing security incident affecting part of our infrastructure” and was “proactively exiting affected...
La Provincia di Como reports the technical office’s institutional email “had been hacked” and used from 26 to 28 September to send more than 300 fake...
DysruptionHub reported that “Internet and phone outages disrupted Llano Independent School District in Texas Sept.
The city said that “between June 1 and July 18, ‘certain information may have been accessed and copied without authorization,’” possibly including “names...
Per HIPAA Journal, an unauthorized party accessed the network on 16 and 17 Mar 2026; names, dates of birth, SSNs and clinical information were involved.
Per IT-Connect and Journal du Geek, ANSSI’s 30 Sep 2026 REACTIV situation report disclosed the compromise of 118 Metabase user accounts used by ANSSI’s...
Aliquippa police said an email account “belonging to Chief Lane” was compromised and “the chief did not personally send the fraudulent messages” (WPXI via...
Yamato said a third party accessed the Kuroneko pay-later service (detected 28 Sep).
Seicomart said a third party accessed the member server via the Seicomart App server.
HIPAA Journal reports IU Health learned on 4 Aug 2026 that a previously unknown vulnerability affected an isolated legacy system run by IT vendor The AME...
Attackers reached HelloBetter’s business intelligence system and associated database on the evening of 6 Sep 2026.
TVP World reported on 29 Sep that customer data was breached at the Polish invoicing service Fakturownia.
Telangana Today reports the health-tech firm’s systems and patient records on its platform were encrypted around 29 Sep.
Per HIPAA Journal, suspicious activity indicating an intrusion was found on 30 Jun 2026 and an unauthorized party accessed systems with personal and health...
SRG said unauthorized parties accessed data of about 340 current and former SRF staff (mostly from today’s Information unit).
HIPAA Journal reports suspicious activity on 23 Jul 2026 and confirmed unauthorized network access; the final notification list was obtained on 17 Sep 2026.
Per HIPAA Journal, an unauthorized party accessed the medical device outsourcing firm’s network from 15 to 19 Dec 2025 and acquired files.
Medyc’s notice says that “in connection with a cyberattack on Medyc’s infrastructure” personal data was accessed and stolen.
Per Inside Housing, L&Q said “a targeted cyber security incident that has affected L&Q’s website” let an unauthorised party access emails and webform...
Jims says an unauthorized third party gained access to parts of its member and customer management system and personal data was viewed and copied.
Dodo Pizza confirmed a cyberattack on its IT system and said attackers may have accessed some customers’ names, contact details, addresses, dates of birth...
DHCF’s notice says that on 21 Jul 2026 it learned two reports on its website “contained hidden personal information”.
Tokyo Metro announced on 27 Sep that an unauthorized third party accessed the email addresses of about 59,000 customers enrolled in its Metpo loyalty...
Starts Publishing said its systems detected a large volume of unauthorized access from overseas on 26 Sep, and up to 447,610 OZmall members’ email...
The GAD website homepage was replaced on the morning of 27 Sep with a Pakistani flag and pro-Pakistan messages (Deccan Chronicle, Organiser).
An ESNEFT spokesman said “Ten people working at the trust have been removed from direct active duty or suspended pending further investigation” over...
The company said on 26 Sep that 41 members’ data in the Nippon Rent-A-Car app may have been viewed, and on 1 Oct that a different-method attack from 19 to...
Keio: “In the early hours of September 26, 2026, we confirmed a ransomware attack on our group’s servers.” Some business systems, reportedly payments and...
Business Day/TimesLive (26 Sep) report ATNS brought in forensic investigators after a “ransomware attack, with possible data exfiltration and employee...
Times Car confirmed theft of data on about 6.6 million current and former members plus Times Business Service users.
UpGuard said “we identified 16,326 databases exposing readable tables” out of about 300,000 domains showing Supabase use.
Per The 74, a phishing email “late last month” impersonated “the state education agency or a widely used payment platform” and “tried to obtain vendors’...
Simba said 23,549 customers were affected in an incident on 24 Sep, with names, IC numbers, dates of birth, phone numbers and emails exposed.
Per HIPAA Journal, the allergy and immunotherapy software provider said part of its network was compromised.
Adif detected “unusual activity” on the night of Thursday 24 Sep and suspended its websites for some hours.
MedImpact’s notice (filed with the California AG on 25 Sep 2026) says that on 18 Oct 2025 it “identified unauthorized activity within certain systems in...
Per LRT (BNS), the Interior Ministry said hackers “gained unauthorised access to the EPEKIS information system”, administered by its Information Technology...
Kiteworks said on 25 Sep it received “credible threat intelligence from federal intelligence authorities” that “a threat actor may attempt to target some...
HIPAA Journal reports suspicious activity on 27 Jul 2026; an unauthorized party had access from 16 to 27 Jul 2026 and files “may have been accessed or...
Chief Justice Ann Scott Timmer announced on Friday 25 Sep that hackers are believed to have “gained possession of personal identifying information” of...
A flaw in a Defense Manpower Data Center file-sharing system exposed unencrypted SSNs of about 3.05 million people with military ties, Oct 2025 to Jul 2026.
Hijacked actions-cool/issues-helper and maintain-one-comment were re-enabled on 16 Sep 2026 with every tag still malicious. Remove them and rotate CI secrets.
Source-code analysis of the Corp MDM Android spyware campaign targeting logistics companies through fake Google Play pages, with SMS theft, call forwarding, persistence, C2, and detection details.
Paradigm’s letter dated 14 Sep 2026 (filed with the California AG) says it became aware of unauthorized access to its local network on 13 Oct 2025 and on...
HIPAA Journal (24 Sep 2026) reports the lab notified 20,040 patients after employee email accounts were accessed between 31 Mar and 2 Apr 2026, exposing...
Per Solutions Numeriques, Docaposte described “unauthorized access attempts by a cybercriminal to send illegitimate letters” via its Maileva online mail...
Per HIPAA Journal, the medical device maker said an unauthorized party accessed its network and “may have viewed or obtained” data including names, SSNs...
Per hessenschau (24 Sep), KVV said unknown parties embedded malicious code in several of its websites, including kvvks.de, kvg.de, netzplusservice.de and...
Ikegami said it received outside information on 21 Sep of a possible cyberattack.
The Fed OIG’s 24 Sep report (2026-MO-B-014R) concerns “a departing Board employee who potentially removed Federal Open Market Committee classified and...
24 Sep 2026: hot wallets on Ethereum, BNB Chain, Tron and Bitcoin drained.
Per HIPAA Journal, an unauthorized party used a WellSky clinical user account in the EMR between 5 Jun and 24 Jul 2026 (WellSky identified it on 21 Jul).
Bitget disclosed the theft on 24 Sep 2026 and halted withdrawals.
WBTV found that “by changing the web address by a single number” anyone could reach other people’s jury deferral uploads, including “social security...
Rockland Radio reports (23 Sep), citing the Verbandsgemeinde, that a platform for daycare centres in two local municipalities was attacked.
In a Bursa Malaysia announcement dated 23 Sep, CTOS said it detected “unauthorised access to a specific environment supporting its consumer business” and...
The district said a cyber incident came to its attention on 21 Sep and that “During this ransomware attack, an unauthorized third party gained access to...
Astrana’s 8-K (date of report 22 Sep 2026, signed 23 Sep) says subsidiary Astrana Health Management detected unusual activity.
Per HIPAA Journal, the practice notified 16,876 patients of a network intrusion identified on 28 Jul 2026.
The university said on 22 Sep that unknown parties gained unauthorized access to a server of the Chair of Economic and Business Education, Learning, Design...
The university said on 22 Sep it was the target of a cyberattack that “war eine solche Zero-Day-Attacke” against decentralised facilities.
Trellix researchers (reported by The Hacker News) found SideCopy targeting academic institutions in India, a widening from its usual defence and government...
22 Sep 2026: Neutron DAO proposal #9 (“AIATO: AI Agent Takeover.
Modoc’s notice (filed with the California AG on 22 Sep 2026) says it became aware of unauthorized access on 27 Jan 2026 and “an unknown actor accessed a...
