MaxwellCTI Weekly: October 27 to November 2, 2026
MaxwellCTI Weekly: October 27 to November 2, 2026
Covers 5 daily digests (2026-10-27 to 2026-11-02).
All summaries, analysis, and story clustering are done by an LLM. It may make mistakes and say incorrect things. Check the sources and support the actual journalists.
Top Stories
1. North Korea-linked TraderTraitor stole billions in digital assets from Binance via compromised laptop
5 outlets, 2026-10-30 to 2026-11-02 - severity 5/5 Story page: 2026-10-30 Binance Investigates Massive Crypto Theft of Billions in Assets
The North Korea-linked threat actor TraderTraitor (also known as Lazarus Group) stole between $5.912 billion and $6.43 billion in digital assets from Binance. The attackers gained access to a service container via a compromised DevOps engineer's laptop using trojanized Terraform providers to deploy a Bash loader, the FLATROOF information stealer, and the ROOFDECK backdoor. This access allowed the actor to submit 50 pre-signed authorizations from a Binance hot wallet to a sweeper contract, subsequently draining 167,464 ETH and 1.615 billion USDT across 10 to 11 blockchains. In response, Binance temporarily suspended operations, while vendors including Tether, Circle, and Ripple froze approximately $2.67 billion in stablecoins. The FBI and other US agencies are currently coordinating to block 628 associated cryptocurrency addresses, though approximately $3.3 billion was converted into non-freezable assets. Binance has since resumed withdrawals and reports covering approximately 95% of the impacted funds.
Sources
- Binance probes potential $5.8 billion crypto-theft hack - BleepingComputer, 2026-10-29 (quality: 11/21)
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen - The Hacker News, 2026-10-30 (quality: 20/21)
- FBI links $6.3 billion Binance crypto heist to North Korean hackers - BleepingComputer, 2026-11-01 (quality: 19/21)
- Hackers steal $6.3 billion from Binance in record crypto heist - Ars Technica Security, 2026-10-30 (quality: 14/21)
- North Korea-linked group steals $6.3B from Binance in largest-ever cryptocurrency hack - Cybersecurity Dive, 2026-10-30 (quality: 19/21)
- FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist - The Hacker News, 2026-11-01 (quality: 19/21)
- Binance hit by largest-ever crypto theft, with $6.3 billion stolen - Malwarebytes, 2026-10-30 (quality: 17/21)
2. Department of Peace leaks Icepick database containing DHS employee records
5 outlets, 2026-10-29 to 2026-11-02 - severity 4/5 Story page: 2026-10-29 Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists
The hacktivist group Department of Peace leaked a database known as "Icepick" containing internal records of more than 41,000 US Department of Homeland Security (DHS) employees and contractors. The leaked data includes names, contact information, job titles, and Microsoft Active Directory group memberships that reveal access to sensitive tools such as the Palantir Falcon platform, PenLink, and Mobile Fortify. The dataset affects several component agencies, including over 21,000 US Customs and Border Protection employees and approximately 1,000 Cybersecurity and Infrastructure Security Agency employees. While the threat actor claimed the data was obtained via an Okta single sign-on service, Okta stated it found no evidence that its own systems were compromised. DHS acknowledged the breach and is working to protect affected personnel, while the data remains available through publishers like Distributed Denial of Secrets despite attempts by contractors to remove the Icepick domain.
Sources
- Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists - CyberScoop, 2026-10-28 (quality: 18/21)
- Leaked DHS employee archive, Icepick, faces challenges to stay online - CyberScoop, 2026-10-29 (quality: 16/21)
- Massive leak exposes 41,000 DHS workers and undercover ICE agents - Ars Technica Security, 2026-10-29 (quality: 16/21)
- Over 41,000 DHS Employee Records Leaked Online - SecurityWeek, 2026-10-29 (quality: 17/21)
- Hackers leak personnel data of 41,000+ Homeland Security staff, including ICE and border agents - Graham Cluley, 2026-10-30 (quality: 17/21)
- Hackers steal and publish data on 41,000 Homeland Security workers - Malwarebytes, 2026-10-30 (quality: 18/21)
3. China-nexus actor targets Palo Alto Networks devices using PHP2Shell exploit chain
4 outlets, 2026-10-29 to 2026-11-02 - severity 4/5 Story page: 2026-10-21 PHP Releases Emergency Updates for Two Critical Remote Code Execution Vulnerabilities
A China-nexus threat actor exploited the PHP2Shell exploit chain, combining CVE-2026-109618 and CVE-2026-109619 with the Fragnesia Linux kernel privilege escalation vulnerability (CVE-2026-46300), to root 25 servers across the U.S., Japan, Taiwan, and South Korea. The actor used the FOFA search engine and an AI-assisted aiscan platform to identify 19,000 internet-facing firewalls, eventually compromising 24 Palo Alto Networks devices via their management interfaces. In one instance, the attacker breached a U.S. government-affiliated organization, using a reverse SSH tunnel to decrypt an LDAP service account password and obtain Active Directory credentials and network topology. While Palo Alto Networks reported that 0.02% of its global installed base was impacted, Cato Networks observed broader opportunistic attacks targeting healthcare, technology, and professional services. CISA added all three vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26, requiring federal agencies to apply fixes by October 31, 2026.
Sources
- China-Linked Hackers Exploit PHP2Shell to Root Firewalls - SecurityWeek, 2026-10-28 (quality: 18/21)
- PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network - The Hacker News, 2026-10-28 (quality: 19/21)
- Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces - The Hacker News, 2026-10-29 (quality: 20/21)
- Limited reports of PHP bug exploitation emerge - The Record (Recorded Future), 2026-10-29 (quality: 20/21)
- Palo Alto Networks firewalls compromised in chained attacks using PHP2Shell - Cybersecurity Dive, 2026-10-30 (quality: 19/21)
- PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress - SecurityWeek, 2026-10-30 (quality: 20/21)
4. FBI and partners seize Russian-speaking bulletproof hosting service Virtualine domain
4 outlets, 2026-10-29 to 2026-11-02 - severity 4/5 Story page: 2026-10-29 FBI and International Partners Seize Russian-Speaking Bulletproof Hosting Service Virtualine
The FBI and international partners seized the primary domain of Virtualine, a Russian-speaking bulletproof hosting service that facilitated phishing, ransomware, and money laundering. Operating under aliases such as Secury and Massgod, Virtualine provided infrastructure for threat actors including Qilin, DragonForce, and the Coinbase Cartel, and claimed to possess the largest collection of autonomous system numbers for botnet and malware hosting. The provider knowingly hosted child sexual abuse material and supported hack-for-hire services, including the creation of websites for uploading stolen sexually explicit content. TRM Labs identified Virtualine as receiving more illicit-attributed cryptocurrency than any other bulletproof hosting provider it tracks. The operation involved cooperation between the U.S. Department of Justice, European law enforcement agencies, and private partners like Lumen and Chainalysis. As of November 2, 2026, the primary domain remains seized.
