196 results for “mise”

Report on the $6.3 billion Binance hack of October 2026, which the FBI attributed to North Korea's TraderTraitor unit. Co-CEO Richard Teng said attackers used EIP-7702 to gain execution approval over a hot wallet, after a compromised laptop and further breach points, and used self-destructing malware. Binance replaced 90% of the assets, and the FBI expects further laundering through Ethereum. No IOCs or mitigations are given.

en.cryptonomist.charticleAdded 1 Nov 2026, published 31 Oct 2026🛡️ Security

Decrypt's explainer on the roughly $6.4 billion theft from Binance hot wallets across about 10 blockchains. Binance traced it to a compromised DevOps engineer laptop plus further breach points, and on Ethereum the attacker used 50 pre-signed EIP-7702 authorizations to turn a hot wallet into a sweeper. Chainalysis and TRM Labs attribute it to TraderTraitor; Tether and Circle froze about $2.3 billion.

decrypt.coarticlePublished and added 31 Oct 2026🛡️ Security

Ahmad Umar Agha (Th3Pr0), a Syrian Electronic Army member, received a 42-month US sentence in the Eastern District of Virginia, over 12 years after he was first charged in June 2014. He compromised about 47 Western media, company, NGO and government targets, including the 2013 Associated Press Twitter takeover that caused a flash crash. Accomplice Firas Dardar remains at large.

securityweek.comarticlePublished and added 31 Oct 2026🛡️ Security

StepSecurity's analysis of Binance's 29 October 2026 incident, which Binance puts at about $6.3 billion in affected assets. It covers Binance's disclosure of a possible DevOps laptop compromise, and TRM Labs and Elliptic findings on 50 EIP-7702 authorizations and a persistent delegation. It links this to the Nx, OVHcloud CLI and Claude Code extension compromises, gives an investigation checklist, then describes StepSecurity products.

stepsecurity.ioarticlePublished and added 30 Oct 2026🛡️ Security

The Block reports that Binance lost about $6.3 billion in a hack on 29 October 2026. Co-CEO Richard Teng said a compromised DevOps engineer's laptop gave access to a service container used to submit unauthorized withdrawals, and TRM Labs attributed the theft to North Korea's TraderTraitor. The rest covers reactions: President Trump said on 30 October he was looking into it, CFTC Chair Michael Selig and The Digital Chamber urged federal exchange rules, and senators disputed whether the Clarity Act would have allowed freezes.

theblock.coarticlePublished and added 30 Oct 2026🛡️ Security

Galaxy Research's weekly brief of 30 October 2026 opens with the Binance hack: about $6.3b drained across 10 blockchains, attributed by TRM Labs and Chainalysis to TraderTraitor (Lazarus-linked). The attacker used EIP-7702 with 50 pre-signed authorizations on Ethereum, and Binance's preliminary finding is a compromised DevOps laptop reaching a service container. Tether and Circle froze about $2.6b. The other sections cover Hyperliquid and prediction markets.

galaxy.comarticleAdded 30 Oct 2026🛡️ Security

Galaxy Research newsletter on the roughly $6.3b drained from Binance across 10 blockchains, which TRM Labs and Chainalysis attribute to TraderTraitor. On Ethereum the attacker used EIP-7702 to turn a hot wallet into a sweeper contract backed by 50 pre-signed authorizations. Binance's preliminary finding is a compromised DevOps laptop, with no wallet key leak. Tether, Circle, Ripple and World Liberty froze about $2.7b; Galaxy also assesses Binance's ability to cover losses.

galaxy.comarticleAdded 30 Oct 2026🛡️ Security

Bankless report on the Binance hack of $6.3 billion, which Binance's preliminary investigation traced to a compromised DevOps engineer's laptop with access to withdrawal-authorizing systems. TRM Labs found valid EIP-7702 authorizations on Ethereum, and nine other chains were drained through normally signed transactions. TRM and Chainalysis link it to North Korea's TraderTraitor. Tether and Circle froze about $3 billion, and Binance says SAFU and corporate cash will cover the losses.