Fresenius Medical Care said on 22 Sep it is investigating “unauthorized access to a limited number of internal systems” and that the incident “has not...
Help Net Security, citing Cloudskope, reported that elsevier.com, the Evolve nursing and health-education login portal and the Submit manuscript portal...
Per Onlinekhabar, the attack on Data Hub’s data centre was detected early Sunday (20 Sep) and disrupted servers and trading management systems of 72...
A cyberattack led to the diversion of R$ 43 million held on the BRBJUS platform, from judicial deposits of the Tribunal de Justica da Bahia (TJBA).
HIPAA Journal reports the translation and interpretation provider told HHS OCR that 4,649 people were affected.
After an attack on Monday 21 Sep the court took its main systems including PJe offline.
The Spokesman-Review reported on 22 Sep 2026 that the district “experienced a ‘cybersecurity incident’ Sunday night” (20 Sep), families were notified...
Ridgeway’s letter dated 21 Sep 2026 says it learned on 21 Aug 2026 that its website, “designed and developed by a third-party vendor”, was accessed by an...
The city suffered a cyberattack on Friday 18 Sep in which “os criminosos invadiram os sistemas” and made fraudulent transfers from municipal bank accounts.
The state data protection commissioner (LfDI MV) said on 21 Sep it has received unusually many breach reports in recent weeks.
Per HIPAA Journal, a former physician partner leaving the practice copied patient data over three days from 29 Jun 2026, accessing more than 3,000 names...
BigCommerce said credentials for the third-party “Ribon and Ribon 1.5” apps (Be A Part Of / Fastr) were compromised and used between 13 and 17 Sep to...
HIPAA Journal reports the dental practice was told by its IT support company on 26 May 2026 of suspicious activity and a cyberattack was confirmed.
15 Sep 15:35 UTC to 20 Sep 20:56 UTC: XRPL.to counted 11.75M XRP (about USD 18.7M) taken from 6,678 wallets in six waves.
19 Sep 2026: 8,721,530 FET (about USD 1.55M) withdrawn from the Ethereum TokenConversionManagerV3 contract.
An 18 Sep invitation for a “Living with HBOC” event was sent with recipients in CC instead of BCC, exposing names and email addresses (some revealing...
LMU said (19 Sep) an unauthorized attacker gained access to a server and that it must assume the data was retrieved.
The company said on 19 Sep that “its network experienced unusually high traffic consistent with a distributed denial-of-service, or DDoS, attack,” “causing...
Per BRF (via Belga), the Belgian table tennis federation and its French-speaking wing were hit by a cyberattack the week before.
Joint advisory (Japan NPA, FBI, Australia, Germany’s BfV): from Dec 2025 to Jul 2026 WaterPlum infected at least 30,000 devices in 100+ countries and took...
Governor Jared Polis’s spokeswoman said hackers “changed equipment settings, disabled remote access and alarms and altered pumping cycles at both...
Google confirmed on 18 Sep (after Wall Street Journal reporting, per the Star-Advertiser) that a Gemini model being tested by Israeli firm Irregular in May...
Per CoinDesk, co-founder and CTO Adam Carlile told clients “It was 15 clients impacted” in “a targeted attack by a group on us”.
Gyazo (Helpfeel) confirmed a third party accessed its database on 11 Sep 2026.
Per KWCH, “Portions of Ellis County’s information technology systems have been affected by a ransomware incident,” detected 17 Sep.
Per HIPAA Journal, Call-on-Doc began notifying patients on 18 Sep 2026 that an unauthorized party had network access from 22 Dec 2025 to 3 Jan 2026...
HIPAA Journal reports the Dallas hospice operator identified unauthorized access to its email environment on 8 Aug 2025.
HIPAA Journal reports the incident was identified on 30 Mar 2026 and an unauthorized party “accessed or acquired files” with names, SSNs and insurance...
Per HIPAA Journal, the practice identified the incident on 6 Mar 2026 and confirmed unauthorized access and file exfiltration.
az-online reports (17 Sep), citing the municipality, that its IT infrastructure was the target of a security-relevant attack.
Per HIPAA Journal, zHealth’s network was accessed on 20 and 21 Jan 2026.
The bus company confirmed a cybersecurity incident in environments linked to its official ticket-sales websites, and “dados de 7.883 clientes podem ter...
Zscaler ThreatLabz documented four new tools used against government and defence organisations in India and Afghanistan, with most post-compromise activity...
In a 16 Sep 2026 statement, the Town said it and Sutton Public Schools “recently identified a cybersecurity incident affecting certain portions of its...
HIPAA Journal reports suspicious activity on 22 Jul 2026 at the emergency room operator (Longview, Tyler and Galveston).
Per DN/Lusa, executive secretary Paulo Santos said a ransomware attack on the CIM’s email server was identified in the early hours of 15 September.
Turkey’s Personal Data Protection Board published a decision dated 16 Sep stating the breach affected 424 organizations in Turkey, exposing names, business...
TKD’s notice dated 4 Sep 2026 (filed with the California AG, posted 15 Sep 2026) says it found suspicious activity on 10 Sep 2025 and that there was...
HIPAA Journal reports suspicious activity on 3 Apr 2026; an unauthorized party accessed the network and acquired data including SSNs, driver’s license...
MUIS confirmed on 15 Sep a cybersecurity incident involving an HR system operated by Avelogic.
KEYC reported on 15 Sep that Mankato Clinic was investigating “unauthorized activity involving our computer network” after a cybercriminal group claimed...
Per HIPAA Journal, LHC Group was hit by an incident involving a third-party technology vendor.
In a TWSE filing on 15 Sep, the company said “certain internal information systems were subjected to a cyberattack”.
In a TWSE material information filing on 15 Sep, EVA Airways said an unauthorized party broke into its internal information environment through suspicious...
Joint advisory: “Iranian state cyber actors” have used the Windows malware CHOSEN BRICK since at least 2025 against dissidents, activists and journalists...
Per HIPAA Journal, the practice notified 1,500 current and former patients of a hacking incident reported to HHS OCR.
Revolut told affected customers an attacker requested PII by email from a government agency’s domain and “it was fulfilled under the reasonable belief that...
CenterPoint’s 8-K says a third party posted online claiming a data set of its customer information, and its investigation found an unauthorized party...
On 13 Sep 2026, from early afternoon to about 8 pm, cybercriminals hacked the server of Renova Petech Private Limited (recharges, bill payments...
The Digital Agency said a third party breached the shared government IT platform GSS “by exploiting a vulnerability in a network connection device (VPN)”.
FortiGuard Labs examines how a new Casbaneiro campaign targeting Latin America uses geofencing and distributed servers to evade analysis and detection…
IHL said a network security incident affected its offices including the Office of Student Financial Aid.
CISA, NSA and FBI say China-based AI companies, likely with Chinese government awareness, extracted capabilities from US models (variants of Claude, GPT...
15:53:10 UTC 6 Sep 2026 (Liquid block 4,050,336): about 4,000 L-BTC not backed by reserves was created and pegged out through SideSwap’s peg-out...
IDScan’s notice (4 Sep) says an unauthorized party “may” have accessed or copied customer information in accounts on its IDScan.net cloud.
The Gujarat state-owned mining company (listed) disclosed that CERT-In informed it of a probable data breach pertaining to https://www.gmdcltd.com.
Dropbox notified users that an unauthorized party accessed their accounts between 4 and 21 Aug 2026 because of “an issue with Lenovo’s email verification...
Covers Dec 2025 to Aug 2026.
Luminis Health (Anne Arundel Medical Center, Doctors Community Medical Center) suffered a cybersecurity incident that disrupted many network systems.
Attackers exploited CVE-2026-63077 (TeamCity deserialization, unauthenticated RCE, CVSS 9.8, disclosed by JetBrains 27 Jul) on the Cadence cloud-compute...
30 Aug 2026: the attacker inflated thinly traded TONIC about 100x in about 20 minutes and borrowed across nine markets, USD 120.4M in total per Cronos’s...
McKesson’s 8-K says it discovered “a cybersecurity incident affecting its information systems” on 25 Aug 2026.
CISA added five Linux kernel flaws to KEV between 27 Aug and 28 Oct 2026, including Fragnesia (CVE-2026-46300). Install a kernel with all five fixes and reboot.
