Headlines from leading security publishers, collected every 10 minutes.
Robin Patrick Martin faces federal charges for allegedly sending threatening communications and hoaxes to intimidate election officials nationwide. The case highlights threats directed at personnel involved in the democratic process.
Blockchain infrastructure provider Chainstack disclosed a cyber attack that allowed unauthorized access to parts of its production infrastructure. The incident resulted in the exposure of customer data and password hashes.
Refrigerator controls at supermarkets and grocery stores across Europe were hacked during the early hours of Monday. This incident marks the second wave of attacks following a previous wave in France, with unidentified attackers causing fridges to defrost and inventory to spoil.
Authorities seized more than 100 servers and searched locations linked to the alleged operation across 17 countries.
Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew installation and recruitment-themed social engi…
Binance stated that a months-long campaign resulted in a $6.3 billion cryptocurrency theft. The exchange reported that attackers utilized techniques including social engineering through fake job interviews, while North Korea denied responsibility.
Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services.
Frontline Education suffered a data breach after hackers exploited a vulnerability in third-party software. The incident resulted in the theft of personal information belonging to school district staff and students.
Law enforcement agencies coordinated an operation resulting in the arrest of seven individuals and the seizure of over 100 servers. The investigation was initiated following a complaint from a German couple regarding financial losses exceeding 4 million euros.
A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host. [...]
Evidence suggests a model may have generated and revised commands during the ransom gang's breach, though researchers stopped short of claiming full automation.
Assured Data Protection has announced a new managed service named CleanRoom SCAN to strengthen cyber recovery. The service independently scans isolated backup data using multiple security engines to identify hidden threats prior to restoration.
Russia's Interior Ministry stated that police dismantled the infrastructure of the VasyGrek group, identified suspected members, and detained three individuals. The investigation was conducted with assistance from cybersecurity firm Kaspersky.
A Russia-linked cyber espionage group is targeting war crimes investigations and military aid routes in Ukraine. The hackers use simple malware to steal sensitive documents and login credentials from organizations near the front lines and border regions.
European law enforcement authorities arrested seven suspects and seized more than 100 servers in a joint action targeting an unnamed company suspected of providing fraudulent trading websites to criminal gangs. [...]
Your team is remediating more vulnerabilities than ever, yet your breach risk has barely changed. You’re spending too much time and effort on exposures attackers may never exploit, while higher-risk exposures sit, waiting in the queue.
A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations.
Hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned. [...]
Google and its partners successfully dismantled a botnet consisting of over 1.3 million set-top boxes. The malicious network relied on a backdoor named XCPE and was allegedly created by Android TV box maker Videostrong to facilitate ad fraud and proxy abuse.
Criminals who break into corporate cloud accounts are using the stolen access to run AI models at the victim’s expense, in some cases racking up more than $100,000 in charges in a single day, Google Threat Intelligence Group (GTIG) and Mandiant researchers have found.
Developers of BTCPay Server urged users to update their software following reports of Bitcoin and Litecoin thefts from hot wallets. Attackers targeted instances running older, unpatched versions of the self-hosted payment platform.
Synology is urging customers to update its DiskStation Manager software following ransomware attacks targeting Network Attached Storage devices. The attacks exploit a previously patched vulnerability in the software.
An interview with HackerOne CEO Kara Sprague highlights that while artificial intelligence can find flaws quickly, humans maintain an advantage in judging the business impact of vulnerabilities. The discussion also covered business logic bugs and the impact of AI on the crowdsourced security model.
Security findings reveal attempts to exploit a maximum-severity unpatched vulnerability in the CryptoPayment Gateway WordPress plugin. Tracked as CVE-2026-81648 with a CVSS score of 10.0, the flaw could potentially expose digital wallet credentials.
Ahmad Umar Agha, also known as Th3Pr0, was sentenced after spending over a decade as a fugitive for targeting Western media, businesses, and NGOs on behalf of the regime of Bashar Al Assad.
Ransomware operators attacked UNM hospital and surprisingly offered monetary compensation of 2,500 dollars to affected patients alongside an apology. Observers noted this is an unprecedented move in breach history.
The Office for Civil Rights settled an investigation regarding the 2023 breach at Lehigh Valley Health Network. The AlphV or BlackCat group carried out the attack and notoriously leaked sensitive patient images.
A second hospital in Liverpool is investigating two potential instances where staff members accessed medical records connected to the Southport attack without authorization.
Kyodo News reports: Leading beverage manufacturer Suntory Holdings Ltd. on Monday joined a growing list of firms reporting personal data leaks, saying information relating to around 100,000 people, including employees, was leaked following unauthorized access to an external cloud…
Dickson Tam reports: The Office of the Privacy Commissioner for Personal Data said it has received multiple notifications of data breaches involving Hong Kong Airlines, Cathay Pacific, Malaysia Airlines, as well as electronics retailers Yoho Hong Kong and Broadway.
