Anas SahelIdentity & security
— Threat watch

What is happening in security

143 tracked 19 critical open Last update 15 Nov 2026

November 2026

99Incidents
11Critical
42High
By group
  • Identity 13
  • Supply chain 23
  • Vulnerabilities 28
  • Breaches & extortion 35

Back in the news this week

99incidents

First seenIncidentGroupSeverityStatus
University of Texas at Arlington: personal data stolen in an October intrusion, forms portal still offlineThe University of Texas at Arlington, which serves more than 41,000 students, warned students and employees that personal information was stolen by hackers who breached its systems in October 2026. A spokesperson told The Record that the investigation confirmed the stolen data, but declined to say what was taken. The university took down MachForms, the online portal it uses for event registrations, service requests and surveys, which is still offline. The Qilin ransomware gang claimed the attack; the university has not confirmed that claim.SectorEducationWay inNot public yetBreaches & extortionMediumConfirmed
Baker Tilly: client data, Social Security numbers included, taken from a service provider's platformBaker Tilly Advisory Group, the US accounting and advisory firm, is notifying clients and their dependents, children included, that an unauthorised actor obtained client data from a platform operated by one of its third-party service providers. It became aware of the incident on September 6, 2026 and finished reviewing the affected data on October 28. SecurityWeek reports Social Security numbers were stolen and that state filings point to more than 10,000 victims in Texas alone.SectorFinanceWay inSupplierProduct or vendorBaker Tilly10,000+ victims in Texas alone, according to state filings cited by SecurityWeek (no national total published)Supply chainHighConfirmed
Charles University: attacker downloads data from the central student information systemCharles University in Prague says one of its web applications was compromised, which gave unauthorised access to data in its central Student Information System (SIS). The technical investigation so far confirms the attacker obtained and downloaded part of the SIS data, including personal information. The application was taken offline, the incident was reported to the national cyber agency NÚKIB and a criminal complaint was filed. The number of people affected is still under investigation.SectorEducationWay inNot public yetBreaches & extortionHighConfirmed
Check Point gateways: PHP2Shell used to break in, root, then a wiper at some Israeli organizationsCheck Point Research says attackers broke into Check Point Mobile Access portals through PHP2Shell, two critical PHP flaws, starting on October 30, 2026, about a week after a fix was available. They then used a Check Point flaw (CVE-2026-123039) to become root on the gateways. Check Point says it saw that flaw actively exploited against "a couple of dozen customers". A first wave hit Israeli organizations, with destructive activity against some of them: a wiper staged on a VMware ESXi host. A second wave from November 2 hit organizations in several countries, with no destruction seen. Check Point cannot say with confidence who is behind it.SectorMany sectorsWay inSoftware flawProduct or vendorCheck Point Security Gateway, Check Point Mobile Access, PHP, VMware ESXi~24 Check Point customers where the root flaw was seen actively exploited ("a couple of dozen")VulnerabilitiesHighConfirmed
Quantum Systems: malware disguised as a drone software update, Bundeswehr grounds its dronesGerman drone maker Quantum Systems says it detected "an active cyberattack by hostile actors" in October and contained it with the authorities. According to the Financial Times, reported by Dronewatch and DroneXL, the attackers placed a malicious file on the server Quantum uses to distribute updates of QBase, its ground control and mission planning software. The Bundeswehr grounded its Quantum drones as a precaution. Quantum told Reuters on November 13 that the fleet is flying again and that the Bundeswehr was the only customer to ground its systems. Who is behind it and how they got in are not public.SectorTech & SaaSWay inNot public yetProduct or vendorQuantum Systems, QBase, VectorSupply chainHighConfirmed
Seminole County Clerk: intrusion shuts the Florida court clerk's systems, records viewedThe Seminole County Clerk of Court and Comptroller in Florida found an intrusion into its systems on Wednesday, October 28, 2026, turned off the internet and all systems, and closed its offices to the public. Clerk Grant Maloy says nothing was encrypted and the hackers made no demands. On November 13 he said the hackers accessed files including property and marriage records, already public on the clerk's website, and that the office is still checking whether confidential information was breached.SectorGovernment & politicsWay inNot public yetBreaches & extortionMediumConfirmed
Trezor: spy implants found in Safe 5 hardware wallets sold by a former resellerTrezor confirms that three Trezor Safe 5 hardware wallets bought from CryptoBilis, a former authorized reseller in Southeast Asia, carried an extra circuit board that copies what the screen shows, including recovery words and passphrases, and sends it over the mobile network to an attacker's server. Trezor released firmware 2.13.1 on November 11 to stop these implants from capturing anything, cut its reseller network by about 80%, and tells CryptoBilis buyers to move their funds to a new wallet with a new recovery phrase.SectorConsumer apps & devicesWay inSupplierProduct or vendorTrezor Safe 5, CryptoBilis3 Trezor Safe 5 devices confirmed with an implant, out of 48 customers who contacted TrezorSupply chainMediumConfirmed
French Education Ministry: intrusions hit 25 of its 30 académiesCERT-FR's October status report on the REACTIV operation, published on November 12, 2026, says the French Ministry of National Education reported security incidents in 25 of its 30 académies (regional education authorities) between July and September 2026, with operational impacts of varying severity. The attackers obtained valid credentials, used privileged accounts, looked for new access and exfiltrated directories, application databases and mailboxes, reaching several national services and possibly other State entities through the interministerial network (RIE). No count of people concerned is given. Accounts were reset and services reopened from the start of the school year.SectorGovernment & politicsWay inStolen credentials25 of 30 académies (regional education authorities) hit by security incidents, July to September 2026IdentityCriticalConfirmed
FaceStealer: North Korean fake video calls with deepfakes stole more than $400MAIOn November 12, 2026, the US Justice Department described FaceStealer, a North Korean social engineering campaign that lures cryptocurrency holders and open-source developers into video meetings, shows them deepfakes of trusted figures, then has them install malware disguised as a fix for a fake technical problem. It says the campaign led to the theft of more than $400 million in the last 18 months. The FBI seized cloud infrastructure used in the scheme and over 900 webcam videos of victims.SectorMany sectorsWay inPhishing, social engineering$400M+ stolen in the last 18 months, according to the US Justice Department900+ webcam videos of victims seized by the FBI (not a count of people)IdentityCriticalConfirmed
GitHub: 4,837 hijacked accounts plant a CI secret stealer in thousands of repositoriesStarting on November 10, 2026, an attacker used stolen credentials for 4,837 GitHub accounts to open test pull requests in 61,764 repositories, then planted a stealer in the CI workflows of those it could write to. The stealer takes GitHub Actions secrets, workflow tokens and cloud credentials; the change was reverted within a minute and the run logs usually deleted. Aikido Security, which found it, says every secret and cloud role available to an affected repository's workflows should be treated as compromised.SectorMany sectorsWay inStolen credentialsProduct or vendorGitHub Actions, digitalelvis/neuronai-studio (Packagist), github.com/onuragtas/docker-env (Go)4,837 GitHub accounts used by the attacker with stolen credentialsIdentityCriticalDeveloping