Sources
- Police seize Virtualine bulletproof service tied to ransowmare, cybercrime - BleepingComputer, 2026-10-28 (quality: 20/21)
- Officials seize domain of top bulletproof hosting provider Virtualine - CyberScoop, 2026-10-29 (quality: 19/21)
- FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering - The Hacker News, 2026-10-28 (quality: 20/21)
- Bulletproof Host Virtualine Loses Its Domain to FBI Seizure - SecurityWeek, 2026-10-30 (quality: 16/21)
5. China-linked Volt Typhoon and UAT-11473 exploit Cisco vulnerability targeting US government entities
3 outlets, 2026-10-30 - severity 5/5 Story page: 2026-10-13 GitLab Fixes Critical Remote Code Execution Vulnerability
China-linked Volt Typhoon and a threat cluster known as UAT-11473 exploited CVE-2026-20127, a maximum-severity authentication-bypass vulnerability in Cisco Catalyst SD-WAN controllers, managers, and validators. UAT-11473 deployed the KeyDrift malware framework, using the PolyFlame backdoor and LittleFilch module to intercept decrypted control-plane traffic and extract AES-256 IPsec data-plane key material. Volt Typhoon utilized a covert access network of compromised IoT devices and routers called Silent Train to execute these attacks against US government entities, telecoms, and critical infrastructure in Hawaii, California, and Texas, as well as aerospace and satellite services. The activity involved pre-positioning and espionage, including the exfiltration of documents regarding military operations and network structures. Cisco has released security updates to address the vulnerability and provided detection rules for the KeyDrift C2 connections.
Sources
- Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware - BleepingComputer, 2026-10-29 (quality: 19/21)
- Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network - SecurityWeek, 2026-10-29 (quality: 19/21)
- Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys - The Hacker News, 2026-10-29 (quality: 19/21)
6. China-linked Volt Typhoon Uses Silent Train Framework to Target United States Infrastructure
3 outlets, 2026-10-29 - severity 5/5 Story page: 2026-10-29 China-linked Volt Typhoon Uses Silent Train Framework to Target United States Systems
The China-linked state-sponsored group Volt Typhoon utilized the Silent Train framework to target critical infrastructure, government agencies, and telecommunications firms in California, Texas, and Hawaii. The attack chain employed rotating chains of compromised SOHO, IoT, and enterprise devices to obscure origin, leveraging vulnerabilities including CVE-2026-16812, CVE-2026-20127, CVE-2025-8875, CVE-2025-8876, and CVE-2024-39717, alongside a suspected zero-day in Quest KACE. Following the disruption of the KV-Botnet by the FBI and Department of Justice in early 2024, the actor increased its reliance on Silent Train and evolved the framework into a hybrid architecture that retains enterprise-grade devices for longer durations. The operation affected over 27 device classes from vendors such as Cisco, Fortinet, and Ivanti to maintain covert access to high-value United States systems.
Sources
- Volt Typhoon hides zero-day attacks using 'Silent Train' framework - BleepingComputer, 2026-10-28 (quality: 19/21)
- Researchers uncover Volt Typhoon’s covert, ephemeral network - CyberScoop, 2026-10-28 (quality: 19/21)
- Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns - The Hacker News, 2026-10-28 (quality: 19/21)
7. Artem Aleksandrovych Stryzhak Sentenced for Nefilim and Hive Ransomware Attacks
5 outlets, 2026-10-28 to 2026-10-29 - severity 4/5 Story page: 2026-10-28 Artem Aleksandrovych Stryzhak Sentenced for Nefilim and Hive Ransomware Attacks
Ukrainian national Artem Aleksandrovych Stryzhak was sentenced to 70 months in prison for his role as an affiliate for the Nefilim and Hive ransomware groups between 2018 and 2021. Stryzhak targeted hospitals, government entities, and businesses across the US, Canada, Australia, and France, using "Corporate Leaks" dark web sites to pressure victims into paying ransoms. The Nefilim and Hive groups collectively targeted approximately 1,500 victims worldwide, causing over $100 million in losses. In late July 2022, a multinational law enforcement operation penetrated Hive's infrastructure to capture decryption keys, saving victims over $130 million. Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025. Another key figure, Volodymyr Tymoshchuk, remains on the FBI and European Union most-wanted lists with a reward of up to $10 million for his capture.
Sources
- Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison - CyberScoop, 2026-10-27 (quality: 16/21)
- Nefilim, Hive ransomware operator given five-year-plus sentence after guilty plea - The Record (Recorded Future), 2026-10-27 (quality: 18/21)
- Hive ransomware affiliate jailed, years after FBI infiltrated the gang’s systems - Graham Cluley, 2026-10-28 (quality: 16/21)
- Nefilim and Hive ransomware affiliate gets 70 months in prison - BleepingComputer, 2026-10-28 (quality: 16/21)
- Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison - SecurityWeek, 2026-10-28 (quality: 16/21)
8. Syrian Electronic Army Member Sentenced for Targeting Western Media and Government
4 outlets, 2026-11-02 - severity 4/5 Story page: 2026-11-02 Syrian Electronic Army Member Sentenced for Hacking Western Media and Government
Ahmad Umar Agha, a member of the Syrian Electronic Army operating under the direction of Bashar al-Assad's inner circle and the General Intelligence Directorate, was sentenced to 42 months in prison on October 29, 2026. Between August 2011 and January 2024, the group targeted approximately 47 Western media outlets, businesses, NGOs, and government bodies, including the White House and the U.S. Marine Corps. Notable attacks included the hijacking of the Associated Press Twitter account in April 2013 to post a false claim about an explosion at the White House, which triggered a flash crash that briefly erased $136 billion in stock market value, and the compromise of a White House staff member's personal email. Following the collapse of the Assad regime in December 2024 and Agha's subsequent appearance in court, the legal proceedings concluded with his sentencing in the Eastern District of Virginia.
Sources
- Syrian hacker who served Assad regime gets 42 months in US prison - CyberScoop, 2026-10-30 (quality: 19/21)
- Syrian Electronic Army hacker gets prison time for attacks on Western targets - The Record (Recorded Future), 2026-10-30 (quality: 17/21)
- Syrian Hacker Gets Prison Time in US After Over a Decade on the Run - SecurityWeek, 2026-10-31 (quality: 18/21)
- Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in Prison - The Hacker News, 2026-10-30 (quality: 20/21)
Under the Radar
High-severity stories that received limited coverage this period.
