{"generated":"2026-11-08T11:51:44.666Z","about":"HARD Live: every security incident HARD is following, with patch status, fixed versions, what to do, and a sourced timeline. https://hard.fyi/live/","feeds":{"rss":"https://hard.fyi/live/feed.xml","changes":"https://hard.fyi/api/live?changes=1","incident":"https://hard.fyi/api/live?id={id}"},"incidents":[{"id":"cryptobilis-wallet-hardware-implants-oct-2026","category":"supply-chain","status":"live","title":"CryptoBilis wallet thefts: Ledger confirms hardware implant; Trezor Safe 5 tampering suspected","tldr":"Ledger wallets sold through CryptoBilis contained cryptocurrency-stealing implants; one Trezor Safe 5 is also suspected. Affected buyers should move funds to a trusted, newly created wallet with a new recovery phrase. Reusing the old phrase leaves funds exposed.","action":"If you bought a Ledger from CryptoBilis, or any Trezor supplied by CryptoBilis from March 2026 onwards, do not set up an unused device or enter an existing recovery phrase into it. If already using one, move funds to a new wallet created on a trusted device with a new recovery phrase; restoring the old phrase on replacement hardware does not protect the funds. Contact the maker through its official website for help and never share your recovery phrase; eligible Trezor buyers can request a replacement or voucher.","product":"Ledger hardware wallets and Trezor hardware wallets supplied by CryptoBilis","audience":"home","severity":"critical","patch":"na","exploited":true,"cves":[],"tags":["cryptobilis","ledger","trezor","hardware-wallet","supply-chain","crypto-theft"],"fixed":[],"started":"2026-10-09","closed":null,"updated":"2026-11-03T20:39:30.734Z","url":"https://hard.fyi/live/cryptobilis-wallet-hardware-implants-oct-2026/","json":"https://hard.fyi/api/live?id=cryptobilis-wallet-hardware-implants-oct-2026"},{"id":"liquid-network-bitcoin-theft-sep-2026","category":"breach","status":"live","title":"Liquid Network restores backing after US$320 million theft; direct Federation withdrawals still restricted","tldr":"An Elements flaw let an attacker drain roughly US$320 million from Liquid's bitcoin reserves. Full L-BTC backing is restored, but direct Federation withdrawals remain restricted. SideSwap conversions are open; no wallet or key change is required.","action":"If you hold L-BTC, no wallet or key change is required for this incident. SideSwap conversions to bitcoin are open with a 0.1% service fee, but payouts can wait for its wallet to be replenished. Check with your wallet or exchange about its withdrawal route, because direct Federation withdrawals remain restricted.","product":"Liquid Network L-BTC and SideSwap's bitcoin withdrawal service","audience":"both","severity":"critical","patch":"na","exploited":true,"cves":[],"tags":["liquid-network","blockstream","sideswap","bitcoin","crypto-theft"],"fixed":["Elements 23.3.4"],"started":"2026-09-06","closed":null,"updated":"2026-11-03T20:34:01.717Z","url":"https://hard.fyi/live/liquid-network-bitcoin-theft-sep-2026/","json":"https://hard.fyi/api/live?id=liquid-network-bitcoin-theft-sep-2026"},{"id":"langflow-code-execution-attacks-jul-2026","category":"patch","status":"live","title":"Langflow code-execution flaw CVE-2026-0770 exploited; fixed version remains unconfirmed","tldr":"Attackers are exploiting CVE-2026-0770 to run code on Langflow AI-building servers without logging in. Restrict access and check for compromise. CISA links version 1.9.0, but a vendor-confirmed fix could not be verified.","action":"If your business or family office runs Langflow, ask its administrator to restrict access to trusted users behind external authentication and confirm remediation with Langflow. Have them review historical validation requests and server activity, and replace potentially exposed credentials if compromise cannot be ruled out. Families who do not run Langflow have no direct device update to install.","product":"Langflow AI agent and workflow builder","audience":"work","severity":"critical","patch":"none","exploited":true,"cves":["CVE-2026-0770"],"tags":["langflow","ai","code-execution","actively-exploited","cloud-credentials"],"fixed":[],"started":"2026-07-21","closed":null,"updated":"2026-11-03T22:16:30.335Z","url":"https://hard.fyi/live/langflow-code-execution-attacks-jul-2026/","json":"https://hard.fyi/api/live?id=langflow-code-execution-attacks-jul-2026"},{"id":"arista-velocloud-command-injection-jul-2026","category":"patch","status":"live","title":"Arista VeloCloud Orchestrator command injection CVE-2026-16812 exploited; patch coverage remains partial","tldr":"Attackers exploited VeloCloud Orchestrator, which manages business networks. Released fixes cover three branches, but Arista has not confirmed complete coverage. Ask your IT provider to update, restrict management access and check for compromise.","action":"If your business uses VeloCloud, ask its IT provider to confirm a released fix is installed and investigate possible compromise. Restrict the management interface to trusted administrative networks; ask Arista to confirm remediation for 7.0, Hosted or Dedicated deployments.","product":"Arista VeloCloud Orchestrator","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-16812"],"tags":["arista","velocloud","command-injection","zero-day","volt-typhoon"],"fixed":["VCO 5.2.3.14 and later in the 5.2 branch","VCO 6.1.3.4 and later in the 6.1 branch","VCO 6.4.2.4 and later in the 6.4 branch"],"started":"2026-07-27","closed":null,"updated":"2026-11-03T22:16:11.904Z","url":"https://hard.fyi/live/arista-velocloud-command-injection-jul-2026/","json":"https://hard.fyi/api/live?id=arista-velocloud-command-injection-jul-2026"},{"id":"adobe-commerce-stylesmuggler-attacks-sep-2026","category":"patch","status":"live","title":"Adobe Commerce and Magento StyleSmuggler attacks: hotfix and October bypass fixes required","tldr":"Attackers used StyleSmuggler to compromise Adobe Commerce and Magento shops without logging in. Apply Adobe's VULN-39341 hotfix plus October security fixes, check for backdoors and rotate exposed credentials. Monthly patches alone are insufficient.","action":"There is no device update for shoppers. If your family or business runs an Adobe Commerce or Magento shop, ask its developer or hosting provider to apply and verify hotfix VULN-39341 alongside the October security fixes. Have them check for existing compromise and follow Adobe's encryption-key and credential-rotation instructions.","product":"Adobe Commerce, Adobe Commerce B2B and Magento Open Source","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-75650","CVE-2026-103849"],"tags":["adobe","magento","adobe-commerce","zero-day","remote-code-execution","stylesmuggler"],"fixed":["CVE-2026-75650: Adobe hotfix VULN-39341, using the version-specific patch in Adobe's APSB26-146 installation instructions; it remains separate from September and October isolated security patches.","CVE-2026-103849 — Adobe Commerce: 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct; also 2.4.10-alpha1.","CVE-2026-103849 — Adobe Commerce B2B: 1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct; also 1.5.4-alpha1.","CVE-2026-103849 — Magento Open Source: 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct; also 2.4.10-alpha1."],"started":"2026-09-04","closed":null,"updated":"2026-11-03T22:14:46.463Z","url":"https://hard.fyi/live/adobe-commerce-stylesmuggler-attacks-sep-2026/","json":"https://hard.fyi/api/live?id=adobe-commerce-stylesmuggler-attacks-sep-2026"},{"id":"ajaxpro-deserialisation-attacks-aug-2026","category":"patch","status":"live","title":"Ajax.NET Professional code-execution flaw CVE-2021-23758 exploited; fixes depend on the package","tldr":"Attackers are exploiting an old Ajax.NET Professional flaw on website servers. The official AjaxNetProfessional package has a fix; several other packages do not. Ask your website developer to migrate to official version 24.10.10.1 and check for intruders.","action":"There is no routine phone or browser update for families: this affects website servers. If your business or family office runs a website, ask its developer to replace affected packages with official AjaxNetProfessional 24.10.10.1 and check the server for intruders. Retire affected software if it cannot be safely updated or replaced.","product":"Ajax.NET Professional (AjaxPro) for ASP.NET website servers","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2021-23758"],"tags":["ajaxpro","aspnet","windows","server","deserialisation","remote-code-execution"],"fixed":["AjaxNetProfessional 21.11.29.1 — maintainer-designated fix, despite conflicting affected-version table","AjaxNetProfessional 24.10.10.1 — latest official release available"],"started":"2026-08-26","closed":null,"updated":"2026-11-03T22:14:05.181Z","url":"https://hard.fyi/live/ajaxpro-deserialisation-attacks-aug-2026/","json":"https://hard.fyi/api/live?id=ajaxpro-deserialisation-attacks-aug-2026"},{"id":"arista-velocloud-orchestrator-input-validation-sep-2026","category":"patch","status":"live","title":"Arista VeloCloud Orchestrator On-Prem flaw CVE-2026-93952 (CVSS 10) exploited; fixes for only some versions","tldr":"Arista's on-prem VeloCloud Orchestrator has a maximum-severity input flaw (CVE-2026-93952) under attack. Fixed only in 5.2.3.16 and 6.4.2.8; 6.1 and 7.0 have no fix listed. Organisations should patch, restrict web access to admin networks and check logs.","action":"Work-system issue: if your business runs on-prem VeloCloud Orchestrator, update to 5.2.3.16 or 6.4.2.8 or later. On 6.1 or 7.0, restrict the web interface to trusted admin networks and ask Arista TAC about a fix. Nothing for home users to do.","product":"Arista VeloCloud Orchestrator (VCO) On-Prem","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-93952"],"tags":["arista","velocloud","sd-wan","orchestrator","zero-day","exploited","cisa-kev","network"],"fixed":["5.2.3.16 and later (5.2.3 train)","6.4.2.8 and later (6.4.2 train)"],"started":"2026-09-22","closed":null,"updated":"2026-11-03T22:07:53.058Z","url":"https://hard.fyi/live/arista-velocloud-orchestrator-input-validation-sep-2026/","json":"https://hard.fyi/api/live?id=arista-velocloud-orchestrator-input-validation-sep-2026"},{"id":"wso2-api-manager-jwt-bypass-sep-2026","category":"patch","status":"live","title":"WSO2 API Manager and gateway products: login bypass CVE-2026-5430 used in attacks; update levels available","tldr":"WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway have a CVSS 10 flaw (CVE-2026-5430) that lets attackers forge admin tokens. It is being used in attacks. Business IT teams should apply WSO2's May 2026 fixes and rotate credentials. Nothing for home users.","action":"If your business runs WSO2 API Manager or related gateways, ask your IT team or WSO2 support to apply the update level in advisory WSO2-2026-5328 or higher. They should also review admin activity and rotate API credentials and keys.","product":"WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-5430"],"tags":["wso2","api-manager","jwt","authentication-bypass","cisa-kev","exploited","enterprise"],"fixed":["API Control Plane 4.6.0 update level 22; 4.5.0 update level 58","API Manager 4.6.0 level 21; 4.5.0 level 57; 4.4.0 level 72; 4.3.0 level 108; 4.2.0 level 197; 4.1.0 level 257","Traffic Manager 4.6.0 level 21; 4.5.0 level 56","Universal Gateway 4.6.0 level 21; 4.5.0 level 57","Community users: public code fixes carbon-apimgt pull request 13752 and product-apim pull request 14167"],"started":"2026-09-24","closed":null,"updated":"2026-11-03T22:07:20.176Z","url":"https://hard.fyi/live/wso2-api-manager-jwt-bypass-sep-2026/","json":"https://hard.fyi/api/live?id=wso2-api-manager-jwt-bypass-sep-2026"},{"id":"zammad-helpdesk-zero-days-divd-breach-oct-2026","category":"patch","status":"live","title":"Zammad helpdesk: session-hijack and root-escalation flaws CVE-2026-102489 and CVE-2026-102490 used in attacks","tldr":"Two Zammad helpdesk flaws, CVE-2026-102489 (remote code execution, 6.5 and older) and CVE-2026-102490 (local root, DEB/RPM packages), were used against DIVD. Update to Zammad 7.2.2 or later; 6.5 and older get no regular security fixes.","action":"If you run