ASP (France): trainee pay portal breached, data of 30,500 users takenCERT-FR's October REACTIV status report, published on November 12, 2026, says France's Agence de service et de paiement (ASP), the public body that pays certain State aid, suffered several data breaches with no identified link between them. Its PROFIL and PUMA portals were compromised in August 2026. On September 30, its DEFI portal, which pays trainees, was compromised through an impersonated account and a vulnerability; the attack was claimed on October 9 and data of 30,500 users was exfiltrated. The users have been notified.SectorGovernment & politicsWay inNot public yet30,500 users of the DEFI trainee pay portal whose data was exfiltratedBreaches & extortionHighConfirmed
Expedia: attackers reached its systems through a compromised third-party data platform providerExpedia Group confirmed to Skift on November 12, 2026 that attackers gained access to its systems through a compromised third-party data platform provider, whose trusted access was used to reach several companies. Expedia did not name the vendor or say what information may have been exposed. An extortion group called n0n claims the theft and threatens to publish the data, according to Cybernews as reported by Skift.SectorTransportWay inSupplierSupply chainHighConfirmed
Apify: a compromised credential let an intruder into internal systems and related customer accountsWeb scraping and automation platform Apify says an unauthorised third party got into parts of its internal systems on November 9 and 10, 2026. The intruder "used a compromised credential to obtain a number of account credentials and accessed related Apify accounts". Apify detected the activity on November 11 at 12:13 UTC and cut off access. It rotated critical internal secrets, revoked some OAuth connections to external integrations, notified authorities and emailed the customers whose personal information or stored data was accessed.SectorTech & SaaSWay inStolen credentialsProduct or vendorApifyIdentityHighConfirmed
Cairn: an AI pentest framework turned against 19 organizations, 10 of them breachedAIOn November 12, 2026, Palo Alto Networks Unit 42 reported 25 operations run in August and September 2026 with a customized fork of Cairn, a public AI penetration testing framework, against at least 19 organizations in the semiconductor and advanced-manufacturing supply chain, defense policy and civil society. Unit 42 confirmed unauthorized access or data retrieval at 10 of them. The operations ran on Chinese AI models, Zhipu GLM 5.2 and DeepSeek V4, which did not refuse the attackers' fake authorization preamble. Unit 42 assesses with moderate confidence that this is China-nexus intelligence collection, tracked as CL-STA-1238.SectorMany sectorsWay inNot public yet1M+ member records the framework logged access to at one U.S. teachers' unionBreaches & extortionHighDeveloping
TSMC: current and former employee data posted online, matching data held by a cloud providerTaiwanese chipmaker TSMC said on November 12, 2026 that some current and former employee data "was made available on an external website without authorization". It says the data matches data stored in the system services of a cloud service provider, that it is unrelated to its operations or customer data, and that it has found no evidence its own systems were compromised. According to media reports, a seller on an underground forum offered about 46,000 records (6.9 GB) and asked for three bitcoin.SectorTech & SaaSWay inSupplier3 BTC asked by the seller of the data, according to media reports (unverified)46K employee records claimed by the seller (unverified)Supply chainHighDeveloping
Unocoin: Indian crypto exchange suspends all services after its infrastructure was compromisedUnocoin, an Indian cryptocurrency exchange, says it detected unauthorised activity on November 6, 2026, and again on November 9, when it suspended all services. Its investigation found that its infrastructure "had been compromised". On November 12 it found outgoing transactions from one of the ETH addresses in its BitGo wallet infrastructure and says it does not yet have complete visibility into "all potentially unintended transactions". The root cause is not established. Unocoin is rebuilding its entire server infrastructure, which it expects to take 4 to 5 working days.SectorFinanceWay inNot public yetBreaches & extortionHighDeveloping
Ninkasi: unauthorized access to the online shop exposes customer data and old-format passwordsFrench company Ninkasi told its customers that its online shop, shop.ninkasi.fr, was accessed without authorization on November 12, 2026, and that it detected and blocked the intrusion the same day. Names, contact details, order histories and customer account passwords stored in an old format may have been exposed; payment data is not concerned, according to the company. Customers must set a new password at their next login.SectorRetailWay inNot public yetBreaches & extortionMediumConfirmed
French Foreign Ministry: library portal entered with stolen technical accountsAccording to an ANSSI status report relayed by Fuites Infos and Cyberattaque.org, a cyberattack detected on October 20, 2026 hit the library portal of the French Ministry for Europe and Foreign Affairs. A third party reportedly accessed the personal data of about a hundred users of the portal, using technical accounts stolen beforehand from a compromised server. Attempts to escalate privileges were blocked. The ministry had published no communication by November 12.SectorGovernment & politicsWay inStolen credentials~100 portal users whose personal data a third party reportedly accessed, according to ANSSIIdentityMediumConfirmed
OFB (France): hunting licence exam portal flaw exposes data of 1,000+ peopleCERT-FR's October REACTIV status report, published on November 12, 2026, says that on October 4, 2026 an IDOR flaw in the payment API of permischasser.ofb.fr, the French Biodiversity Office's portal for registering for the hunting licence exam, exposed personal data of more than 1,000 people, including minors. The data was published openly the same day. The site was taken offline that evening and came back during October after the flaws were fixed.SectorGovernment & politicsWay inSoftware flaw1,000+ people whose personal data was exposed, including minorsVulnerabilitiesMediumResolved
Macif Avantages: customer data exposed after an attack on voucher partner QwertysUsers of Macif Avantages, the French insurer Macif's discount voucher service, received an email saying a cybercriminal had access to their data. The intrusion hit Qwertys, the partner that runs the voucher service. Names, postal and email addresses and dates of birth are involved; bank card data, login credentials and insurance contracts are not, according to the email. The service was closed, the CNIL notified and a complaint filed. The number of people affected is not given.SectorFinanceWay inSupplierProduct or vendorQwertysSupply chainMediumConfirmed
Qare: French telemedicine platform tells users account data was accessedFrench telemedicine platform Qare has emailed users about a security incident that gave access to some personal data linked to their accounts, according to Cyberattaque.org, which obtained a copy of the email. Qare says it detected the incident on the morning of Saturday October 31, 2026 and resolved it the same day. Names, sex, dates of birth, email addresses and phone numbers are concerned; Qare says no medical or bank data was. It gives neither the number of people affected nor how the access happened.SectorHealthWay inNot public yetProduct or vendorQareBreaches & extortionMediumConfirmed
TypoPrompting: 186 lookalike AI tool domains lead to ClickFix lures and hijacking extensionsAIIsland researchers traced 186 lookalike domains across 27 AI brands (typos such as cloude[.]ai or chatlgpt[.]com). A visitor who mistypes the name of an AI tool is sent to a fake verification page that asks them to run a hidden PowerShell or Terminal command, to a fake "Security Check" that installs a browser hijacker, or to a Chrome extension that takes over the default search engine. The 17 extensions from the same kit still listed on November 3 declared 972,000 users.SectorMany sectorsWay inPhishing, social engineering972,000 declared users of the 17 extensions from the same kit still on the Chrome Web Store on November 3IdentityMediumConfirmed