Anthropic Breach, UEFI Flaw CVE-2026-97631, and Cloudflare AI Leak
1 outlet, 2026-11-02 - severity 5/5
A critical buffer overflow vulnerability, identified as CVE-2026-97631, affects the TianoCore EDK II UEFI boot code used by most servers worldwide that utilize network boot. The flaw impacts firmware provided by suppliers including AMI, Insyde, and Phoenix. This vulnerability allows for potential unauthorized code execution during the boot process, affecting a vast number of server infrastructures globally.
Why it matters: A critical UEFI flaw affecting most servers worldwide and suspected Iranian attacks on US military infrastructure represent critical-infrastructure risk.
Sources
- In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak - SecurityWeek, 2026-10-30 (quality: 16/21)
UTA0576 Exploits Ivanti Connect Secure Vulnerabilities for Root-Level Code Execution
2 outlets, 2026-11-02 - severity 4/5 Story page: 2026-10-14 Unauthenticated Attackers Exploit Zero-Day Chain in Ivanti Connect Secure
Threat actor UTA0576 used an exploit chain of three vulnerabilities in Ivanti Connect Secure to obtain unauthenticated root-level code execution. The chain includes CVE-2026-111357, a privilege escalation flaw (CVSS 8.8), and CVE-2026-118527, which allows remote authenticated file uploads (CVSS 4.3). Ivanti stated that a limited number of customers were affected before the vulnerabilities were disclosed. CISA has added both CVEs to its known exploited vulnerabilities catalog and mandated mitigation deadlines for Federal Civilian Executive Branch agencies. Ivanti has released patches in versions 25.1.1.3 and 22.8R2.6 to resolve the flaws.
Why it matters: Confirmed in-the-wild exploitation of a zero-day chain providing root access, resulting in CISA mandates for federal agency mitigation.
Sources
- Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain - SecurityWeek, 2026-11-02 (quality: 18/21)
- Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access - The Hacker News, 2026-10-31 (quality: 19/21)
CryptoBilis supply-chain attack targets Trezor and Ledger wallets with hardware implants
2 outlets, 2026-11-02 - severity 4/5 Story page: 2026-11-02 Trezor Warns of Suspected Hardware Implant in Some Wallets
A supply-chain attack involving hardware implants targeted Trezor and Ledger wallets sold through the reseller CryptoBilis. An Indonesian customer discovered a circuit board with a cellular module and antenna installed between the main board and screen of a Trezor Safe 5, which is suspected of transmitting recovery phrases over a mobile network. While Trezor is awaiting lab confirmation of the device and has no confirmed fund losses, the Singapore Police Force reported at least two compromised Ledger wallets from the same reseller, with one instance resulting in a $3,500,000 loss. Trezor has ceased sales through CryptoBilis and advised all customers who purchased devices from the reseller since March 2026 to migrate their funds.
Why it matters: Confirmed supply-chain hardware implants across two major vendors resulting in millions of dollars in losses.
Sources
- Trezor warns of suspected crypto-theft implant in hardware wallet - BleepingComputer, 2026-10-30 (quality: 17/21)
- Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis - The Hacker News, 2026-10-30 (quality: 18/21)
Unknown Threat Actor Infects Magento Stores Using Multiple Vulnerabilities
2 outlets, 2026-10-27 - severity 4/5 Story page: 2026-10-21 PHP Releases Emergency Updates for Two Critical Remote Code Execution Vulnerabilities
An unknown threat actor infected 953 online stores, primarily running Magento, with a JavaScript loader between July 2025 and October 2026. The attackers gained initial access via the PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) vulnerabilities, as well as through rogue administrator accounts. The loader was staged within the cms_block database table and used browser fingerprinting and localStorage to serve payloads to real visitors while evading security scanners. Additionally, separate in-the-wild exploitations of PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were recorded using honeypot servers to fetch payloads from 162.35.99[.]94.
Why it matters: Confirmed in-the-wild exploitation of multiple vulnerabilities affecting nearly 1,000 e-commerce stores via a sophisticated, scanner-evading malware campaign.
Sources
- 953 Online Stores Infected in Long-Lasting Malware Campaign - SecurityWeek, 2026-10-26 (quality: 17/21)
- Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento - The Hacker News, 2026-10-26 (quality: 18/21)
All Stories by Category
Vulnerabilities & Patches
- Anthropic's Frontier Red Team identifies vulnerabilities across Chrome, Safari, Android, Windows, and Linux (2026-10-29 to 2026-10-30, 2 outlets, severity 4/5)
- Hackers Target Critical Oracle Flaw Despite Recent Security Patch (2026-10-29, 2 outlets, severity 4/5)
- Remote Attackers Target Multiple Vendors via Node2Shell Brotli Vulnerability (2026-10-29, 2 outlets, severity 4/5)
- Apple backports CoreGraphics zero-day patches to older iOS devices (2026-10-28, 2 outlets, severity 4/5)
- Hackers Exploit Critical Infrastructure and IoT Device Vulnerabilities (2026-10-29, 1 outlet, severity 4/5)
- Dahua IP Cameras Hijacked in Ukraine via P2P Vulnerabilities (2026-10-27, 1 outlet, severity 4/5)
- SS7 and Diameter Flaws Enable Phone Tracking and Interception (2026-11-02, 1 outlet, severity 4/5)
- Attackers Target Alpine Linux GitLab Server via CVE-2026-97229 Vulnerability (2026-10-30 to 2026-11-02, 2 outlets, severity 3/5)
- Popcorn Time Legacy Updaters Create Massive Security Risks (2026-11-02, 1 outlet, severity 3/5)
- BigSleep Outperforms Fuzzilli in Finding V8 JavaScript Engine Bugs (2026-10-28, 1 outlet, severity 3/5)
- Samsung TVs May Secretly Record Audio Via Connected Soundbars (2026-10-28, 1 outlet, severity 3/5)
- PHP and Brotli Flaws Spark New Web Safety Warnings (2026-10-28, 1 outlet, severity 3/5)