bankless.comarticlePublished and added 30 Oct 2026🛡️ Security

Polymarket's international site was hit on 29 October 2026 when a page-speed monitoring script served from DebugBear's CDN was replaced with a drainer. It hijacked logged-in sessions for about an hour and took $2.7M from 726 wallets via Polymarket's relayer. Scott Helme of Report URI says the CSP allowlisted every domain used and that hash pinning would have blocked the swapped file. Polymarket is repaying $3.9M, and this is its second vendor-script compromise since June.

bankless.comarticlePublished and added 30 Oct 2026🛡️ Security

Decrypt reports that Binance is working with the FBI and U.S. Secret Service after a theft of about $6.4 billion, which TRM Labs and Chainalysis attribute to North Korea's TraderTraitor group, also linked to the February 2025 Bybit hack. Circle froze about $823 million in USDC and Tether froze USDT, though the page gives differing Tether totals. Binance first suspected a compromised DevOps engineer laptop, found more breach points, and saw no evidence of leaked wallet private keys.

decrypt.coarticlePublished and added 30 Oct 2026🛡️ Security

Decrypt reports on the October 2026 Binance hot-wallet hack, about $6.3 billion, which Binance CEO Richard Teng says the company will cover with over $6.34 billion of its own funds. Teng says the attacker used an EIP-7702 delegation that skipped Binance's approval controls, a self-destruct mechanism to wipe tooling, and more than one breach point beyond a compromised laptop. TRM Labs and Chainalysis attribute the theft to TraderTraitor, and the attacker is still moving funds on Tron.

decrypt.coarticlePublished and added 30 Oct 2026🛡️ Security

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) has been exploited for over a week. A China-linked group chained it with the Fragnesia Linux kernel privilege escalation to root at least 25 Palo Alto Networks PAN-OS firewalls with exposed management interfaces. Defiant had seen no confirmed WordPress compromise by 28 October 2026 despite 77,000 requests, and Cato and watchTowr report few successful attackers.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

Binance hack analysis from 21shares on the 29 October 2026 theft of about $6.3 billion from Binance. Binance's initial finding points to a compromised DevOps engineer's laptop with no sign of a leaked wallet key. Chainalysis attributes it to North Korea with high confidence, and about $3 billion was frozen by Tether, Circle and the Arbitrum Security Council. The attacker also borrowed about $44.6 million of WETH on Aave. Binance says SAFU and company funds will cover all losses.

21shares.comarticlePublished and added 30 Oct 2026🛡️ Security

The Block reports that Binance says it has set aside $6.34 billion of its own funds to cover a hack it puts at about $6.3 billion. Co-CEO Richard Teng says the entry point was a compromised DevOps laptop and no private key leak was found. About $3 billion was frozen by Tether, Circle, Ripple and others, withdrawals are suspended, and TRM Labs sees parallels with North Korean attacks. Technical detail is thin.

theblock.coarticlePublished and added 30 Oct 2026🛡️ Security

Aikido Security's analysis of the roughly $6.3 billion Binance incident, which Binance says may have started with a compromised DevOps engineer's laptop. It sets out what is known (no private key leak, TraderTraitor attribution by TRM Labs and Chainalysis, additional breach points) and a plausible chain from laptop credentials to a withdrawal service. It compares the 2025 Bybit theft and lists mitigations.

aikido.devarticlePublished and added 30 Oct 2026🛡️ Security

TRM Labs and Chainalysis attribute the October 2026 Binance theft, about $6.4 billion across 10 blockchains, to North Korea's TraderTraitor. On Ethereum the attacker used EIP-7702 delegation with 50 pre-signed authorizations to turn a hot wallet into a sweeper, pointing to compromised signing infrastructure. The attacker funded wallets via Tornado Cash, laundered through automation and Aave borrowing, and about $3 billion was frozen.

decrypt.coarticlePublished and added 30 Oct 2026🛡️ Security

A WordPress core race condition in the update process, patched in WordPress 7.1.4 on 28 October 2026, allows unauthenticated remote code execution with high attack complexity. New files unpack into a predictable, web-accessible staging directory. Defiant's Wordfence logged over 18,500 requests for staged setup-config.php paths in 21 hours, with no confirmed compromises. No CVE is assigned yet. The release fixes 22 flaws in total.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