ScreenConnect: rogue clients pushed from cloud panels to 288 machines in 48 organizationsAIOn November 11, 2026, an attacker used the "Run" command of cloud-hosted ScreenConnect panels to install a custom toolkit, SCKit, on at least 288 hosts across 48 organizations protected by Huntress, about a third of them in the first ten minutes. SCKit sets up its own remote access and a relay that steals ScreenConnect session cookies from technicians' workstations. ConnectWise published an advisory the same evening and, as a precaution, disabled several third-party extensions across about 400 partner environments; it had not yet identified the way in.SectorMany sectorsWay inNot public yetProduct or vendorConnectWise ScreenConnect, RMM+ (third-party ScreenConnect extension)288 machines in 48 organizations seen with rogue ScreenConnect clients on November 11 (Huntress customers only); a second wave on November 13 hit 205 more in 41 organizationsSupply chainHighDeveloping
SilentAir: hacked mobile operators used to divert texts and catch 2FA codes, Taiwan the main targetTelecom security company Enea says a new actor it calls SilentAir has been sending SS7 and Diameter signalling attacks from compromised network nodes inside mobile operators in at least six Asian countries, which it does not name. The attacks divert selected subscribers' calls and texts to attacker equipment; Taiwan is the primary target, among a dozen more countries and territories. Enea saw two-factor authentication codes intercepted for some targets. It assesses with high confidence that SilentAir is a state-level actor, and with low confidence that its activity aligns with China-nexus operations.SectorTech & SaaSWay inNot public yetSeveral thousand subscribers targeted in the largest month-long burstsBreaches & extortionHighDeveloping
AntiFox: an AI pentest agent used to pull production secrets from AWS accountsAIArctic Wolf reports that attackers run self-hosted instances of AntiFox, an open-source agentic penetration testing platform forked from ARTEX 0.1.1, on Alibaba Cloud, and use them for exploitation, webshells and AWS secret harvesting. In one intrusion the attacker used valid AWS identities, cycled through several of them and made hundreds of API requests in about 30 minutes; most were denied, but some succeeded and reached production secrets. AWS says its services "were not compromised and operated as designed" and that the credentials were taken from customers' compromised applications.SectorMany sectorsWay inNot public yetProduct or vendorAWS, Microsoft IISIdentityHighConfirmed
Silent Lynx: an AI agent helped spy on Tajik and Uzbek government systemsAIOn November 11, 2026, CloudSEK published what it found on an exposed server of a Silent Lynx operator: domain-level access to Tajikistan's national railway network from mid-August to at least October 10, documents taken from the Tajik government's electronic document platform, and command execution on a server of Uzbekistan's Smart Forestry initiative. An open-source AI agent, Hermes, set up as an offensive security specialist and mainly run on DeepSeek models, handled reconnaissance, collection and cleanup. CloudSEK assesses with medium confidence that the operator has a Kazakhstan nexus.SectorGovernment & politicsWay inNot public yetProduct or vendorGeoServer2,000+ unique documents taken that were addressed to or routed through Tajikistan's Ministry of DefenceBreaches & extortionHighDeveloping
Worten: attackers exploit a flaw to reach customer and service-provider dataPortuguese electronics retailer Worten (Sonae group) says it was the victim of "a criminal act of unauthorised access" to some customer and service-provider data, through a vulnerability it has since fixed. For a small group of customers, the attackers reached their tax number (NIF), phone number, email address and in some cases an order number. Worten says no payment data, cards or passwords were accessed, has informed affected customers and is working with CNCS, the CNPD and the Polícia Judiciária.SectorRetailWay inSoftware flawProduct or vendorWortenVulnerabilitiesMediumConfirmed
CSCTelecom: four years of bank and airline text messages left in an open databaseCybernews researchers found a publicly accessible ClickHouse database belonging to the Latvian branch of CSCTelecom, a company that sends text messages on behalf of businesses. It held over 125 million SMS messages from October 2022 to September 2026, updated in real time, with message content, recipient phone numbers and sender names such as Swedbank, SEB, airBaltic and Latvia's 112 emergency line. According to Artea, CSCTelecom described "an identified access configuration vulnerability", said it was resolved and that its checks found no signs of an attack. Cybernews says it has no evidence that malicious actors accessed the database.SectorTech & SaaSWay inExposed or misconfiguredProduct or vendorCSCTelecom, ClickHouse125M+ SMS messages readable in the open database (October 2022 to September 2026)VulnerabilitiesMediumDeveloping
Effy: a partner craftsman's login used to read customers' renovation projectsEffy, a French energy renovation platform, told customers by email, relayed on November 11, 2026, that a third party logged into its partner space with the credentials of a partner craftsman, Airtech, and accessed the details of people put in touch with that company. Effy says its own systems were not hacked and that the credentials were "vraisemblablement" (probably) taken from the internet after a professional's computer was hacked or spyware was installed. It cut the access, reset the accounts' credentials and notified the CNIL.SectorConsumer apps & devicesWay inStolen credentialsIdentityMediumConfirmed
GSocket: attackers keep a hidden way back into hacked Linux web serversOn November 11, 2026, Microsoft described several incidents in which threat actors broke into internet-facing Linux web servers, mostly PHP applications on cPanel hosting, and installed GSocket, an open-source remote access tool. Both the server and the operator connect out to a public relay network, so there is no attacker address to block, and access survives the patch of the original flaw. Microsoft says devices with GSocket-related detections rose 356.2% from March through August 2026.SectorMany sectorsWay inSoftware flawProduct or vendorcPanel, Apache, Linux kernelVulnerabilitiesMediumConfirmed
Monceau Fleurs: customer data of four Emova florist brands taken through a checkout software supplierEmova Group, owner of the Monceau Fleurs, Au Nom de la Rose, Happy and Cœur de Fleurs florist chains, told customers by email that the provider of its checkout management software was hit by a cyberattack on October 30, 2026, and that the attacker was able to extract customer data. Emova speaks of a "nombre limité" (limited number) of customers, says bank data is not included and notified the CNIL on November 6. The supplier is not named.SectorRetailWay inSupplierSupply chainMediumConfirmed
Maersk: unauthorised access and data extraction from a local legacy systemThe Danish shipping group said on November 11 that it was investigating an IT security incident involving unauthorised access and data extraction from one of its local legacy systems, which came from a previous acquisition. Maersk says the incident is isolated to that system, that its findings so far strongly suggest no sensitive data was disclosed, and that it does not expect disruption for customers.SectorTransportWay inNot public yetBreaches & extortionMediumConfirmed
Kinnarps: an IT attack stops production at three Swedish furniture factoriesSwedish office furniture maker Kinnarps found abnormal activity in its networks on the evening of Saturday, November 7, 2026, and shut down its systems. All production stopped on Monday at its factories in Kinnarp, Jönköping and Skillingaryd, and was still stopped on Wednesday, November 11. The company has reported the attack to the police, says no ransom has been demanded, and does not know who is behind it.SectorRetailWay inNot public yetBreaches & extortionHighConfirmed
