https://vulnpocalypse.dev/feeds/Our advisories where exploitation is confirmed.enThu, 12 Nov 2026 16:59:02 +0000https://vulnpocalypse.dev/advisories/turla-cereal-malware-hides-in-exchange-servers-to-steal-email/https://vulnpocalypse.dev/advisories/turla-cereal-malware-hides-in-exchange-servers-to-steal-email/Thu, 12 Nov 2026 12:00:00 +0000Russia-linked Turla uses new Cereal malware inside Exchange servers at two government bodies; hunt for ESET indicators of compromise.breachenterprisehttps://vulnpocalypse.dev/advisories/github-issue-comment-injection-campaign/https://vulnpocalypse.dev/advisories/github-issue-comment-injection-campaign/Thu, 12 Nov 2026 12:00:00 +0000Hidden shell commands in GitHub issues, PRs and comments hit 61 repos, including Trivy and MLflow. Find workflows that put issue text into run steps.supply-chaingithub-actionsci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/coinbase-amplitude-vendor-incident/https://vulnpocalypse.dev/advisories/coinbase-amplitude-vendor-incident/Thu, 12 Nov 2026 12:00:00 +0000An incident at analytics vendor Amplitude exposed contact and some transaction data of Coinbase customers. Coinbase says its systems and funds were not hit.breachcryptoenterprisehttps://vulnpocalypse.dev/advisories/danfoss-refrigeration-defrost-attack-france/https://vulnpocalypse.dev/advisories/danfoss-refrigeration-defrost-attack-france/Thu, 12 Nov 2026 12:00:00 +0000On 11 Oct and 2 Nov 2026, attackers forced European supermarket fridges, and France's blood service, into defrost via exposed refrigeration controllers.breachnetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/denmark-cpr-register-breach/https://vulnpocalypse.dev/advisories/denmark-cpr-register-breach/Thu, 12 Nov 2026 12:00:00 +0000Attackers used one firm's CPR access to pull names, addresses and CPR numbers of 8.8 million people in Sep 2026. A CPR number no longer proves identity.breachenterprisewebhttps://vulnpocalypse.dev/advisories/dmdc-pentagon-personnel-data-breach/https://vulnpocalypse.dev/advisories/dmdc-pentagon-personnel-data-breach/Thu, 12 Nov 2026 12:00:00 +0000A flaw in a Defense Manpower Data Center file-sharing system exposed unencrypted SSNs of about 3.05 million people with military ties, Oct 2025 to Jul 2026.breachenterprisehttps://vulnpocalypse.dev/advisories/bank-of-baroda-data-leak-2026/https://vulnpocalypse.dev/advisories/bank-of-baroda-data-leak-2026/Thu, 12 Nov 2026 12:00:00 +0000Bank of Baroda says a compromised employee email account exposed "certain data" after TripleX posted files said to hold KYC and loan documents on 24 Jul 2026.breachenterprisehttps://vulnpocalypse.dev/advisories/check-point-vpn-cve-2026-50751/https://vulnpocalypse.dev/advisories/check-point-vpn-cve-2026-50751/Thu, 12 Nov 2026 12:00:00 +0000An IKEv1 flaw lets attackers open Check Point remote access VPN sessions with no password. Exploited since 7 May 2026. Install sk185033 or force IKEv2.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/bufferzonecorp-go-rubygems-ci-stealer/https://vulnpocalypse.dev/advisories/bufferzonecorp-go-rubygems-ci-stealer/Thu, 12 Nov 2026 12:00:00 +0000BufferZoneCorp Go modules and knot-* gems stole SSH, cloud, npm, gh and kube credentials and tampered with GitHub Actions. Check go.mod and Gemfile.lock.supply-chaingithub-actionsci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/beyondtrust-rs-pra-cve-2026-1731/https://vulnpocalypse.dev/advisories/beyondtrust-rs-pra-cve-2026-1731/Thu, 12 Nov 2026 12:00:00 +0000Unauthenticated command injection in self-hosted BeyondTrust Remote Support and PRA, exploited since 31 Jan 2026. Patch to RS 25.3.2 or PRA 25.1.1 and hunt.exploitedenterprisenetwork-edgehttps://vulnpocalypse.dev/advisories/microsoft-reports-threat-actors-using-gsocket-for-persistent-linux-c2/https://vulnpocalypse.dev/advisories/microsoft-reports-threat-actors-using-gsocket-for-persistent-linux-c2/Wed, 11 Nov 2026 12:00:00 +0000Microsoft reports threat actors deploy GSocket on compromised Linux servers for persistent access; remove the client, not just patch the app.ecosystemwebendpointopen-sourcehttps://vulnpocalypse.dev/advisories/kaspersky-reports-citrus-ransomware-using-vless-tunnels-and-sn00py/https://vulnpocalypse.dev/advisories/kaspersky-reports-citrus-ransomware-using-vless-tunnels-and-sn00py/Wed, 11 Nov 2026 12:00:00 +0000Kaspersky reports Citrus ransomware group uses VLESS tunnels and Sn00py; review contractor VPN and RDP access and GHOST machine accounts.breachenterpriseendpointhttps://vulnpocalypse.dev/advisories/gbhackers-reports-fake-cloudflare-captcha-lures-hide-malware-in-png-images/https://vulnpocalypse.dev/advisories/gbhackers-reports-fake-cloudflare-captcha-lures-hide-malware-in-png-images/Wed, 11 Nov 2026 12:00:00 +0000GBHackers reports Huntress research on fake Cloudflare CAPTCHA ClickFix lures that run PowerShell; never paste commands from a web page.ecosystemendpointwebhttps://vulnpocalypse.dev/advisories/cisco-broadworks-cve-2026-20320-and-openwave-flaw-added-to-cisa-kev/https://vulnpocalypse.dev/advisories/cisco-broadworks-cve-2026-20320-and-openwave-flaw-added-to-cisa-kev/Wed, 11 Nov 2026 12:00:00 +0000CISA added exploited Cisco BroadWorks and Openwave flaws to its KEV list; patch now, federal deadline is November 24, 2026.exploitedenterprisehttps://vulnpocalypse.dev/advisories/asec-reports-snakekeylogger-phishing-disguised-as-quote-requests/https://vulnpocalypse.dev/advisories/asec-reports-snakekeylogger-phishing-disguised-as-quote-requests/Wed, 11 Nov 2026 12:00:00 +0000ASEC reports phishing emails posing as quote requests deliver SnakeKeylogger through a JavaScript attachment; do not open such attachments.ecosystemendpointhttps://vulnpocalypse.dev/advisories/microsoft-november-2026-patch-tuesday-exploited-outlook-zero-day/https://vulnpocalypse.dev/advisories/microsoft-november-2026-patch-tuesday-exploited-outlook-zero-day/Wed, 11 Nov 2026 12:00:00 +0000Microsoft's November 2026 Patch Tuesday fixes an exploited Outlook NTLM hash flaw, CVE-2026-124194; install the November updates.exploitedenterpriseendpointhttps://vulnpocalypse.dev/advisories/chrome-cve-2026-125350-zero-day-update-to-1570810350/https://vulnpocalypse.dev/advisories/chrome-cve-2026-125350-zero-day-update-to-1570810350/Wed, 11 Nov 2026 12:00:00 +0000Google patched an actively exploited Chrome XML use-after-free, CVE-2026-125350; update Chrome to 157.0.8103.50 or later and relaunch.exploitedwebendpointhttps://vulnpocalypse.dev/advisories/check-point-reports-three-china-nexus-campaigns-linked-via-sparrow-malware/https://vulnpocalypse.dev/advisories/check-point-reports-three-china-nexus-campaigns-linked-via-sparrow-malware/Wed, 11 Nov 2026 12:00:00 +0000The Hacker News reports Check Point links three China-nexus espionage clusters via Sparrow malware; review indicators and sideloading alerts.breachendpointnetwork-edgewebhttps://vulnpocalypse.dev/advisories/wiz-says-attacker-abused-qubole-aws-role-access-in-customer-breaches/https://vulnpocalypse.dev/advisories/wiz-says-attacker-abused-qubole-aws-role-access-in-customer-breaches/Wed, 11 Nov 2026 12:00:00 +0000Wiz says an attacker used a Qubole AWS account to access customer AWS accounts; Qubole users should check CloudTrail logs from October 1 onward.supply-chaincloudhttps://vulnpocalypse.dev/advisories/operation-snowball-jailbroken-ai-agent-hits-european-telecom/https://vulnpocalypse.dev/advisories/operation-snowball-jailbroken-ai-agent-hits-european-telecom/Wed, 11 Nov 2026 12:00:00 +0000A jailbroken AI agent attacked a European telecom and 13 hosted organizations for two weeks; patch Cisco BroadWorks CVE-2026-20320 now.ai-toolsai-toolsnetwork-edgeenterprisecloudhttps://vulnpocalypse.dev/advisories/ny-ag-says-perry-johnson-companies-breach-exposed-133m-peoples-data/https://vulnpocalypse.dev/advisories/ny-ag-says-perry-johnson-companies-breach-exposed-133m-peoples-data/Wed, 