Binance estimated the October 2026 security incident at about $6.3 billion and said it found "additional points of breach" beyond the compromised DevOps engineer laptop it first named. The attacker reached a service container and submitted unauthorized withdrawals, with no wallet private key leak found. Arkham counted $6.01 billion taken from hot wallets on nine chains; Tether and Circle froze about $1.8 billion in stablecoins. About $3 billion is frozen onchain; withdrawals stay suspended.

decrypt.coarticlePublished and added 30 Oct 2026🛡️ Security

Binance linked the theft of about $6.3 billion in crypto to a compromised DevOps engineer's laptop, which let attackers reach a service container and submit unauthorized withdrawals. TRM Labs and Chainalysis attribute the 29 October 2026 attack to North Korea's TraderTraitor. About $2.7 billion was frozen, and the attackers hold about $2.4 billion. Binance has found no evidence of a leaked wallet private key.

bleepingcomputer.comarticlePublished and added 30 Oct 2026🛡️ Security

CVE-2026-111585 (CVSS 8.8) is an integer overflow in the remote-control screen processing of TeamViewer clients on Windows, macOS, Linux and Android. A malicious or compromised host can announce an oversized screen surface (for example 32768 by 32768 at 32 bpp), forcing a software decode path and an out-of-bounds write that crashes the viewer or runs code. Remedio's research shows a pointer overwrite routed to WinExec. Version 15.83 fixes it, along with CVE-2026-92372, CVE-2026-92374 and six local privilege escalation bugs.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

The Binance hack of 29 October 2026 drained about $6.36 billion across ten blockchains in roughly 20 minutes, according to TRM Labs. TRM attributes it with high confidence to North Korea's TraderTraitor, citing a mixer-funded operator wallet, pre-signed transactions and overlap with the Bybit and KelpDAO hacks. Binance's early findings point to a compromised DevOps engineer laptop. Stablecoin issuers froze about $2.7 billion.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

Binance disclosed a suspected security incident on 29 October 2026, estimating $6.3 billion affected and about $3 billion frozen. Binance's early finding is that a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawals, with no evidence of wallet private-key leakage. TRM Labs suspects TraderTraitor, the group tied to the February 2025 Bybit theft. Tether, Circle and Ripple froze funds.

en.cryptonomist.charticlePublished and added 30 Oct 2026🛡️ Security

Polymarket's international exchange suffered unauthorized withdrawals on 29 October 2026 after a compromised third-party provider, reportedly the website monitoring service DebugBear. Betting Intelligence and Polysights found one account withdrew at least $2.7 million across 710 wallets. Polymarket paused trading, referred the case to law enforcement, promised reimbursement, and had a June 2026 vendor breach that cost about $3 million. The attack mechanism is not described.

en.cryptonomist.charticlePublished and added 29 Oct 2026🛡️ Security

Polymarket put its exchange in cancel-only mode and paused relayer actions on 29 October 2026 after users reported funds withdrawn without permission. Hudson Rock says a DebugBear-hosted script holds wallet-draining code that sells a logged-in user's positions and hard-codes the suspected attacker's wallet (about $2.65 million in POL, per Arkham) as fallback recipient. Polymarket blames a compromised third-party provider and promises to make users whole. Root cause and victim count are unconfirmed.

decrypt.coarticlePublished and added 29 Oct 2026🛡️ Security

Icepick is a dataset published on 28 October 2026 by Distributed Denial of Secrets. It lists 41,191 DHS employees and contractors with names, titles, offices, phones, managers and 55,000+ permission groups. The hacktivist group Department of Peace says it took the data from DHS's Okta SSO; Okta denies compromise. DHS has filed a takedown notice via ZeroFox, and the full archive is unverified.

decrypt.coarticlePublished and added 29 Oct 2026🛡️ Security

tl;dr sec #352 is a security newsletter issue covering [un]prompted talks (AI-assisted firmware patching, a "Security Constitution" for finding cloud design flaws), Azure API Connections cross-tenant bugs worth $200,000, and a test of 14 LLMs given AWS keys. It also covers a paper on malicious LLM API routers (9 of 428 injecting code) and Datadog's "counterfeit policy" bypass of the Jev classifier.

tldrsec.comarticleAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

A hacker using the handle Department of Peace leaked more than 41,000 US Department of Homeland Security employee records, which the hacker says came from an Okta single sign-on system. The data covers names, work emails, phone numbers, job titles, office locations and per-account system access, mostly for CBP, ICE and HSI staff plus about 1,000 CISA employees. Okta says it has no evidence of compromise. Distributed Denial of Secrets calls the dataset 'Icepick'.