ActiveCloud (Belarus): ransomware encrypts part of a cloud provider's infrastructureActiveCloud, a cloud provider serving businesses in Belarus and Russia, says a ransomware attack starting at 03:30 on November 10, 2026 encrypted part of its cloud infrastructure. Its E-Cloud and E-Cloud Protected hosting, SmartMail and SelfMail email, websites, support and telephony went down for days. The company says it found no leak of customer data. Main services were back by late November 12; some virtual machines may not boot because their disk boot area was damaged.SectorTech & SaaSWay inNot public yetProduct or vendorActiveCloud E-Cloud, ActiveCloud SmartMailSupply chainHighConfirmed
Turla turned government Exchange servers in Kazakhstan and Romania into spy hubsOn November 10, 2026, ESET disclosed Cereal, a new toolset hidden inside the Microsoft Exchange servers of two national government bodies, one in Kazakhstan and one in Romania. It picked out emails with Word or PDF attachments, and in Romania it was set to collect mail to or from NATO and EU addresses. ESET attributes it to Turla with high confidence, and Romania's intelligence service (SRI) also names Turla. The SRI says the attackers exploited vulnerabilities in Microsoft operating systems and that no exfiltration of sensitive data was identified in Romania.SectorGovernment & politicsWay inSoftware flawProduct or vendorMicrosoft Exchange2 national government organizations compromisedVulnerabilitiesHighConfirmed
GhostFrame: an ESXi implant that steals Windows credentials from virtual machine snapshots, linked to Settra ransomwareRecorded Future's Insikt Group describes GhostFrame, a previously undocumented control framework that runs on compromised VMware ESXi hypervisors. It lets operators control guest virtual machines, pivot through the network and pull credentials out of VM snapshots and disks, so no malware runs inside the Windows machines. Insikt saw it used by TAG-218, a group whose operations overlap with Settra ransomware, which targeted VPN appliances in the US and Europe from late August to October 2026.SectorMany sectorsWay inNot public yetProduct or vendorVMware ESXi, SonicWall, Palo Alto Networks, Fortinet4 targeted organizations later listed on the Settra leak siteBreaches & extortionHighConfirmed
Xen Orchestra: an empty login token gives attackers admin over virtualization serversOn November 10, 2026, Vates, the French company behind Xen Orchestra, published a critical advisory for an authentication bypass in its virtualization management tool and the Xen Orchestra Appliance. A cookie holding an empty token logs an attacker in with admin rights, which Vates says can lead to code execution on managed pools and a full XCP-ng node takeover as root. Vates says the flaw is actively exploited and has shipped fixes.SectorMany sectorsWay inSoftware flawProduct or vendorXen Orchestra, Xen Orchestra Appliance, XCP-ngVulnerabilitiesHighConfirmed
Grok Build: most apps made with the AI builder opened to anyone, some with staff and patient dataAIClaroc Research found that Grok's app builder preselects "Anyone with the link" when an app is published, and that the app names can be found through common subdomain discovery. Of 37,571 Grok Build apps still online, 35,578 (94.7%) opened with no sign-in. Exposed apps included a hospital group's roster of more than 3,500 employees, a contractor timesheet script holding 18 accounts with plain-text passwords, and SpaceXSI and X staff apps such as an advertising proposal to a U.S. federal agency marked confidential. SpaceXSI took down its 24 staff apps; no change to the default for other users has been reported.SectorMany sectorsWay inExposed or misconfiguredProduct or vendorGrok Build, Grok35,578 Grok Build apps that opened with no sign-in, out of 37,571 online, according to ClarocVulnerabilitiesMediumDeveloping
Poland: ePUAP government services platform shut down after a cyberattackPoland's Digital Affairs Minister Krzysztof Gawkowski said a cyberattack on ePUAP, the national platform for sending official documents and dealing with public agencies online, was detected and stopped. The ministry took the platform offline as a precaution and says the system was not compromised. Authorities have not said how the attack was carried out, who is behind it, or when service will return.SectorGovernment & politicsWay inNot public yetProduct or vendorePUAPBreaches & extortionMediumDeveloping
Outlook: Microsoft patches a zero-day that leaks Windows login hashes through a crafted message fileOn November 10, 2026, Microsoft's Patch Tuesday fixed CVE-2026-124194, an Outlook spoofing flaw that attackers are already exploiting. A crafted message file, once opened, makes Outlook connect to an attacker's server without the usual external-content warning, which can disclose the user's authentication information. Microsoft confirms attacks but has not said who is behind them or who was targeted. CISA added the flaw to its Known Exploited Vulnerabilities catalog.SectorMany sectorsWay inSoftware flawProduct or vendorMicrosoft Outlook, Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024VulnerabilitiesMediumConfirmed
Vanderbilt University: a cybersecurity incident cuts access to campus systemsVanderbilt University in Nashville said on November 9, 2026 that it was responding to an active cybersecurity incident affecting university devices, systems and cloud-based services. It told staff to shut down university devices and disconnect from campus Wi-Fi. By the evening Wi-Fi was back, but access to most systems and applications stayed restricted. A ransomware group calling itself BYOD claims the attack and says it took student and employee records; Vanderbilt has not confirmed any data theft or named who is behind it.SectorEducationWay inNot public yet1M+ Social Security numbers and student and employee records claimed by the BYOD group (unverified)Breaches & extortionHighConfirmed
N-able N-central: 33 flaws published, then cryptominers on 21 servers despite the hotfixA researcher published details and proof-of-concept code for 33 unpatched flaws in N-able N-central, the remote monitoring and management tool used by managed service providers, chained into four exploits he calls "Able2Shell". On November 9, 2026, N-able took its hosted N-central environment offline "as a precautionary measure" and told on-premises customers to keep their servers offline until a fix ships. At first, N-able said it had seen no evidence that the flaws were exploited. A hotfix shipped on November 10; a day later the researcher published two new exploit chains that work against it, which N-able says only reach servers with the non-default Legacy API turned on and exposed to the internet. Within hours, attackers used the new chain: researchers at Huntback and Lupovis found a Monero miner on 21 N-central servers, 19 of them already running the hotfix. N-able says it found additional indicators of compromise, is working with those customers, and is restricting some N-central features and integrations while it fixes the flaws.SectorTech & SaaSWay inSoftware flawProduct or vendorN-able N-central21 N-central servers found running a cryptominer, 19 of them on the latest hotfixVulnerabilitiesHighConfirmed
MSP Process: app credentials and tokens for Microsoft partner tenants taken from the MSP software vendorMSP Process, a software vendor for managed service providers, says an unauthorized party reached one of its internal servers and part of its infrastructure on November 7, 2026, between 09:56 and about 14:40 UTC. That infrastructure held app credentials and access tokens for partners who use its features connected to Microsoft Partner Center admin relationships (Authenticator, Password Reset, Contacts sync). The vendor rotated its credentials and disabled its identity features for all partners. Huntress, as reported by The Stack, saw successful malicious token grants in 47 tenants. MSP Process has not said how the attacker got in.SectorTech & SaaSWay inNot public yetProduct or vendorMSP Process, Microsoft Partner Center, Microsoft Entra ID47 tenants with successful malicious token grants, according to HuntressSupply chainHighConfirmed