Zammad, update to 7.2.2 or later (version 7.0 or later for CVE-2026-102489), and move off 6.5 or older. Limit server access to trusted administrators and check logs for signs of compromise, as DIVD advises.","product":"Zammad helpdesk and ticketing software","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-102489","CVE-2026-102490"],"tags":["zammad","helpdesk","zero-day","privilege-escalation","remote-code-execution","divd","cisa-kev"],"fixed":["7.2.2 (CVE-2026-102490)","7.2.0 and later include hardening for CVE-2026-102489; 7.0 and later not affected in practice","6.5.5 emergency release, flaw not named"],"started":"2026-10-02","closed":null,"updated":"2026-11-03T21:59:30.830Z","url":"https://hard.fyi/live/zammad-helpdesk-zero-days-divd-breach-oct-2026/","json":"https://hard.fyi/api/live?id=zammad-helpdesk-zero-days-divd-breach-oct-2026"},{"id":"fortimail-ibe-path-traversal-oct-2026","category":"patch","status":"live","title":"Fortinet FortiMail unauthenticated file-write flaw CVE-2026-104286 exploited; fixes for 7.4, 7.6, 8.0","tldr":"Fortinet FortiMail email gateways have a critical flaw (CVE-2026-104286) that lets anyone on the internet write files without logging in. It is being exploited. Update to 8.0.2, 7.6.7 or 7.4.9; 7.2 awaits 7.2.10 and 7.0 has no fix. Cloud is already fixed.","action":"If you or your business run FortiMail, upgrade to 8.0.2, 7.6.7 or 7.4.9, and check the advisory for compromise indicators. Until then, turn off the IBE service and keep the webmail interface off the internet; ask your IT provider if unsure. Home users have nothing to do.","product":"Fortinet FortiMail email security gateway (8.0, 7.6, 7.4, 7.2, 7.0)","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-104286"],"tags":["fortinet","fortimail","path-traversal","zero-day","email-gateway","cisa-kev","exploited"],"fixed":["FortiMail 8.0.2","FortiMail 7.6.7","FortiMail 7.4.9","FortiMail 7.2.10 (upcoming)","FortiMail Cloud (remediated by Fortinet 2026-10-05)"],"started":"2026-10-01","closed":null,"updated":"2026-11-03T21:59:14.844Z","url":"https://hard.fyi/live/fortimail-ibe-path-traversal-oct-2026/","json":"https://hard.fyi/api/live?id=fortimail-ibe-path-traversal-oct-2026"},{"id":"check-point-ikev1-vpn-auth-bypass-jun-2026","category":"patch","status":"live","title":"Check Point Security Gateway VPN sign-in bypass (CVE-2026-50751) exploited, including by a Qilin ransomware affiliate","tldr":"Check Point firewalls with IKEv1 remote-access VPN can be logged into without a valid password (CVE-2026-50751). Used in attacks since 7 May, including a Qilin ransomware case. Install Check Point's hotfix or disable IKEv1/legacy clients, then check logs from 7 May.","action":"If you run a Check Point gateway, install the fix for your version (for example R82.10 Take 24, R82 Take 107, R81.20 Take 146 or R81.10 Take 187) or apply Check Point's workarounds, and review VPN logs since 7 May 2026. Otherwise, nothing for you to do; ask your IT provider if unsure.","product":"Check Point Security Gateways and Spark firewalls (remote access VPN / Mobile Access)","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-50751","CVE-2026-50752"],"tags":["check-point","vpn","firewall","ikev1","authentication-bypass","ransomware","qilin","actively-exploited"],"fixed":["R82.10 Take 24","R82 Take 107","R81.20 Take 146","R81.10 Take 187","Spark R82.00.10 Build 998002216","Spark R81.10.17 Build 996004901"],"started":"2026-06-08","closed":null,"updated":"2026-11-03T21:47:04.465Z","url":"https://hard.fyi/live/check-point-ikev1-vpn-auth-bypass-jun-2026/","json":"https://hard.fyi/api/live?id=check-point-ikev1-vpn-auth-bypass-jun-2026"},{"id":"php-php2shell-emergency-patches-oct-2026","category":"patch","status":"live","title":"PHP2Shell flaws exploited: emergency PHP fixes released, but product updates and a follow-up fix remain","tldr":"PHP2Shell lets attackers run code on vulnerable web servers without logging in. The original two flaws have PHP fixes, but bundled-product updates remain uneven and a separate follow-up awaits release. Ask your website host or IT team to confirm protection.","action":"If you own a website, ask its host or IT team to confirm the running web server uses PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later, or a supplier-confirmed backported fix, and that every PHP worker has been restarted. Also ask them to apply PHP's session.upload_progress.enabled=0 advice for the follow-up issue until its fix arrives. Ordinary website visitors have no PHP update to install.","product":"PHP web servers and products that bundle PHP","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-109618","CVE-2026-109619","CVE-2026-115560"],"tags":["php","php2shell","remote-code-execution","actively-exploited","web-server"],"fixed":["PHP 8.2.35 — CVE-2026-109618 and CVE-2026-109619","PHP 8.3.36 — CVE-2026-109618 and CVE-2026-109619","PHP 8.4.27 — CVE-2026-109618 and CVE-2026-109619","PHP 8.5.12 — CVE-2026-109618 and CVE-2026-109619","PHP 8.6.0 RC4 — fixes both original flaws in the development branch; PHP warns against production use"],"started":"2026-10-20","closed":null,"updated":"2026-11-03T20:50:55.705Z","url":"https://hard.fyi/live/php-php2shell-emergency-patches-oct-2026/","json":"https://hard.fyi/api/live?id=php-php2shell-emergency-patches-oct-2026"},{"id":"linux-copy-fail-takeover-apr-2026","category":"patch","status":"live","title":"Linux Copy Fail flaw CVE-2026-31431 used in attacks to gain full control","tldr":"Copy Fail lets someone already running code on an affected Linux machine gain administrator control. Attackers are using it. Install your distribution's kernel security updates and restart; some specialist kernels still lack a fix.","action":"If you use Linux, install all kernel security updates through your distribution's normal updater, then restart the computer. Ask whoever manages your business servers or cloud systems to confirm that the running kernel fixes CVE-2026-31431; where a fix remains unavailable, they should apply the distribution's temporary mitigation.","product":"Linux kernel on Linux computers, servers and container hosts","audience":"both","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2026-31431"],"tags":["linux","kernel","copy-fail","privilege-escalation","actively-exploited"],"fixed":["Upstream Linux 5.10.254","Upstream Linux 5.15.204","Upstream Linux 6.1.170","Upstream Linux 6.6.137","Upstream Linux 6.12.85","Upstream Linux 6.18.22","Upstream Linux 6.19.12","Upstream Linux 7.0","Ubuntu 22.04 LTS standard kernel: 5.15.0-179.189","Ubuntu 22.04 LTS HWE kernel: 6.8.0-117.117~22.04.1","Ubuntu 24.04 LTS standard kernel: 6.8.0-117.117","Ubuntu 24.04 LTS HWE kernel: 6.17.0-29.29~24.04.1"],"started":"2026-05-01","closed":null,"updated":"2026-11-03T22:28:09.720Z","url":"https://hard.fyi/live/linux-copy-fail-takeover-apr-2026/","json":"https://hard.fyi/api/live?id=linux-copy-fail-takeover-apr-2026"},{"id":"linux-watch-queue-exploited-aug-2026","category":"patch","status":"live","title":"Linux kernel CVE-2022-0995 used in attacks; fixes available, but some Ubuntu kernels remain vulnerable","tldr":"CISA confirms attacks using Linux kernel flaw CVE-2022-0995. Someone already able to run code locally could gain higher privileges or crash the machine. Install your Linux vendor's kernel update and restart; some older Ubuntu kernels remain vulnerable.","action":"If you use Linux, install your distribution's kernel security updates and restart. For Ubuntu 22.04's standard 5.15 kernel, use package version 5.15.0-138.148 or later; Ubuntu 20.04's 5.15 hardware-enablement kernel needs 5.15.0-138.148~20.04.1 or later. If your kernel is still listed as vulnerable, ask your IT provider to move you to a fixed kernel or unaffected supported release.","product":"Linux kernel (watch_queue event notification subsystem)","audience":"both","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2022-0995"],"tags":["linux","kernel","ubuntu","privilege-escalation","actively-exploited"],"fixed":["Linux 5.17-rc8 (upstream fix identified by Red Hat)","Ubuntu 22.04 LTS linux: 5.15.0-138.148","Ubuntu 20.04 LTS linux-hwe-5.15: 5.15.0-138.148~20.04.1"],"started":"2026-08-26","closed":null,"updated":"2026-11-03T22:13:48.808Z","url":"https://hard.fyi/live/linux-watch-queue-exploited-aug-2026/","json":"https://hard.fyi/api/live?id=linux-watch-queue-exploited-aug-2026"},{"id":"linux-kernel-tls-algif-ebtables-kev-sep-2026","category":"patch","status":"live","title":"Linux kernel: three flaws in TLS, crypto sockets and ebtables used in attacks (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266)","tldr":"CISA says attackers are using three Linux kernel flaws (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266). Kernel fixes exist, but coverage varies by distribution and device. Update your Linux system, router or appliance firmware; ask the vendor if unsure.","action":"Install your Linux distribution's latest kernel update and restart. For routers, NAS boxes and appliances built on Linux, install the maker's newest firmware, and if the device is no longer supported, plan to replace it.","product":"Linux kernel (including distributions and devices that ship it, such as Siemens SIMATIC CN 4100)","audience":"both","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2025-39682","CVE-2025-39964","CVE-2026-53266"],"tags":["linux","linux-kernel","kev","cisa","privilege-escalation","tls","netfilter","exploited"],"fixed":["Upstream Linux stable-tree fixes (per-CVE commits)","Siemens SIMATIC CN 4100 V5.0"],"started":"2026-09-18","closed":null,"updated":"2026-11-03T22:08:00.336Z","url":"https://hard.fyi/live/linux-kernel-tls-algif-ebtables-kev-sep-2026/","json":"https://hard.fyi/api/live?id=linux-kernel-tls-algif-ebtables-kev-sep-2026"},{"id":"moonwell-mamo-collateral-theft-aug-2026","category":"breach","status":"live","title":"Moonwell MAMO manipulation enables US$11.03 million borrowing; supplier recovery remains unresolved","tldr":"An attacker used inflated MAMO collateral to borrow US$11.03 million from Moonwell on Base, leaving about US$9.13 million in debt after liquidations. Supplier recovery remains unresolved. Check affected positions with Moonwell before adding funds.","action":"If you supplied funds to Moonwell on Base, directly or through Mamo, check your position and available withdrawals through the official service and ask support about your market’s recovery status. Avoid adding funds until you understand the remaining debt and withdrawal restrictions; there is no device update to install.","product":"Moonwell lending markets on Base, including the MAMO collateral market","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["moonwell","mamo","base","crypto-theft","defi","oracle-manipulation"],"fixed":[],"started":"2026-08-27","closed":null,"updated":"2026-11-03T21:57:00.660Z","url":"https://hard.fyi/live/moonwell-mamo-collateral-theft-aug-2026/","json":"https://hard.fyi/api/live?id=moonwell-mamo-collateral-theft-aug-2026"},{"id":"saga-sagaevm-unbacked-mint-theft-jan-2026","category":"breach","status":"live","title":"Saga's SagaEVM chain loses about US$7 million to unbacked stablecoin minting; chain being shut down","tldr":"Attackers abused a flaw in SagaEVM's inherited Ethermint code to mint Saga Dollars without backing and took about US$7M on 21 Jan 2026. No recovery reported. SagaEVM is reportedly shutting down 23 Nov 2026: if you hold assets on it, withdraw them.","action":"If you hold any assets on SagaEVM, including Saga Dollar, withdraw them before the reported 23 November 2026 shutdown, and check Saga's official channels first. Otherwise nothing for you to do.","product":"Saga SagaEVM chain and Saga Dollar stablecoin","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["saga","sagaevm","crypto","defi","stablecoin","ethermint","bridge","theft"],"fixed":[],"started":"2026-01-21","closed":null,"updated":"2026-11-03T21:51:44.561Z","url":"https://hard.fyi/live/saga-sagaevm-unbacked-mint-theft-jan-2026/","json":"https://hard.fyi/api/live?id=saga-sagaevm-unbacked-mint-theft-jan-2026"},{"id":"ahold-delhaize-supermarket-cyberattack-oct-2026","category":"breach","status":"live","title":"Ahold Delhaize cyberattack