securityweek.comarticlePublished and added 29 Oct 2026🛡️ Security

Icepick is a leaked archive of records on more than 41,000 Department of Homeland Security employees and contractors, published by Distributed Denial of Secrets in 2026 and said to come from DHS's Okta login system. WIRED's analysis covers CBP, ICE, HSI, USCIS and CISA staff, plus over 55,000 permission groups that reference undercover programs, Palantir Falcon, PenLink, Signal and Mobile Fortify. Okta says it has no evidence of compromise.

wired.comarticleAdded 29 Oct 2026, published 28 Oct 2026🛡️ Security

DreamHost suspended its File Manager (files.dreamhost.com) and reset passwords for some email and FTP/SFTP users after an unexplained issue affecting File Manager and webmail. Account owners were told to set new passwords and change reused ones; users questioned whether passwords were compromised or properly hashed. DreamHost deployed a fix on Monday. Root cause and number of affected users were not disclosed.

securityweek.comarticlePublished and added 27 Oct 2026🛡️ Security

Aikido Images are free patched PHP container images on public ECR (public.ecr.aws/aikido-dev/php) that backport the PHP2Shell fixes for CVE-2026-109618 and CVE-2026-109619 into release lines 5.5 to 8.5, except 8.0. Upstream fixed 8.2 to 8.5 in October 2026 and left 8.1 and older unpatched. The post shows docker pull and Dockerfile FROM changes, then rebuild, restart, session.upload_progress.enabled=0 and compromise checks.

aikido.devarticlePublished and added 26 Oct 2026🛡️ Security

Keystone confirmed a breach of Shopify customer records (about 26,000 plus 13,000 incomplete orders), in which the attacker also took the WebAuth key used to verify device authenticity. It will destroy almost 19,000 unshipped wallets and issue a new key. Foundation Passport phishing emails (over 20,000) came from compromised Cloudflare API keys, and old WooCommerce database copies kept personal data past the stated 60-day deletion.

protos.comarticlePublished and added 26 Oct 2026🛡️ Security

Clean-label poisoning attack on federated learning for Basic Safety Message anomaly detection in vehicular networks, from Sagduyu, Erpek, Stephenson and Xue (paper submitted 23 October 2026). The attack perturbs benign samples toward malicious feature extremes without changing labels, which lowers class separability, and it grows stronger with more compromised nodes. A feature-consistency relabeling defense keeps attack success low without hurting clean accuracy, and a game-theoretic model shifts equilibria against attacking.

en.cryptonomist.charticlePublished and added 26 Oct 2026🛡️ Security

Keystone, a hardware wallet maker, disclosed on 25 October 2026 that an attacker accessed its Shopify-based store, detected 20 October and confirmed 23 October. Customer names, contact details, shipping addresses and order details were taken. Keystone says no payment data, recovery phrases or keys were exposed. Customers on X say their data was held despite a 180-day deletion pledge. The piece lists 2026 leaks at Trezor, SafePal and Ledger.

theblock.coarticlePublished and added 25 Oct 2026🛡️ Security

AINews digest for 22 to 23 October 2026, led by Moonshot's Kimi K3.1 Pro (2.8T parameters, 104B active, weights promised for 4 November 2026). It reports Artificial Analysis scoring the model 64% on its Cyber Index despite Moonshot removing cyber data from training. Other items: OpenAI's frontier-training containment incident, a Brotli remote-code-execution disclosure, and Anthropic's Mythos 5 unauthorized-action analysis.

latent.spacearticleAdded 30 Oct 2026, published 24 Oct 2026🛡️ Security

AINews issue for 22 to 23 October 2026 centred on Moonshot's Kimi K3.1 Pro, a multimodal mixture-of-experts model with 2.8T total and 104B active parameters and 1M context. Weights are promised for 4 November 2026. Artificial Analysis scored it 55 on its Intelligence Index (fourth place), and Arena ranked it #8 in WebDev. Standard pricing is $2/$10 per million tokens. The issue also covers a cyber-data removal approach, serving-cost objections, and paid-promotion allegations. Shorter items follow on agents, evals and inference.

