{"title":"Exploited in the wild","description":"Our advisories where exploitation is confirmed.","home":"https://vulnpocalypse.dev/feeds/","items":[{"id":"https://vulnpocalypse.dev/advisories/turla-cereal-malware-hides-in-exchange-servers-to-steal-email/","title":"Turla Cereal malware hides in Exchange servers to steal email","url":"https://vulnpocalypse.dev/advisories/turla-cereal-malware-hides-in-exchange-servers-to-steal-email/","date":"2026-11-12","summary":"Russia-linked Turla uses new Cereal malware inside Exchange servers at two government bodies; hunt for ESET indicators of compromise.","tags":["breach","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/github-issue-comment-injection-campaign/","title":"GitHub issue and PR comment injection: 83 hidden shell payloads hit workflows in 61 public repositories","url":"https://vulnpocalypse.dev/advisories/github-issue-comment-injection-campaign/","date":"2026-11-12","summary":"Hidden shell commands in GitHub issues, PRs and comments hit 61 repos, including Trivy and MLflow. Find workflows that put issue text into run steps.","tags":["supply-chain","github-actions","ci-cd","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/coinbase-amplitude-vendor-incident/","title":"Coinbase customer contact and transaction data exposed in an incident at analytics vendor Amplitude","url":"https://vulnpocalypse.dev/advisories/coinbase-amplitude-vendor-incident/","date":"2026-11-12","summary":"An incident at analytics vendor Amplitude exposed contact and some transaction data of Coinbase customers. Coinbase says its systems and funds were not hit.","tags":["breach","crypto","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/danfoss-refrigeration-defrost-attack-france/","title":"Supermarket fridges hijacked across Europe: internet-exposed Danfoss, Copeland and Dixell controllers forced into defrost","url":"https://vulnpocalypse.dev/advisories/danfoss-refrigeration-defrost-attack-france/","date":"2026-11-12","summary":"On 11 Oct and 2 Nov 2026, attackers forced European supermarket fridges, and France's blood service, into defrost via exposed refrigeration controllers.","tags":["breach","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/denmark-cpr-register-breach/","title":"Denmark CPR breach: 8.8 million names, addresses and CPR numbers pulled through one company's login","url":"https://vulnpocalypse.dev/advisories/denmark-cpr-register-breach/","date":"2026-11-12","summary":"Attackers used one firm's CPR access to pull names, addresses and CPR numbers of 8.8 million people in Sep 2026. A CPR number no longer proves identity.","tags":["breach","enterprise","web"]},{"id":"https://vulnpocalypse.dev/advisories/dmdc-pentagon-personnel-data-breach/","title":"Pentagon DMDC breach: SSNs of about 3 million people read from a file-sharing server for nine months","url":"https://vulnpocalypse.dev/advisories/dmdc-pentagon-personnel-data-breach/","date":"2026-11-12","summary":"A flaw in a Defense Manpower Data Center file-sharing system exposed unencrypted SSNs of about 3.05 million people with military ties, Oct 2025 to Jul 2026.","tags":["breach","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/bank-of-baroda-data-leak-2026/","title":"Bank of Baroda data leak: bank confirms employee email compromise after TripleX posts KYC and audit files","url":"https://vulnpocalypse.dev/advisories/bank-of-baroda-data-leak-2026/","date":"2026-11-12","summary":"Bank of Baroda says a compromised employee email account exposed \"certain data\" after TripleX posted files said to hold KYC and loan documents on 24 Jul 2026.","tags":["breach","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/check-point-vpn-cve-2026-50751/","title":"Check Point Remote Access VPN CVE-2026-50751: IKEv1 authentication bypass exploited since May 2026","url":"https://vulnpocalypse.dev/advisories/check-point-vpn-cve-2026-50751/","date":"2026-11-12","summary":"An IKEv1 flaw lets attackers open Check Point remote access VPN sessions with no password. Exploited since 7 May 2026. Install sk185033 or force IKEv2.