disrupts supermarket websites, apps and grocery orders","tldr":"Ahold Delhaize’s cyberattack disrupted supermarket apps and orders across Europe and the US. Services returned in stages, but a group-wide all-clear remains unconfirmed. Check orders and refunds directly through your supermarket.","action":"Check your order, refund and any compensation by opening your supermarket’s app or website directly. Albert Heijn says cancelled-order credits are applied automatically; use its official customer service if a refund is missing. Be cautious of messages asking you to follow a link to claim compensation.","product":"Ahold Delhaize supermarket websites, apps and online ordering services across Europe and the US","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["ahold-delhaize","supermarkets","cyberattack","service-disruption","online-shopping"],"fixed":[],"started":"2026-10-11","closed":null,"updated":"2026-11-03T21:46:56.802Z","url":"https://hard.fyi/live/ahold-delhaize-supermarket-cyberattack-oct-2026/","json":"https://hard.fyi/api/live?id=ahold-delhaize-supermarket-cyberattack-oct-2026"},{"id":"bonzo-lend-oracle-theft-jul-2026","category":"breach","status":"live","title":"Bonzo Lend loses US$9.05 million through false token price; user recovery remains incomplete","tldr":"Bonzo Lend users face losses after a false price feed enabled US$9.05 million in borrowing. The verifier was fixed, but recovery remains incomplete. Claims are targeted for the week of 9 November; wait for official instructions.","action":"If you supplied assets to Bonzo Lend, wait for the confirmed claims opening and use instructions reached through Bonzo’s official website. Read the recovery terms before claiming: they will include a release of claims relating to the incident and recovery. Never share your wallet recovery phrase or private keys.","product":"Bonzo Lend crypto lending service on Hedera","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["bonzo","hedera","supra","crypto-theft","defi","oracle-manipulation"],"fixed":[],"started":"2026-07-11","closed":null,"updated":"2026-11-03T21:44:45.485Z","url":"https://hard.fyi/live/bonzo-lend-oracle-theft-jul-2026/","json":"https://hard.fyi/api/live?id=bonzo-lend-oracle-theft-jul-2026"},{"id":"burger-king-japan-app-breach-oct-2026","category":"breach","status":"live","title":"Burger King Japan app breach exposes approximately 11.18 million membership records","tldr":"Attackers accessed Burger King Japan’s app membership system on 2–7 October, exposing about 11.18 million records. Card numbers were not held there; password leakage was not confirmed. Watch for impersonation emails, texts and calls.","action":"If you used Burger King Japan’s official app, watch for emails, texts or calls impersonating the company. Do not open suspicious links or attachments or provide membership details or passwords; check any notice through the official app or website directly. There is no customer software patch identified for this breach.","product":"Burger King Japan official app membership service","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["burger-king","japan","data-breach","personal-data","mobile-app"],"fixed":[],"started":"2026-10-02","closed":null,"updated":"2026-11-03T21:37:51.260Z","url":"https://hard.fyi/live/burger-king-japan-app-breach-oct-2026/","json":"https://hard.fyi/api/live?id=burger-king-japan-app-breach-oct-2026"},{"id":"quest-diagnostics-quanum-lsm-breach-oct-2026","category":"breach","status":"live","title":"Quest Diagnostics confirms intruder accessed patient records through Quanum Lab Services Manager","tldr":"Quest Diagnostics says an intruder accessed patient records in Quanum LSM, the system clients use to order tests and get results. Quest says it is remediated, but the data and patient count are unknown. Watch for phishing and wait for a Quest letter.","action":"You don't need to do anything yet. Watch for a Quest letter, and treat unexpected calls, texts or emails about lab results, breach notices or credit monitoring as possible scams. Check them by contacting Quest directly through its website.","product":"Quest Diagnostics Quanum Lab Services Manager (LSM)","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["quest-diagnostics","data-breach","healthcare","patient-records","quanum","lab-results","sec-filing"],"fixed":[],"started":"2026-10-22","closed":null,"updated":"2026-11-03T21:37:46.659Z","url":"https://hard.fyi/live/quest-diagnostics-quanum-lsm-breach-oct-2026/","json":"https://hard.fyi/api/live?id=quest-diagnostics-quanum-lsm-breach-oct-2026"},{"id":"cedar-county-hospital-cyberattack-aug-2026","category":"breach","status":"live","title":"Cedar County Memorial Hospital cyberattack: records restored after two weeks; patient-data review continues","tldr":"Cedar County Memorial Hospital restored electronic records on 28 August after a two-week outage. Unauthorised access is confirmed; patient-data exposure remains under review. Patients concerned they were affected can request free credit monitoring.","action":"If you or a relative used this hospital and believe you may be affected, call its incident helpline on 1-844-772-1430 to ask about free credit monitoring and identity protection. Review medical bills, insurance benefit statements and credit reports for unfamiliar activity. There is no device update to install for this incident.","product":"Cedar County Memorial Hospital and Medical Mall Clinic patient services","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["cedar-county-memorial-hospital","healthcare","cyberattack","extortion","patient-data"],"fixed":[],"started":"2026-08-14","closed":null,"updated":"2026-11-03T21:35:09.791Z","url":"https://hard.fyi/live/cedar-county-hospital-cyberattack-aug-2026/","json":"https://hard.fyi/api/live?id=cedar-county-hospital-cyberattack-aug-2026"},{"id":"polymarket-website-crypto-theft-jun-2026","category":"breach","status":"live","title":"Polymarket website compromise steals about US$3 million; full reimbursement remains unconfirmed","tldr":"A compromised website supplier let attackers steal about US$3 million from Polymarket customers. Polymarket said it removed the malicious code and would refund victims. Check June account activity and contact support about losses or unpaid refunds.","action":"If you used Polymarket around 25 June, check your wallet and trading history for unrecognised activity and contact Polymarket support about any loss or outstanding reimbursement. There is no device or app update to install for this website incident.","product":"Polymarket website and customer crypto wallets","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["polymarket","crypto","theft","supply-chain","website-compromise"],"fixed":[],"started":"2026-06-25","closed":null,"updated":"2026-11-03T21:34:53.828Z","url":"https://hard.fyi/live/polymarket-website-crypto-theft-jun-2026/","json":"https://hard.fyi/api/live?id=polymarket-website-crypto-theft-jun-2026"},{"id":"sony-sonet-customer-breach-oct-2026","category":"breach","status":"live","title":"Sony So-net breach exposes 2.58 million customer records and 54,401 email passwords","tldr":"Sony’s Japanese So-net service lost 2,585,481 customer records, including plala (S Course) customers, plus 54,401 email credentials. Affected email users must reset their passwords through So-net’s official website. Watch for impersonation scams.","action":"If you use Email Service (G), A-Box, So-net VAIO Mail or PostPet Mail Account Service, open So-net’s official website yourself and follow its breach FAQ to reset your email password, then update it in your email app. Check My Page for individual notices. Treat unexpected calls, texts and emails claiming to be So-net or Docomo cautiously; avoid their links and attachments.","product":"Sony So-net internet and email services; Docomo Hikari plala (S Course), Japan","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["sony","so-net","docomo","japan","data-breach","passwords"],"fixed":[],"started":"2026-10-19","closed":null,"updated":"2026-11-03T21:30:40.519Z","url":"https://hard.fyi/live/sony-sonet-customer-breach-oct-2026/","json":"https://hard.fyi/api/live?id=sony-sonet-customer-breach-oct-2026"},{"id":"firefox-extensions-wallet-theft-factory-aug-2026","category":"supply-chain","status":"live","title":"Firefox extension network steals wallet recovery phrases, credentials and clipboard data","tldr":"Socket found 77 linked Firefox add-ons; 40 were confirmed wallet stealers. Some began harmless and turned malicious via updates. 16 more followed in October. If you entered a recovery phrase in one, move funds to a new wallet. Remove unfamiliar wallet extensions.","action":"If you installed a wallet or utility add-on in Firefox that you don't recognise, remove it. If you ever typed a recovery phrase or private key into one, move your funds to a new wallet with a new phrase, created on a clean device.","product":"Mozilla Firefox add-ons (crypto wallet and utility extensions)","audience":"home","severity":"high","patch":"partial","exploited":true,"cves":[],"tags":["firefox","browser-extension","supply-chain","crypto","wallet","rabby","okx","mozilla"],"fixed":[],"started":"2026-08-19","closed":null,"updated":"2026-11-03T21:26:18.107Z","url":"https://hard.fyi/live/firefox-extensions-wallet-theft-factory-aug-2026/","json":"https://hard.fyi/api/live?id=firefox-extensions-wallet-theft-factory-aug-2026"},{"id":"ostium-liquidity-vault-theft-jul-2026","category":"breach","status":"live","title":"Ostium vault loses 23.75 million USDC through fraudulent prices; recovery remains incomplete","tldr":"Attackers stole 23.75 million USDC from Ostium’s liquidity vault; trader collateral was unaffected. Trading resumed, but compensation remains incomplete. Affected vault holders should check the official recovery portal and read its release terms.","action":"If you held Ostium liquidity-vault shares during the theft, check the Recovery Portal at https://app.ostium.com/vault; claims for verified losses of up to 1,000 USDC remain available until 29 December 2026 at 23:59 UTC. Larger holders who did not accept the settlement were due to enter Stage 2 automatically: read the full-release terms before any first redemption, for which Ostium says there is no deadline. Ignore recovery messages asking for your seed phrase, private keys or funds.","product":"Ostium public liquidity-provider vault (OLP) on Arbitrum","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["ostium","arbitrum","crypto","defi","crypto-theft","key-compromise"],"fixed":[],"started":"2026-07-15","closed":null,"updated":"2026-11-03T21:25:40.095Z","url":"https://hard.fyi/live/ostium-liquidity-vault-theft-jul-2026/","json":"https://hard.fyi/api/live?id=ostium-liquidity-vault-theft-jul-2026"},{"id":"android-qualcomm-display-zero-day-mar-2026","category":"patch","status":"live","title":"Android March 2026 update fixes exploited Qualcomm chip flaw CVE-2026-21385","tldr":"Google's March 2026 Android update fixes CVE-2026-21385, a Qualcomm memory flaw possibly used in limited, targeted attacks. CISA lists it as exploited. Install updates until your phone shows a security patch level of 2026-03-05 or later.","action":"Open Settings, then Security or System update, and install any available Android update until your security patch level reads 2026-03-05 or later. If your phone's maker has stopped issuing updates, consider replacing it, especially for executives or anyone likely to be targeted.","product":"Android phones and tablets with Qualcomm chipsets","audience":"both","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2026-21385"],"tags":["android","qualcomm","zero-day","exploited","cisa-kev","memory-corruption","mobile"],"fixed":["Android security patch level 2026-03-05 or later"],"started":"2026-03-02","closed":null,"updated":"2026-11-03T21:22:53.279Z","url":"https://hard.fyi/live/android-qualcomm-display-zero-day-mar-2026/","json":"https://hard.fyi/api/live?id=android-qualcomm-display-zero-day-mar-2026"},{"id":"midnight-mimosa-android-firmware-malware-oct-2026","category":"supply-chain","status":"live","title":"Midnight Mimosa malware preinstalled in firmware of cheap Android