Qubole: an attacker used the data platform's trusted AWS access to read customer secrets and dataBetween October 14 and October 26, 2026, an attacker used IAM credentials from an AWS account associated with Qubole, a big-data platform, to assume the roles customers had created for it in their own AWS accounts. Wiz and Sentra, who disclosed the campaign on November 9, say the attacker read secrets, Lambda environment variables and parameters, then downloaded S3 data. How the attacker obtained Qubole's credentials is not known, and no statement from Qubole had been published.SectorTech & SaaSWay inSupplierProduct or vendorQubole12+ organizations impacted, according to Sentra (which also speaks of dozens of customers)Supply chainHighDeveloping
Technical University of Munich: myTUM portal attack exposes central login passwordsThe Technical University of Munich (TUM) says unknown attackers hit its myTUM portal and stole passwords for the central login to TUM systems. With a TUMonline system administrator's credentials, they then attacked TUMonline, the campus management system, which TUM took offline. TUM disclosed the incident on November 6, 2026 and brought TUMonline back on November 9, with a password change and two-factor authentication required. It says accounts with MFA were protected. TUM has not said how the attackers first got in or how many people are affected.SectorEducationWay inNot public yetProduct or vendorTUMonlineBreaches & extortionHighConfirmed
York University: personal data stolen from department web forms dating back to 2007York University in Toronto confirms that an unauthorized actor accessed online forms used by its departments and stole personal information from some of them. The incident came to its attention on October 25, 2026 and covers forms on 14 university websites, some filled in since 2007. Most stolen records hold York ID numbers and contact details, but some forms also held health, disability, criminal background or financial information. York has not said how many people are affected or how the actor got in.SectorEducationWay inNot public yetBreaches & extortionHighConfirmed
Wyndham: a password left in the Android app opened an internal customer databaseSecurity researcher Robert Wiggins of What Security found a password inside the source code of Wyndham's Android app that gave access to an internal company database hosted by Salesforce, TechCrunch reported on November 9, 2026. The database held customer names, email addresses, Wyndham member numbers, customer login tokens and internal files, in "millions of entries". Wyndham revoked the credential soon after TechCrunch alerted it and says its security teams "have no evidence of any unauthorized access".SectorConsumer apps & devicesWay inStolen credentialsProduct or vendorWyndham app, SalesforceIdentityMediumResolved
Chrome: Google patches an XML zero-day exploited in the wild, the eighth of 2026On November 9, 2026, Google shipped Chrome 157.0.8103.50/.51 with a fix for CVE-2026-125350, a high-severity use-after-free in the browser's XML component. Google says "an exploit for CVE-2026-125350 exists in the wild" but has shared no details on the attacks. It is the eighth Chrome zero-day exploited this year, according to BleepingComputer and SecurityWeek.SectorMany sectorsWay inSoftware flawProduct or vendorGoogle ChromeVulnerabilitiesMediumConfirmed
Garanka: customer data exfiltrated in a cyberattackFrench company Garanka told its customers by email on November 9 that personal data was exfiltrated during a cyberattack. In October its website only said that systems had been isolated and email was down. The data may include names and contact details, heating system and service history details, and in isolated cases invoices and payment information. Garanka says no bank card data was taken, and that it filed a criminal complaint and notified the CNIL.SectorConsumer apps & devicesWay inNot public yetBreaches & extortionMediumConfirmed
Visionix: cyberattack on the French eye-care equipment maker's IT systemsRevenio Group, the Finnish eye-care company that took over Visionix in May 2026, said on November 9, 2026 that it had detected a cyberattack on the IT systems of its French subsidiary. The affected server held internal IT service requests. Revenio says it contained the attack to a local server, that its other operations are not affected, and that it notified the relevant French authorities. How the attackers got in and what, if anything, was taken have not been made public.SectorHealthWay inNot public yetProduct or vendorVisionixBreaches & extortionMediumConfirmed
FreeSWITCH: a crafted SIP message runs API commands on phone servers, exploited in the wildFreeSWITCH, the open-source telephony server maintained by SignalWire, let an incoming SIP MESSAGE with a plus sign in the recipient's user name reach its api chat handler, which runs FreeSWITCH API commands. It works on the default setup when the attacker has one registered account, or with the empty-password default user of the stock configuration. The project fixed it in 1.11.3 on October 28, 2026 and says exploitation has been observed in the wild. CISA added it to its list of exploited flaws on November 9, 2026, according to The Hacker News.SectorMany sectorsWay inSoftware flawProduct or vendorFreeSWITCH, SignalWireVulnerabilitiesMediumConfirmed
GPUStack: a forged header gives attackers admin over AI model servers, exploited in the wildAIGPUStack, an open-source platform for running AI models on GPU clusters, trusted any request that appeared to come from the local machine. A request with a forged X-GPUStack-Real-IP: 127.0.0.1 header, or one passed through a reverse proxy on the same host, was treated as an unauthenticated admin, and an admin can register a custom inference backend that runs commands. The project fixed it in version 2.2.0 and says the flaw was exploited in the wild against a 2.1.1 deployment. CISA added it to its list of exploited flaws on November 9, 2026, according to The Hacker News.SectorMany sectorsWay inSoftware flawProduct or vendorGPUStackVulnerabilitiesMediumConfirmed
IBM Aspera Faspex: an authorization bypass that grants full admin rights, listed as exploited by CISAIBM fixed an authorization bypass in Aspera Faspex, its file exchange server, in version 5.0.19 PL1. The flaw (CVE-2026-123218, CVSS 9.8) lets a user craft a message that gives full administrative privileges, according to SecurityWeek. CISA added it to its catalog of exploited vulnerabilities on November 9, 2026. IBM's bulletin does not mention exploitation, and no details on the attacks are public.SectorMany sectorsWay inSoftware flawProduct or vendorIBM Aspera FaspexVulnerabilitiesMediumConfirmed
South Korea's Financial Security Institute hacked: files from 48 financial firms leaked from its evaluation siteOn November 9, 2026, attackers reached the online system that South Korea's Financial Security Institute (FSI), the body in charge of cybersecurity for the financial sector, uses to collect financial firms' security self-assessments. Korean media report that they posed as a user with the privileges of the Financial Supervisory Service. The FSI says employees' names, dates of birth and masked phone numbers leaked, but no system diagrams, resident registration numbers or customer credit data. Police are investigating; no attacker has been named.SectorFinanceWay inSoftware flaw48 financial companies whose files leakedVulnerabilitiesMediumConfirmed
Philippines SEC: personal data of online platform users exposed, tax IDs includedOn November 9, 2026, the Philippines' Securities and Exchange Commission (SEC) confirmed a data breach affecting users of its digital platforms, after the group Deep Web Konek flagged a forum listing of about 487,000 lines of SEC-linked data on November 5. The SEC's notice to users lists names, usernames, emails, mobile numbers, birth dates, addresses and tax identification numbers (TIN). It says no passwords leaked and no company records were affected, and it has notified the National Privacy Commission. It has not said how many people are affected.SectorGovernment & politicsWay inNot public yet487K lines of SEC-linked data offered by a forum seller (unverified; the SEC has not confirmed the link)Breaches & extortionMediumConfirmed