27 Aug 2026: losses estimated at about USD 8.7M (CertiK, PeckShield) to USD 9.1M (BlockSec).
MAG said it detected an intrusion, restricted access and contacted impacted customers.
HIBP’s Troy Hunt counted more than 12.9 million real Carhartt accounts (emails, names, phone numbers, physical addresses) plus 15,000+ employee...
DOJ and FBI carried out a court-authorized disruption of QScan and QTRouter by seizing hard-coded domains.
Boston Scientific’s 8-K says it identified an incident on 25 Aug 2026 affecting certain IT systems that caused a “global disruption to the Company’s...
A DDoS attack starting 03:38 on 24 Aug 2026 disrupted ID-porten, Kontakt- og reservasjonsregisteret, Maskinporten, MinID, eFormidling, ELMA, eInnsyn...
20 to 25 Aug 2026: BlockSec estimates about USD 14.8M across the three disclosed chains.
Gujarat ATS arrested Jaseem Shahnawaz Ansari of Nadiad and booked a juvenile in May 2025 for over 50 DDoS attacks on central and state government sites...
23 Aug 2026: about USD 8.5M (about 2,843 ETH and 1.68M USDC) drained from six Ethereum vaults (PeckShield, CertiK, BlockSec).
The Hyderabad contract research and testing lab said it recently detected an incident affecting part of its IT infrastructure.
Lenskart disclosed a cyber incident at a sub-vendor of group company Lenskart Solutions Pte.
Bitdefender: about 65 infection instances (upper bound), mostly Asia, after a first detection around Oct 2025 at a government body involved in economic...
The Murugappa group electrical equipment maker disclosed a suspected cyber event on its IT systems with no impact on core systems and operations.
Sakura said hackers accessed its IT system on 9 Aug 2026 and the incident “may have impacted up to 1,360,563 member accounts” (contract and membership data.
The Delhi jeweller (NSE Emerge) said an impostor posing as company officials contacted its bank over WhatsApp and the bank transferred Rs 16,65,177 on...
Government notices reviewed by Reuters (one dated 17 Aug 2026) ordered Google to remove at least 57 websites and databases hosted on Firebase.
Shared Health said ransomware discovered on 10 Aug 2026 affected central HVAC monitoring (systems kept running under local monitoring) and the access-card...
Frontline identified unauthorized activity on 14 Aug 2026 (last activity 15 Aug) linked to “a vulnerability in a third-party software product” that gave...
The Ministry of Economy said an attacker accessed the DGFiP information system in June and July 2026 and consulted or extracted data on 678,000 individuals...
CIAD-2026-0039 says Apple issued threat notifications worldwide “including India” warning of mercenary spyware attempts.
Berlin’s data protection authority says attackers were active between 7 and 12 Aug 2026 in the networks of the Senate departments for Urban Development...
The court detected the attack around 05:30 on 10 Aug 2026; malicious software encrypted or blocked files and systems and the attackers demanded money.
A use-after-free in the Windows WinSock driver gave Lazarus SYSTEM rights to install a rootkit on defense targets. Install the August 2026 Windows update.
A default authentication client in SAP Commerce Cloud’s Data Hub Adapter lets attackers run code without logging in. Deploy 2211.55 or 2211-jdk21.17 now.
TCS told the exchanges it received threat-intelligence alerts alleging exposure of employee information.
FBI, CISA, DC3, NSA, US Secret Service and South Korea’s KNPA warn of Gunra (emerged Apr 2025, C/C++, reportedly built from leaked Conti code, RaaS...
HCLTech filed a clarification that a hacker group claimed potential exposure of limited HCLTech employee data.
Valve told European Steam hardware customers that “certain information about Steam customers, including you, was likely compromised” (names, addresses...
About 13:00 UTC 9 Aug 2026: investigator SpecterAnalyst estimated more than USD 7.9M (BlockWatchdog: about USD 8.07M).
Malicious software compromised city IT systems around 05:45 on 7 Aug 2026, hitting 911 routing, police and fire dispatch and records.
Framework notified “all customers” that attackers took names, emails, phone numbers and physical addresses (no payment data).
Levi’s SEC filing says “certain corporate information was accessed and exfiltrated” after social engineering of three employees compromised their...
FBI, EPA and CISA warned on 30 Jul that attackers remotely accessed water and wastewater systems in at least seven states, “resulting in a loss of...
Prompt injection in GitHub issues let attackers reach CI secrets through Claude Code, Gemini CLI and Codex. Upgrade, and keep untrusted input away from secrets.
Drains: about USD 3.14M from 431 accounts on 27 May 2026, about USD 2.55M from 30 May to 13 Jul, and about USD 40K on 20 to 21 Jul.
The government said an unknown perpetrator gained unauthorized access to the VwbP on the night of 30 Jul 2026 and copied data on about 31,000 legal...
The ministry said COLCERT’s preliminary findings show a ransomware infection on Sunday 2 Aug 2026.
An incomplete fix let attackers bypass login and take over N-central admin accounts; exploited. Self-hosted servers need 2026.3.1.14 (HF4) or later.
PNLD (run by West Yorkshire Police) identified an incident on 26 Jul 2026.
On Saturday 1 Aug 2026 malware affected about 10 Uttarakhand government sites, including the Chief Minister’s Relief Fund, PWD, Food and Civil Supplies...
Amar Ujala reports police cyber crime officials described unauthorised entry into the RPSC recruitment portal and tampering with exam results, candidate...
AdaptHealth (home medical equipment provider) reported 4,115,802 affected.
30 Jul 2026: first wave drained about 1,083 BTC from 1,196 addresses in 41 minutes (Galaxy Research).
Unauthenticated root code execution through vCenter’s syslog server, exploited since early August. Update to 8.0 U3k, 9.0.2.0100 or 9.1.0.0300.
VulnCheck found 1.3% of AI-found vulnerabilities exploited in 1H 2026, the same as all bugs. Patch AI-found CVEs by exposure, not by how they were found.
The attack was detected shortly after 02:00 on 28 Jul 2026, less than 24 hours before Unitel’s IPO.
RingCentral said systems were compromised following a “sophisticated social engineering campaign”, impact limited to a portion of customers, core platform...
Minnesota IT Services (MNIT) said “more than 30 water systems throughout the state were impacted” on 26 and 27 Jul 2026.
Bank of Baroda says a compromised employee email account exposed “certain data” after TripleX posted files said to hold KYC and loan documents on 24 Jul 2026.
Bank of Baroda (public sector bank) said on X: “The incident involved compromise of an employee’s email account, resulting in unauthorised access to...
First flagged 24 Jul 2026. Losses estimated at about USD 11.8M (Specter), up from USD 9.3M; PeckShield put it above USD 9.7M.
Night of 17 to 18 May 2026: about USD 11.58M (1,625 ETH, about 103 tBTC, 147K USDC) for about USD 10 in fees.
CISA, NSA, FBI and partners: Russian APT LAUNDRY BEAR exploited CVE-2025-66376 in Zimbra Collaboration Suite so that viewing an email in vulnerable webmail...
The Ahmedabad chemical maker (NSE Emerge) said an unknown party gained access to the Managing Director’s WhatsApp account and issued payment instructions...
FBI, CISA, NSA, EPA, DOE, CNMF and Treasury: Iranian-affiliated APT actors seeking disruptive effects connected to exposed Rockwell CompactLogix/Micro850...
Chick-fil-A said attackers ran an automated attack 17 to 19 Jun 2026 “using account credentials ... obtained from a third-party source”, accessing...
22 Jul 2026, Arbitrum: about USD 24.15M USDC drained from AFX’s own custody bridge, moved to Ethereum and swapped to about 12,467 ETH.
Between 14:46 and 14:55 UTC 20 Jul 2026 (detected 21 Jul): about 515M NIGHT tokens drained from the bridge treasury, valued at about USD 9M to 13M.
Upbound’s SEC filing says it “experienced cybersecurity incidents in which certain non-sensitive customer information and other documents were obtained...
Notice: “We became aware of a cybersecurity issue involving a vulnerability in the Oracle E-Business Suite system”; compromise on or around 9 Aug 2025.