phones; fixes only from some makers","tldr":"Bitdefender found Midnight Mimosa malware preinstalled in cheap MediaTek Android phones (Doogee, Cubot, fake-brand clones) in 150+ countries. It can silently install apps and use the phone as a proxy. Can't be uninstalled; check for a maker firmware update or replace the phone.","action":"If you own a budget Android phone, especially a Doogee, Cubot or a lookalike of a famous brand, check for a firmware update from the maker and consider replacing a phone you can't verify. Don't use it for banking or sensitive accounts until it's confirmed clean.","product":"Low-cost Android phones on MediaTek chips (e.g. Doogee S200 X, Cubot KINGKONG X, counterfeit-brand phones)","audience":"home","severity":"high","patch":"partial","exploited":true,"cves":[],"tags":["android","firmware","supply-chain","preinstalled-malware","residential-proxy","ad-fraud","mediatek","bitdefender"],"fixed":[],"started":"2026-10-08","closed":null,"updated":"2026-11-03T21:21:24.032Z","url":"https://hard.fyi/live/midnight-mimosa-android-firmware-malware-oct-2026/","json":"https://hard.fyi/api/live?id=midnight-mimosa-android-firmware-malware-oct-2026"},{"id":"loblaw-two-million-customer-breach-mar-2026","category":"breach","status":"live","title":"Loblaw breach exposes personal information of approximately two million Canadians","tldr":"A Loblaw breach affected approximately two million Canadians, exposing varying combinations of contact, birth date, loyalty, purchase and partial card details. Check your individual notice, verify unexpected messages and use the identity protection offered.","action":"Read your individual notice to see which information was involved, and take up the free TransUnion credit monitoring and identity protection if offered. Verify unexpected breach messages through Loblaw’s official website or independently obtained contact details before sharing information or following links. Review account statements and report unfamiliar activity directly to the account provider.","product":"Loblaw customer accounts and services, including PC Optimum","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["loblaw","pc-optimum","canada","data-breach","personal-data"],"fixed":[],"started":"2026-03-10","closed":null,"updated":"2026-11-03T21:20:00.294Z","url":"https://hard.fyi/live/loblaw-two-million-customer-breach-mar-2026/","json":"https://hard.fyi/api/live?id=loblaw-two-million-customer-breach-mar-2026"},{"id":"candiru-adfection-spyware-ads-oct-2026","category":"breach","status":"live","title":"Candiru spyware infected Al Jazeera devices through no-click advertisements: AdFection","tldr":"Targeted advertisements delivered Candiru spyware to Al Jazeera devices without a click. Advertising platforms restricted Discover-Tech, but no complete remedy is confirmed. Block ads and seek specialist help if you face targeted surveillance.","action":"Use a trusted browser ad blocker and disable mobile ad tracking to reduce exposure. If your work or public profile puts you at risk of targeted surveillance, ask your security team or a spyware specialist for help; advertising-platform blocks do not clean an infected device.","product":"Al Jazeera devices; websites and mobile apps displaying Discover-Tech advertisements","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["candiru","adfection","spyware","zero-click","malvertising","al-jazeera"],"fixed":[],"started":"2026-10-15","closed":null,"updated":"2026-11-03T21:18:17.119Z","url":"https://hard.fyi/live/candiru-adfection-spyware-ads-oct-2026/","json":"https://hard.fyi/api/live?id=candiru-adfection-spyware-ads-oct-2026"},{"id":"google-pixel-modem-zero-day-sep-2026","category":"patch","status":"live","title":"Google Pixel modem zero-day CVE-2026-58704 fixed; wider device patch coverage unclear","tldr":"Google fixed an exploited Pixel modem flaw that needs no user interaction or prior privileges. Install the latest Pixel update and check for security patch level 2026-09-05 or later. Fix coverage for other devices using affected Samsung chips is unconfirmed.","action":"On a Pixel, open Settings → System → Software update and install the latest update; check that the Android security update date is 5 September 2026 or later. For another device using an affected Samsung chip, ask its manufacturer whether its firmware fixes CVE-2026-58704.","product":"Google Pixel phones and Samsung Exynos cellular modems","audience":"home","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2026-58704"],"tags":["google","pixel","android","samsung","modem","zero-day"],"fixed":["Google Pixel security patch level 2026-09-05 or later"],"started":"2026-09-15","closed":null,"updated":"2026-11-03T21:05:31.443Z","url":"https://hard.fyi/live/google-pixel-modem-zero-day-sep-2026/","json":"https://hard.fyi/api/live?id=google-pixel-modem-zero-day-sep-2026"},{"id":"apple-spyware-threat-notifications-aug-2026","category":"breach","status":"live","title":"Apple warns targeted users in 110 countries about mercenary spyware","tldr":"Apple sent spyware warnings to targeted users in 110 countries on 13 August. A warning establishes targeting, not successful infection. Verify it at account.apple.com, update your devices, enable Lockdown Mode and seek specialist help.","action":"If you received a warning, type account.apple.com into your browser and sign in to verify it. Update your Apple devices, then on iPhone or iPad open Settings → Privacy & Security → Lockdown Mode → Turn On Lockdown Mode and follow the restart prompts. Seek specialist security help; Apple recommends Access Now’s Digital Security Helpline.","product":"Apple iPhone users receiving mercenary spyware threat notifications","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["apple","iphone","spyware","targeted-attacks","threat-notifications"],"fixed":[],"started":"2026-08-13","closed":null,"updated":"2026-11-03T20:59:44.314Z","url":"https://hard.fyi/live/apple-spyware-threat-notifications-aug-2026/","json":"https://hard.fyi/api/live?id=apple-spyware-threat-notifications-aug-2026"},{"id":"gyazo-account-image-data-breach-sep-2026","category":"breach","status":"live","title":"Gyazo breach exposes 23.62 million account records; 432 image files confirmed accessed","tldr":"Gyazo’s breach affected account records and image metadata, including location data and extracted text. Some images were accessed. Change your Gyazo password and similar passwords elsewhere; review older images before restoring sharing.","action":"If you have not changed your Gyazo password since the breach, change it now, along with any identical or similar passwords elsewhere. Review older images and their visibility settings before selecting “Resume delivery”. Be wary of breach-related messages: Helpfeel says its notification emails will not ask you to follow links or act on linked websites.","product":"Gyazo screenshot, video and image-sharing service","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["gyazo","helpfeel","data-breach","privacy","account-data","image-sharing"],"fixed":[],"started":"2026-09-11","closed":null,"updated":"2026-11-03T20:59:13.794Z","url":"https://hard.fyi/live/gyazo-account-image-data-breach-sep-2026/","json":"https://hard.fyi/api/live?id=gyazo-account-image-data-breach-sep-2026"},{"id":"amadeus-airline-booking-data-breach-oct-2026","category":"breach","status":"live","title":"Amadeus breach exposes airline booking details and some passengers’ passport numbers","tldr":"Unauthorised access at Amadeus exposed airline booking data, including some passport numbers. JAL reports 92,000 affected customers, ANA 37,800 and Cathay 53,000 bookings. Check airline notices and verify unexpected travel messages directly.","action":"No device update is required; Amadeus handled the system changes. Check your airline’s official notice or contact it directly to establish whether your booking and travel-document details were affected. Verify unexpected travel emails, calls or requests for personal or financial information through the airline’s official website or app.","product":"Amadeus airline reservation systems","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["amadeus","airlines","data-breach","passport-data","travel"],"fixed":[],"started":"2026-10-01","closed":null,"updated":"2026-11-03T20:45:50.147Z","url":"https://hard.fyi/live/amadeus-airline-booking-data-breach-oct-2026/","json":"https://hard.fyi/api/live?id=amadeus-airline-booking-data-breach-oct-2026"},{"id":"ummc-ransomware-clinic-closures-feb-2026","category":"breach","status":"live","title":"UMMC ransomware closes 35 Mississippi clinics; personal and medical data exposure notices follow","tldr":"Ransomware closed UMMC's 35 Mississippi clinics in February; normal operations resumed on 2 March. November notices warn of possible personal and medical data exposure. Check any notification and ask UMMC whether you are affected.","action":"If you or a relative may be affected, call UMMC's incident line on +1 844 971 8617. Follow any notification letter, review financial and medical insurance statements, and consider a credit freeze; free credit monitoring is offered when a Social Security number was affected.","product":"University of Mississippi Medical Center hospitals and clinics","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["ummc","ransomware","healthcare","data-breach","mississippi"],"fixed":[],"started":"2026-02-11","closed":null,"updated":"2026-11-03T20:43:14.057Z","url":"https://hard.fyi/live/ummc-ransomware-clinic-closures-feb-2026/","json":"https://hard.fyi/api/live?id=ummc-ransomware-clinic-closures-feb-2026"},{"id":"p3-global-intel-tip-breach-mar-2026","category":"breach","status":"live","title":"P3 Global Intel breach exposes millions of confidential crime and school-safety tip records","tldr":"Hackers copied confidential P3 crime and school-safety data, exposing tipsters and people named in reports. The 8.3 million figure counts records, not people. Ask your programme about exposure; Toronto has paused tips. Never share tip passwords with callers.","action":"If you submitted a P3 tip or believe you were named in one, ask the relevant programme or school about your exposure through its official contact details. Do not share your tip number or password with unsolicited callers. Toronto Crime Stoppers has paused tips; for immediate danger in Canada or the US, call 911.","product":"Navigate360 P3 Global Intel crime and school-safety tip platform","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["navigate360","p3-global-intel","crime-stoppers","data-breach","school-safety","privacy"],"fixed":[],"started":"2026-03-18","closed":null,"updated":"2026-11-03T20:37:21.688Z","url":"https://hard.fyi/live/p3-global-intel-tip-breach-mar-2026/","json":"https://hard.fyi/api/live?id=p3-global-intel-tip-breach-mar-2026"},{"id":"odido-customer-data-theft-feb-2026","category":"breach","status":"live","title":"Odido IT impersonation breach exposed about 6.39 million people’s customer data","tldr":"Attackers posing as IT staff stole data on about 6.39 million current and former Odido and Ben customers. The data was later published. Ask Odido what was exposed and verify unexpected calls and messages through its official app or website.","action":"If you are a current or former Odido or Ben customer, contact Odido through its official website to ask which details were exposed. Treat unexpected messages cautiously, and use ‘Check je Gesprek’ in the Odido app to verify callers claiming to represent Odido. Do not follow texts asking you to verify your identity to prevent your subscription being blocked.","product":"Odido and Ben customer services in the Netherlands","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["odido","ben","netherlands","data-breach","impersonation","shinyhunters"],"fixed":[],"started":"2026-02-05","closed":null,"updated":"2026-11-03T20:23:58.169Z","url":"https://hard.fyi/live/odido-customer-data-theft-feb-2026/","json":"https://hard.fyi/api/live?id=odido-customer-data-theft-feb-2026"},{"id":"aesto-health-patient-breach-jun-2026","category":"breach","status":"live","title":"Aesto Health breach exposes health and identity information of 