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/bufferzonecorp-go-rubygems-ci-stealer/","title":"BufferZoneCorp: 10 Go modules and 7 knot-* Ruby gems stole CI secrets, planted SSH keys and rewired GitHub Actions","url":"https://vulnpocalypse.dev/advisories/bufferzonecorp-go-rubygems-ci-stealer/","date":"2026-11-12","summary":"BufferZoneCorp Go modules and knot-* gems stole SSH, cloud, npm, gh and kube credentials and tampered with GitHub Actions. Check go.mod and Gemfile.lock.","tags":["supply-chain","github-actions","ci-cd","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/beyondtrust-rs-pra-cve-2026-1731/","title":"BeyondTrust Remote Support and PRA CVE-2026-1731: pre-auth command injection exploited before disclosure and used by ransomware","url":"https://vulnpocalypse.dev/advisories/beyondtrust-rs-pra-cve-2026-1731/","date":"2026-11-12","summary":"Unauthenticated command injection in self-hosted BeyondTrust Remote Support and PRA, exploited since 31 Jan 2026. Patch to RS 25.3.2 or PRA 25.1.1 and hunt.","tags":["exploited","enterprise","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/microsoft-reports-threat-actors-using-gsocket-for-persistent-linux-c2/","title":"Microsoft reports threat actors using GSocket for persistent Linux C2","url":"https://vulnpocalypse.dev/advisories/microsoft-reports-threat-actors-using-gsocket-for-persistent-linux-c2/","date":"2026-11-11","summary":"Microsoft reports threat actors deploy GSocket on compromised Linux servers for persistent access; remove the client, not just patch the app.","tags":["ecosystem","web","endpoint","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/kaspersky-reports-citrus-ransomware-using-vless-tunnels-and-sn00py/","title":"Kaspersky reports Citrus ransomware using VLESS tunnels and Sn00py","url":"https://vulnpocalypse.dev/advisories/kaspersky-reports-citrus-ransomware-using-vless-tunnels-and-sn00py/","date":"2026-11-11","summary":"Kaspersky reports Citrus ransomware group uses VLESS tunnels and Sn00py; review contractor VPN and RDP access and GHOST machine accounts.","tags":["breach","enterprise","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/gbhackers-reports-fake-cloudflare-captcha-lures-hide-malware-in-png-images/","title":"GBHackers reports fake Cloudflare CAPTCHA lures hide malware in PNG images","url":"https://vulnpocalypse.dev/advisories/gbhackers-reports-fake-cloudflare-captcha-lures-hide-malware-in-png-images/","date":"2026-11-11","summary":"GBHackers reports Huntress research on fake Cloudflare CAPTCHA ClickFix lures that run PowerShell; never paste commands from a web page.","tags":["ecosystem","endpoint","web"]},{"id":"https://vulnpocalypse.dev/advisories/cisco-broadworks-cve-2026-20320-and-openwave-flaw-added-to-cisa-kev/","title":"Cisco BroadWorks CVE-2026-20320 and Openwave flaw added to CISA KEV","url":"https://vulnpocalypse.dev/advisories/cisco-broadworks-cve-2026-20320-and-openwave-flaw-added-to-cisa-kev/","date":"2026-11-11","summary":"CISA added exploited Cisco BroadWorks and Openwave flaws to its KEV list; patch now, federal deadline is November 24, 2026.","tags":["exploited","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/asec-reports-snakekeylogger-phishing-disguised-as-quote-requests/","title":"ASEC reports SnakeKeylogger phishing disguised as quote requests","url":"https://vulnpocalypse.dev/advisories/asec-reports-snakekeylogger-phishing-disguised-as-quote-requests/","date":"2026-11-11","summary":"ASEC reports phishing emails posing as quote requests deliver SnakeKeylogger through a JavaScript attachment; do not open such attachments.","tags":["ecosystem","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/microsoft-november-2026-patch-tuesday-exploited-outlook-zero-day/","title":"Microsoft November 2026 Patch Tuesday: exploited Outlook zero-day","url":"https://vulnpocalypse.dev/advisories/microsoft-november-2026-patch-tuesday-exploited-outlook-zero-day/","date":"2026-11-11","summary":"Microsoft's November 2026 Patch Tuesday fixes an exploited Outlook NTLM hash flaw, CVE-2026-124194; install the November updates.","tags":["exploited","enterprise","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/chrome-cve-2026-125350-zero-day-update-to-1570810350/","title":"Chrome CVE-2026-125350 zero-day: update to 157.0.8103.50","url":"https://vulnpocalypse.dev/advisories/chrome-cve-2026-125350-zero-day-update-to-1570810350/","date":"2026-11-11","summary":"Google patched an actively exploited Chrome XML use-after-free, CVE-2026-125350; update Chrome to 157.0.8103.50 or later and