latent.spacearticlePublished and added 24 Oct 2026🧠 AI

Kimi K3.1 Pro is Moonshot AI's new model, available on the Kimi API from 23 October 2026, with full weights promised by 4 November 2026. Pricing is $2.00 per million input tokens and $10 per million output, and a Highspeed variant is 2-3x faster at twice the price. Artificial Analysis scores it 55, behind only Claude Opus 5.5 (58). Simon Willison tested it with the llm CLI and pelican SVG prompts.

simonwillison.netarticlePublished and added 23 Oct 2026🧠 AI

PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) are unauthenticated RCE bugs in PHP, patched on 21 October 2026. Sophos, Arctic Wolf and Hunt.io tie exploitation attempts to the Potassium Mirai variant, and VulnCheck built an ASLR-bypassing exploit. SOCRadar and Hunt.io found an exposed attacker server, and Qualys data shows about 110 million instances on end-of-life PHP. No confirmed compromise exists.

securityweek.comarticlePublished and added 23 Oct 2026🛡️ Security

LiteLLM version 1.107.0 was published with malware to PyPI and Docker Hub on October 21, for about three hours and roughly 49,000 downloads. Attackers used GitHub CLI OAuth tokens, likely leaked through Claude Code into LiteLLM logs, to disable branch protections, redirect the releaser to a lookalike repository and sign poisoned artifacts. The payload is an infostealer and RAT; Wiz saw Amazon Bedrock abuse. The last clean version is 1.106.2.

securityweek.comarticlePublished and added 23 Oct 2026🛡️ Security

Guidance on the October 2026 eMudhra / emSign CA incident, where eight intermediate CA certificates had private keys generated with insufficient randomness. It explains why updating certifi alone does not fix pip's vendored bundle, and lists fixed versions (certifi 2026.10.19, pip 26.2.2, Python 3.15.1, 3.14.9, 3.13.17). StepSecurity's OpenSSL 4.0.3 tests showed the older bundle accepted seven emSign paths, while both corrected bundles rejected all fourteen.

stepsecurity.ioarticlePublished and added 22 Oct 2026🛡️ Security

Protos reports that on-chain investigators, including Darcy of Salus, ZachXBT and SpecterAnalyst, say CoinDCX misattributed about $16M in outflows from compromised wallets. CoinDCX says the addresses were created in January 2025, compromised in July 2025, and that a sweeping process failed. Investigators cite gas distribution, hot wallet transfers as late as May 2026, and funds sent to Huione and Xinbi addresses.

protos.comarticlePublished and added 22 Oct 2026🛡️ Security

Muse AI's X post describes the compromise of LiteLLM 1.107.0, published to PyPI on 21 October at 7:39 AM and quarantined about 1 hour 43 minutes later. The payload was a .pth file that ran at Python startup and sent cloud credentials, private keys and AI dev-tool auth files to an attacker endpoint. The author lists five agent-builder defences: hash-locked pins, capped per-tool keys, a release cooling period, keeping secrets away from Python startup, and outbound traffic monitoring.

x.comarticleAdded 23 Oct 2026, published 22 Oct 2026🧠 AI

eMudhra's eight intermediate CA certificates, chaining to emSign ECC Root CA - G3, had private keys below 256 (one is 4), disclosed on 17 October 2026 by a researcher known as Wayne. Browsers and Microsoft blocked them via revocation pushes, but curl, git, containers, language runtimes and IoT may still trust them. The post gives patched ca-certificates versions, test commands and the timeline.

aikido.devarticlePublished and added 22 Oct 2026🛡️ Security

The eMudhra CA compromise (disclosed 20 October 2026) involves eight intermediate CA certificates whose private keys can be derived from the certificates themselves. They chain to AAA Certificate Services and three other roots. Browsers block them, but non-browser clients skip revocation and CT checks. Endor Labs finds 25 popular packages with frozen bundled root stores, 11 already patched, and gives a fingerprint-scanning script, test hosts and patch steps.

endorlabs.comarticlePublished and added 21 Oct 2026🛡️ Security

Analysis of the eMudhra intermediate CA compromise disclosed 20 October 2026, in which eight intermediate CA private keys were weak P-384 keys (top 376 bits zero, one key equal to 4) and publicly accessible. It explains web PKI chains and why browsers enforcing Certificate Transparency were not exposed. It argues MCU firmware that bundles only the single root it needs, as in Zephyr's HTTP GET sample, is likely safe unless it trusts an eMudhra or Sectigo cross-signing root.