9.54 million patients","tldr":"Aesto Health’s December 2025 breach affected 9,540,683 patients through their healthcare providers. Information included health, identity and financial details. Check your notice, use the offered protection and consider freezing your US credit files.","action":"If you receive a notice, ask your healthcare provider which information was involved and follow the letter’s instructions for any free identity protection before its enrolment deadline. Consider freezing your US credit files with Equifax, Experian and TransUnion, and check financial accounts for unfamiliar activity. Report suspicious transactions promptly to your bank.","product":"Aesto Health healthcare data migration and archiving services","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["aesto-health","healthcare","data-breach","patient-records","identity-theft","us"],"fixed":[],"started":"2026-06-24","closed":null,"updated":"2026-11-03T20:21:48.835Z","url":"https://hard.fyi/live/aesto-health-patient-breach-jun-2026/","json":"https://hard.fyi/api/live?id=aesto-health-patient-breach-jun-2026"},{"id":"manchester-airports-group-customer-breach-aug-2026","category":"breach","status":"live","title":"Manchester Airports Group breach exposes about 8.7 million customers; stolen data published","tldr":"Attackers stole customer data from Manchester, Stansted and East Midlands airport services and later published it. MAG says everyone affected has been told. Watch for convincing booking-related scams; existing bookings remain valid.","action":"Watch for unexpected emails, texts or calls about airport bookings, and avoid their links and attachments. Verify requests through the airport's website or a contact number you find independently; MAG says it will never unexpectedly request card details, banking information or passwords. Existing bookings remain valid, so you do not need to cancel or rebook because of the breach.","product":"Manchester Airports Group parking, lounge, Fast Track and Wi-Fi services","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["manchester-airports-group","data-breach","customer-data","travel","extortion"],"fixed":[],"started":"2026-08-27","closed":null,"updated":"2026-11-03T20:19:45.742Z","url":"https://hard.fyi/live/manchester-airports-group-customer-breach-aug-2026/","json":"https://hard.fyi/api/live?id=manchester-airports-group-customer-breach-aug-2026"},{"id":"denmark-population-register-breach-oct-2026","category":"breach","status":"live","title":"Denmark's population register breach exposes identifying data on 8.8 million people","tldr":"Denmark's population register exposed names, addresses and CPR identification numbers for about 8.8 million people through misused company access. Access was blocked; investigations continue. Treat callers who know these details with caution.","action":"Never give passwords or other confidential information to an unsolicited caller or email sender, even if they know your name, address and CPR number. For official guidance, visit sikkerdigital.dk or call Denmark's Cyberhotline on +45 33 37 00 37. There is no device update for this breach.","product":"Denmark's Central Population Register (CPR)","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["denmark","cpr","government","data-breach","personal-data"],"fixed":[],"started":"2026-10-05","closed":null,"updated":"2026-11-03T20:18:01.690Z","url":"https://hard.fyi/live/denmark-population-register-breach-oct-2026/","json":"https://hard.fyi/api/live?id=denmark-population-register-breach-oct-2026"},{"id":"gmo-desktop-cloud-breach-oct-2026","category":"breach","status":"live","title":"GMO Onamae.com Desktop Cloud breach: 26,739 servers potentially affected; PC advice revised","tldr":"GMO’s Onamae.com Desktop Cloud breach affects customers using hosted desktops, including FX traders. GMO revised its shutdown advice on 28 October: scan and back up before reusing PCs, reset trading passwords from another device and end all sessions.","action":"If you use Onamae.com Desktop Cloud, check GMO’s official notices: its 28 October update asks you to run a security scan and back up before using your PC again. From a separate device not used for FX trading, change trading-account passwords, ask your broker to end all sessions, check transactions and balances, and enable two-factor authentication where available. Avoid alleged leaked-data sites and anyone asking for payment to recover losses.","product":"GMO Onamae.com Desktop Cloud","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["gmo","onamae","cloud-desktop","data-breach","extortion","forex"],"fixed":[],"started":"2026-10-20","closed":null,"updated":"2026-11-03T18:57:22.947Z","url":"https://hard.fyi/live/gmo-desktop-cloud-breach-oct-2026/","json":"https://hard.fyi/api/live?id=gmo-desktop-cloud-breach-oct-2026"},{"id":"revolve-saved-card-breach-oct-2026","category":"breach","status":"live","title":"Revolve saved-card breach may affect 1.5 million shoppers","tldr":"Revolve says an attacker may have obtained shoppers’ saved card numbers, expiry dates and contact details. A filing tracker puts the potential total at 1.5 million. Check your breach notice, review transactions and contact your card issuer.","action":"If you saved a card with Revolve or FWRD, check your breach notice for the affected card’s last four digits and review its transactions. Call your card issuer using the number on the card to discuss the exposure and whether replacement is appropriate; report any unauthorised charges immediately.","product":"Revolve and FWRD online shopping accounts with saved payment cards","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["revolve","fwrd","data-breach","payment-cards","retail"],"fixed":[],"started":"2026-10-29","closed":null,"updated":"2026-11-03T18:56:02.584Z","url":"https://hard.fyi/live/revolve-saved-card-breach-oct-2026/","json":"https://hard.fyi/api/live?id=revolve-saved-card-breach-oct-2026"},{"id":"videostrong-xcpe-tv-box-backdoor-nov-2026","category":"supply-chain","status":"live","title":"Google disrupts XCPE botnet in 1.3 million Android TV boxes; backdoor remains","tldr":"Google disrupted a botnet in more than 1.3 million Android TV boxes, but infected devices remain backdoored. Videostrong and MECOOL owners should check with their seller, disconnect suspected boxes and seek a replacement or verified clean firmware.","action":"Ask your seller whether your Videostrong-built or MECOOL TV box is implicated in XCPE; a model name alone cannot confirm infection. Disconnect a suspected box from power and the internet, and ask for a replacement or verified clean firmware. Do not treat uninstalling an app or the botnet takedown as proof that the box is safe.","product":"Videostrong-built Android TV boxes, including an infected MECOOL KM9PRO Max","audience":"home","severity":"high","patch":"none","exploited":true,"cves":[],"tags":["videostrong","mecool","android","android-tv","xcpe","botnet","backdoor","supply-chain"],"fixed":[],"started":"2026-11-02","closed":null,"updated":"2026-11-03T18:55:36.478Z","url":"https://hard.fyi/live/videostrong-xcpe-tv-box-backdoor-nov-2026/","json":"https://hard.fyi/api/live?id=videostrong-xcpe-tv-box-backdoor-nov-2026"},{"id":"binance-crypto-theft-oct-2026","category":"breach","status":"live","title":"Binance reopens withdrawals in phases after US$6.3 billion crypto theft","tldr":"Binance is expanding withdrawals after a US$6.34 billion theft. It now reports 98% of affected tokens replenished and says it will cover losses. Customers should check their exact asset and network in Binance’s official app or website.","action":"Open Binance’s official app or website directly and check withdrawal availability for your exact asset and network. Follow its official announcements for replenishment and reimbursement updates; Binance warns that withdrawals may take longer during the rollout. Contact Binance Support through the official service if access remains unavailable.","product":"Binance cryptocurrency exchange","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["binance","crypto","theft","withdrawals","north-korea"],"fixed":[],"started":"2026-10-29","closed":null,"updated":"2026-11-03T18:54:07.992Z","url":"https://hard.fyi/live/binance-crypto-theft-oct-2026/","json":"https://hard.fyi/api/live?id=binance-crypto-theft-oct-2026"},{"id":"florida-student-aid-breach-oct-2026","category":"breach","status":"live","title":"Florida student financial aid breach may expose 4.9 million people’s Social Security numbers","tldr":"Florida says a student financial aid website breach may affect 4.9 million people. Past applicants should check the official notice, review financial accounts and credit reports, and consider a credit freeze or fraud alert.","action":"If you previously applied for financial aid in Florida, check the department’s official breach notice and review your financial accounts and credit reports through AnnualCreditReport.com. Consider a credit freeze or fraud alert with Equifax, Experian and TransUnion. Send questions about whether your details were affected to databreach@fldoe.org.","product":"Florida Student Financial Aid website","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["florida","education","financial-aid","data-breach","identity-theft"],"fixed":[],"started":"2026-10-29","closed":null,"updated":"2026-11-01T16:04:49.293Z","url":"https://hard.fyi/live/florida-student-aid-breach-oct-2026/","json":"https://hard.fyi/api/live?id=florida-student-aid-breach-oct-2026"},{"id":"unm-health-cyberattack-oct-2026","category":"breach","status":"live","title":"UNM Health cyberattack disrupted surgeries, appointments and ambulance access","tldr":"UNM Health's 26 October cyberattack disrupted patient care. UNM says clinical services are restored, although an IT disruption alert remains open. Confirm cancelled care with your clinic and ignore anyone offering attack-related compensation.","action":"Contact your UNM Health clinic through its usual number to confirm or reschedule care cancelled during the disruption; call 911 for emergencies. Do not respond to anyone claiming responsibility or offering compensation, and do not share personal or financial information. Save suspicious messages and report them to the FBI at IC3.gov.","product":"University of New Mexico Health Sciences Center and UNM Health services","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["unm-health","healthcare","cyberattack","service-disruption"],"fixed":[],"started":"2026-10-26","closed":null,"updated":"2026-11-01T14:55:10.772Z","url":"https://hard.fyi/live/unm-health-cyberattack-oct-2026/","json":"https://hard.fyi/api/live?id=unm-health-cyberattack-oct-2026"},{"id":"polymarket-hijacked-script-theft-oct-2026","category":"supply-chain","status":"live","title":"Polymarket traders lose about US$2.7 million through hijacked DebugBear script","tldr":"A hijacked website script stole about US$2.7 million from Polymarket traders. Trading has resumed and refunds are automatic, but reimbursement is not confirmed complete. Check your positions, balances and refund amount.","action":"Check your Polymarket positions, balances and refund amount. Payments are automatic; if yours is missing or incorrect, use the review form linked from Polymarket's official incident page. Reject unexpected wallet signing requests.","product":"Polymarket international website (polymarket.com), through its DebugBear monitoring script","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["polymarket","debugbear","crypto","supply-chain","javascript","wallet-theft"],"fixed":[],"started":"2026-10-29","closed":null,"updated":"2026-11-01T11:22:49.309Z","url":"https://hard.fyi/live/polymarket-hijacked-script-theft-oct-2026/","json":"https://hard.fyi/api/live?id=polymarket-hijacked-script-theft-oct-2026"},{"id":"vmware-aria-command-injection-mar-2026","category":"patch","status":"live","title":"VMware Aria Operations command injection CVE-2026-22719 used in attacks","tldr":"CISA lists VMware Aria Operations flaw CVE-2026-22719 as exploited. It permits commands without a login during support-assisted migration. Ask IT to install the fixed release; older Telco installations