Music agency HYBE disclosed a cyberattack that exposed sensitive personal information, credit card numbers, and medical records of current and former employees and partners.
The record theft shows how weak system separation, inadequate controls, and untested attack paths can turn one breach into systemic loss.
Blockchain security companies said more than $46 million left the Mercado Bitcoin platform.
Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries. [...]
A ransomware group known as BYOD published a post linking themselves to a security incident that triggered campus-wide measures at Michigan State University. The same group was previously connected to an attack on another university in October.
Financial technology company Abrigo restored its Sageworks risk management application, excluding borrower-facing features, following an outage caused by irregular activity in its environment. The disruption was reportedly triggered by a suspected cyberattack.
Google and industry partners dismantled a botnet containing more than 1.3 million Android TV boxes. Google stated that the manufacturer intentionally infected these streaming devices with malware to generate revenue.
Polymarket announced plans to reimburse affected users for their lost funds and site downtime compensation. This followed a post-mortem review of a security incident that occurred on October 29.
An alliance of Belarusian and pro-Ukrainian hackers claimed to have taken out Russia's federal statistics agency, Rosstat, and stolen vast amounts of sensitive government data in a cyberattack.
Google successfully cut off a botnet of over 1.3 million Android devices from its servers in late October, mostly affecting TV set-top boxes. Reports indicate that a device manufacturer allegedly sold criminal access.
The maintainer of BTCPay Server urged users to update their software immediately. This warning follows reports of threat actors draining hot wallets on older, unpatched instances.
Mobile carriers can retain call and text metadata for extended periods. Such retention risks exposing sensitive information about user relationships, locations, and daily routines if a breach occurs.
A new Windows infostealer sends the data it steals to an AI model and asks it to rank the victim’s assets by how much money they could bring in, Cisco Talos has found.
Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026.
The Florida Department of Education says SSNs and other personal data may have been exposed in a breach of its financial aid website.
A popular Ukrainian air raid alert system was hacked over the weekend, prompting a cyber group to breach a similar Russian system in retaliation.
A cyberattack disrupted refrigeration systems across multiple supermarket chains in several European countries. Hackers remotely altered the temperature settings on freezers and cooling units.
Organizations in the region face attacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains.
Hackers accessed its online shopping platform and stole customers’ personal and payment card information.
Supermarket refrigerators across Europe faced a suspected hacking incident that manipulated temperature controls and spoiled inventory. This marks the second such occurrence within recent weeks targeting refrigeration systems.
Blockchain analytics firm Chainalysis has suffered a cybersecurity incident that led to a data breach. According to the company’s Friday announcement, the incident is unrelated to the recent Binance hack. What was accessed?
Synology urged customers to update their devices immediately amid a surge in C3RB3r ransomware attacks. The attacks target outdated network-attached storage units by exploiting a security flaw from 2024.
Chainalysis reported a data breach following a cyberattack on its systems. Attackers utilized offensive agentic techniques to gain access to internal company tools and systems.
Emergency alert applications in Ukraine and Russia were reportedly hit by hackers. The attackers sent fraudulent warnings regarding nuclear and missile attacks, causing public safety concerns.
North Korea was behind the theft of more than $6 billion in cryptocurrency from Binance, the FBI has confirmed. “The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of mo…
The FBI has officially pinned the $6 billion Binance hack on North Korea’s TraderTraitor as the attackers launder the stolen crypto.
Chainalysis suffered a cyberattack exposing customer names, emails and user IDs, while investigation data and passwords remain safe. Blockchain analytics firm Chainalysis says it was the target of a cybersecurity incident.
Cybersecurity researchers discovered a new Windows malware called VOLTA that utilizes large language models to rank stolen victim data by monetization value. The malware leverages artificial intelligence tools to analyze and prioritize harvested information.
The group behind the Aur0ra ransomware has been using AI agents to move through victim networks, collect credentials and work its way up to domain administrator access, according to Sophos.
The FBI and U.S. Secret Service alleged this weekend that North Korean hackers were responsible for stealing more than $6.3 billion from cryptocurrency platform Binance last week.
The FBI attributed the theft of billions in cryptocurrency from Binance to North Korea. The agency urged crypto firms to block any transactions connected to the stolen funds.
Attackers attempted to exploit a critical flaw in the development infrastructure of Alpine Linux. The open-source project responded by rebuilding its GitLab server and resetting all credentials due to potential compromise concerns.
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: r/opensource bans AI projects, and solo devs go down with them Moderators of r/opensource, Reddit’s catch-all forum for open source software, have barred any project that “uses AI, i…
Attackers allegedly replaced a third-party script loaded by prediction site Polymarket on October 29. The malicious code executed unauthorized sales of signed-in users' positions and transferred roughly 2.7 million dollars to the hackers.