- The web’s having a rough week. Here’s how to browse safely - Malwarebytes
- Cyberdione Labs Discovers Tailworm Vulnerabilities Affecting Tailscale and headscale SSH (2026-10-28, 3 outlets, severity 2/5)
- Story page: 2026-10-28 Cyberdione Labs Discovers Tailworm Vulnerabilities Affecting Tailscale and headscale SSH
- Tailscale warns of SSH flaws allowing root privilege escalation - BleepingComputer
- Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws - SecurityWeek
- Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers - The Hacker News
- L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara (2026-11-02, 1 outlet, severity 2/5)
- Blue Initiative Launches Free Vulnerability Database for Maritime Systems (2026-10-27, 1 outlet, severity 2/5)
- onedump.py Update Enables Bulk Extraction of Embedded OneNote Files (2026-11-02, 1 outlet, severity 2/5)
- Story page: 2026-11-02 onedump.py Update Enables Bulk Extraction of Embedded OneNote Files
- OneNote File Extraction, (Sun, Nov 1st) - SANS Internet Storm Center
- Windows 11 KB5127936 Update Brings 41 Changes and Fixes (2026-10-30, 1 outlet, severity 1/5)
- Story page: 2026-10-30 Windows 11 KB5127936 Update Brings 41 Changes and Fixes
- Windows 11 KB5127936 update released with 41 changes and fixes - BleepingComputer
- Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving (2026-11-02, 1 outlet, severity 1/5)
Data Breaches
- Moldova Probes Foreign Involvement in Massive Government Data Breach (2026-10-29, 1 outlet, severity 4/5)
- Story page: 2026-10-15 Israel-based NSO Group Had Access to Data Harvested by Polish Government
- Moldova investigates possible foreign involvement in major government cyberattack - The Record (Recorded Future)
- UK Police Data Suppliers Repeatedly Breached, Watchdog Reports (2026-10-28, 1 outlet, severity 4/5)
- Story page: 2026-10-28 UK Police Data Suppliers Repeatedly Breached, Watchdog Reports
- Hackers repeatedly breached suppliers holding UK police data, watchdog finds - The Record (Recorded Future)
- Florida Student Financial Aid Breach Exposes 4.9 Million SSNs (2026-11-02, 1 outlet, severity 4/5)
- Story page: 2026-11-02 Florida Student Financial Aid Breach Exposes 4.9 Million SSNs
- Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach - The Record (Recorded Future)
- Amadeus IT Group Data Breach Exposes Japan Airlines Customer Information (2026-10-29 to 2026-10-30, 2 outlets, severity 3/5)
- Story page: 2026-10-30 Japan Airlines Passenger Data Exposed via Amadeus System Breach
- Japan Airlines warns of data breach as country grapples with multiple cyber incidents - The Record (Recorded Future)
- Japan Airlines suffers third-party data breach exposing passenger info - BleepingComputer
- Sony Network Communications Data Breach Exposes 2.6 Million So-net Members (2026-10-29 to 2026-10-30, 2 outlets, severity 3/5)
- BAE Systems reports no data stolen in bankruptcy court breach (2026-10-30, 2 outlets, severity 3/5)
- Story page: 2026-10-16 Cyberattack on BAE Systems Disrupts US Federal Bankruptcy Noticing Center
- Federal bankruptcy courts contractor says no data stolen during cyber intrusion - The Record (Recorded Future)
- BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts - SecurityWeek
- Northflank Breach Leads to Abuse of Customers' AI API Keys (2026-11-02, 1 outlet, severity 3/5)
- Revolve Hackers Steal Customer Payment Card Information (2026-11-02, 1 outlet, severity 3/5)
- Story page: 2026-11-02 Revolve Hackers Steal Customer Payment Card Information
- Fashion retailer Resolve says hackers stole payment card information - The Record (Recorded Future)
- Warp Breach Exposes AI Agent Logs and User Telemetry (2026-10-28, 1 outlet, severity 3/5)
- Story page: 2026-10-28 Warp Breach Exposes AI Agent Logs and User Telemetry
- Warp discloses breach exposing AI agent logs, user telemetry data - BleepingComputer
- ENGIE Data Breach Exposes French Customer Contact and Contract Info (2026-10-28, 1 outlet, severity 3/5)
- University of Copenhagen Breach Exposes Data of 525,000 People (2026-10-27, 1 outlet, severity 3/5)
- Genesys Hack Exposes Customer Data From Internal Systems (2026-10-27, 1 outlet, severity 3/5)
- Quest Diagnostics Breach Exposes Patient Records via Quanum Platform (2026-10-27, 1 outlet, severity 3/5)
Ransomware
- Byod ransomware group targets University of New Mexico Health System (2026-10-27 to 2026-10-30, 4 outlets, severity 3/5)
- Story page: 2026-10-27 UNM Health System Diverts Patients After Major Cybersecurity Breach
- Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics - SecurityWeek
- UNM Health ransomware attack disrupts patient care, surgeries - BleepingComputer
- University of New Mexico hospital diverts ambulances after cyberattack - The Record (Recorded Future)
- BYOD cyberattack diverts ambulances and cancels classes at University of New Mexico health center - Graham Cluley
- Japan's GMO fights ransomware threat with $1 million bounty (2026-10-28, 2 outlets, severity 3/5)
- Cisco Talos Reports Rising Ransomware and Help Desk Vishing (2026-10-30, 1 outlet, severity 3/5)
- What happens when security tools go dark before the ransomware (2026-10-28, 1 outlet, severity 3/5)
Supply Chain Attacks
- Tampered Anthropic Claude Code Extension Distributes SSH Backdoors via Cursor Marketplace (2026-11-02, 4 outlets, severity 3/5)
- Story page: 2026-11-02 Tampered Anthropic Claude Code Extension Distributes SSH Backdoors via Cursor Marketplace
- Inside a malicious Claude Code-branded extension and its persistent SSH backdoor - Microsoft Threat Intelligence
- Malicious Claude Code extension on Cursor planted SSH backdoors - BleepingComputer
- Anthropic VS code extension on Cursor backdoored for nearly 12 hours - Ars Technica Security
- Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor - The Hacker News
- DebugBear DNS compromise leads to supply chain attack on Polymarket (2026-10-30 to 2026-11-02, 3 outlets, severity 3/5)