need Broadcom's upgrade guidance.","action":"Nothing to update on ordinary family phones or computers: this affects business infrastructure. If your business or family office uses it, ask IT to install Aria Operations 8.18.6 or Cloud Foundation Operations 9.0.2.0, following Broadcom's guidance for bundled products; older Telco installations need support advice. If updating must wait, IT can apply Broadcom's temporary workaround to every Aria Operations node.","product":"VMware Aria Operations and its Cloud Foundation and Telco bundles","audience":"work","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2026-22719"],"tags":["broadcom","vmware","aria-operations","command-injection","actively-exploited"],"fixed":["VMware Aria Operations 8.18.6","VMware Cloud Foundation Operations 9.0.2.0","VMware Cloud Foundation 5.2.3","VMware Cloud Foundation 9.0.2","Telco bundles: VMware Aria Operations 8.18.6, build 25211474, for the upgrade paths listed in KB428241; unlisted TCP/TCI versions require Broadcom support guidance"],"started":"2026-03-03","closed":null,"updated":"2026-11-03T22:29:48.379Z","url":"https://hard.fyi/live/vmware-aria-command-injection-mar-2026/","json":"https://hard.fyi/api/live?id=vmware-aria-command-injection-mar-2026"},{"id":"cisco-ios-csrf-attacks-jul-2026","category":"patch","status":"live","title":"Cisco IOS web administration flaw CVE-2008-4128 used in attacks; no confirmed fixed release","tldr":"Attackers are using an old Cisco IOS 12.4 web administration flaw to run router commands. The software is unsupported and no fixed release is confirmed. Ask your network provider to identify and replace affected equipment.","action":"Ask whoever manages your office or family network to check for Cisco equipment running IOS 12.4 and arrange replacement of unsupported equipment. Have them restrict access to web administration while they resolve it; no exact Cisco-confirmed update for this CVE was found.","product":"Cisco IOS 12.4 router software","audience":"work","severity":"high","patch":"none","exploited":true,"cves":["CVE-2008-4128"],"tags":["cisco","ios","router","csrf","actively-exploited","end-of-life"],"fixed":[],"started":"2026-07-13","closed":null,"updated":"2026-11-03T22:22:21.081Z","url":"https://hard.fyi/live/cisco-ios-csrf-attacks-jul-2026/","json":"https://hard.fyi/api/live?id=cisco-ios-csrf-attacks-jul-2026"},{"id":"palo-alto-globalprotect-authentication-bypass-may-2026","category":"patch","status":"live","title":"Palo Alto Networks GlobalProtect VPN sign-in bypass CVE-2026-0257 exploited by ransomware gangs","tldr":"Attackers are using a GlobalProtect VPN flaw to enter business networks without valid credentials, including for ransomware. Ask IT to install the correct PAN-OS fix, confirm Prisma Access upgrades and investigate suspicious VPN connections.","action":"If your business or family office uses GlobalProtect, ask IT to update every portal and gateway to the fixed release for its branch listed below and confirm the Prisma Access upgrade status. Until updated, administrators should disable Authentication Override in both portal and gateway settings. Ask them to investigate suspicious VPN connections using Unit 42’s guidance.","product":"Palo Alto Networks PAN-OS GlobalProtect VPN and Prisma Access","audience":"work","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2026-0257"],"tags":["palo-alto-networks","pan-os","globalprotect","prisma-access","vpn","authentication-bypass","ransomware"],"fixed":["PAN-OS 12.1: 12.1.4-h6 or 12.1.7 and later, as applicable.","PAN-OS 11.2: 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 or 11.2.12 and later, as applicable.","PAN-OS 11.1: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 or 11.1.15 and later, as applicable.","PAN-OS 10.2: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 or 10.2.18-h6 and later, as applicable.","Prisma Access 10.2: 10.2.10-h36 and later; customer rollout completion unconfirmed.","Prisma Access 11.2: 11.2.7-h13 and later; customer rollout completion unconfirmed."],"started":"2026-05-13","closed":null,"updated":"2026-11-03T22:07:13.512Z","url":"https://hard.fyi/live/palo-alto-globalprotect-authentication-bypass-may-2026/","json":"https://hard.fyi/api/live?id=palo-alto-globalprotect-authentication-bypass-may-2026"},{"id":"cursor-claude-code-backdoor-oct-2026","category":"supply-chain","status":"live","title":"Malicious Claude Code extensions in Cursor planted persistent backdoor components","tldr":"Malicious Claude Code extensions in Cursor potentially exposed up to 5,000 developers. Distribution has stopped, but affected computers need investigation and cleanup: updating or uninstalling the extension alone does not remove its backdoor components.","action":"If anyone in your family uses Cursor with Claude Code, ask their IT team to check for the malicious marketplace builds, including automatic updates. If affected, disconnect the computer and follow Cursor’s macOS or Windows cleanup guidance, remove the unauthorised remote-access components, and rotate accessible credentials and sessions from a trusted device. Updating or uninstalling the extension alone is insufficient.","product":"Claude Code extension in Cursor’s extension marketplace","audience":"work","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["cursor","claude-code","malicious-extension","supply-chain","backdoor","macos","windows"],"fixed":[],"started":"2026-10-29","closed":null,"updated":"2026-11-03T21:58:40.285Z","url":"https://hard.fyi/live/cursor-claude-code-backdoor-oct-2026/","json":"https://hard.fyi/api/live?id=cursor-claude-code-backdoor-oct-2026"},{"id":"ivanti-connect-secure-auth-bypass-oct-2026","category":"patch","status":"live","title":"Ivanti Connect Secure authentication bypass CVE-2026-104935 used in attacks; fixes for most branches","tldr":"Ivanti Connect Secure VPN appliances have a login-bypass flaw (CVE-2026-104935) that lets attackers run commands without an account, and it is being used in attacks. If you run one, update now: 25.1.1.2, 25.1.3.x or 22.8R2.5. Home users are not affected.","action":"If your business runs Ivanti Connect Secure, update to 25.1.1.2, 25.1.3.1 or 22.8R2.5 and run Ivanti's Integrity Checker Tool. If you are on 25.1.2.x, confirm your fixed build with Ivanti. Ask your IT provider if you are unsure.","product":"Ivanti Connect Secure VPN gateway","audience":"work","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2026-104935"],"tags":["ivanti","connect-secure","vpn","authentication-bypass","zero-day","cisa-kev","remote-code-execution"],"fixed":["25.1.1.2","25.1.3.0","25.1.3.1","22.8R2.5"],"started":"2026-10-13","closed":null,"updated":"2026-11-03T21:57:06.952Z","url":"https://hard.fyi/live/ivanti-connect-secure-auth-bypass-oct-2026/","json":"https://hard.fyi/api/live?id=ivanti-connect-secure-auth-bypass-oct-2026"},{"id":"brotli-node2shell-attacks-oct-2026","category":"patch","status":"live","title":"Brotli flaw CVE-2026-111497 exploited as Node.js, .NET and vendor fixes roll out","tldr":"Attackers are targeting a Brotli flaw in business software and potentially WordPress hosting. Ask IT or your website host to patch every affected library and bundled copy, then restart or redeploy services. Some vendor fixes remain pending.","action":"Ask IT to apply vendor fixes, including Node.js 22.23.4, 24.22.1 or 26.12.1 and .NET 8.0.33, 9.0.22, 10.0.14 or 11 RC3, update bundled copies, rebuild affected applications and containers, and restart services. If you run a WordPress website, ask its host to confirm that every Brotli copy used by the site is patched and affected services have been restarted or redeployed. Where updates remain pending, ask the supplier for its recommended temporary protection.","product":"Google Brotli decompression library and software that includes it, including Node.js, Microsoft .NET and some WordPress hosting environments","audience":"work","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2026-111497"],"tags":["google","brotli","nodejs","microsoft","dotnet","actively-exploited","remote-code-execution"],"fixed":["Google Brotli 1.0.10, 1.1.1 and 1.2.1","Node.js 22.23.4, 24.22.1 and 26.12.1","Microsoft .NET 8.0.33, 9.0.22, 10.0.14 and 11.0.0-rc.3.26522.148","Official PHP Windows package rebuilds 8.2.35-1, 8.3.36-1, 8.4.27-1 and 8.5.12-1","Envoy v1.36.12, v1.37.8, v1.38.6, v1.39.3 and v1.40.0","Python Brotli 1.2.1 and brotlicffi 1.2.1.0","PowerShell 7.4.22, 7.5.13 and 7.6.9","Palo Alto Networks Prisma Cloud Application Security Transporter Client 0.2.9","PAN-OS branch-specific fixes: 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4, 11.2.16-h1, 12.1.4-h13, 12.1.7-h11, 12.1.10-h3 and 12.2.4-h1"],"started":"2026-10-21","closed":null,"updated":"2026-11-03T18:54:07.992Z","url":"https://hard.fyi/live/brotli-node2shell-attacks-oct-2026/","json":"https://hard.fyi/api/live?id=brotli-node2shell-attacks-oct-2026"},{"id":"coindcx-tron-deprecated-wallet-theft-oct-2026","category":"breach","status":"live","title":"CoinDCX loses about US$16 million from retired TRON deposit addresses; US$2.2 million frozen","tldr":"Indian exchange CoinDCX lost about US$16M in USDT on 21 Oct from old deposit addresses it said were retired. It says it absorbed the loss and user balances are unaffected; Tether froze about US$2.2M. Customers need not act, but keep funds off any exchange you don't need.","action":"Nothing required if your CoinDCX balances are unchanged; the exchange says users were credited. As a precaution, don't keep more on any exchange than you need, and never send funds to an old deposit address, only to the one shown in the app.","product":"CoinDCX crypto exchange (India)","audience":"home","severity":"medium","patch":"na","exploited":true,"cves":[],"tags":["coindcx","crypto","exchange","tron","usdt","data-breach","india","tether-freeze"],"fixed":[],"started":"2026-10-21","closed":null,"updated":"2026-11-03T21:49:57.547Z","url":"https://hard.fyi/live/coindcx-tron-deprecated-wallet-theft-oct-2026/","json":"https://hard.fyi/api/live?id=coindcx-tron-deprecated-wallet-theft-oct-2026"},{"id":"duelbits-hot-wallet-theft-sep-2026","category":"breach","status":"live","title":"Duelbits crypto casino loses about US$7 million from hot wallets; reopened, cause not published","tldr":"Crypto casino Duelbits lost about US$7M from hot wallets on 24 Sep. It reopened on 27 Sep and says user funds are safe. No cause or recovery has been published. Users: keep only what you're willing to risk on the platform.","action":"If you hold a balance at Duelbits, consider withdrawing what you don't need to keep there, and use a unique password with two-step sign-in. Nothing needs updating on your devices.","product":"Duelbits crypto casino (hot wallets)","audience":"home","severity":"medium","patch":"na","exploited":true,"cves":[],"tags":["duelbits","crypto","hot-wallet","key-compromise","ethereum","bnb-chain","tron","data-breach"],"fixed":[],"started":"2026-09-24","closed":null,"updated":"2026-11-03T21:49:49.615Z","url":"https://hard.fyi/live/duelbits-hot-wallet-theft-sep-2026/","json":"https://hard.fyi/api/live?id=duelbits-hot-wallet-theft-sep-2026"},{"id":"padre-terminal-fake-app-solana-theft-oct-2026","category":"scam","status":"live","title":"Fake Padre Terminal iPhone app on App Store linked to US$23,000 Solana wallet thefts","tldr":"A fake Padre Terminal app on Apple's App Store took imported Solana wallet keys and is linked to about US$23,000 stolen from 27 wallets. Apple removed it. Never import wallet keys into an app; the real Padre/Terminal service is web-only.","action":"Never type or import a wallet's private key or recovery phrase into an app. If you did with a Padre or similar app, move your funds to a new wallet created on a trusted device, and install trading apps only from links on the project's official website.","product":"Fake Padre Terminal app (Apple iPhone App Store) impersonating Padre / Terminal by pump.fun","audience":"home","severity":"medium","patch":"na","exploited":true,"cves":[],"tags":["scam","ios","app-store","solana","crypto","wallet-drainer","padre","fake-app"],"fixed":[],"started":"2026-10-25","closed":null,"updated":"2026-11-03T21:40:17.733Z","url":"https://hard.fyi/live/padre-terminal-fake-app-solana-theft-oct-2026/","json":"https://hard.fyi/api/live?id=padre-terminal-fake-app-solana-theft-oct-2026"},{"id":"chrome-searchjacked-extensions-oct-2026","category":"supply-chain","status":"live","title":"319 