The FBI has officially attributed the theft of over 6 billion dollars in virtual assets to the North Korea-aligned hacking group TraderTraitor. This incident represents the largest recorded cryptocurrency heist to date.
Cloud application hosting platform Northflank warned customers of a security breach that resulted in unauthorized access to AI API keys. The company advises all users to rotate credentials and secrets stored on the platform.
Blockchain analytics firm Chainalysis disclosed a data breach after attackers used "offensive agentic techniques" to access internal systems and tools, exposing customer names, email addresses, user IDs, and organizational roles. [...]
A US court sentenced Syrian hacker Ahmad Umar Agha to 42 months for pro-Assad attacks on media, businesses, and government entities.
Drupal warns that threat actors are actively exploiting a critical authorization flaw in the Commerce Core module. The vulnerability, tracked as CVE-2026-118539, puts vulnerable online stores at risk of compromise.
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday.
Vapor Panda targeted over 200 organizations across at least 14 countries in an ongoing campaign. According to CrowdStrike, the threat group successfully compromised 140 sensitive targets in just 11 days with shocking speed.
Fashion retailer Resolve announced that a recent cyber incident exposed customer payment card numbers. The company confirmed that hackers stole the sensitive financial information from its systems.
Binance linked a massive cryptocurrency theft amounting to $6.3 billion to a compromised DevOps laptop. Blockchain analysts attributed the cyberattack to North Korean hackers while the platform was investigating suspicious transfers.
Chinese state-sponsored threat actors were spotted deploying a Go-based artificial intelligence penetration testing framework named ARTEX. The simultaneous attacks targeted more than 200 high-value organizations globally.
The Florida Department of Education stated that a data breach impacted the Florida Student Financial Aid website after an incident discovered on October 19. The security breach resulted in the leak of Social Security numbers for 4.9 million individuals.
A defense contractor admitted to letting co-conspirators use his identity and security clearance to apply for numerous jobs. The scheme utilized his credentials in nearly 100 employment applications last year.
Recent reports detailed various security incidents, including potential breaches and a firmware flaw affecting servers. Additional mentions included military equipment hacks and AI-powered malware.
Ahmad Umar Agha is best known for posting a fake Associated Press tweet claiming President Obama was injured in a White House bombing.
A federal court sentenced Ahmad Umar Agha, known online as Th3Pr0, for his role in a hacking conspiracy organized by close advisers of former Syrian President Bashar al-Assad.
Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.
It allowed customers to host hack-for-hire services, supported ransomware and infostealer operators, and accepted crypto payments.
A Syrian man who used a hijacked news agency Twitter account to post a fake report of explosions at the White House has been sentenced to 42 months in prison, the US Department of Justice has announced.
Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.
Ahmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets.
Cryptocurrency exchange Binance has connected the theft of roughly $6.3 billion in digital assets to the compromise of a DevOps engineer's laptop.
About $6.3 billion in cryptocurrency was stolen from Binance in what might be the biggest crypto hack in history. “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a…
Blockchain analysts have connected the record-breaking cryptocurrency theft at Binance to North Korean hackers. This comes as the platform investigates a potentially compromised engineer laptop.
Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3…
A hacker leaks personal data on more than 40,000 DHS employees, including CBP, ICE and CISA staff, after an undisclosed breach. Personal details of thousands of U.S.
One retail scam used more than 1,200 look-alike .shop domains sharing a single IP address. The sites reused HTML, JavaScript and payment-page designs intended to harvest card numbers, expiry dates and security codes, according Akamai’s Fraud and Abuse Report 2026.
Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets. The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far.
Cryptocurrency exchange Binance is investigating a potential security breach involving up to $5.8 billion in digital assets, in what could become the largest cryptocurrency hack in history. [...]
A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times.
Japan Airlines (JAL) has announced that a data breach at Amadeus's Passenger Service System exposed the data of about 92,000 customers. [...]
James Hopkin reports: The Sault’s police chief says it’s currently unclear how many anonymous tips received by Crime Stoppers locally were potentially exposed in a massive data breach. Both the Sault Ste.
Polymarket temporarily suspended trading on Thursday after a third-party service was compromised to distribute malicious JavaScript that drained cryptocurrency. Approximately 2.5 million dollars in assets were traced to a suspected attacker wallet.
A leaked archive concerning DHS employees faced challenges staying online after a contractor requested its removal. A social media site also blocked links to the archive before it found a new hosting location.
John Rupolo reports: University of New Mexico Health is addressing concerns after a cyberattack on Monday, with reports surfacing this week that a ransomware group claimed responsibility for the incident.