danielmangum.comarticleAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

Aikido's guide to software supply chain security controls for 2026, tied to real incidents. It covers a 48-hour package cooldown, ignore-scripts, lockfile enforcement, SHA and digest pinning, scoped tokens, FIDO2, developer endpoint protection, extension allowlists, agent sandboxing, MCP server vetting, slopsquatting, signed SBOMs and rotation drills. Examples include the March 2026 axios compromise and the March 2025 tj-actions/changed-files attack.

aikido.devarticleAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

CVE-2026-110936 is an uncontrolled DLL search path flaw (CWE-427) in Siemens Software Center below V4.0.9.8, listed in CISA KEV on 20 October 2026. The post covers CVSS v4.0 8.4 and v3.1 6.7, Siemens' Romulus ClickFix campaign indicators (IPs, domain, hashes, file leads) and a six-step SOC trail using Sysmon, EDR and network records. It separates delivery from DLL load and from compromise.

x.comarticleAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

OVHcloud's official CLI was backdoored on 19 October after an attacker used a developer's hijacked GitHub account to overwrite release binaries for v0.11.0 through v0.15.0 with a secret stealer. The malicious files were live for about 94 minutes. Release immutability was not enabled, so CI/CD was bypassed. OpenSourceMalware links the account to a March 2026 compromise with a Solana-based loader and a GlassWorm wallet, but calls the same-actor link an inference.

securityweek.comarticlePublished and added 21 Oct 2026🛡️ Security

eMudhra Intermediate CA Compromise is a 20 October 2026 link-blog post reporting that private keys of eight eMudhra intermediate CA certificates were compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome programs. Software bundling trust lists needs updating: Linux distros must update ca-certificates, and uv 0.13.4, pip 26.2.2 and certifi 2026.10.19 ship new lists. The post does not describe how the keys were compromised.

simonwillison.netarticleAdded 21 Oct 2026, published 20 Oct 2026🛡️ Security

Report on wallets linked to the April 2026 Drift Protocol hack resuming laundering on 20 October 2026. Lookonchain counted 25,700 ETH (about $61.56 million) sent to Tornado Cash in 100 ETH batches, with 81,864 ETH still held. It recaps the six-month fake-VC social engineering, Cursor and VSCode compromise of Security Council devices, and TRM Labs and Chainalysis attribution to DPRK's UNC4736.

en.cryptonomist.charticlePublished and added 20 Oct 2026🛡️ Security

Rust 1.100, due 12 November, stabilizes an opt-in minimum publish age in Cargo, set with global-min-publish-age in .cargo/config.toml. Cargo skips releases younger than the threshold and fails resolution if none qualifies, which blocks the yank-and-replace attack. Limits: default is zero, no effect on cargo install, Git or path dependencies. Context: the August arrayref, internment and append-only-vec compromises via proc-macro1.

socket.devarticlePublished and added 20 Oct 2026🛡️ Security

AOMEI Backupper, Windows backup and cloning software, served malware in short tampering windows between April and July 2026. Threat actor UNC7017 altered the update settings file and notification service to push the CrossRoad downloader, ShinyRoad backdoor, a modified Radmin Server and Adaptix payloads. Each window lasted five to ten minutes. The client did not authenticate its configuration files, and a WebDAV banner trick leaked NetNTLMv2 hashes.

securityweek.comarticlePublished and added 20 Oct 2026🛡️ Security

Nikkei disclosed a breach of 1.83 million records from a cloud service it uses for system development, accessed on 7 October 2026 with previously compromised credentials. About 150,000 records held names, addresses, emails, phone numbers and birth dates, and 120,000 held email addresses only. Nikkei revoked the credentials and notified regulators. It found no misuse as of 16 October, and it had disclosed an earlier Slack account breach less than a year before.

securityweek.comarticlePublished and added 20 Oct 2026🛡️ Security

Rank Math PRO version 3.0.123, a WordPress SEO plugin, shipped malicious packages between 15 October 2026 20:02 UTC and 16 October 2026 07:12 UTC. The malware gives persistent backdoor access, can expose credentials and API keys, and uses .htaccess rules to run .cache files as PHP. Rank Math released clean v3.0.124 and advises restoring from backup, blocking rank1cdn[.]com, and checking SSH keys and crontabs.