Dormant RubyGems accounts pushed a fake git_credential_manager that installs a backdoor daemon on developer laptops. Check Gemfile.lock and ~/.local/share/gcm.
HIBP (added 19 Jul 2026): 23.3 million email addresses with names, addresses, dates of birth, bank account numbers, payout and transaction histories...
Nichirei’s systems were hit on 13 Jul 2026 and disconnected; operations at Nichirei Logistics Group refrigerated warehouses and Nichirei Foods shipping...
World Leaks posted 18,997 files (about 14.3 GB) tagged to Kudankulam, part of a 1.2 TB Reliance Infrastructure dataset, reportedly available on its leak...
Hugging Face disclosed that internal datasets and service credentials were compromised and urged users to rotate tokens and keys stored on the platform.
EY’s notice: an unauthorized party accessed a third-party support ticket system used by EY IT staff between 28 Mar and 12 Apr 2026 and downloaded documents.
Coca-Cola announced unauthorized access to part of fairlife’s systems, “including production-related systems”, in connection with a ransomware event.
Sky Gold said its subsidiary Starmangalsutra Pvt Ltd lost Rs 10.70 crore after unknown persons gained access to an employee’s company-issued phone and...
Reuters (15 Jul) reported nearly 19,000 files linked to the Kudankulam nuclear project, among 858,000 Reliance files on World Leaks’ site.
15 Jul 2026, Arbitrum: about USD 23.75M drained from the OLP vault in eight payouts (BlockSec).
Three exploited flaws in on-premises SharePoint 2016, 2019 and Subscription Edition chain to code execution. Install the July 2026 update, rotate machine keys.
The attack froze ANCPI email and the e-Terra cadastre application, blocking mortgage registrations, building-permit applications and cadastral requests...
Microsoft (13 Jul 2026) identifies three paths: vishing to get malicious connected apps approved, OAuth tokens stolen from vendors, and misconfigured...
Lidl said “unknown individuals briefly gained access to a separately stored file containing customer data” (salutation, name, phone, email, date of birth...
NSA, CISA, FBI, DC3 and 15 allied agencies attribute router targeting across communications, DIB, energy, finance, government and healthcare to Russian FSB...
11 Jul 2026: about USD 9M lost (6.63M USDC and 34.5M wrapped HBAR borrowed against 250 SAUCE worth a few dollars).
Maine AG filing: 6,998,886 people. Data: names, contact info, policy and claims information, driver and vehicle information and driver’s licence numbers.
npm 12 skips dependency install scripts and refuses git and URL dependencies unless allowed. Upgrade, run npm approve-scripts and commit the allowlist.
Accenture confirmed a security incident and said it had remediated the source of an “isolated matter” with no operational impact; it did not describe the data.
6 Jul 2026: about USD 6M in DAI drained (PeckShield).
6 Jul 2026, Solana: about 4.43T BONK (about USD 20.5M per Hypernative; USD 21.2M per QuillAudits) moved from the community treasury.
The Ahmedabad agrochemical maker disclosed (2 Jul) a cyber incident affecting non-core IT systems that “appears to involve ransomware”.
C-Track Canada found unauthorized activity on 30 Jun 2026; an unauthorized party had obtained certain files in March 2026 from systems serving the Court of...
Reported to HHS OCR in July 2026 (HIPAA Journal): Aesto, LLC 9,540,683 individuals (at least 39 healthcare clients.
Aflac’s SEC filing (30 Jun) says a third party “unlawfully accessed certain of Aflac Japan’s systems” from 15 to 25 Jun 2026.
KDDI said attackers breached an email system it operates for itself and five ISPs (STNet, JCOM, Chubu Telecommunications, NIFTY, BIGLOBE) on 16 May 2026.
Acronis TRU found active compromises of Indian government systems, including machines tied to senior administrative staff, beaconing 12 to 22 Jun 2026.
PTI (via ThePrint) reported the MDA homepage replaced by a black screen with pro-Pakistan messages and slogans on Saturday 27 Jun 2026.
The Coimbatore sugar company said a cyber security incident occurred at its distillery unit in Tamil Nadu at about 4:40 pm on 27 Jun 2026.
Confirmed 25 Jun 2026: about USD 2.94M taken from at least 11 user wallets (Specter); Bubblemaps counted fewer than 15 accounts.
Europol-coordinated action: 326 servers and 142 domains actioned, over EUR 41M (about $47M) in crypto flagged and restricted, 27M stolen credentials...
Tata Electronics told Recorded Future News it detected the breach “a few weeks ago” and that operations were unaffected; it declined to say what was stolen.
Bajaj Auto disclosed a ransomware attack at about 08:00 IST on 23 Jun 2026 impacting its systems and those of wholly owned subsidiary Bajaj Auto Technology...
Xsolis (utilization management software) reported 1,396,519 individuals: a phishing email in Jan 2026 gave the actor four days of access.
Between 23:41 on 19 Jun and 01:23 on 20 Jun 2026, someone outside the civil defence system triggered 10 unauthorized alerts through the national Defesa...
The Navi Mumbai IT and supply-chain software firm reported a suspected incident on 18 Jun 2026 involving compromise of one employee’s email account.
Klue said it found “unauthorized activity affecting a portion of Klue’s integration infrastructure” on 12 Jun.
Kodak confirmed an unauthorized party gained “temporary access” to a limited amount of company data and said it is “confident there is no threat to our...
Ahmedabad Cyber Crime Branch, working with NTA, arrested Navinkumar Yadav, 19, of Gaya, Bihar.
An unauthenticated endpoint in Splunk Enterprise 10.0 and 10.2 lets attackers write files and run code. Exploited. Update to 10.2.4 or 10.0.7.
A pre-auth flaw in PeopleTools 8.61 and 8.62 was used by ShinyHunters to steal data, mostly from universities. Apply Oracle’s fix and block /PSEMHUB/.
CISA’s BOD 26-04 sets patch deadlines by exposure, KEV status, automation and impact; the riskiest get 3 days. Track KEV dueDate and forensicTriage.
A CVSS 10 command injection in Ivanti Sentry gives unauthenticated root. Exploited after a public PoC. Update to R10.5.2, R10.6.2 or R10.7.1; close port 8443.
Unauthorised activity was identified on 9 Jun 2026 in the Campus Solutions (PeopleSoft) student records platform, run in an isolated third-party-maintained...
ServiceNow notified affected customers of “anomalous activity” in which an unauthenticated access flaw in an API endpoint was used to query data from...
Hijacked releases of ensmallen and other graph ML, bioinformatics and AI packages stole CI secrets on import. Kill gh-token-monitor before revoking tokens.
An IKEv1 flaw lets attackers open Check Point remote access VPN sessions with no password. Exploited since 7 May 2026. Install sk185033 or force IKEv2.
Meta’s Maine AG filing and statements: 20,225 Instagram accounts were hijacked through the AI-assisted “High Touch Support” recovery tool.
8 to 9 Jun 2026: about USD 36M lost. About 141M H drained from the Ethereum bridge lockbox, and more than 122B H minted on BNB Smart Chain against a prior...
7 Jun 2026: about 5B SYS (about USD 9M to 10M) released without authorization on the UTXO side.
DentaQuest announced in early June 2026 that it was investigating an incident in a limited part of its network.
The India-based smart-ring maker told TechCrunch attackers accessed an internal analytics system on 27 Mar 2026 and read customers’ wellness data, contact...
MediaNama, citing FalconFeeds, reported more than 100 compromised government and public-sector domains, including central ministries, a High Court, a...
Researcher Rylen Anil (16) reported on X that a public cloud storage endpoint for the JEE (Advanced) 2026 results portal was readable without...
UNI reports the cancer hospital’s IT team found a ransom note on its main server after an issue starting about 7:30 am on 1 Jun.
Drain 29 May 2026, first statement 30 May: about 4.35M USDC, 434K USDT, 274 WETH and 14.16 PAXG (about USD 5.4M) from Ethereum custody.
29 May 2026, BNB Chain: about USD 7.3M from about 1,400 legacy liquidity locks.
HIBP found about 4.9 million unique email addresses (names, phone numbers, physical addresses) plus about 85,000 internal employee-directory records with...