relaunch.","tags":["exploited","web","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/check-point-reports-three-china-nexus-campaigns-linked-via-sparrow-malware/","title":"Check Point reports three China-nexus campaigns linked via Sparrow malware","url":"https://vulnpocalypse.dev/advisories/check-point-reports-three-china-nexus-campaigns-linked-via-sparrow-malware/","date":"2026-11-11","summary":"The Hacker News reports Check Point links three China-nexus espionage clusters via Sparrow malware; review indicators and sideloading alerts.","tags":["breach","endpoint","network-edge","web"]},{"id":"https://vulnpocalypse.dev/advisories/wiz-says-attacker-abused-qubole-aws-role-access-in-customer-breaches/","title":"Wiz says attacker abused Qubole AWS role access in customer breaches","url":"https://vulnpocalypse.dev/advisories/wiz-says-attacker-abused-qubole-aws-role-access-in-customer-breaches/","date":"2026-11-11","summary":"Wiz says an attacker used a Qubole AWS account to access customer AWS accounts; Qubole users should check CloudTrail logs from October 1 onward.","tags":["supply-chain","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/operation-snowball-jailbroken-ai-agent-hits-european-telecom/","title":"Operation Snowball: Jailbroken AI agent hits European telecom","url":"https://vulnpocalypse.dev/advisories/operation-snowball-jailbroken-ai-agent-hits-european-telecom/","date":"2026-11-11","summary":"A jailbroken AI agent attacked a European telecom and 13 hosted organizations for two weeks; patch Cisco BroadWorks CVE-2026-20320 now.","tags":["ai-tools","ai-tools","network-edge","enterprise","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/ny-ag-says-perry-johnson-companies-breach-exposed-133m-peoples-data/","title":"NY AG says Perry Johnson companies' breach exposed 13.3M people's data","url":"https://vulnpocalypse.dev/advisories/ny-ag-says-perry-johnson-companies-breach-exposed-133m-peoples-data/","date":"2026-11-11","summary":"New York AG says a 2023 breach at Perry Johnson & Associates exposed 13.3 million people's data; check medical statements and credit reports.","tags":["breach","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/huntress-reports-ahsaycbs-intrusion-with-webshells-miner-and-c2-implant/","title":"Huntress reports AhsayCBS intrusion with webshells, miner and C2 implant","url":"https://vulnpocalypse.dev/advisories/huntress-reports-ahsaycbs-intrusion-with-webshells-miner-and-c2-implant/","date":"2026-11-11","summary":"Huntress reports attackers exploited AhsayCBS flaws to plant webshells, miners and a C2 implant; apply Ahsay hotfixes and hunt for leftover artifacts.","tags":["exploited","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/","title":"Ethersphere bee-js 13.3.0 and Swarm Desktop 0.56.2 compromised","url":"https://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/","date":"2026-11-11","summary":"Malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 steal Swarm wallet files; check for them and rotate keys on any affected host.","tags":["supply-chain","npm","nodejs","github-actions","crypto","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/","title":"Fake GitHub security tool repos spread AsyncRAT, Doctor Web reports","url":"https://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/","date":"2026-11-11","summary":"Doctor Web reports fake GitHub security tool repos infected over 2,000 PCs; inspect build steps before running any cloned project.","tags":["supply-chain","open-source","endpoint","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/sonicwall-sonicos-sslvpn-cve-2026-19868-exploited-cisa-says-in-kev-listing/","title":"SonicWall SonicOS SSLVPN CVE-2026-19868 exploited, CISA says in KEV listing","url":"https://vulnpocalypse.dev/advisories/sonicwall-sonicos-sslvpn-cve-2026-19868-exploited-cisa-says-in-kev-listing/","date":"2026-11-11","summary":"CISA says SonicWall SonicOS SSLVPN flaw CVE-2026-19868 is exploited and added it to KEV; find exposed devices and check SonicWall guidance.