- Story page: 2026-10-30 Polymarket Halts Trading After $2.5M Crypto-Draining Breach
- Polymarket halts trading after crypto-draining script breach, $2.5M traced - BleepingComputer
- $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack - SecurityWeek
- Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script - The Hacker News
- Atlassian Warns SBOMs Lack Visibility Against Shai-Hulud Worm Attacks (2026-10-28, 1 outlet, severity 3/5)
- Convertr Analytics Script Hijacked to Steal Payment Card Data (2026-10-28, 1 outlet, severity 3/5)
- Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk (2026-10-28, 1 outlet, severity 3/5)
- PwC confirms learning records breached in attack on vendor site (2026-10-28, 1 outlet, severity 3/5)
- Security Questionnaires Fail as Reliable Vendor Risk Management Tools (2026-10-29, 1 outlet, severity 2/5)
- GitHub Launches npm Firewall to Block Malicious Packages (2026-10-30, 1 outlet, severity 2/5)
Nation-State / APT
- China-linked Vapor Panda Targets 200 Organizations Using the ARTEX AI Framework (2026-11-02, 3 outlets, severity 4/5)
- Story page: 2026-11-02 China-linked Vapor Panda Targets 200 Organizations Using the ARTEX AI Framework
- Chainalysis discloses data breach from "offensive agentic techniques" - BleepingComputer
- China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days - CyberScoop
- Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data - The Hacker News
- Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide - The Hacker News
- Lazarus Group Uses Post-Quantum Encryption in Operation FlashHole (2026-10-28, 1 outlet, severity 4/5)
- North Korean Hackers Use Generative AI to Scale Cyberattacks (2026-10-30, 1 outlet, severity 4/5)
- Story page: 2026-10-30 North Korean Hackers Use Generative AI to Scale Cyberattacks
- Tracking AI adoption in North Korean threat actor tradecraft - Microsoft Threat Intelligence
- China-linked Warp Panda Exploits VMware ESX Zero-Day to Target US Law (2026-10-29, 1 outlet, severity 4/5)
- Vučić Loses Election Amid Pegasus Spyware and Digital Repression (2026-10-27, 1 outlet, severity 4/5)
- Story page: 2026-10-20 Spyware Targets Serbian Critics and Opposition Ahead of Elections
- Serbian autocrat loses election following widespread reports of digital repression - The Record (Recorded Future)
- Apple notifications alert victims in 99 countries about mercenary spyware infections (2026-11-02, 1 outlet, severity 4/5)
- Unknown APT Group Targets Asian Government Entities via Supply-Chain Attack (2026-10-30 to 2026-11-02, 2 outlets, severity 3/5)
- Story page: 2026-10-30 NetamLoader Targets Customized Windows 10 OS in Asian Governments
- Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia - SecureList (Kaspersky)
- NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection - The Hacker News
- Russian-linked actor targets global users with XMRig cryptominers via GitHub (2026-10-28 to 2026-10-30, 2 outlets, severity 3/5)
- Story page: 2026-10-28 Yoba Malware Uses Signed ChatGPT and Claude Binaries
- Tricks from the Past deployed via signed ChatGPT and Claude binaries - Check Point Research
- Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners - The Hacker News
- FrostyNeighbor Launches First Destructive Cyberattack Against Ukrainian Transportation (2026-10-30, 1 outlet, severity 3/5)
- EU Satellite Imagery Delayed Over Gaza and Parts of West Bank by 24-hours (2026-10-30, 1 outlet, severity 2/5)
- Jared Kushner’s iPhone Allegedly Hacked Twice, New Book Claims (2026-10-29, 1 outlet, severity 2/5)
Malware & Botnets
- Malicious Chrome extensions hijack search settings of 13.4 million users (2026-10-30 to 2026-11-02, 2 outlets, severity 4/5)
- Australian Signals Directorate Disrupts Amadey Malware, Saving 180,000 Computers (2026-10-28, 1 outlet, severity 4/5)
- uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts (2026-10-27, 1 outlet, severity 3/5)
- Italy Targeted by Unique Cyberattacks and drIBAN Malware (2026-10-29, 1 outlet, severity 3/5)
- Aokigahara Stealer Targets AI Assistants and Developer Cloud Credentials (2026-10-28, 1 outlet, severity 3/5)
- ZloyRAT Malware Targets Russians via Fake Fuel and Drone Apps (2026-10-28, 1 outlet, severity 3/5)
- Story page: 2026-10-28 ZloyRAT Malware Targets Russians via Fake Fuel and Drone Apps
- Malicious apps prey on Russians’ anxiety about fuel prices, drone strikes - The Record (Recorded Future)
- Hugging Face GPU-Mining Malware Returns via Malicious Models (2026-10-30, 1 outlet, severity 3/5)
- Hugging Face malware campaign returns to hijack GPUs for crypto mining - BleepingComputer
- Fake Firefox Extensions Impersonate Phantom, Jupiter, and Getbit Wallets (2026-10-30, 1 outlet, severity 3/5)
- Note: Buttondown's filter refused the name of a centralized cryptocurrency exchange, so it appears here as "Getbit".
- Story page: 2026-10-30 Fake Firefox Extensions Impersonate Phantom, Jupiter, and Getbit Wallets
- Malicious Firefox extensions impersonate popular crypto wallets - Malwarebytes
- VirusTotal Adds Process Trees to YARA-X and Livehunt Reports (2026-10-28, 1 outlet, severity 2/5)
- AS-7456 Scanning Campaign Identified via DShield Honeypot Analysis (2026-10-27, 1 outlet, severity 2/5)
- Story page: 2026-10-27 AS-7456 Scanning Campaign Identified via DShield Honeypot Analysis
- Looking for a Language [Guest Diary], (Wed, Oct 21st) - SANS Internet Storm Center
- Padre Terminal App Steals $23K From Solana Wallet Users (2026-10-30, 1 outlet, severity 2/5)
- Story page: 2026-10-30 Padre Terminal App Steals $23K From Solana Wallet Users
- Fake crypto app on Apple App Store linked to $23K wallet theft - BleepingComputer
- Ghidra Server Deployment Guide for Malware Analysis Labs (2026-10-30, 1 outlet, severity 1/5)
- Story page: 2026-10-30 Ghidra Server Deployment Guide for Malware Analysis Labs
- Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th) - SANS Internet Storm Center