Ethersphere: poisoned bee-js and Swarm Desktop releases steal Swarm wallet keysOn November 9, 2026, an attacker published a malicious @ethersphere/bee-js 13.3.0 on npm and a malicious Swarm Desktop 0.56.2 through the project's own release pipeline, using compromised GitHub accounts. The code sent Swarm node wallet keys and their password to the attacker and installed a remote backdoor. Both releases were withdrawn within hours; downloads stayed low, and no theft of funds had been reported.SectorTech & SaaSWay inSupplierProduct or vendor@ethersphere/bee-js, Swarm Desktop, npm65 downloads of the malicious Swarm Desktop 0.56.2, researchers included (upper bound, according to Socket)Supply chainMediumConfirmed
Softway Medical: data breach on One Manager, its radiology information systemSoftway Medical, a French healthcare software publisher, said on November 8, 2026 that a malicious act caused a data breach on One Manager, its radiology information system (RIS). It says it stopped the breach, notified every affected client and suspended some remote access, while the software stays fully functional. It has not said how the attackers got in, which data was involved, or how many radiology centres or patients are concerned. On November 13 the CHU de Reims confirmed that its patients are affected.SectorHealthWay inNot public yetProduct or vendorSoftway Medical One ManagerSupply chainHighConfirmed
Operation Snowball: an AI agent spends two weeks inside a European telecom providerAIMalbear Labs found an exposed open directory holding the logs of an autonomous AI intrusion harness, built on DeepSeek Flash with a jailbreak system prompt, that attacked a European telecoms provider and thirteen organizations hosted on its infrastructure for more than two weeks. The researchers say it extracted dozens of credential sets and thousands of rows of subscriber billing and device records. They do not name the victims and describe the operator as Chinese-speaking.SectorTech & SaaSWay inSoftware flawProduct or vendorCisco BroadWorks, LiferayVulnerabilitiesHighDeveloping
Chambourcy: town hall network shut down after a weekend cyberattackThe town hall of Chambourcy, in the Yvelines west of Paris, says it was the target of a cyberattack over the weekend of November 7 to 8, 2026. It shut down its IT network as a precaution, filed a complaint and informed the CNIL. Staff are working largely on paper; reception, phones, the website and social media still work. The town has not said how the attackers got in, whether data was taken, or whether ransomware was involved.SectorGovernment & politicsWay inNot public yetBreaches & extortionMediumConfirmed
LNbits: Lightning wallet servers told to shut down during a wave of attacks, then patched in 1.7.0On November 8, 2026, the LNbits project, open-source software that people run to offer Bitcoin Lightning wallets, told every operator to "stop their LNbits servers IMMEDIATELY" after "a wave of attacks", and took its own hosted service offline. One operator reported 2,285,545 sats (about 0.023 BTC) withdrawn that day. On November 10, LNbits released version 1.7.0 as an urgent security update and said versions before it are at risk. It has not yet explained the exploit or said how many servers were hit.SectorMany sectorsWay inNot public yetProduct or vendorLNbitsBreaches & extortionMediumConfirmed
NEAR AI: an SGLang flaw on an inference server exposes about 100 users and 18 agentsAIAI platform NEAR AI says an attacker exploited a remote code execution flaw in SGLang, the open-source inference engine on its servers, on November 8, 2026. The attacker reached an internal system behind its deprecated Private Chat and took account details of about 100 users, plus chat history, settings and logs of 18 agents on a legacy deployment. NEAR AI says it fixed the flaw on all its inference servers and reported it to the SGLang project.SectorTech & SaaSWay inSoftware flawProduct or vendorSGLang, NEAR AI~100 users whose account details (email, name, and for some plan and balance) were downloaded, plus 18 agentsVulnerabilitiesMediumResolved
Maru-Jan: email addresses and passwords of 1.85 million players leakedSignalTalk, the Japanese company behind the online mahjong game Maru-Jan, says attackers abused a function of its management system and downloaded the email addresses and passwords of all 1,855,578 members by November 4. It asks players to change their password there and on any other service where they reuse it.SectorConsumer apps & devicesWay inNot public yet1.86M members whose emails and passwords were takenBreaches & extortionCriticalConfirmed
Mittwald: an attacker used a flaw in the web host's AI assistant server to compromise 56 customer projectsAIGerman web host Mittwald says an attacker exploited a weakness in the MCP server of its mStudio platform, the interface that lets customers connect AI assistants to their hosting. The attacker went unnoticed from October 27 to November 4 and compromised 56 customer projects. Mittwald's CEO says the speed of the attack, sometimes seconds between steps, points to the use of AI tools.SectorTech & SaaSWay inSoftware flawProduct or vendorMittwald mStudio56 customer projects compromisedVulnerabilitiesHighConfirmed
UnrealIRCd: any chat user can send commands with server authority, and attackers are using itCVE-2026-114713 is a flaw in the labeled-response module of UnrealIRCd, an open-source IRC chat server. On a network with two or more linked servers, an ordinary user can inject server-to-server commands, which UnrealIRCd says lets normal users execute commands with server or IRCOp authority. The project fixed it on November 7, 2026 in version 6.2.7.1 and a hot-patch, then reported attacks in the wild. CISA added it to its catalog of exploited flaws on November 13.SectorMany sectorsWay inSoftware flawProduct or vendorUnrealIRCdVulnerabilitiesMediumConfirmed
Italy: Foreign Minister Tajani's personal data spread on the dark webItalian Foreign Minister Antonio Tajani said on November 7, 2026 that "for days" cybercriminals had been spreading his personal data on the dark web and seeking more information about him and his family, which they were willing to pay for. Prime Minister Giorgia Meloni linked it to the activities of pro-Russian hackers. Neither has said what data was published, how it was obtained or which group is behind it.SectorGovernment & politicsWay inNot public yetBreaches & extortionMediumConfirmed
Claude Code: "don't ask again" saved typed secrets in a settings file found in public GitHub reposAIResearchers at Apiiro found 1,122 public copies of Claude Code's .claude/settings.local.json file holding at least one real-looking secret, 1,379 distinct secrets in all. When a user approves an exact command with "Yes, and don't ask again", the command is saved as an allow rule, with any password or token typed into it. Apiiro did not test whether the secrets work; one notified company confirmed its key had been live.SectorMany sectorsWay inExposed or misconfiguredProduct or vendorClaude CodeVulnerabilitiesMediumConfirmed
Who Gives A Crap: customer data accessed through a marketing software providerThe Australian toilet paper brand Who Gives A Crap told customers in Australia, the US and the UK that their personal information "was accessed without authorisation" in a security incident at one of its marketing software providers. Names, contact details, postal addresses and total spend are involved; payment details, order details and passwords are not. The company has not given a number of customers.SectorRetailWay inSupplierSupply chainMediumConfirmed
Smartbox: unauthorised access to one of its platformsThe gift box company told customers by email that it detected unauthorised access to one of its platforms on November 3. Names and email addresses may have been viewed; it says bank details and passwords were not affected.SectorRetailWay inNot public yetBreaches & extortionMediumConfirmed
Nitori: up to 37.62 million customer records may have leaked after unauthorised accessNitori, Japan's largest furniture and home goods retailer, confirmed on November 6 that a third party had accessed a system it manages. The access may have started in mid-to-late October. The company says up to 37.62 million records of personal information may have leaked; passwords and card data were not exposed.SectorRetailWay inNot public yet37.62M customer records that may have leaked (upper bound, not a count of people)Breaches & extortionCriticalConfirmed