11 Nov 2026 12:00:00 +0000New York AG says a 2023 breach at Perry Johnson & Associates exposed 13.3 million people's data; check medical statements and credit reports.breachenterprisehttps://vulnpocalypse.dev/advisories/huntress-reports-ahsaycbs-intrusion-with-webshells-miner-and-c2-implant/https://vulnpocalypse.dev/advisories/huntress-reports-ahsaycbs-intrusion-with-webshells-miner-and-c2-implant/Wed, 11 Nov 2026 12:00:00 +0000Huntress reports attackers exploited AhsayCBS flaws to plant webshells, miners and a C2 implant; apply Ahsay hotfixes and hunt for leftover artifacts.exploitedenterprisehttps://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/https://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/Wed, 11 Nov 2026 12:00:00 +0000Malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 steal Swarm wallet files; check for them and rotate keys on any affected host.supply-chainnpmnodejsgithub-actionscryptoopen-sourcehttps://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/https://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/Wed, 11 Nov 2026 12:00:00 +0000Doctor Web reports fake GitHub security tool repos infected over 2,000 PCs; inspect build steps before running any cloned project.supply-chainopen-sourceendpointcryptohttps://vulnpocalypse.dev/advisories/sonicwall-sonicos-sslvpn-cve-2026-19868-exploited-cisa-says-in-kev-listing/https://vulnpocalypse.dev/advisories/sonicwall-sonicos-sslvpn-cve-2026-19868-exploited-cisa-says-in-kev-listing/Wed, 11 Nov 2026 12:00:00 +0000CISA says SonicWall SonicOS SSLVPN flaw CVE-2026-19868 is exploited and added it to KEV; find exposed devices and check SonicWall guidance.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/armorsteal-python-malware-kit-steals-data-and-mines-crypto-seqrite-reports/https://vulnpocalypse.dev/advisories/armorsteal-python-malware-kit-steals-data-and-mines-crypto-seqrite-reports/Wed, 11 Nov 2026 12:00:00 +0000Seqrite reports Armorsteal, a Python kit that steals data and mines crypto on Windows; check for its scheduled tasks and Defender exclusions.ecosystemendpointcryptohttps://vulnpocalypse.dev/advisories/openssh-alpine-musl-password-auth-bypass/https://vulnpocalypse.dev/advisories/openssh-alpine-musl-password-auth-bypass/Wed, 11 Nov 2026 12:00:00 +0000On Alpine and musl systems with sshd built without PAM, a locked account accepts any long password. Update openssh and restart sshd.exploitedopen-sourcecloudhttps://vulnpocalypse.dev/advisories/zyxel-gs1900-switch-zero-day-cve-2026-107441-lets-attackers-run-root-commands-be/https://vulnpocalypse.dev/advisories/zyxel-gs1900-switch-zero-day-cve-2026-107441-lets-attackers-run-root-commands-be/Wed, 11 Nov 2026 12:00:00 +0000Zyxel GS1900 switches have a pre-auth RCE flaw, CVE-2026-107441, exploited in the wild and missed by the June patch, fixed October 22.exploitednetwork-edgeenterprisehttps://vulnpocalypse.dev/advisories/fake-gta-vi-download-sites-push-malware-and-crypto-scams-ahead-of-the-november-1/https://vulnpocalypse.dev/advisories/fake-gta-vi-download-sites-push-malware-and-crypto-scams-ahead-of-the-november-1/Wed, 11 Nov 2026 12:00:00 +0000Netcraft found fake GTA VI leaked builds, early access and mobile downloads that deliver flagged malware or demand crypto before the November 19 launch.ecosystemendpointcryptowebhttps://vulnpocalypse.dev/advisories/beget-hosting-cyberattack-wipes-cloud-data-vps-and-kubernetes-backups-lost/https://vulnpocalypse.dev/advisories/beget-hosting-cyberattack-wipes-cloud-data-vps-and-kubernetes-backups-lost/Wed, 11 Nov 2026 12:00:00 +0000Attackers reached Beget's management systems and ran wipe scripts, destroying VPS, cloud storage and Kubernetes data and all binary VPS backups.breachcloudwebenterprisehttps://vulnpocalypse.dev/advisories/artex-ai-framework-exposed-korean-banks/https://vulnpocalypse.dev/advisories/artex-ai-framework-exposed-korean-banks/Wed, 