Chrome extensions with 13.4 million installs hijack searches; 264 newly found by Socket","tldr":"Socket found 264 more Chrome extensions that redirect searches through the operators' servers, bringing the total to 319 and about 13.4 million installs. Check your extensions list and default search engine, and remove anything you didn't choose.","action":"Open chrome://extensions and remove any extension you don't recognise or didn't choose, especially PDF, \"safe search\" or search tools. Then check Settings > Search engine and reset it to your preferred one. Run a security scan if unsure.","product":"Google Chrome extensions (search-hijacking add-ons)","audience":"both","severity":"medium","patch":"partial","exploited":true,"cves":[],"tags":["chrome","browser-extension","search-hijacking","supply-chain","socket","chrome-web-store","adware"],"fixed":[],"started":"2026-10-29","closed":null,"updated":"2026-11-03T21:34:53.044Z","url":"https://hard.fyi/live/chrome-searchjacked-extensions-oct-2026/","json":"https://hard.fyi/api/live?id=chrome-searchjacked-extensions-oct-2026"},{"id":"collabora-code-server-nextcloud-rce-oct-2026","category":"patch","status":"live","title":"Nextcloud's Built-in CODE Server (Collabora) command injection CVE-2026-110447 used in attacks; update to 26.4.303","tldr":"Attackers are using a critical flaw in Nextcloud's optional Built-in CODE Server app (richdocumentscode) to plant web shells. Update it to 26.4.303 or remove it; disabling is not enough. Check for unknown PHP files if it was exposed.","action":"If you run Nextcloud with the Built-in CODE Server app, update richdocumentscode to 26.4.303 or later in the app store, or remove it; disabling it is not enough. Then look in apps/richdocumentscode/ for PHP files you don't recognise, and ask whoever runs your server to check logs back to 10 September.","product":"Nextcloud Built-in CODE Server app (richdocumentscode, Collabora Online)","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-110447"],"tags":["nextcloud","collabora","richdocumentscode","command-injection","web-shell","cisa-kev","self-hosted"],"fixed":["26.4.303"],"started":"2026-10-23","closed":null,"updated":"2026-11-03T22:05:17.997Z","url":"https://hard.fyi/live/collabora-code-server-nextcloud-rce-oct-2026/","json":"https://hard.fyi/api/live?id=collabora-code-server-nextcloud-rce-oct-2026"},{"id":"plex-plex2shell-server-attacks-oct-2026","category":"patch","status":"live","title":"Plex2Shell attacks hijack Plex Media Server for cryptocurrency mining and proxy traffic","tldr":"Plex2Shell attacks target internet-accessible Plex Media Servers, installing miners and routing strangers’ traffic through victims’ connections. Update to 1.43.3.10861 or later; an already compromised server also needs cleaning or rebuilding.","action":"In Plex Web, open Settings → General and update Plex Media Server to 1.43.3.10861 or later; use Plex’s manual NAS package if needed. If an older server was internet-accessible, ask whoever maintains it to check for compromise and rebuild it cleanly if that cannot be ruled out, then sign out all Plex devices and change your password. Turn off Settings → Remote Access if you do not need it.","product":"Plex Media Server","audience":"home","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-96652","CVE-2026-96654","CVE-2026-96655","CVE-2026-96656"],"tags":["plex","plex-media-server","plex2shell","nas","actively-exploited","cryptomining"],"fixed":["Plex Media Server 1.43.3.10861 and later"],"started":"2026-10-17","closed":null,"updated":"2026-11-03T21:54:08.482Z","url":"https://hard.fyi/live/plex-plex2shell-server-attacks-oct-2026/","json":"https://hard.fyi/api/live?id=plex-plex2shell-server-attacks-oct-2026"},{"id":"cisco-sdwan-authentication-bypass-feb-2026","category":"patch","status":"live","title":"Cisco Catalyst SD-WAN authentication bypass CVE-2026-20127 exploited; fixes available","tldr":"Attackers used a login bypass in Cisco Catalyst SD-WAN business-network systems, later linked to KeyDrift malware designed to collect encryption keys. Fixes are available. Ask IT to update all affected components and investigate any earlier compromise.","action":"If your business or family office uses Cisco Catalyst SD-WAN, ask its IT provider to check Controller, Manager and Validator against the fixed versions below and arrange a Cisco TAC compromise assessment. Have the provider preserve diagnostic evidence before remediation and investigate earlier intrusions even if updates have already been installed.","product":"Cisco Catalyst SD-WAN Controller, Manager and Validator","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-20127"],"tags":["cisco","sd-wan","authentication-bypass","zero-day","actively-exploited","keydrift"],"fixed":["20.9: 20.9.8.2","20.11: migrate to 20.12.6.1","20.12: 20.12.5.3 or 20.12.6.1, according to maintenance branch","20.13, 20.14 and 20.15: 20.15.4.2","20.16 and 20.18: 20.18.2.1","Cisco-hosted CDCS clusters only: 20.15.405 is also fixed"],"started":"2026-02-25","closed":null,"updated":"2026-11-03T22:30:00.465Z","url":"https://hard.fyi/live/cisco-sdwan-authentication-bypass-feb-2026/","json":"https://hard.fyi/api/live?id=cisco-sdwan-authentication-bypass-feb-2026"},{"id":"icagenda-file-upload-attacks-jun-2026","category":"patch","status":"live","title":"iCagenda file-upload flaw CVE-2026-48939 exploited to run code on Joomla websites; fixes available","tldr":"Attackers used iCagenda's event attachments to upload and run malicious files on Joomla websites. The flaw was fixed in June. Website owners should install the current release and check for earlier compromise; visitors have no software to update.","action":"If you own a Joomla website, ask its maintainer to update iCagenda to 4.0.17 or later, or PRO 3.9.17 on Joomla 3, and check the whole site for earlier compromise. Free iCagenda 3.9 is no longer supported; arrange migration to a supported Joomla version. Website visitors have no software to update for this flaw.","product":"iCagenda events-calendar extension for Joomla websites","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-48939"],"tags":["joomlic","icagenda","joomla","file-upload","remote-code-execution","actively-exploited"],"fixed":["iCagenda 4.0.8","iCagenda 3.9.15"],"started":"2026-07-10","closed":null,"updated":"2026-11-03T22:26:05.678Z","url":"https://hard.fyi/live/icagenda-file-upload-attacks-jun-2026/","json":"https://hard.fyi/api/live?id=icagenda-file-upload-attacks-jun-2026"},{"id":"adobe-coldfusion-path-traversal-jul-2026","category":"patch","status":"live","title":"Adobe ColdFusion path traversal CVE-2026-48282 exploited; fixes available","tldr":"Attackers are exploiting CVE-2026-48282 in Adobe ColdFusion website servers. Businesses should install the latest cumulative update: the first fixes were 2025 Update 10 and 2023 Update 21.","action":"Nothing needs updating on ordinary family devices: ColdFusion is website server software. If your business uses it, ask its IT team or hosting provider to install the latest cumulative update, at least ColdFusion 2025 Update 10 or 2023 Update 21, restart it and check for signs of intrusion.","product":"Adobe ColdFusion 2025 and 2023","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-48282"],"tags":["adobe","coldfusion","path-traversal","remote-code-execution","actively-exploited"],"fixed":["ColdFusion 2025 Update 10","ColdFusion 2023 Update 21"],"started":"2026-07-07","closed":null,"updated":"2026-11-03T22:16:55.337Z","url":"https://hard.fyi/live/adobe-coldfusion-path-traversal-jul-2026/","json":"https://hard.fyi/api/live?id=adobe-coldfusion-path-traversal-jul-2026"},{"id":"ibm-langflow-code-injection-jul-2026","category":"patch","status":"live","title":"IBM Langflow code execution flaw CVE-2026-9198 used in attacks; fixed in 1.10.1","tldr":"Attackers are exploiting IBM Langflow OSS 1.0.0–1.10.0 to run code without signing in. Version 1.10.1 fixes this flaw. Ask whoever runs your AI systems to update, investigate exposed servers and replace exposed credentials.","action":"If your business or family office runs Langflow, ask its IT provider to update to the latest release; version 1.10.1 fixes this particular flaw. Have any exposed vulnerable server checked for compromise and replace credentials available to it. Families who do not run Langflow have no direct update to install.","product":"IBM Langflow OSS","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-9198"],"tags":["ibm","langflow","ai","remote-code-execution","actively-exploited"],"fixed":["IBM Langflow OSS 1.10.1"],"started":"2026-08-04","closed":null,"updated":"2026-11-03T22:15:52.637Z","url":"https://hard.fyi/live/ibm-langflow-code-injection-jul-2026/","json":"https://hard.fyi/api/live?id=ibm-langflow-code-injection-jul-2026"},{"id":"cisco-secure-email-gateway-sqli-root-sep-2026","category":"patch","status":"live","title":"Cisco Secure Email Gateway SQL injection CVE-2026-76461 exploited; fixes released, no workaround","tldr":"Cisco Secure Email Gateway flaw CVE-2026-76461 (CVSS 9.8) lets an unauthenticated attacker gain root with a crafted email, and is being used in attacks. Fixed in 15.5.5-014, 16.0.4-302 and 16.5.0-780. No workaround. Businesses running the appliance should update now.","action":"If your organisation runs a Cisco Secure Email Gateway, update to 15.5.5-014, 16.0.4-302 or 16.5.0-780 (16.5.0-780 preferred) and check the mail logs for suspicious SQL. Home users have nothing to do.","product":"Cisco Secure Email Gateway (AsyncOS), physical and virtual","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-76461"],"tags":["cisco","email-gateway","sql-injection","root","zero-day","exploited","cisa-kev","asyncos"],"fixed":["15.5.5-014 (for 15.5 and earlier)","16.0.4-302","16.5.0-780"],"started":"2026-09-14","closed":null,"updated":"2026-11-03T22:08:52.632Z","url":"https://hard.fyi/live/cisco-secure-email-gateway-sqli-root-sep-2026/","json":"https://hard.fyi/api/live?id=cisco-secure-email-gateway-sqli-root-sep-2026"},{"id":"beyondtrust-remote-support-auth-bypass-oct-2026","category":"patch","status":"live","title":"BeyondTrust Remote Support login bypass CVE-2026-102764 exploited since August; patch BT26-05-RS","tldr":"BeyondTrust Remote Support has a critical login-bypass flaw (CVE-2026-102764) attackers used from late August. Cloud customers are already patched. Self-hosted IT teams should apply BT26-05-RS now and check for earlier compromise.","action":"If your business runs a self-hosted BeyondTrust Remote Support or Privileged Remote Access appliance, apply the BT26-05-RS patch now (upgrade first if older than 24.3.1), and ask your IT provider to check for earlier compromise and rotate stored credentials. Cloud-hosted customers need do nothing. Families don't normally run this product.","product":"BeyondTrust Remote Support (and Privileged Remote Access) self-hosted appliances","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-102764"],"tags":["beyondtrust","remote-support","authentication-bypass","zero-day","cisa-kev","armory-castle","self-hosted"],"fixed":["BT26-05-RS patch for Remote Support 24.3.1 to 26.2.3","SaaS tenants patched by BeyondTrust by 8 to 9 October 2026"],"started":"2026-10-15","closed":null,"updated":"2026-11-03T22:06:35.947Z","url":"https://hard.fyi/live/beyondtrust-remote-support-auth-bypass-oct-2026/","json":"https://hard.fyi/api/live?id=beyondtrust-remote-support-auth-bypass-oct-2026"},{"id":"adobe-commerce-magento-file-upload-cve-2026-48356","category":"patch","status":"live","title":"Adobe Commerce and Magento file upload flaw CVE-2026-48356 added to CISA's exploited list; July patches available","tldr":"CISA says attackers are using CVE-2026-48356, a critical file upload flaw in Adobe Commerce and Magento Open Source. Adobe fixed it in July 2026. Store owners should apply the July patch for their version and check for files uploaded earlier, since patching doesn't remove them.","action":"If you