Amplifon Americas: hearing care files copied over three weeks, 1.3 million people affectedAmplifon Americas, the US arm of the Italian hearing care group Amplifon, says an unauthorized third party obtained files from certain of its systems between January 18 and February 8, 2026. It detected the activity on February 11 and found on October 6 that personal and health information may have been involved. Its filing with the Texas Attorney General, on November 6, counts 1,332,826 people affected in total. How the attackers got in is not public.SectorHealthWay inNot public yet1.3M people affected in total, per Amplifon's filing with the Texas Attorney GeneralBreaches & extortionCriticalConfirmed
Keplr: a flaw at login provider Web3Auth exposes the keys of Google and Apple sign-in walletsOn November 6, Web3Auth put its login service into maintenance "due to a security incident". Keplr, a Cosmos crypto wallet that uses Web3Auth for Google and Apple sign-in, reported unauthorized transactions on some of those accounts and paused both logins. Web3Auth then used the same access path to move funds from wallets still at risk into recovery wallets: at least $6.01M from about 44,700 wallets, according to Bitquery. Neither company has said how much the attacker took or how the flaw worked.SectorFinanceWay inSupplierProduct or vendorKeplr, Web3Auth$6.01M moved out of exposed wallets, mostly into Web3Auth's recovery wallets, counted by Bitquery (amount stolen not public)44.7K wallets whose funds were moved, according to BitquerySupply chainHighConfirmed
Delcampe: collectors' addresses and purchases downloadedThe Belgian collectibles marketplace told some members by email that files holding their data were downloaded without authorisation on the night of November 5 to 6: names, delivery addresses and details of some purchases. It says passwords, real email addresses, phone numbers and payment data were not exposed.SectorRetailWay inNot public yetBreaches & extortionMediumConfirmed
Gnosis Pay: customer data exposed in its legacy card systemThe crypto payment card provider says its monitoring detected unauthorised access on November 3 to the legacy system behind its Gnosis Pay-branded cards. Certain customer information was exposed; it says funds were not affected and its white-label platform was not touched.SectorFinanceWay inSoftware flawProduct or vendorGnosis PayVulnerabilitiesMediumConfirmed
SonicWall SSLVPN: a flaw lets other credentials skip SAML and its MFASonicWall says a SonicOS SSLVPN flaw, CVE-2026-19868, can let a user with valid credentials for another authentication method bypass SAML login controls, including SAML-enforced MFA. It investigated a report of potential exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities catalog.SectorMany sectorsWay inSoftware flawProduct or vendorSonicWall SonicOSVulnerabilitiesMediumConfirmed
Three charged in AI impersonation scheme that stole more than $129 millionAIUS prosecutors in New York say three men used AI to imitate the voice or image of company executives, then posed as lawyers, to get employees to wire money to accounts they controlled. The charges are accusations: the defendants are presumed innocent.SectorMany sectorsWay inPhishing, social engineering$129M+ taken from companies, 2024 to 2026IdentityCriticalConfirmed
French blood service (EFS): plasma cold rooms tampered with through a supplierAn attacker reached the systems of a refrigeration equipment supplier and raised temperature and defrosting thresholds in cold rooms at three EFS sites. Alarms caught it, staff regained control, and EFS says no blood products were lost.SectorHealthWay inSupplierProduct or vendorCoolworldSupply chainHighConfirmed
Fake security tools on GitHub infect more than 2,000 PCs of the people building themDr.Web describes GitHub repositories posing as scanning, security-testing and log-analysis tools. Hidden code runs when the project is built or opened, then installs a backdoor, a clipboard hijacker for crypto addresses and an infostealer. Dr.Web counts more than 2,000 infected PCs; the first such repositories appeared about two years ago.SectorTech & SaaSWay inSupplierProduct or vendorGitHubSupply chainHighConfirmed
SignalPlus: fake Teams invite compromises an engineer, Binance and Deribit revoke API keysSignalPlus, a crypto options trading platform, says an attacker used a compromised Telegram account of a vendor contact to send an engineer a fake Microsoft Teams invitation. SignalPlus says it lost $81,897 and has fully compensated the 23 affected users. Binance and Deribit removed all API keys linked to SignalPlus as a precaution.SectorFinanceWay inPhishing, social engineering$81,897 user funds lost, fully repaid23 users affectedIdentityHighConfirmed
Illicado: copies of 15,000 company e-gift cards taken in an automated attackIllicado, a French multi-brand gift card company, told AFP on November 6, 2026 that a cyberattack on November 1 targeted 15,000 digital gift cards (e-cards) bought by companies for their employees. Its email to clients describes a "targeted and automated" attack on the service that generates the e-cards' PDF documents. Illicado says it deactivated the cards, sent each holder a new e-card with the exact balance, that no payment had been made with them so far, and that it notified the CNIL.SectorRetailWay inNot public yetProduct or vendorIllicado15,000 digital gift cards (e-cards) affected, according to IllicadoBreaches & extortionMediumConfirmed
"sshole": OpenSSH on Alpine Linux accepts any long password for locked accountsOn musl-based Linux systems such as Alpine, OpenSSH without PAM let an attacker log in to an account whose password field is "*" with any password longer than 256 bytes. OpenSSH 10.6p2 and Alpine packages fixed it on November 5. A researcher saw attempts within nine hours, and root access on one of its honeypots.SectorMany sectorsWay inSoftware flawProduct or vendorOpenSSH, Alpine LinuxVulnerabilitiesMediumConfirmed
BOSSAI: a lone operator's AI agents take data from Taiwan's emergency servicesAIAcronis researchers describe a single operator, based in Taiwan, who ran a mesh of 12 AI agents (nine active), mostly on local models with their safety training removed, against hundreds of organizations in eleven countries. They confirmed data theft or access at about ten, including Taipei fire and ambulance dispatch records, patient data left open without a login, and three Thai universities. The ways in were ordinary: SQL injection, default credentials and systems open without authentication.SectorGovernment & politicsWay inSoftware flaw~10 organizations where researchers confirmed data theft or access, out of hundreds targeted in 11 countriesVulnerabilitiesHighDeveloping
Kyiv Independent: CMS and newsletter service used to send fake newsAttackers got into the outlet's content system and a newsletter service, then sent four fake emails, one claiming a nuclear strike on Kyiv.SectorMediaWay inNot public yetIdentityHighConfirmed
ARTEX: a copycat Docker image adds a root backdoor to the AI pentest consoleAIAfter the author of ARTEX went closed source on October 8, a copy of the repository changed one line of docker-compose.yml to pull the image tomicdd/artex. Badbyte says the image runs commands as root on one unauthenticated login request. It counted 62 internet-facing consoles serving it. No attack through the backdoor is reported.SectorTech & SaaSWay inSupplierProduct or vendorARTEX, Docker HubSupply chainMediumConfirmed
cPGuard: a fake security update, signed in with a stolen key, ran as root on about 2,950 serversAn attacker broke into the billing and licensing server of OPSSHIELD, the vendor of the cPGuard Linux security suite, took the key used to publish updates, and pushed a fake update. For about 70 minutes on 2 November, cPGuard agents installed it as root and sent password hashes, root SSH keys and other secrets to the attacker. OPSSHIELD has disclosed the details and published a clean version.SectorTech & SaaSWay inSupplierProduct or vendorcPGuard7,900 customer accounts in the stolen billing recordsSupply chainCriticalConfirmed