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/armorsteal-python-malware-kit-steals-data-and-mines-crypto-seqrite-reports/","title":"Armorsteal Python malware kit steals data and mines crypto, Seqrite reports","url":"https://vulnpocalypse.dev/advisories/armorsteal-python-malware-kit-steals-data-and-mines-crypto-seqrite-reports/","date":"2026-11-11","summary":"Seqrite reports Armorsteal, a Python kit that steals data and mines crypto on Windows; check for its scheduled tasks and Defender exclusions.","tags":["ecosystem","endpoint","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/openssh-alpine-musl-password-auth-bypass/","title":"OpenSSH password bypass on Alpine and musl without PAM: locked accounts accept long passwords","url":"https://vulnpocalypse.dev/advisories/openssh-alpine-musl-password-auth-bypass/","date":"2026-11-11","summary":"On Alpine and musl systems with sshd built without PAM, a locked account accepts any long password. Update openssh and restart sshd.","tags":["exploited","open-source","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/zyxel-gs1900-switch-zero-day-cve-2026-107441-lets-attackers-run-root-commands-be/","title":"Zyxel GS1900 switch zero-day CVE-2026-107441 lets attackers run root commands before login, now patched","url":"https://vulnpocalypse.dev/advisories/zyxel-gs1900-switch-zero-day-cve-2026-107441-lets-attackers-run-root-commands-be/","date":"2026-11-11","summary":"Zyxel GS1900 switches have a pre-auth RCE flaw, CVE-2026-107441, exploited in the wild and missed by the June patch, fixed October 22.","tags":["exploited","network-edge","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/fake-gta-vi-download-sites-push-malware-and-crypto-scams-ahead-of-the-november-1/","title":"Fake GTA VI download sites push malware and crypto scams ahead of the November 19 launch","url":"https://vulnpocalypse.dev/advisories/fake-gta-vi-download-sites-push-malware-and-crypto-scams-ahead-of-the-november-1/","date":"2026-11-11","summary":"Netcraft found fake GTA VI leaked builds, early access and mobile downloads that deliver flagged malware or demand crypto before the November 19 launch.","tags":["ecosystem","endpoint","crypto","web"]},{"id":"https://vulnpocalypse.dev/advisories/beget-hosting-cyberattack-wipes-cloud-data-vps-and-kubernetes-backups-lost/","title":"Beget hosting cyberattack wipes cloud data, VPS and Kubernetes backups lost","url":"https://vulnpocalypse.dev/advisories/beget-hosting-cyberattack-wipes-cloud-data-vps-and-kubernetes-backups-lost/","date":"2026-11-11","summary":"Attackers reached Beget's management systems and ran wipe scripts, destroying VPS, cloud storage and Kubernetes data and all binary VPS backups.","tags":["breach","cloud","web","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/artex-ai-framework-exposed-korean-banks/","title":"ARTEX AI pentest operators exposed their own servers, revealing an agentic hacking campaign against South Korean banks","url":"https://vulnpocalypse.dev/advisories/artex-ai-framework-exposed-korean-banks/","date":"2026-11-11","summary":"Operators of the China-made ARTEX AI pentest framework left servers open, exposing Claude Code and DeepSeek-driven tooling tied to breaches at seven South.","tags":["ai-tools","ai-tools","enterprise","cloud","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/apt29-watering-hole-campaign-serves-n-day-ios-and-android-exploits-via-hacked-si/","title":"APT29 watering hole campaign serves n-day iOS and Android exploits via hacked sites and Plerdy","url":"https://vulnpocalypse.dev/advisories/apt29-watering-hole-campaign-serves-n-day-ios-and-android-exploits-via-hacked-si/","date":"2026-11-11","summary":"Russia-linked APT29 used hacked sites, cloned domains and the Plerdy tracker to serve patched-flaw exploits to out-of-date iPhones and Android phones.","tags":["supply-chain","endpoint","web"]},{"id":"https://vulnpocalypse.dev/advisories/amadeus-incident-exposes-booking-data-at-singapore-airlines-cathay-pacific-japan/","title":"Amadeus incident exposes booking data at Singapore Airlines, Cathay Pacific, Japan Airlines and other Asian","url":"https://vulnpocalypse.dev/advisories/amadeus-incident-exposes-booking-data-at-singapore-airlines-cathay-pacific-japan/","date":"2026-11-11","summary":"A vulnerability in an Amadeus travel booking display environment exposed passenger booking data at several Asian airlines, and the cause is still under","tags":["breach","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/workos-artex-ai-breach/","title":"WorkOS says an attacker used the ARTEX AI agent to breach an internal sales app","url":"https://vulnpocalypse.dev/advisories/workos-artex-ai-breach/","date":"2026-11-11","summary":"On 30 October 2026 WorkOS found an attacker had used