Phishing & Social Engineering
- STAC4749 targets organizations with Microsoft Teams access using social engineering (2026-10-27 to 2026-10-28, 2 outlets, severity 4/5)
- Story pages: 2026-10-27 STAC4749 Uses Microsoft Teams IT Scams to Deploy Chaos Ransomware · 2026-10-28 External Teams Chats Anchor 15-Minute Malware Delivery
- Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware - The Hacker News
- External Teams Chats Anchor 15-Minute Malware Delivery - DarkReading
- AtlasCore and Russian Traffer Teams Target Prediction Market Users (2026-10-30, 1 outlet, severity 3/5)
- Anthropic Phishing Emails Bypass Proofpoint and Microsoft Security Tools (2026-10-30, 1 outlet, severity 3/5)
- Skyw4lker Phishing Campaign Targets U.S. Healthcare and Tech Sectors (2026-10-29, 1 outlet, severity 3/5)
- Attacker Relentlessly Scans for Credentials by Impersonating AI Bots (2026-10-29, 1 outlet, severity 2/5)
- ClickFix Campaign Targets Windows and macOS via Fake Cloudflare Pages (2026-10-30, 1 outlet, severity 2/5)
- Story page: 2026-10-30 ClickFix Campaign Targets Windows and macOS via Fake Cloudflare Pages
- Yet Another ClickFix Campaign, (Wed, Oct 28th) - SANS Internet Storm Center
- Election Scams: Five Common Tactics to Steal Your Data (2026-10-28, 1 outlet, severity 2/5)
- Story page: 2026-10-28 Election Scams Five Common Tactics to Steal Your Data
- Five election scams to watch out for - Malwarebytes
- Generative AI Powers More Convincing Phishing and Account Takeovers (2026-10-28, 1 outlet, severity 1/5)
Cloud & Infrastructure Security
- Cloudflare Tracks Exploitation of eMudhra’s Weak Private Keys (2026-11-02, 1 outlet, severity 4/5)
- k0s Konnectivity Vulnerability Chain Enables Cloud Tenant Isolation Bypass (2026-10-28, 1 outlet, severity 4/5)
- DreamHost Security Incident Disrupts File Manager and Forces User Password Resets (2026-10-27 to 2026-10-28, 2 outlets, severity 3/5)
- Story page: 2026-10-27 DreamHost Forces Password Resets Following Security Incident
- DreamHost forces password resets in ongoing "incident" - BleepingComputer
- Unexplained DreamHost Incident Prompts Email, FTP Password Resets - SecurityWeek
- Cloudflare Mitigates 18.2 Million Network-Layer DDoS Attacks in Q3 (2026-10-30 to 2026-11-02, 2 outlets, severity 2/5)
- Story page: 2026-11-02 Cloudflare Mitigates 18.2 Million Network-Layer DDoS Attacks in Q3
- Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants - Cloudflare Security
- Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38% - The Hacker News
- Cloudflare Launches PHP CTF to Test WAF Bypass Skills (2026-10-28, 1 outlet, severity 1/5)
- Hybrid Sovereign Architectures Secure Data and AI Workloads (2026-10-27, 1 outlet, severity 1/5)
- Story page: 2026-10-27 Hybrid Sovereign Architectures Secure Data and AI Workloads
- Security anchors a modern hybrid sovereign architecture - Cybersecurity Dive
Identity & Access Management
- Gheist Uses Stolen Tokens to Steal Secrets from GitHub Repositories (2026-10-27, 2 outlets, severity 3/5)
- AD CS Abuse: Attackers Use Teams Impersonation and ESC1/ESC8 (2026-11-02, 1 outlet, severity 3/5)
- Story page: 2026-11-02 AD CS Abuse Attackers Use Teams Impersonation and ESC1ESC8
- From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths - Microsoft Threat Intelligence
- GhostAction Attackers Maintain GitHub Access Despite Blocked Workflows (2026-10-29, 1 outlet, severity 3/5)
- Microsoft 365 Token-Replay Attacks Compromise 79 Organizations (2026-10-27, 1 outlet, severity 3/5)
- Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key (2026-10-28, 1 outlet, severity 3/5)
- Gitee Repositories Expose 26,400 Cloud and AI Credentials (2026-10-30, 1 outlet, severity 3/5)
- Agent Identity Management: Design Tenets for Scalable Authentication (2026-10-28, 1 outlet, severity 2/5)
- Story page: 2026-10-28 Agent Identity Management Design Tenets for Scalable Authentication
- Design Tenets for Agent Identity Management Systems - NIST Cybersecurity Insights
- Reddit to lock content behind logins to fight scrapers (2026-11-02, 1 outlet, severity 1/5)
- Story page: 2026-11-02 Reddit to lock content behind logins to fight scrapers
- Reddit to lock content behind logins to fight scrapers - BleepingComputer
- Passkeys Boost Security But Require Continuous Identity Threat Detection (2026-11-02, 1 outlet, severity 1/5)
- Microsoft Urges Entra ID Admins to Adopt Passkeys Now (2026-10-29, 1 outlet, severity 1/5)
- Story page: 2026-09-22 Microsoft Urges Entra ID Admins to Migrate to Passkeys
- Microsoft urges Entra ID admins to migrate users to passkeys - BleepingComputer
AI & Machine Learning Security
- CyberStrikeAI Uses 44 AI Agents to Target Japanese Organizations (2026-10-28, 1 outlet, severity 4/5)
- Stolen AI Reasoning Could Help China Build Cheaper Rivals (2026-10-27, 1 outlet, severity 4/5)
- Former Pentester Used ARTEX AI to Steal 8.2 Million Records (2026-10-27, 1 outlet, severity 4/5)
- VOLTA-AUTODOXER Malware Uses LLMs to Prioritize and Rank Windows Victims (2026-11-02, 2 outlets, severity 3/5)
- MALFEX Uses Malicious Files to Trick AI Coding Agents (2026-10-27, 1 outlet, severity 3/5)
- Malicious Markdown Files Manipulate AI Agents to Steal Tokens (2026-10-27, 1 outlet, severity 3/5)
- AI Relay Disables Security Sandboxes for Codex and Claude Code (2026-10-30, 1 outlet, severity 3/5)
- NIK C2 Framework Uses AI to Analyze Stolen Victim Data (2026-10-30, 1 outlet, severity 3/5)
- Story page: 2026-10-30 NIK C2 Framework Uses AI to Analyze Stolen Victim Data
- NIK C2: The new AI-enabled command-and-control framework - Cisco Talos Blog
- Cisco Open Sources Project Quarry to Detect AI Agent Attacks (2026-10-30, 1 outlet, severity 3/5)
- Qwen3.8-Flash-Next Behavior Linked to Model Jaggedness, Not Malice (2026-10-30, 1 outlet, severity 2/5)
- Story page: 2026-10-30 Qwen3.8-Flash-Next Behavior Linked to Model Jaggedness, Not Malice
- Cohere’s Qwen Story: Looks More Like Model Jaggedness - Check Point Research