Stolen Entra app secrets used against 27 organizations, many through MSP appsSince November 1 an operator has signed in to Microsoft Entra ID and Azure DevOps as applications, using stolen app secrets, a federated workload identity and replayed tokens. Todyl counts 27 organizations reached, 81 files downloaded and about 2,279 mailbox items accessed. Microsoft ties related activity to agentic AI tooling that scans GitHub for exposed secrets.SectorMany sectorsWay inStolen credentialsProduct or vendorMicrosoft Entra ID, Azure DevOpsIdentityHighConfirmed
mSecure: password manager warns of "suspicious activity" without saying what happenedmSeven Software emailed mSecure customers that it had learned of suspicious activity linked to the app. It suggests changing passwords, resetting two-factor authentication and removing passkeys. The notice does not say what happened, when, or whether vault data was reached.SectorTech & SaaSWay inNot public yetProduct or vendormSecureBreaches & extortionMediumDeveloping
Nojima: about 7 million member records leaked from its online shopJapanese electronics retailer Nojima detected unauthorized access to the member management system behind its Nojima Online shop and its used smartphone buyback site on November 1, 2026, and confirmed a leak the same day. About 7 million member records are affected, with names, birth dates, addresses, phone numbers, emails, login IDs and encrypted passwords. Nojima says it holds no credit card data on these sites. It has consulted the police and plans to report to Japan's data protection authority.SectorRetailWay inNot public yetProduct or vendorNojima Online7M member records leaked (about), per NojimaBreaches & extortionCriticalConfirmed
XCPE: Google says a TV box maker built a backdoor into 1.3 million devicesGoogle's Threat Intelligence Group says it disrupted the XCPE botnet, made of more than 1.3 million Android TV set-top boxes with a backdoor preloaded in the firmware. Google assesses with high confidence that the maker, Videostrong, built and ran it on purpose to sell access to criminal affiliates. Cutting the affiliates' servers would sever access to at least 10 million more devices.SectorConsumer apps & devicesWay inSupplierProduct or vendorVideostrong1.3M+ backdoored set-top boxesSupply chainCriticalConfirmed
Mercado Bitcoin: about $38 to $46 million drained from Brazil's largest crypto exchangeOn November 2, Mercado Bitcoin, Brazil's largest crypto exchange, said it had "identified and quickly contained a security incident in one of our systems" and suspended deposits and withdrawals. Blockchain analysts counted more than $46 million leaving the platform; the exchange later put the total at about $38 million and says no customer will lose assets. It has not said how the attackers got in.SectorFinanceWay inNot public yet$38–46M in crypto moved out (exchange vs. blockchain analysts)Breaches & extortionHighConfirmed
Myriad Genetics: network intrusion suspends genetic testing and order systemsOn November 2, US genetic testing company Myriad Genetics "detected unauthorized access within its information technology network environment". It temporarily suspended its testing operations and order management systems and reset certain credentials. In a filing with the SEC on November 5, it says most systems are back and that it is still assessing whether patient records were accessed.SectorHealthWay inNot public yetBreaches & extortionHighConfirmed
Beget (Russia): hosting provider's cloud data wiped after attackers reach its management layerIn the night of November 1 to 2, attackers reached the systems that manage Beget's infrastructure and ran scripts that erased data. VPS, S3 and Kubernetes data were lost, along with all binary backups of virtual servers. File-level backups survived. Restoration needs manual checks on more than 1,000 servers.SectorTech & SaaSWay inNot public yetProduct or vendorBeget1,000+ servers needing manual checksSupply chainHighConfirmed
WorkOS: a researcher's AI pentest agent left its sandbox and pulled sales and support dataAIWorkOS found that an internal sales tool had been reached from the internet and its records pulled in bulk. A security researcher then took responsibility: their ARTEX agent "escaped its isolated testing environment" during benchmark work. It got in with a predictable credential meant for local development. WorkOS and an independent forensics firm validated the claim.SectorTech & SaaSWay inExposed or misconfiguredVulnerabilitiesHighConfirmed
Barracuda: attackers exploit two flaws that give root on Email Security Gateway appliancesOn November 2, 2026, Barracuda patched two flaws in its Email Security Gateway and five other appliances. Chained, they let an attacker who can reach the admin interface bypass authorization and get root on the device. On November 9, Barracuda added that it has "identified exploitation activity affecting a small number of organizations".SectorMany sectorsWay inSoftware flawProduct or vendorBarracuda Email Security Gateway, Barracuda Load Balancer ADC, Barracuda Message Archiver, Barracuda WAF Control Center, Barracuda Web Application Firewall, Barracuda Web Security GatewayVulnerabilitiesMediumConfirmed
Node-RED: unauthenticated admin API flaw (CVE-2026-58115) exploited to drop a Linux bot and webshellsCVE-2026-58115 is a missing-authentication flaw in Node-RED, the low-code automation tool, rated CVSS 10.0. Siemens disclosed it on August 11, 2026 for Node-RED on its SIMATIC IoT2050 industrial devices. On October 30, VulnCheck's honeypots caught an attacker using it to push a flow that downloads a Linux bot, followed by webshells. VulnCheck says the activity looks like opportunistic mass scanning and has not seen it against Siemens products. No victims have been named.SectorMany sectorsWay inSoftware flawProduct or vendorNode-RED, Siemens SIMATIC IoT2050VulnerabilitiesMediumConfirmed
Crédit Mutuel Arkéa: a cyberattack enables fraudulent transfersThe bank confirmed a cyberattack that enabled fraudulent operations and says clients bear no loss. On-chain investigators count more than $100M moved to crypto. The attackers came in through a service provider's platform, not yet named.SectorFinanceWay inSupplier$109–133M moved to crypto, by on-chain estimatesSupply chainCriticalConfirmed
BTCPay Server: attackers drain hot wallets on outdated self-hosted payment serversOn November 1, 2026, operators of BTCPay Server, an open-source payment processor that merchants host themselves, reported Bitcoin and Litecoin stolen from their hot wallets. BTCPay says the attacks targeted servers running version 2.4.1 or earlier and used a different method to exploit a vulnerability fixed in 2.4.2 in August. Blockchain analytics firm Bitquery traced at least $1.63 million taken in 682 sweeps.SectorMany sectorsWay inSoftware flawProduct or vendorBTCPay Server$1.63M in Bitcoin and Litecoin traced to the thief by Bitquery (a floor, at November 2 prices)VulnerabilitiesHighConfirmed
Rosstat: destructive cyberattack on Russia's statistics serviceRussia's Federal State Statistics Service (Rosstat) says its information resources were hit by "targeted destructive cyberattacks" from October 29 to November 1. Two hacktivist groups, Silent Crow and the Belarusian Cyber Partisans, defaced its sites and claim to have taken 23 TB of data. Rosstat says no leak of databases or protected information has been identified.SectorGovernment & politicsWay inNot public yetBreaches & extortionHighConfirmed
Ukraine and Russia: emergency alert apps hijacked to send fake nuclear warningsOn the night of November 1, Ukraine's Air Alert app sent fake radiation, chemical and street-fighting alerts. Hours later, Russia's Emergency Situations Ministry app sent a fake nuclear warning across 33 regions. Both sides confirm the hacks and say their national warning systems kept working.SectorGovernment & politicsWay inNot public yetProduct or vendorAir AlertBreaches & extortionHighConfirmed
Trigger.dev: attacker obtained customer root API keysThe background jobs platform Trigger.dev detected anomalous activity on November 1 and found that an attacker had obtained root API keys for some customer environments, about 0.66% of its customers. It revoked every exposed key and asked customers to rotate their credentials. It does not disclose the attack vector.SectorTech & SaaSWay inNot public yetProduct or vendorTrigger.devSupply chainMediumConfirmed