the ARTEX AI pentest agent to breach an internal sales app and read CRM and customer records.","tags":["ai-tools","ai-tools","enterprise","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/llmjacking-google-researchers-report-stolen-ai-access-bills-up-to-1-million/","title":"LLMJacking: Google researchers report stolen AI access bills up to $1 million","url":"https://vulnpocalypse.dev/advisories/llmjacking-google-researchers-report-stolen-ai-access-bills-up-to-1-million/","date":"2026-11-11","summary":"Google researchers report LLMJacking, where stolen cloud credentials run AI models at victim cost; watch AI service changes and rotate keys.","tags":["ai-tools","ai-tools","cloud","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/chainstack-discloses-breach-of-production-systems-exposing-customer-data/","title":"Chainstack discloses breach of production systems exposing customer data","url":"https://vulnpocalypse.dev/advisories/chainstack-discloses-breach-of-production-systems-exposing-customer-data/","date":"2026-11-11","summary":"Chainstack says an attacker accessed part of its production systems and customer data; rotate node credentials, API keys and passwords.","tags":["breach","crypto","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/3am-ransomware-encrypts-37-machines-in-uk-school-estate-in-suspected-ai-assisted/","title":"3AM ransomware encrypts 37 machines in UK school estate in suspected AI-assisted attack","url":"https://vulnpocalypse.dev/advisories/3am-ransomware-encrypts-37-machines-in-uk-school-estate-in-suspected-ai-assisted/","date":"2026-11-11","summary":"A 3AM ransomware affiliate encrypted 37 machines in a UK school estate in September 2026, with Bitdefender suspecting AI-assisted command retries.","tags":["ai-tools","enterprise","endpoint","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/paprat-bitter-espionage-south-asia/","title":"Bitter APT drops a new PapRAT backdoor on South Asian targets using malicious VHDX disk images","url":"https://vulnpocalypse.dev/advisories/paprat-bitter-espionage-south-asia/","date":"2026-11-11","summary":"Fortinet says the Bitter espionage group is spreading a new backdoor, PapRAT, in South Asia using malicious VHDX disk images, shortcut files and MSI installers.","tags":["breach","endpoint","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/google-xcpe-android-botnet/","title":"Google disrupts XCPE Android botnet of 1.3 million set-top boxes and bans TV box maker Videostrong","url":"https://vulnpocalypse.dev/advisories/google-xcpe-android-botnet/","date":"2026-11-11","summary":"Google and partners took down XCPE, a firmware backdoor that turned over 1.3 million Android set-top boxes into a botnet, and banned maker Videostrong.","tags":["breach","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/billboard-hijacks-in-egypt-malaysia-and-brazil-show-explicit-video/","title":"Billboard hijacks in Egypt, Malaysia and Brazil show explicit video","url":"https://vulnpocalypse.dev/advisories/billboard-hijacks-in-egypt-malaysia-and-brazil-show-explicit-video/","date":"2026-11-11","summary":"Explicit video appeared on LED billboards in Egypt, Malaysia and Brazil; operators should keep screen content systems off the public internet.","tags":["exploited","network-edge","web","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/polymarket-traders-drained-via-hijacked-debugbear-monitoring-script-dns-compromi/","title":"Polymarket traders drained via hijacked DebugBear monitoring script, DNS compromise cited","url":"https://vulnpocalypse.dev/advisories/polymarket-traders-drained-via-hijacked-debugbear-monitoring-script-dns-compromi/","date":"2026-11-11","summary":"A DebugBear monitoring script on Polymarket.com was swapped for wallet-draining code on October 29, costing traders about 2.7 million dollars.","tags":["supply-chain","web","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/florida-department-of-education-confirms-financial-aid-site-breach-exposing-ssns/","title":"Florida Department of Education confirms financial aid site breach exposing SSNs of about 4.9 million people","url":"https://vulnpocalypse.dev/advisories/florida-department-of-education-confirms-financial-aid-site-breach-exposing-ssns/","date":"2026-11-11","summary":"Florida's education department says hackers accessed its student financial aid