- US Voting Machines Face AI Threats and Cybersecurity Risks (2026-10-30, 1 outlet, severity 2/5)
- Healthcare AI Adoption Outpaces Critical Security Governance (2026-10-30, 1 outlet, severity 2/5)
- Cloudflare Patches GLM-5.3 Workers AI Tenant Isolation Vulnerability (2026-10-27, 1 outlet, severity 2/5)
- LLMs Outperform Algorithms in Automating Security Filter Generation (2026-11-02, 1 outlet, severity 2/5)
- Story page: 2026-11-02 LLMs Outperform Algorithms in Automating Security Filter Generation
- Filter generation in practice: from algorithms to LLMs - SecureList (Kaspersky)
- AI Security Benchmarks Require Internal Testing for Full Accuracy (2026-10-27, 1 outlet, severity 2/5)
- Eclypsium and Nvidia Warn of AI Infrastructure Poisoning Risks (2026-11-02, 1 outlet, severity 2/5)
- GPT-6.1 Terra Is Safer Overall But More Destructive in Tests (2026-10-28, 1 outlet, severity 2/5)
- OpenAI Urges Researchers to Improve AI-Generated Bug Report Quality (2026-10-28, 1 outlet, severity 2/5)
- NIST, CISA, and NSA Guide AI Agent Incident Response (2026-10-27, 1 outlet, severity 2/5)
- James Mickens Urges Hardware Isolation to Contain AI Risks (2026-10-29, 1 outlet, severity 2/5)
- AI Agents Use Chrome DevTools and WebMCP to Control Browsers (2026-10-30, 1 outlet, severity 2/5)
- Story page: 2026-10-30 AI Agents Use Chrome DevTools and WebMCP to Control Browsers
- 3 Ways AI Agents Already Operate in Your Browser - BleepingComputer
- US Banks Block AI Agents to Protect Account Security (2026-10-29, 1 outlet, severity 2/5)
- AI Halloween Video Sites Risk User Photo Privacy (2026-10-27, 1 outlet, severity 2/5)
- Story page: 2026-10-27 AI Halloween Video Sites Risk User Photo Privacy
- AI Halloween videos: Who’s getting your photos? - Malwarebytes
- Anthropic Outlines AI Security Risks Ahead of Planned IPO (2026-10-27 to 2026-10-28, 2 outlets, severity 1/5)
- Story page: 2026-10-27 Anthropic Files for Potentially the Biggest IPO Ever as CEO Warns of Risk to Humanity From AI
- Anthropic Files for Potentially the Biggest IPO Ever as CEO Warns of Risk to Humanity From AI - SecurityWeek
- All the security risks Anthropic is worried about before its IPO - CyberScoop
- Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI - SecurityWeek
- CTF Competitions Evolve as AI Disrupts Cybersecurity Entry-Level Jobs (2026-11-02, 1 outlet, severity 1/5)
- JPMorgan and Goldman Sachs Prioritize Security in AI Integration (2026-10-30, 1 outlet, severity 1/5)
- Story page: 2026-10-30 JPMorgan and Goldman Sachs Prioritize Security in AI Integration
- JPMorgan Chase, Goldman Sachs underscore security in AI plans - Cybersecurity Dive
- Rethinking Cybersecurity Awareness in the AI Era (2026-10-30, 1 outlet, severity 1/5)
- Story page: 2026-10-30 Rethinking Cybersecurity Awareness in the AI Era
- Rethinking Cybersecurity Awareness in the AI Era - DarkReading
- Kudelski Security Warns AI May Erode Cybersecurity Technical Skills (2026-10-28, 1 outlet, severity 1/5)
- AI Companionship and Deepfakes Reshape Modern Human Intimacy (2026-10-28, 1 outlet, severity 1/5)
- Nvidia's Mark Weatherford on AI's Impact on CISO Roles (2026-10-27, 1 outlet, severity 1/5)
- Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model (2026-10-30, 1 outlet, severity 1/5)
- AI Shifts Security Roles Toward the New Threat Operator (2026-10-30, 1 outlet, severity 1/5)
- Kaspersky Launches New Tools to Secure Corporate AI Agents (2026-10-27, 1 outlet, severity 1/5)
- Story page: 2026-10-27 Kaspersky Launches New Tools to Secure Corporate AI Agents
- Deploying AI agents securely: how Kaspersky products mitigate AI threats - SecureList (Kaspersky)
- Wazuh Integrates AI to Accelerate SOC Incident Response (2026-10-29, 1 outlet, severity 1/5)
- Story page: 2026-08-22 Wazuh Integrates AI to Automate SOC Threat Detection and Response
- Wazuh and AI for Enhanced SOC Workflows - The Hacker News
- NDR and AI Expose Attackers Hiding Between Security Alerts (2026-10-27, 1 outlet, severity 1/5)
Legal & Law Enforcement
- Operation Serengeti III Nets 1,400 Arrests and $105 Million (2026-10-28, 1 outlet, severity 4/5)
- Defense Contractor Pleads Guilty to Aiding North Korean Worker Scheme (2026-11-02, 1 outlet, severity 4/5)
- Operation Blackout Dismantles West African Scam Networks and Trafficking (2026-11-02, 1 outlet, severity 4/5)
- US Sanctions Russia and North Korea Over IT Worker Laundering (2026-10-29, 1 outlet, severity 4/5)
- Story page: 2026-10-29 US Sanctions Russia and North Korea Over IT Worker Laundering
- US sanctions Russians, North Koreans for laundering IT worker earnings - The Record (Recorded Future)
- Chinese national extradited for $36 million cryptocurrency investment scam (2026-10-27, 3 outlets, severity 3/5)
- Story page: 2026-10-27 Chinese national extradited for $36 million cryptocurrency investment scam
- Chinese man extradited for role in $36 million cryptocurrency scam - BleepingComputer
- Authorities extradite Chinese national for alleged $37M investment scam - CyberScoop
- Dutch police extradite Chinese national accused of laundering Cambodian investment scam funds - The Record (Recorded Future)
- Chui Kok Wa and Co-conspirators Indicted for NFT Scams Targeting Americans (2026-10-28 to 2026-10-29, 2 outlets, severity 3/5)
- GM Pays $220 Million to Settle Driver Data Sale Claims (2026-10-30, 1 outlet, severity 3/5)
- Story page: 2026-10-30 GM Pays $220 Million to Settle Driver Data Sale Claims
- GM settles with 36 states for selling driver data, agrees to $220 million fine and reforms - The Record (Recorded Future)
- DOJ Seeks Privacy Oversight for Character.AI User Data Sale (2026-11-02, 1 outlet, severity 3/5)
- Story page: 2026-11-02 DOJ Seeks Privacy Oversight for Character.AI User Data Sale
- DOJ raises privacy concerns over potential sale of Character.AI chats - The Record (Recorded Future)