Carnival’s Maine filing: 5,995,277 people.
Bengaluru researcher Nisarga Adhikary reported five critical flaws in CBSE’s OnMark On-Screen Marking portal.
34 lure packages on npm, PyPI and crates.io stole keys, wallets and cloud credentials and planted AI-agent rule files. Check for the names and rotate secrets.
unimed detected the attack on 14 Apr 2026; attackers tried and failed to encrypt systems but took data from a limited area, including billing-dispute...
durabletask 1.4.1, 1.4.2 and 1.4.3 stole cloud, Kubernetes and Vault secrets on import on Linux. Check for pgsql-monitor.service, then rotate and rebuild.
Two exploited Defender bugs let a local user gain SYSTEM or disrupt Defender. Check for engine 1.1.26040.8 and platform 4.18.26040.7 or later on every machine.
Reported 19 May 2026 by PeckShield and Lookonchain: about 1,000 eBTC minted (notional about USD 76.7M).
7-Eleven’s notification letters (sent 1 May 2026) say an unauthorized third party accessed systems used to store franchisee documents on 8 Apr 2026...
Exchange filing of 18 May 2026: a cyber-security incident on 16 May 2026, “a communication from an anonymous source claiming access to certain portions of...
15 May 2026: about USD 10.7M (first estimated USD 7.4M) drained from one of five Asgard vaults.
Lumexa first reported 2,994 affected to HHS OCR and later updated the count to 5,830,949, making it the largest healthcare breach of H1 2026 per HIPAA Journal.
Texas Cyber Command detected an incident on 13 May 2026 at the vendor that sells TPWD hunting and fishing licenses.
OpenAI said two employees’ devices were impacted and it found unauthorized access to, and theft of “only limited credential material” from, a limited set...
A CVSS 9.8 Netlogon overflow lets an unauthenticated attacker crash or take over Windows domain controllers. Install the May 2026 update on every DC.
Foxconn confirmed “Some of Foxconn’s factories in North America suffered a cyberattack” and said they were resuming normal production.
Poisoned TanStack packages stole an Nx developer’s GitHub token. A trojaned Nx Console release then hit GitHub and Grafana. Check installs, rotate tokens.
Inditex confirmed unauthorized access to databases hosted by a third-party technology provider (not named) in April 2026.
A trending Hugging Face repo posing as OpenAI’s Privacy Filter ran a loader that installs a Windows infostealer. Check your HF cache; rotate browser sessions.
West detected an intrusion on 4 May 2026 and on 7 May determined it had a “material cybersecurity attack”: data was exfiltrated and certain systems encrypted.
7 May 2026: about USD 5.87M on-chain (TrustedVolumes’ own accounting about USD 6.7M) drained from its inventory vault in one transaction.
Trellix said it “recently identified unauthorized access to a portion of our source code repository,” found no evidence that release or distribution was...
DigiCert’s incident report (Mozilla Bug 2033170): an attacker posing as a customer sent a malicious ZIP containing a .scr file through support chat on 2...
Braintrust, an AI evaluation and observability platform, confirmed unauthorized access to one of its AWS accounts that held org-level AI provider API keys...
BufferZoneCorp Go modules and knot-* gems stole SSH, cloud, npm, gh and kube credentials and tampered with GitHub Actions. Check go.mod and Gemfile.lock.
Instructure detected unauthorized activity in Canvas on 29 Apr 2026 and disclosed it on 1 May.
lightning 2.6.2 and 2.6.3 on PyPI stole credentials on import and spread via GitHub and npm. Check installs, rotate secrets, use 2.6.1 or 2.6.4+.
07:36 to about 07:50 UTC (reported 30 Apr to 1 May 2026): about USD 5M from Ethereum, Base and Blast (estimates USD 4.5M to 5.9M).
A kernel crypto bug lets any local user overwrite cached setuid binaries and get root, including from containers. Patch the kernel or disable algif_aead.
Pitney Bowes said it “identified unauthorized access to certain records in our Salesforce customer relationship management environment” on 9 Apr 2026...
elementary-data 0.23.3 on PyPI and its GHCR image ran a credential stealer via elementary.pth. Find 0.23.3, move to 0.23.4 or later, and rotate secrets.
ADT detected unauthorized access on 20 Apr 2026 and said “the information involved was limited to names, phone numbers, and addresses”, with dates of birth...
UK Biobank said it found de-identified participant data offered for sale on a consumer website operated by Alibaba.
Rituals said member data was downloaded from its “My Rituals” database: name, email, phone, date of birth, gender and home address depending on the customer.
Bloomberg, about 21 Apr 2026: a private Discord group had used Mythos since roughly 7 Apr, through a contractor’s still-valid credentials and guessing of...
A pre-auth SQL injection in LiteLLM proxy 1.81.16 to 1.83.6 exposes API keys and provider credentials. Exploited. Upgrade to 1.84.0 or later and rotate keys.
Vercel’s bulletin: an attacker compromised Context.ai, a third-party AI tool used by a Vercel employee, used it to take over the employee’s Google...
18 Apr 2026: about 116,500 rsETH (about USD 292M) released from KelpDAO’s LayerZero bridge contract on Ethereum against a burn on Unichain that never happened.
On shared Windows PCs, AI coding tools loaded system-wide config from a user-writable ProgramData folder. Update Claude Code to 2.1.75 and lock the folders.
HIBP (added 17 Apr 2026): 2.1M affected email addresses with names, physical addresses and support tickets.
08:22 to 09:42 UTC 16 Apr 2026: about USD 18.4M (early reports said USD 7.6M).
Theft around 15 Apr 2026, announced 16 Apr: about USD 15M (more than 1B roubles) per TRM; Grinex said about 1B roubles (about USD 13.7M).
Since 15 April 2026 NIST no longer adds severity scores or product data to most new CVEs. Tools that match on NVD data miss or misjudge risk.
Basic-Fit confirmed unauthorized access to a system that tracks member visits, exposing membership information, names, addresses, emails, phone numbers...
B.Tech student Ankit Thakur reported three flaws in UPI apps to Google’s security reporting channel from June 2025.
Booking.com said it “recently noticed some suspicious activity” in which unauthorized third parties could access some guests’ booking information.
Rockstar Games confirmed “a limited amount of non-material company information was accessed” and said “This incident has no impact on our organization or...
Blue Dart disclosed a low-severity cyber incident “within our parent group” with no sensitive or customer data breached.
Ransomware was detected on 7 Apr 2026 (attack began 6 Apr per The Record).
Seven 2026 Cursor CVEs let prompt injection or a cloned repo run code outside the sandbox. Update to 3.1.2 or later; the Windows git.exe bug has no stated fix.
CERT-EU: on 19 Mar an attacker used an AWS API key exposed through the compromised Trivy release, created a new access key on an existing user, ran...
Hasbro’s 8-K (Item 8.01) says it identified unauthorized access to its network on 28 Mar 2026 and was still reviewing which files may have been affected.
First withdrawal 16:06:09 UTC 1 Apr 2026: about USD 280M (Drift) to USD 285M (PeckShield) drained in about 12 minutes across 31 transactions.
A hijacked maintainer account published axios 1.14.1 and 0.30.4 with a dependency that installs a remote access trojan. Check lockfiles for plain-crypto-js.
A hacker accessed the 226-bed hospital’s network from 15 Jan 2026; it was identified on 31 Jan.
Mercor confirmed a security incident and told Fortune it was “one of thousands of companies” affected by the LiteLLM supply-chain attack.
nginx-ui’s /mcp_message endpoint let anyone rewrite nginx configs with no login; it has been exploited. Upgrade nginx-ui and keep port 9000 off the internet.
Exchange filing of 27 Mar 2026: RBI imposed a Rs 95,40,000 penalty.
The auto-components maker suspected an incident on 26 Mar and confirmed ransomware on 27 Mar 2026, with core systems and operations unaffected.
A stack overflow in FreeBSD’s kgssapi lets a remote client run code in the kernel of an NFS server. Update to 15.0-p5, 14.4-p1, 14.3-p10 or 13.5-p11 and reboot.