website, exposing Social Security numbers and other data of about 4.9 million","tags":["breach","web"]},{"id":"https://vulnpocalypse.dev/advisories/chainalysis-breach-by-offensive-agentic-techniques-exposes-customer-names-and-em/","title":"Chainalysis breach by offensive agentic techniques exposes customer names and emails","url":"https://vulnpocalypse.dev/advisories/chainalysis-breach-by-offensive-agentic-techniques-exposes-customer-names-and-em/","date":"2026-11-11","summary":"Chainalysis says an attacker using offensive agentic techniques accessed customer user IDs, names, emails and role labels, but not investigation content or","tags":["ai-tools","ai-tools","crypto","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/black-october-ai-platform-breaches/","title":"Black October: nine AI developer platforms breached, stolen keys ran about 2.5M Bedrock calls","url":"https://vulnpocalypse.dev/advisories/black-october-ai-platform-breaches/","date":"2026-11-11","summary":"Nine AI developer platforms disclosed breaches in October 2026. Stolen keys from stored secrets drove about 2.5M Bedrock calls. Revoke, then rotate.","tags":["ai-tools","cloud","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/","title":"Binance hack: $6.3B drained after attackers got its own systems to sign","url":"https://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/","date":"2026-11-11","summary":"On 29 Oct 2026 attackers got Binance's hot-wallet signing systems to sign withdrawals on ten chains, taking about $6.3B, reportedly via a DevOps laptop.","tags":["breach","crypto","cloud","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/apple-warns-iphone-users-in-99-countries-of-mercenary-spyware-targeting-includin/","title":"Apple warns iPhone users in 99 countries of mercenary spyware targeting, including German lawmakers","url":"https://vulnpocalypse.dev/advisories/apple-warns-iphone-users-in-99-countries-of-mercenary-spyware-targeting-includin/","date":"2026-11-11","summary":"Apple began sending new mercenary spyware threat notifications in 99 countries, including to German lawmakers; vendor and exploit are not confirmed.","tags":["ecosystem","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/trojanized-claude-code-extension-21312-21313-on-cursor-marketplace-installs-pers/","title":"Trojanized Claude Code extension (2.1.312, 2.1.313) on Cursor marketplace installs persistent SSH backdoor","url":"https://vulnpocalypse.dev/advisories/trojanized-claude-code-extension-21312-21313-on-cursor-marketplace-installs-pers/","date":"2026-11-11","summary":"A tampered anthropic.claude-code build on the Cursor marketplace planted an SSH key, a reverse tunnel and persistence on up to 5,000 developer machines.","tags":["supply-chain","ai-tools","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/sophos-reports-gold-ogre-used-ai-agents-in-aur0ra-ransomware-intrusions/","title":"Sophos reports GOLD OGRE used AI agents in Aur0ra ransomware intrusions","url":"https://vulnpocalypse.dev/advisories/sophos-reports-gold-ogre-used-ai-agents-in-aur0ra-ransomware-intrusions/","date":"2026-11-11","summary":"Sophos reports the GOLD OGRE group used Cursor and AI models to run Aur0ra ransomware intrusions, so check for its indicators and tighten AD defenses.","tags":["ai-tools","ai-tools","enterprise","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/revolve-card-data-breach-exposes-saved-payment-card-numbers-and-expiry-dates/","title":"Revolve card data breach exposes saved payment card numbers and expiry dates","url":"https://vulnpocalypse.dev/advisories/revolve-card-data-breach-exposes-saved-payment-card-numbers-and-expiry-dates/","date":"2026-11-11","summary":"Revolve says an unauthorized actor may have taken names, contact details, card numbers and expiry dates from saved payment info in customer accounts.","tags":["breach","web"]},{"id":"https://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/","title":"Trojanized Claude Code extension on Cursor's marketplace planted an SSH backdoor (2.1.312, 2.1.313), plus","url":"https://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/","date":"2026-11-11","summary":"Fake Claude Code 2.1.312 and 2.1.313 on Cursor's marketplace added an attacker SSH key and reverse tunnel. Check authorized_keys for svc-telemetry.","tags":["supply-chain","ai-tools","endpoint","open-source"]}]}