- Court Strikes Down West Virginia Law Shielding Officials' Personal Data (2026-10-29, 1 outlet, severity 3/5)
- Story page: 2026-10-29 Court Strikes Down West Virginia Law Shielding Officials' Personal Data
- Court strikes down West Virginia law barring disclosure of public officials’ personal data - The Record (Recorded Future)
- noyb Sues Scale AI Over Invasive Worker Surveillance Claims (2026-10-29, 1 outlet, severity 3/5)
- Story page: 2026-10-29 noyb Sues Scale AI Over Invasive Worker Surveillance Claims
- European digital rights nonprofit noyb sues Scale AI for ‘invasive’ worker surveillance - The Record (Recorded Future)
- Texas Sues OpenAI Over ChatGPT Safety Deceptions (2026-10-27, 1 outlet, severity 3/5)
- Story page: 2026-10-27 Texas Sues OpenAI Over ChatGPT Safety Deceptions
- Texas sues OpenAI for deceiving consumers about safety, seeks sweeping reforms and fines - The Record (Recorded Future)
- Dutch Police Arrest Two for $400,000 NFC Relay Fraud (2026-10-27, 1 outlet, severity 3/5)
- Daniel B. Garrie Shares AI Liability Frameworks for CISOs (2026-10-28, 1 outlet, severity 2/5)
- Court Dismisses Trump DOJ Lawsuit Over Alaska Senate Certification (2026-11-02, 1 outlet, severity 1/5)
- Trump Administration Subpoenas California Officials Over Voter Roll Probe (2026-11-02, 1 outlet, severity 1/5)
- Judge Dismisses Eric Coomer’s Defamation Suit Against Patrick Byrne (2026-10-29, 1 outlet, severity 1/5)
Policy & Regulation
- FTC Probes Nine Companies Over Personalized Pricing and Pay (2026-10-30, 1 outlet, severity 3/5)
- Story page: 2026-10-30 FTC Probes Nine Companies Over Personalized Pricing and Pay
- FTC to probe major companies over personalized pricing and pay - The Record (Recorded Future)
- Wyden and Schiff Accuse Trump Administration of Withholding FISC Opinion (2026-10-27, 1 outlet, severity 3/5)
- CISA Unveils New Four-Year Proactive Defense Strategy (2026-10-27, 2 outlets, severity 2/5)
- Story page: 2026-10-27 CISA Unveils New Four-Year Proactive Defense Strategy
- CISA publishes strategy with eye on the next four years - CyberScoop
- CISA promises proactive defense in new strategic plan - Cybersecurity Dive
- US launches free cybersecurity pilot for rural hospitals (2026-10-28, 2 outlets, severity 2/5)
- Ofcom Proposes Four Age-Verification Methods for UK Social Media (2026-11-02, 1 outlet, severity 2/5)
Other Cybersecurity
- Fortinet Flaws, Banking Trojans, and AI Threats Hit Headlines (2026-10-30, 1 outlet, severity 4/5)
- 26th October – Threat Intelligence Report (2026-10-27, 1 outlet, severity 4/5)
- 26th October – Threat Intelligence Report - Check Point Research
- British spy agency cannot account for thousands of data storage devices, watchdog says (2026-11-02, 1 outlet, severity 3/5)
- Ukraine Denies Musk's Claims of Starlink Misuse for Drone Strikes (2026-10-27, 1 outlet, severity 3/5)
- Story page: 2026-10-27 Ukraine Denies Musk's Claims of Starlink Misuse for Drone Strikes
- Ukraine disputes Musk's claims of Starlink misuse as military connectivity restored - The Record (Recorded Future)
- Belgium's MyMinfin Tax Portal Offline Following Cyberattack (2026-10-30, 1 outlet, severity 3/5)
- Story page: 2026-10-30 Belgium's MyMinfin Tax Portal Offline Following Cyberattack
- Cyberattack disrupts Belgian tax services before filing deadline - The Record (Recorded Future)
- Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S. (2026-10-29, 1 outlet, severity 2/5)
- Discord to Allow Search Engines to Index Public Servers (2026-10-29, 1 outlet, severity 2/5)
- Story page: 2026-10-29 Discord to Allow Search Engines to Index Public Servers
- Discord to let search engines index public server messages - BleepingComputer
- Huntress Tragic Quadrant Ranks Top Threats to Mid-Sized Businesses (2026-10-28, 1 outlet, severity 2/5)
- OpenAI Doubles Pro Usage Limits and Integrates Work Features (2026-10-30 to 2026-11-02, 1 outlet, severity 1/5)
- Cybersecurity Startups Secure Major Funding and High Valuations (2026-10-29, 1 outlet, severity 1/5)
- Palo Alto Networks Warns Retailers of Holiday Cyber Threats (2026-10-29, 1 outlet, severity 1/5)
- Story page: 2026-10-29 Palo Alto Networks Warns Retailers of Holiday Cyber Threats
- Unwrapping Retail Peak Season Cyber Threats - Palo Alto Unit 42
- OpenAI Launches GPT-6.1 Terra With Faster Agents and Lower Pricing (2026-10-27, 1 outlet, severity 1/5)
- 10 Essential Security Practices for Long-Term Digital Resilience (2026-10-27, 1 outlet, severity 1/5)
- Northstar Security Raises $7M to Target Toxic Risk Combinations (2026-11-02, 1 outlet, severity 1/5)
- Lora Vaughn Simplifies Threat Modeling With Four Key Questions (2026-10-30, 1 outlet, severity 1/5)
- Ryan Fetterman on Talos, Splunk, and the Pandora Song incident (2026-10-28, 1 outlet, severity 1/5)
- Kali Linux 2026.3 Adds Six Tools and KDE Plasma 6.7 (2026-10-27, 1 outlet, severity 1/5)
- Story page: 2026-10-27 Kali Linux 2026.3 Adds Six Tools and KDE Plasma 6.7
- Kali Linux 2026.3 released with 6 new tools, desktop updates - BleepingComputer
- YARA-X Releases Versions 1.22.0 and 1.22.1 (2026-11-02, 1 outlet, severity 1/5)
- Story page: 2026-11-02 YARA-X Releases Versions 1.22.0 and 1.22.1
- YARA-X 1.22.1 Release, (Sat, Oct 31st) - SANS Internet Storm Center
- YARA-X 1.22.0 Release, (Sun, Oct 25th) - SANS Internet Storm Center
- From Beginner to Bug Hunter: Learning Cybersecurity in the AI Era (2026-11-02, 1 outlet, severity 1/5)
- Top Cybersecurity Conferences to Attend in 2027 (2026-11-02, 1 outlet, severity 1/5)
- Top cybersecurity conferences to attend in 2027 - Cybersecurity Dive
- Cybersecurity Risk Lessons From a Stage-Three Cancer Diagnosis (2026-10-30, 1 outlet, severity 1/5)
- Wireshark Releases Version 5.0.0rc1 as Major Update Approaches (2026-11-02, 1 outlet, severity 1/5)
- Wireshark 5.0.0rc1 Release, (Sat, Oct 31st) - SANS Internet Storm Center
Reported Data Breaches
Breaches reported via Have I Been Pwned this period.
- AfD - 345,439 breached accounts (2026-10-27)