The Gujarat chemicals firm (listed as AGASTYAEN on NSE) said its website appeared hacked and information on it could not be accessed.
The largest US municipal health system announced on 24 Mar 2026 that it detected suspicious network activity on 2 Feb.
SAML IdP memory leaks and a Gateway memory bug in NetScaler ADC and Gateway were exploited in 2026. Update to 14.1-73.41 or 13.1-64.28 and end all sessions.
Crunchyroll confirmed the leaked data is legitimate and “primarily limited to customer service ticket data” tied to an incident at a third-party vendor...
From 01:50:59 UTC 22 Mar 2026: about 80M unbacked USR minted against about USD 100K to 200K of deposits, about USD 25M to 26.8M extracted (CertiK).
Unauthorized access ran from 22 Dec 2025 to 15 Jan 2026.
Poisoned Trivy and KICS actions and images, LiteLLM 1.82.7/1.82.8 and Telnyx 4.87.1/4.87.2 stole CI and developer secrets. Check, then rotate.
About 900,000 records, mostly names and email addresses from a marketing tool from Circle Media Labs (acquired 2021).
DOJ announced a court-authorized operation with Canada and Germany (Team Cymru adds the Netherlands and Europol’s PowerOFF) against botnets of 3M+ IoT...
NAC detected the incident on 6 Mar 2026 and published a notice on 16 Mar describing “unauthorised access to network infrastructure and administrative accounts”.
Exchange filing of 13 Mar 2026: a SEBI Adjudicating Officer imposed Rs 10,00,000 for violations of the Cyber Security and Cyber Resilience Framework and...
Telus confirmed “unauthorized access to a limited number of our systems” and said it was still determining what was taken and which customers were affected.
Stryker confirmed a cyberattack that disrupted its internal Microsoft environment worldwide.
Nearly Rs 7 crore was taken from four branches (Talaja, Bharatnagar, Subhashnagar and Sidsar) in transactions processed on a Sunday when the bank was closed.
Loblaw’s notice says an unauthorized third party accessed customer information after activity detected around 5 Mar 2026.
Salesforce confirmed a campaign in which attackers mass-scanned public Experience Cloud sites, probed the /s/sfsites/aura endpoint and, where guest user...
HungerRush (POS platform for 16,000+ restaurants) said a third-party vendor’s compromised credentials were used to breach its email marketing service...
LexisNexis confirmed “an unauthorized party accessed a limited number of servers” holding what it called legacy, deprecated data from before 2020, and said...
CIG said a “systematic and sophisticated attack” gave read-only access to some backup systems holding basic account details (names, usernames, contact...
26 Feb 2026: an NTS press release about raids on 124 tax evaders included an unredacted photo of a seized Ledger device and its handwritten recovery phrase.
ManoMano said its investigation found 38 million individuals affected: names, emails, phone numbers and customer service communications.
Two exploited CVSS 10 peering bypasses give admin on Cisco Catalyst SD-WAN controllers. Upgrade to the May 2026 fixed releases and hunt for rogue peers.
Wynn said “an unauthorized third party acquired certain employee data” and that the attacker “has stated that the stolen data has been deleted.” Secondary...
Optimizely notified customers that attackers took basic business contact information from certain internal business systems, CRM records and a limited set...
22 Feb 2026 UTC: more than USD 10M lost (1M USDC and 61.2M XLM borrowed).
Have I Been Pwned loaded 12.5 million affected email addresses on 22 Feb 2026.
21 Feb 2026: at least USD 4.4M per IoTeX’s revised write-up (first said about USD 2M; PeckShield estimated over USD 8M including minted assets).
An attacker using commercial AI models compromised over 600 FortiGate devices in 55+ countries through exposed admin ports and reused passwords, not CVEs.
Detected early on 19 Feb 2026. The attack hit UMMC’s network and many IT systems including its Epic EHR.
PayPal told customers that an error in its PayPal Working Capital (PPWC) application exposed business contact details, Social Security numbers and dates of...
The pharma API maker said it noticed unauthorised access to computer server data at its Khopoli factory.
HIBP (added 18 Feb 2026): 967.2k affected addresses with names, dates of birth, phone numbers and physical addresses, data dating to January 2026.
A Ghost SQL injection (3.24.0 to 6.19.0) leaks Admin API keys and was used to inject ClickFix scripts. Update to 6.19.1, rotate keys, clean posts.
18:01 UTC 15 Feb 2026, when governance proposal MIP-X43 executed: 1,096.317 cbETH liquidated, about USD 1.78M (USD 1,779,044.83) bad debt.
Google patched seven Chrome bugs exploited in the wild from February to September 2026. Update Chrome and any bundled Chromium to 153.0.8010.36 or later.
TechCrunch reports researcher Eaton Zveare found insecure admin APIs that let anyone create super-admin accounts on the pharmacy chain’s platform, exposing...
Odido said attackers accessed its customer contact system on 7 Feb 2026 and downloaded data on more than 6.2 million customers (including Ben NL and former...
Apple patched two zero-days used in targeted attacks in 2026. Update to iOS 26.7.1, macOS 26.7.1 or 15.8.1, or iOS 18.7.11 on older iPhones.
Copilot CLI, the JetBrains plugin and VS Code had command-injection CVEs in 2026. Update to Copilot CLI 0.0.423, JetBrains plugin 1.5.63 and VS Code 1.132.1.
CSA: UNC3886 targeted M1, SIMBA, Singtel and StarHub, gained limited access to some critical systems and exfiltrated a small amount of mainly...
DAF, which manages national ID cards, passports and biometric data, warned residents of a cyberattack and temporarily suspended operations.
Unauthenticated command injection in self-hosted BeyondTrust Remote Support and PRA, exploited since 31 Jan 2026. Patch to RS 25.3.2 or PRA 25.1.1 and hunt.
Norway’s Police Security Service (PST) National Threat Assessment 2026 says Salt Typhoon, believed to work for the Chinese government, broke into several...
Flickr said a vulnerability in a system run by one of its third-party email service providers “may have allowed unauthorized access to some Flickr member...
CEO Chris Best said that on 3 Feb Substack found “a problem with our systems that allowed an unauthorized third party to access limited user data”.
The attack on 1 Feb 2026 began with unauthorized access; about 400 physical and virtual servers were involved and data on compromised systems encrypted.
Acronis TRU reported APT36 targeting staff of Indian startups, especially OSINT and cybersecurity firms near government and law-enforcement work, using a...
Claude Code fixed CVEs in 2026 that let prompt injection skip approvals, escape the sandbox or leak data. Update to 2.1.163 or later; three CVEs were rejected.
Attackers hijacked Notepad++ update traffic for months and served a backdoor to chosen targets. Update to 8.9.2 or later and hunt for the listed indicators.
A crafted link stole the OpenClaw gateway token and gave one-click RCE, and ClawHub served stealer skills. Update to 2026.2.14 or later and review every skill.
31 Jan 2026 (APAC hours): about 261,854 SOL unstaked and moved.
HIBP loaded 5.1M unique emails from a 14M-record dataset (names, phone numbers, physical addresses).
CERT Polska says coordinated attacks on 29 Dec 2025 hit more than 30 wind and photovoltaic farms, a private manufacturing company and a combined heat and...
CERT Polska (30 Jan): on 29 Dec 2025 attackers damaged RTU firmware at 30+ wind and solar grid connection points (communication with the DSO lost...
Two mass-exploited CVSS 9.8 bugs give unauthenticated code execution on on-prem Ivanti EPMM. Apply the RPM fix, reapply after upgrades, hunt for web shells.
Match Group confirmed an incident involving “a limited amount of user data” and is notifying affected users, with “no indication that login credentials...
Attackers with their own FortiCloud account logged in to other customers’ FortiGates via FortiCloud SSO and added admins. Upgrade, then hunt for rogue admins.
A malicious Office file can bypass OLE protections; APT28 used it in RTF phishing. Install the 26 Jan Office 2016/2019 updates and restart Microsoft 365 apps.
TriZetto, a healthcare revenue-cycle business associate, identified suspicious activity on 2 Oct 2025 in a web portal its provider clients use.