11 Nov 2026 12:00:00 +0000Operators of the China-made ARTEX AI pentest framework left servers open, exposing Claude Code and DeepSeek-driven tooling tied to breaches at seven South.ai-toolsai-toolsenterprisecloudopen-sourcehttps://vulnpocalypse.dev/advisories/apt29-watering-hole-campaign-serves-n-day-ios-and-android-exploits-via-hacked-si/https://vulnpocalypse.dev/advisories/apt29-watering-hole-campaign-serves-n-day-ios-and-android-exploits-via-hacked-si/Wed, 11 Nov 2026 12:00:00 +0000Russia-linked APT29 used hacked sites, cloned domains and the Plerdy tracker to serve patched-flaw exploits to out-of-date iPhones and Android phones.supply-chainendpointwebhttps://vulnpocalypse.dev/advisories/amadeus-incident-exposes-booking-data-at-singapore-airlines-cathay-pacific-japan/https://vulnpocalypse.dev/advisories/amadeus-incident-exposes-booking-data-at-singapore-airlines-cathay-pacific-japan/Wed, 11 Nov 2026 12:00:00 +0000A vulnerability in an Amadeus travel booking display environment exposed passenger booking data at several Asian airlines, and the cause is still underbreachenterprisehttps://vulnpocalypse.dev/advisories/workos-artex-ai-breach/https://vulnpocalypse.dev/advisories/workos-artex-ai-breach/Wed, 11 Nov 2026 12:00:00 +0000On 30 October 2026 WorkOS found an attacker had used the ARTEX AI pentest agent to breach an internal sales app and read CRM and customer records.ai-toolsai-toolsenterprisecloudhttps://vulnpocalypse.dev/advisories/llmjacking-google-researchers-report-stolen-ai-access-bills-up-to-1-million/https://vulnpocalypse.dev/advisories/llmjacking-google-researchers-report-stolen-ai-access-bills-up-to-1-million/Wed, 11 Nov 2026 12:00:00 +0000Google researchers report LLMJacking, where stolen cloud credentials run AI models at victim cost; watch AI service changes and rotate keys.ai-toolsai-toolscloudenterprisehttps://vulnpocalypse.dev/advisories/chainstack-discloses-breach-of-production-systems-exposing-customer-data/https://vulnpocalypse.dev/advisories/chainstack-discloses-breach-of-production-systems-exposing-customer-data/Wed, 11 Nov 2026 12:00:00 +0000Chainstack says an attacker accessed part of its production systems and customer data; rotate node credentials, API keys and passwords.breachcryptocloudhttps://vulnpocalypse.dev/advisories/3am-ransomware-encrypts-37-machines-in-uk-school-estate-in-suspected-ai-assisted/https://vulnpocalypse.dev/advisories/3am-ransomware-encrypts-37-machines-in-uk-school-estate-in-suspected-ai-assisted/Wed, 11 Nov 2026 12:00:00 +0000A 3AM ransomware affiliate encrypted 37 machines in a UK school estate in September 2026, with Bitdefender suspecting AI-assisted command retries.ai-toolsenterpriseendpointai-toolshttps://vulnpocalypse.dev/advisories/paprat-bitter-espionage-south-asia/https://vulnpocalypse.dev/advisories/paprat-bitter-espionage-south-asia/Wed, 11 Nov 2026 12:00:00 +0000Fortinet says the Bitter espionage group is spreading a new backdoor, PapRAT, in South Asia using malicious VHDX disk images, shortcut files and MSI installers.breachendpointenterprisehttps://vulnpocalypse.dev/advisories/google-xcpe-android-botnet/https://vulnpocalypse.dev/advisories/google-xcpe-android-botnet/Wed, 11 Nov 2026 12:00:00 +0000Google and partners took down XCPE, a firmware backdoor that turned over 1.3 million Android set-top boxes into a botnet, and banned maker Videostrong.breachendpointhttps://vulnpocalypse.dev/advisories/billboard-hijacks-in-egypt-malaysia-and-brazil-show-explicit-video/https://vulnpocalypse.dev/advisories/billboard-hijacks-in-egypt-malaysia-and-brazil-show-explicit-video/Wed, 11 Nov 2026 12:00:00 +0000Explicit video appeared on LED billboards in Egypt, Malaysia and Brazil; operators should keep screen content systems off the public internet.exploitednetwork-edgewebenterprisehttps://vulnpocalypse.dev/advisories/polymarket-traders-drained-via-hijacked-debugbear-monitoring-script-dns-compromi/https://vulnpocalypse.dev/advisories/polymarket-traders-drained-via-hijacked-debugbear-monitoring-script-dns-compromi/Wed, 