Eric Weiss reports: The Florida Department of Education says a breach of its student financial aid website may have exposed personal information, including Social Security numbers, belonging to approximately 4.9 million people.
School districts utilizing Frontline Central or School Health Management were impacted by a cybersecurity incident. The breach potentially exposed Social Security numbers, dates of birth, or government IDs.
A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. [...]
Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba.
Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network.
CISA added a VMware ESX security flaw to its KEV catalog following revelations that a China-nexus threat actor weaponized it. The exploit was used to reduce audit trail visibility on targeted systems.
Palo Alto Networks issued a warning that threat actors are actively exploiting recently patched PHP2Shell vulnerabilities against internet-accessible management interfaces.
The Department of Peace group shared it with Swiss hacker/journalist maia arson crimew and DDoSecrets put it online.
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems.
A China-linked threat group utilized a framework named Silent Train, which relies on rapidly rotating compromised devices. This covert network allowed the group to infiltrate hundreds of critical infrastructure networks.
Maddie Baker and Spencer Landers As cyberattacks continue across Japan, companies are coming to realize the great financial risk of such attacks if their lax cybersecurity systems cause millions of peoples’ personal information to be leaked.
The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.
Threat actors began probing for a newly patched critical vulnerability within the Oracle E-Business Suite. Threat intelligence firm Defused Cyber noted that this activity started days after the security patch was released.
CoinTelegraph reports: South Korea’s crypto exchange Bithumb is investigating the extent of a data leak caused by a hack of its internal mobile system earlier this week, Yonhap News Agency reported Wednesday.
Sead Fadilpašić reports: Japanese internet giant GMO Group has told its customers to scan their computers for viruses, back up all of their data, disconnect the devices from the internet and then shut them down.
Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand.
Tailscale has released version 1.104.4 to fix flaws in its built-in SSH server that could let an attacker reach services and files on other servers that only the root user should be able to touch.
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June.
Interpol's annual Operation Serengeti, now in its third iteration, led to 1,462 arrests across 20 African countries and the US, recovering $105 million in stolen funds.
CISA added two vulnerabilities affecting Adobe Commerce and the Brotli decoder library to its KEV catalog following evidence of active exploitation. Reports indicate hundreds of stores were targeted in PolyShell attacks involving Brotli exploit traffic.
A wide-scale social engineering campaign is utilizing mail bombing and external messaging platforms to deliver malware within minutes. Reports suggest a possible connection to the Black Basta ransomware group.
Keystone announced in a statement on October 26 that it will destroy thousands of hardware wallets after attackers gained access to its website and stole the device verification key.
The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors.
Threat actors are increasingly bypassing traditional malware deployment to target help desks directly, politely asking for access aided by artificial intelligence technologies.
The State Bank of India suffered a customer personally identifiable information data leak. Such incidents carry significant risks in the region due to the presence of an active underground market for traded personal data.
A security breach involving TiDB has brought to light sensitive customer data stored within cloud infrastructure. The incident demonstrates how unseen information can be retained by providers without the knowledge of either party until an exposure occurs.
Security teams are working urgently to address two critical vulnerabilities in PHP following leaked details and reports of active exploitation attempts. The developments require rapid remediation efforts to prevent potential system compromises.
Attackers utilized a developer's GitHub account at OVHcloud, which was compromised months prior, to distribute malicious code to unsuspecting users. The prolonged access enabled the malicious updates to reach the targets.
The perp, who has Saudi ties, was arrested for allegedly bugging an OpenAI conference room, highlighting a preventable insider threat vector.
A Chinese-speaking attacker has compromised hundreds of websites across the globe, looting from big fish like John Deere, SharkNinja, and engine manufacturer Cummins.
U.S. federal investigators suspect executives at two ransomware negotiation firms were operating the ShinyHunters extortion platform. This development emerged during investigations into the hacking group linked to stealing sensitive information from the FBI.
The United Kingdom has imposed economic sanctions on Cryptomus, a cryptocurrency platform utilized as a major conduit for cybercrime payments. Experts indicate the platform facilitates transactions helping Russia bypass sanctions.
Agents with the FBI arrested a co-founder of a Canadian cybersecurity firm during an ongoing investigation into the ShinyHunters hacking group. The group was linked to the theft of sensitive data belonging to thousands of federal agents.
A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang.
Law enforcement authorities in the Netherlands arrested a 23-year-old convicted cybercriminal suspected of assisting the ShinyHunters hacking group with data thefts and extortion activities.
A U.S. Army soldier received a 70-month prison sentence and restitution after pleading guilty to breaching telecommunications companies. The attacks involved stealing call and text metadata belonging to over 100 million AT&T customers in 2024.
Headlines and summaries come from the named publishers, and claims are theirs. Read the full story at the source.