Mandiant (30 Jan 2026) reported an expanding ShinyHunters-branded campaign that uses voice phishing plus lookalike credential sites (for example...
Detected 25 Jan 2026 on Ethereum, Arbitrum, Base and BSC: SwapNet about USD 13.41M, Aperture about USD 3.67M (two separate incidents, over USD 17M combined).
curl closed its HackerOne bug bounty on 31 January 2026 to stop paying for invented AI reports. How maintainers can filter the flood without missing real bugs.
HIBP (added 21 Jan 2026): about 72.7M email addresses with names, dates of birth, genders, locations and purchase details, leaked on a hacking forum in...
21 Jan 2026: about USD 7M in USDC withdrawn, bridged out and converted to ETH.
Grubhub said “unauthorized individuals ... recently downloaded data from certain Grubhub systems” and that “Sensitive information, such as financial...
Eurail disclosed in mid-January that identity, contact and passport information was compromised after hackers breached its systems on 26 Dec 2025.
AZ Monica detected “a serious disruption in the computer systems” on 13 Jan 2026 and shut down servers at its Antwerp and Deurne campuses.
Betterment detected unauthorized access to internal systems on 9 Jan 2026.
About 23:00 UTC 10 Jan 2026: ZachXBT reported one victim lost about 2.05M LTC and 1,459 BTC (about USD 282M).
8 Jan 2026: about 8,535 ETH (about USD 26.4M to 26.6M) drained.
A CVSS 10 n8n flaw lets anyone read server files through form workflows; chained with CVE-2025-68613 it gives code execution. Upgrade to n8n 1.122.0 or later.
IDHS found on about 22 Sep 2025 that an internal-only mapping website was publicly accessible.
CloudSEK (reported by The Hacker News) documented emails with decoy PDFs posing as Income Tax Department correspondence.
zlib-compressed message handling leaks uninitialized heap memory without authentication.
The Pune auto-components maker said an incident occurred on its IT infrastructure on 23 Dec 2025.
CIAD-2025-0055 says attackers send “Hi, check this photo” from a hijacked contact, lead victims to a fake Facebook viewer that asks them to “verify” with...
CYFIRMA analysed “RTO Challan_v10.0.apk”, first seen October 2025 and sent over WhatsApp as official traffic-violation alerts with fake challan and vehicle...
An unauthenticated RCE in React Server Components hit Next.js App Router apps by default. Exploited within hours. A related RCE was fixed in October 2026.
CIAD-2025-0047 (Critical) says CERT-In/CSIRT-Fin saw a surge of attacks on Palo Alto Networks firewalls “particularly those deployed within the BFSI sector...
Disclosed by Wiz in Dec 2025. Unpatched for weeks.
Civil Aviation Minister K. Rammohan Naidu told the Rajya Sabha (written reply) that “some flights reported ...
SEBI imposed a Rs 5 lakh penalty on the broker for breaches of the cybersecurity and cyber resilience framework over 1 Apr 2023 to 31 Oct 2024.
A self-replicating npm worm runs at install time, steals developer and CI secrets, and registers rogue GitHub runners. New waves hit from April to August 2026.
Medi Assist Healthcare Services said its step-down subsidiary Paramount Health Services and Insurance TPA experienced a cyber incident affecting some...
The company said a cyber incident affected some IT assets, which were isolated; operations unaffected.
KEV: 14 Nov 2025 and 18 Nov 2025. Exploited silently before disclosure.
A Chinese state-sponsored group used Claude Code through MCP tooling against about 30 targets.
Responding to an NSE query about a LiveMint report (“Hackers dupe Dr Reddy’s Laboratories of Rs 2.16 crore”), the company said the incident involved...
VARIndia reported that the Cyber Crime Wing’s data centre (commissioned 30 Sep 2024 under the State Grid Project.
The unauthenticated Ray Jobs API was used to build a self-propagating GPU cryptomining botnet (Oligo).
Fixed: runc 1.2.8, 1.3.3, 1.4.0-rc.3. Not exploited.
The Metro dev server bound to 0.0.0.0, and the `/open-url` endpoint allowed OS command injection.
200+ Salesforce instances.
TechCrunch reports researcher Eaton Zveare found private AWS keys in the source of Tata Motors’ E-Dukaan spare-parts portal, exposing hundreds of thousands...
CYFIRMA (22 Aug 2025) found spear-phishing ZIPs such as “Meeting_Notice_Ltr_ID1543ops.pdf_.zip” containing a .desktop file disguised as a PDF that curls a...
Out-of-band patch 23 Oct 2025. KEV: 24 Oct 2025.
Disclosed 15 Oct 2025. Long-term access to the BIG-IP development environment.
The Singapore High Court sanctioned the creditor-approved scheme of Zettai Pte Ltd (WazirX’s parent) with modifications, announced 13 Oct 2025.
TechCrunch reported a flaw found in September 2025 by researchers Akshay CS and “Viral”.
On the night of 6 Oct 2025 attackers made 1,782 unauthorised transfers to 656 bank accounts in about two and a half hours; about Rs 10 crore was recovered.
Oracle alert 4 Oct 2025. CVSS 9.8, unauthenticated RCE in BI Publisher integration.
Disclosed 3 Oct 2025 (Wiz). CVSS 10. A 13-year-old bug.
About 28k internal repos and 570GB stolen, including about 800 customer engagement reports containing credentials and infrastructure details.
126 packages, about 86k downloads. Dependencies pulled from an attacker URL, invisible to scanners.
Wiz found 550+ secrets in published extensions, including publisher PATs that could push malicious updates.
Oct 2025: self-propagating extensions using invisible-Unicode code and Solana/Google Calendar C2.
Legit Security. Hidden PR comments plus a Camo image-proxy alphabet leaked secrets and code.
Fixed: sudo 1.9.17p1. KEV: 29 Sep 2025.
KEV: 29 Sep 2025. Used by Storm-1175 (Medusa ransomware).
UpGuard found a public Amazon S3 bucket with about 273,000 PDFs of completed National Automated Clearing House (NACH) forms (account numbers, amounts...
UpGuard found on 26 Aug 2025 a public Amazon S3 bucket with 273,160 PDFs (about 210 GB) of NACH transaction forms.
KEV: 25 Sep 2025. Emergency Directive ED 25-03.
RBI imposed a Rs 3.75 lakh penalty by order dated 17 Sep 2025 because the bank did not report incidents such as “unplanned downtime” that caused...
During an internal audit on 15 Sep 2025 the bill, rent and education payments firm found unauthorised transactions of Rs 1,39,95,215.
MobiKwik told exchanges that registered merchants and users in Haryana obtained unauthorised settlements on 11 and 12 Sep 2025.
Phishing domain npmjs.help. Malicious chalk 5.6.1, debug 4.4.2, ansi-styles 6.2.2, strip-ansi 7.1.1 and 14 others.
The Mumbai real-estate developer reported a malware incident affecting select IT systems; business as usual and relevant authorities notified.
IHCL disclosed on 4 Sep 2025 a malware incident affecting select IT systems, with action to contain it and authorities notified.
v1.0.16 silently BCC’d every email sent through the tool to the attacker.
Tata Motors filed JLR’s statements to the exchanges from 1 Sep 2025 (“global IT issues impacting our business”), through the 29 Sep update on phased...
Stolen accounts pushed a malicious “Github Actions Security” workflow that sent secrets to an attacker endpoint.
Stole Solana and Ethereum keys from source files.
Nextron Systems analysed “Note_Warfare_Ops_Sindoor.pdf.desktop”, which opens a decoy PDF while staged components (an AES decryptor, a downloader) install a...
Root cause: a `pull_request_target` workflow injection stole the npm token.
CVE-2025-24085, CVE-2025-24200, CVE-2025-31200 / -31201, CVE-2025-43300 (ImageIO, KEV 21 Aug 2025, used against WhatsApp users with CVE-2025-55177)
8 to 18 Aug 2025. Stolen Drift OAuth and refresh tokens were used to bulk-export Salesforce objects, which were then searched for AKIA keys, passwords and...
Delhi Police IFSO announced 18 arrests on 16 Aug 2025.
RomCom zero-day. Fixed: WinRAR 7.13. KEV: Aug 2025.