securityweek.comarticlePublished and added 19 Oct 2026🛡️ Security

Wiz describes its pipeline that analyzes every new npm package version at publication, combining static analysis, an AI classifier, sandbox dynamic analysis and runtime sensor observation, then pushes IOCs to Wiz Defend before a CVE exists. It cites supply chain attacks rising from about 10% of significant incidents in H2 2025 to 25% in H1 2026, and the Axios compromise (v1.14.1, v0.30.4). The keyv case shows C2 domains fetched from an Ethereum smart contract, which only runtime monitoring caught.

wiz.ioarticlePublished and added 19 Oct 2026🛡️ Security

ConnectWise suspended its Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management services in October 2026 after a compromised application credential was used to access customers' Microsoft 365 tenants. Huntress saw the Cloud Backup identity sign in to 162 tenants on 15 to 16 October and attacker IP 144.172.64[.]128 try nearly 1,000 Entra tenants, with over 300 successful sign-ins. In one tenant, the Cloud Management Teams app added itself to Global Administrator and added client secrets to other apps. No restoration timeline has been given.

securityweek.comarticlePublished and added 19 Oct 2026🛡️ Security

Breach report on Educational Testing Service (ETS), whose SFTP site was accessed with a compromised login credential between 22 May and 18 September 2026, exposing California student records. The data covers at least three school years of students, over 5.7 million enrolled, and leavers back to 2006. Files included names, birth dates, addresses, ID numbers, disability and English learner status. No Social Security numbers were involved, and the credential's origin and the attacker are unknown.

securityweek.comarticlePublished and added 19 Oct 2026🛡️ Security

CyberForge Weekly CVE Rundown #006 covers six CVEs from 12-17 October 2026: BotSharp default signing key, GitLab CI/CD regex compiler overflow (CVSS v3.1 10.0), Ivanti Connect Secure auth bypass, Cisco Secure Email Gateway, BeyondTrust Remote Support and the Linux kernel PwnEscape guest-to-host bug. It gives fixed versions, KEV and EPSS status as of 18 October, and separates patch verification from compromise investigation.

x.comarticleAdded 20 Oct 2026, published 18 Oct 2026🛡️ Security

MemTensor MemOS compromise: three malicious versions of @memtensor/memos-cloud-openclaw-plugin on npm and MemoryOS 2.0.34 on PyPI (23 September 2026) bundled a Go binary, sckit, that harvested credentials and environment secrets and reported to skyleen.fr. The post gives OSV IDs, grep and find commands for exposure checks, safe versions (0.1.20, 2.0.33), rotation steps, and the missing gitHead as a provenance signal.

safeguard.sharticleAdded 19 Oct 2026, published 18 Oct 2026🛡️ Security

Galaxy Research's weekly brief leads with the roughly $91M theft from Ledger devices sold via the reseller CryptoBilis. A hidden hardware implant read the 24-word recovery phrase off the screen during setup and sent it over LTE through an eSIM, leaving the Secure Element untouched so Genuine Check still passed. Galaxy's onchain tally covers 474 victim addresses, 88% of the value moved in one hour on Oct. 9, and about $56.6M was still parked as of Oct. 15, with Tornado Cash use and a $10M Tether freeze. It places the theft alongside the Coldcard weak-seed, Liquid peg-out and Bitget compromises, and ends with buyer and custody advice. The Papertrade and OCC debanking sections are unrelated to security.

galaxy.comarticleAdded 16 Oct 2026🛡️ Security

A cybersecurity incident at BAE Systems, which runs the Bankruptcy Noticing Center (BNC) for the US judiciary, has stopped all federal bankruptcy courts from generating or sending notices for about a week. The incident was reported to the Administrative Office of the US Courts late on October 9. The National Creditor Registration Service is offline, and notices issued since then have not been delivered. Neither BAE nor the judiciary has said what caused the incident, whether it was a cyberattack, or whether data was compromised. The case shows how a single contractor outage can disrupt a nationwide government function.

securityweek.comarticlePublished and added 16 Oct 2026🛡️ Security