11 Nov 2026 12:00:00 +0000A DebugBear monitoring script on Polymarket.com was swapped for wallet-draining code on October 29, costing traders about 2.7 million dollars.supply-chainwebcryptohttps://vulnpocalypse.dev/advisories/florida-department-of-education-confirms-financial-aid-site-breach-exposing-ssns/https://vulnpocalypse.dev/advisories/florida-department-of-education-confirms-financial-aid-site-breach-exposing-ssns/Wed, 11 Nov 2026 12:00:00 +0000Florida's education department says hackers accessed its student financial aid website, exposing Social Security numbers and other data of about 4.9 millionbreachwebhttps://vulnpocalypse.dev/advisories/chainalysis-breach-by-offensive-agentic-techniques-exposes-customer-names-and-em/https://vulnpocalypse.dev/advisories/chainalysis-breach-by-offensive-agentic-techniques-exposes-customer-names-and-em/Wed, 11 Nov 2026 12:00:00 +0000Chainalysis says an attacker using offensive agentic techniques accessed customer user IDs, names, emails and role labels, but not investigation content orai-toolsai-toolscryptoenterprisehttps://vulnpocalypse.dev/advisories/black-october-ai-platform-breaches/https://vulnpocalypse.dev/advisories/black-october-ai-platform-breaches/Wed, 11 Nov 2026 12:00:00 +0000Nine AI developer platforms disclosed breaches in October 2026. Stolen keys from stored secrets drove about 2.5M Bedrock calls. Revoke, then rotate.ai-toolscloudai-toolshttps://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/https://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/Wed, 11 Nov 2026 12:00:00 +0000On 29 Oct 2026 attackers got Binance's hot-wallet signing systems to sign withdrawals on ten chains, taking about $6.3B, reportedly via a DevOps laptop.breachcryptocloudci-cdhttps://vulnpocalypse.dev/advisories/apple-warns-iphone-users-in-99-countries-of-mercenary-spyware-targeting-includin/https://vulnpocalypse.dev/advisories/apple-warns-iphone-users-in-99-countries-of-mercenary-spyware-targeting-includin/Wed, 11 Nov 2026 12:00:00 +0000Apple began sending new mercenary spyware threat notifications in 99 countries, including to German lawmakers; vendor and exploit are not confirmed.ecosystemendpointhttps://vulnpocalypse.dev/advisories/trojanized-claude-code-extension-21312-21313-on-cursor-marketplace-installs-pers/https://vulnpocalypse.dev/advisories/trojanized-claude-code-extension-21312-21313-on-cursor-marketplace-installs-pers/Wed, 11 Nov 2026 12:00:00 +0000A tampered anthropic.claude-code build on the Cursor marketplace planted an SSH key, a reverse tunnel and persistence on up to 5,000 developer machines.supply-chainai-toolsendpointhttps://vulnpocalypse.dev/advisories/sophos-reports-gold-ogre-used-ai-agents-in-aur0ra-ransomware-intrusions/https://vulnpocalypse.dev/advisories/sophos-reports-gold-ogre-used-ai-agents-in-aur0ra-ransomware-intrusions/Wed, 11 Nov 2026 12:00:00 +0000Sophos reports the GOLD OGRE group used Cursor and AI models to run Aur0ra ransomware intrusions, so check for its indicators and tighten AD defenses.ai-toolsai-toolsenterpriseendpointhttps://vulnpocalypse.dev/advisories/revolve-card-data-breach-exposes-saved-payment-card-numbers-and-expiry-dates/https://vulnpocalypse.dev/advisories/revolve-card-data-breach-exposes-saved-payment-card-numbers-and-expiry-dates/Wed, 11 Nov 2026 12:00:00 +0000Revolve says an unauthorized actor may have taken names, contact details, card numbers and expiry dates from saved payment info in customer accounts.breachwebhttps://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/https://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/Wed, 11 Nov 2026 12:00:00 +0000Fake Claude Code 2.1.312 and 2.1.313 on Cursor's marketplace added an attacker SSH key and reverse tunnel. Check authorized_keys for svc-telemetry.supply-chainai-toolsendpointopen-source