ESET found it. It turned out to be an NYU research prototype.
Emergency Directive ED 25-02. Not exploited.
Flare found 10k+ images leaking credentials.
Prompt injection got Copilot to write `chat.tools.autoApprove` into `.vscode/settings.json`, enabling RCE.
CurXecute: prompt injection could write `.cursor/mcp.json` and get RCE.
Cymulate “InversePrompt”. Fixed: 0.2.111 and 1.0.20.
Claude Code was used to automate reconnaissance, intrusion and ransom-note writing against 17 organizations.
CVSS 10. KEV: 28 Jul 2025.
Star Health’s exchange filing of 26 Jul 2025: an IRDAI order dated 25 Jul 2025 levied Rs 3,39,00,000 under the IRDAI Information and Cyber Security...
CEO Sumit Gupta disclosed on Saturday 19 Jul 2025 that an internal account “used only for liquidity provisioning on a partner exchange” was compromised.
Exploited as a zero-day from 18 Jul 2025 (Eye Security).
CVE-2025-31161: KEV 7 Apr 2025. Disclosure was messy (CVE-2025-2825 dispute).
Disclosed 17 Jun 2025. Memory over-read leaks session tokens.
Disclosed 8 Jul 2025. `git clone --recursive` of a malicious repo leads to hook execution (macOS and Linux).
Max Financial Services disclosed on 2 Jul 2025 that its insurance subsidiary received a communication from an anonymous sender about “unauthorized access...
Legacy Firebase storage was left open: about 72k images including IDs, then 1.1M direct messages.
A malicious MCP server’s OAuth `authorization_endpoint` led to RCE on the client.
A precursor to the Mythos story: an AI agent found a bug that was “known only to threat actors”.
A prompt-injected README plus a weak allowlist check ran hidden commands.
Maintainer phished through the `npnjs.com` lookalike domain.
The water-infrastructure company said fraudsters impersonating someone manipulated an employee into transferring Rs 11.15 crore to unidentified accounts...
v1.84.0 shipped a prompt injection telling the agent to wipe local and AWS resources.
MediaNama reports the 10-minute food delivery startup’s Firebase database had no access rules, so anyone with the API key embedded in the app could read...
PTI reports that at TCS’s AGM on 19 Jun 2025 independent director Keki Mistry said the M&S incident “is currently under review and investigation by the...
Digital Health News reports both north Delhi hospitals’ servers were hacked late on the night of 10 to 11 Jun.
Zoomcar Holdings (Bengaluru, Nasdaq-listed) filed an 8-K Item 1.05.
On 9 Jun 2025 someone sold the digital gold of 435 customers on the ABCD app and moved the money to several bank accounts; estimated loss Rs 1.95 crore.
Unauthenticated localhost proxy plus the 0.0.0.0-day browser bug led to RCE from a website.
Aim Labs. A crafted email caused Copilot to leak tenant data through markdown image and link fetches.
The quick-commerce startup said attackers accessed its AWS and GitHub root accounts around 24 to 25 May 2025 (discovered 26 May) and deleted EC2 servers...
Seqrite Labs (published by Quick Heal) tracked spear-phishing from 17 Apr 2025 against government mail and defence (MoD, Army, Navy, DRDO) and counted 650+...
KEV: 19 May 2025. Expression-language injection originating in an open-source library.
Alkem disclosed that email accounts of certain employees at the US subsidiary of Enzene Biosciences were compromised, resulting in a fraudulent transfer of...
Maharashtra Cyber said seven APT and hacktivist groups (APT36, Pakistan Cyber Force, Team Insane PK, Mysterious Bangladesh, Indo Hacks Sec, Cyber Group...
Fraudsters used a customer’s mobile banking app (Hatli branch, Chamba) to send Rs 11.55 crore to 20 accounts on 11 and 12 May 2025.
Storyboard18 reported a PIL filed in February 2025 by IT lawyer Ruzbeh Raja in the Bombay High Court listing 20 government department websites carrying...
Pre-auth `exec()` in `/api/v1/validate/code`.
Teiss reported that the website of defence PSU AVNL was defaced with Pakistan’s Al Khalid tank and flag and the message “Your armoured factory is now owned...
RBI’s order dated 29 Apr 2025 (released 2 May 2025) penalised the bank under the Cyber Security Framework, KYC and card directions.
KEV: CVE-2025-3928 on 28 Apr 2025. CVE-2025-34028 on 2 May 2025.
Seqrite found PDFs (“Action Points & Response by Govt Regarding Pahalgam Terror Attack.pdf”, “Report Update Regarding Pahalgam Terror Attack.pdf”) created...
education.rajasthan.gov.in showed “Pakistan Cyber Force” content calling the Pahalgam attack an “internal conspiracy” (ETV Bharat).
Disclosed 24 Apr 2025. CVSS 10. Exploited as a zero-day.
Disclosed 16 Apr 2025. CVSS 10. Unauthenticated SSH connection-protocol messages lead to RCE.
Seqrite tracked SideCopy activity from late December 2024 (phishing dated 13 and 15 Jan 2025) using decoys for the National Defence College (NDC-65...
ANY.RUN analysed a dropper (IOC name “INDUSLND_BANK_E_KYC.apk”) that installs a second-stage base.apk posing as a banking app, collecting registered mobile...
The airline software firm said a cyber incident impacted part of group company Accelya Global’s IT infrastructure and that the group identified unlawful...
Disclosed 24 Mar 2025 by Wiz. Unauthenticated RCE through the admission controller, which can lead to cluster takeover.
Disclosed 21 Mar 2025. A spoofed `x-middleware-subrequest` header skips middleware entirely.
14 to 15 Mar 2025. All tags were repointed to a commit that dumped runner memory secrets into public logs.
Disclosed 10 Mar 2025. Exploited within about 30 hours of the PoC.
rose87168 claimed 6M records from 140k+ tenants through an unpatched Oracle Fusion Middleware flaw (CVE-2021-35587) on `login.*.oraclecloud.com`.
CVE-2025-2783 (Mojo sandbox escape, Mar 2025, Operation ForumTroll; KEV 27 Mar)
Exchange filing of 28 Feb 2025: the broker received “data leakage post” alerts from its dark-web monitoring partner on 27 Feb 2025 “informing of...
21 Feb 2025. A Safe developer’s macOS machine was compromised (TraderTraitor / Lazarus), and the AWS session was used to modify Safe’s S3-hosted front-end...
On 20 Feb 2025 the attacker emailed executives claiming access to customer data and insurance claims “until February 2025”, with a link to...
Raymond Ltd and Raymond Lifestyle filed identical disclosures that an incident affected some IT assets, which were isolated.
Disclosed 12 Feb 2025 (Assetnote). KEV: 18 Feb 2025.
The Revenue Department said DDoS-style attacks in December 2024 and January 2025 using bots and fake accounts degraded Kaveri 2.0 across all 252...
Windows: CLFS CVE-2025-29824 (KEV 8 Apr, ransomware).
Zimperium zLabs found about 900 to 1,000 malicious APKs spread over WhatsApp as government or banking apps, mainly targeting Indian bank customers.
Zimperium reported on 4 Feb 2025 almost 900 samples (over 1,000 apps analysed) spread through WhatsApp as APKs posing as government or bank apps.
ReversingLabs found models that evaded Picklescan by using 7z-compressed, broken pickles.
Backdoored typosquat of boltdb. The Go module mirror kept serving it for about 3 years.
Tata Technologies filed on 31 Jan 2025 that ransomware affected a few IT assets; some IT services were suspended and restored, client delivery unaffected.
Disclosed 14 Jan 2025. Node.js websocket module auth bypass to super-admin.
Decode (BOOM) reported that researcher Nilabh Rajpooth, browsing archived EPFO pages, found pension dashboards opened by changing a three-digit regional...
During a routine transfer from BDCC Bank to IDBI Bank on 10 Jan 2025, attackers altered account numbers and IFSC codes in the XML payment files while...
Disclosed and patched: 8 Jan 2025. Stack overflow, unauthenticated RCE.
Unauthenticated ClickHouse on the internet: 1M+ log lines, chat history and API secrets (Wiz).
Industry partners