run an Adobe Commerce or Magento Open Source shop, apply the July 2026 patch for your version (or upgrade to the latest patch level first) and ask your developer to check for suspicious uploaded files. Shoppers have nothing to update.","product":"Adobe Commerce, Commerce B2B and Magento Open Source (online shop software)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-48356"],"tags":["adobe","magento","adobe-commerce","file-upload","cisa-kev","ecommerce","polyshell"],"fixed":["Adobe Commerce 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul","Adobe Commerce B2B 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul","Magento Open Source 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul","Adobe Commerce Events 1.21.0"],"started":"2026-10-27","closed":null,"updated":"2026-11-03T21:54:13.584Z","url":"https://hard.fyi/live/adobe-commerce-magento-file-upload-cve-2026-48356/","json":"https://hard.fyi/api/live?id=adobe-commerce-magento-file-upload-cve-2026-48356"},{"id":"arista-velocloud-orchestrator-sqli-oct-2026","category":"patch","status":"live","title":"Arista VeloCloud Orchestrator SQL injection CVE-2026-114625 exploited; update on-prem VCO","tldr":"Arista's on-premises VeloCloud Orchestrator has a critical SQL injection flaw (CVE-2026-114625) that attackers are exploiting. Fixes are out: 5.2.3.18, 6.1.3.10 or 6.4.2.12. If you run it, update and limit who can reach its web interface.","action":"If your organisation runs its own VeloCloud Orchestrator, ask your IT team or network provider to update to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later, and to limit web access to trusted admin networks. Home users have nothing to do.","product":"Arista VeloCloud Orchestrator (on-premises)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-114625"],"tags":["arista","velocloud","sd-wan","sql-injection","exploited","cisa-kev","business"],"fixed":["5.2.3.18","6.1.3.10","6.4.2.12"],"started":"2026-10-22","closed":null,"updated":"2026-11-03T21:53:25.457Z","url":"https://hard.fyi/live/arista-velocloud-orchestrator-sqli-oct-2026/","json":"https://hard.fyi/api/live?id=arista-velocloud-orchestrator-sqli-oct-2026"},{"id":"gitlab-regex-compiler-rce-cve-2026-97229-oct","category":"patch","status":"live","title":"GitLab CE/EE critical remote code execution flaw CVE-2026-97229 exploited in attacks; update to 19.4.2, 19.3.5 or 19.2.8","tldr":"GitLab's CVSS 10 flaw CVE-2026-97229 lets anyone run code on a self-managed GitLab server without logging in, and CISA says it's being exploited. Fixed in 19.4.2, 19.3.5 and 19.2.8. If you run your own GitLab, update now. GitLab.com is already patched.","action":"If you or your business run your own GitLab server, update it to 19.4.2, 19.3.5 or 19.2.8 (or later) now, and ask your IT provider to check for signs of attack. If you use GitLab.com, there is nothing to do, as it is already patched.","product":"GitLab Community Edition and Enterprise Edition (self-managed)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-97229"],"tags":["gitlab","rce","kev","cisa","ci-cd","regex","self-hosted","zero-click"],"fixed":["19.2.8","19.3.5","19.4.2"],"started":"2026-10-12","closed":null,"updated":"2026-11-03T21:52:09.173Z","url":"https://hard.fyi/live/gitlab-regex-compiler-rce-cve-2026-97229-oct/","json":"https://hard.fyi/api/live?id=gitlab-regex-compiler-rce-cve-2026-97229-oct"},{"id":"windows-two-exploited-flaws-apr-2026","category":"patch","status":"live","title":"Windows flaws CVE-2023-36424 and CVE-2025-60710 exploited; Task Host flaw used in ransomware","tldr":"Two patched Windows flaws let attackers who already have access gain greater control. CISA confirmed exploitation in April and later flagged ransomware use of CVE-2025-60710. Install current Windows security updates and restart.","action":"Open Settings → Windows Update, check for updates, install available security updates and restart. Ask whoever manages work computers and servers to verify the fixed build for each Windows release; use Microsoft's current build thresholds below rather than relying only on an update's month.","product":"Microsoft Windows 10, Windows 11 and Windows Server","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2023-36424","CVE-2025-60710"],"tags":["microsoft","windows","windows-server","privilege-escalation","ransomware","actively-exploited"],"fixed":["CVE-2023-36424 — Windows 11 21H2: 10.0.22000.2600","CVE-2023-36424 — Windows 11 22H2: 10.0.22621.2715","CVE-2023-36424 — Windows 11 23H2 and Microsoft's ARM64 entry labelled '22H3': 10.0.22631.2715","CVE-2023-36424 — Windows 10 1507: 10.0.10240.20308","CVE-2023-36424 — Windows 10 1607: 10.0.14393.6452","CVE-2023-36424 — Windows 10 1809: 10.0.17763.5122","CVE-2023-36424 — Microsoft lists 10.0.19043.3693 for Windows 10 21H2; verify this inconsistent branch label with Microsoft before using it for device matching","CVE-2023-36424 — Windows 10 22H2: 10.0.19045.3693","CVE-2023-36424 — Windows Server 2008 SP2, including Server Core: 6.0.6003.22367","CVE-2023-36424 — Windows Server 2008 R2 SP1, including Server Core: 6.1.7601.26816","CVE-2023-36424 — Windows Server 2012, including Server Core: 6.2.9200.24569","CVE-2023-36424 — Windows Server 2012 R2, including Server Core: 6.3.9600.21668","CVE-2023-36424 — Windows Server 2016, including Server Core: 10.0.14393.6452","CVE-2023-36424 — Windows Server 2019, including Server Core: 10.0.17763.5122","CVE-2023-36424 — Windows Server 2022: 10.0.20348.2113","CVE-2023-36424 — Windows Server 2022, 23H2 Edition (Server Core installation): 10.0.25398.531","CVE-2025-60710 — Windows 11 24H2: 10.0.26100.7462","CVE-2025-60710 — Windows 11 25H2: 10.0.26200.7462","CVE-2025-60710 — Windows Server 2025, including Server Core: 10.0.26100.7462"],"started":"2026-04-13","closed":null,"updated":"2026-11-03T22:05:24.793Z","url":"https://hard.fyi/live/windows-two-exploited-flaws-apr-2026/","json":"https://hard.fyi/api/live?id=windows-two-exploited-flaws-apr-2026"},{"id":"times-car-member-data-breach-sep-2026","category":"breach","status":"live","title":"Times Car (Park24) breach: data from about 6.6 million accounts stolen, including ID document images","tldr":"Times Car, Japan's car-sharing service, says data from about 6.6 million current and former accounts was stolen, including driver's licence details and ID images. Passwords were stored unreadably and cards were not exposed. Be wary of messages claiming to be Times Car.","action":"If you have or had a Times Car account, treat unexpected emails, texts or calls claiming to be from Times Car with suspicion, and don't open links or enter passwords or card details. Contact Times Car on 0120-25-8924 or through its inquiry form if you have questions about your account.","product":"Times Car car-sharing service (Park24 / Times Mobility, Japan)","audience":"home","severity":"high","patch":"na","exploited":false,"cves":[],"tags":["data-breach","times-car","park24","japan","car-sharing","identity-documents","drivers-licence","phishing-risk"],"fixed":[],"started":"2026-09-25","closed":null,"updated":"2026-11-03T21:21:51.582Z","url":"https://hard.fyi/live/times-car-member-data-breach-sep-2026/","json":"https://hard.fyi/api/live?id=times-car-member-data-breach-sep-2026"},{"id":"windows-lazarus-fudmodule-zero-day-aug-2026","category":"patch","status":"live","title":"Windows zero-day CVE-2026-68820 fixed after Lazarus used it to deploy FudModule rootkit","tldr":"Lazarus used a Windows flaw to turn an existing foothold into SYSTEM-level control and hide malware. Microsoft released fixes on 11 August. Install current Windows updates; defence-sector staff should also report suspicious recruitment downloads to IT.","action":"Open Windows Update, install all available security updates and restart when asked; the fixed builds for each affected release are listed below. For a work computer, ask IT to confirm CVE-2026-68820 is patched. If you installed software supplied through an unexpected recruitment approach, contact IT or a trusted security professional to check the computer for compromise.","product":"Microsoft Windows 10, Windows 11 and Windows Server","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-68820"],"tags":["microsoft","windows","zero-day","lazarus","rootkit","privilege-escalation"],"fixed":["Windows 10 Version 1607: 10.0.14393.9418","Windows 10 Version 1809: 10.0.17763.9121","Windows 10 Version 21H2: 10.0.19044.7663","Windows 10 Version 22H2: 10.0.19045.7663","Windows 11 Version 23H2: 10.0.22631.7517","Windows 11 Version 24H2: 10.0.26100.9168","Windows 11 Version 25H2: 10.0.26200.9168","Windows 11 version 26H1: 10.0.28000.2704","Windows Server 2012, including Server Core: 6.2.9200.26280","Windows Server 2012 R2, including Server Core: 6.3.9600.23338","Windows Server 2016, including Server Core: 10.0.14393.9418","Windows Server 2019, including Server Core: 10.0.17763.9121","Windows Server 2022: 10.0.20348.5499","Windows Server 2025, including Server Core: 10.0.26100.33296"],"started":"2026-08-11","closed":null,"updated":"2026-11-03T21:14:59.549Z","url":"https://hard.fyi/live/windows-lazarus-fudmodule-zero-day-aug-2026/","json":"https://hard.fyi/api/live?id=windows-lazarus-fudmodule-zero-day-aug-2026"},{"id":"linux-qnap-dirty-frag-may-2026","category":"patch","status":"live","title":"Dirty Frag flaws let local users take over Linux computers and QNAP storage devices","tldr":"Dirty Frag lets someone already running code on affected Linux computers or QNAP storage gain full administrator access. Install your Linux distributor's kernel updates and restart; update QNAP firmware. Some specialised Ubuntu kernels still await fixes.","action":"Install your Linux distributor's latest security kernel update and restart the computer; ask your IT provider to check any specialised kernel against both CVEs. For QNAP storage, install the latest firmware offered for your model, or ask whoever manages it to confirm the Dirty Frag fix is included.","product":"Linux computers and servers; QNAP NAS storage devices and QuTScloud","audience":"both","severity":"high","patch":"partial","exploited":false,"cves":["CVE-2026-43284","CVE-2026-43500"],"tags":["linux","ubuntu","qnap","nas","dirty-frag","privilege-escalation"],"fixed":["Ubuntu 18.04 LTS linux 4.15.0-251.263: CVE-2026-43284","Ubuntu 18.04 LTS HWE linux 5.4.0-231.251~18.04.1","Ubuntu 20.04 LTS linux 5.4.0-231.251","Ubuntu 20.04 LTS HWE linux 5.15.0-181.191~20.04.1","Ubuntu 22.04 LTS linux 5.15.0-181.191","Ubuntu 22.04 LTS HWE linux 6.8.0-124.124~22.04.1","Ubuntu 24.04 LTS linux 6.8.0-124.124","Ubuntu 24.04 LTS HWE linux 6.17.0-35.35~24.04.1","Ubuntu 25.10 linux 6.17.0-35.35","Ubuntu 26.04 LTS linux 7.0.0-22.22"],"started":"2026-05-07","closed":null,"updated":"2026-11-03T21:14:56.350Z","url":"https://hard.fyi/live/linux-qnap-dirty-frag-may-2026/","json":"https://hard.fyi/api/live?id=linux-qnap-dirty-frag-may-2026"},{"id":"emudhra-weak-certificate-keys-oct-2026","category":"patch","status":"live","title":"eMudhra weak certificate keys trigger browser blocks; wider software fixes remain incomplete","tldr":"Eight eMudhra certificate keys could be recovered and used to impersonate websites. Major browsers have protections, but some apps still need separate fixes. Update browsers, operating systems and apps; malicious interception remains unconfirmed.","action":"Update all browsers, operating systems and apps. Firefox users need at least desktop 158.0.1, Android 158.0.2, ESR 153.5.1 or ESR 115.43.1, depending on their release branch. Ask your IT provider to check apps and services with their own certificate lists, including built-in macOS command-line tools; updating the browser alone does not cover everything.","product":"eMudhra emSign certificates and browsers, operating systems and apps that trust them","audience":"both","severity":"high","patch":"partial","exploited":false,"cves":["CVE-2026-113470","CVE-2026-111943"],"tags":["emudhra","certificates","firefox","browser","cryptography","go"],"fixed":["Firefox Desktop 158.0.1","Firefox for Android 158.0.2","Firefox ESR 153.5.1","Firefox ESR 115.43.1","NSS 3.131.1","Go 1.27.3","Go 1.26.10"],"started":"2026-10-17","closed":null,"updated":"2026-11-03T21:11:09.478Z","url":"https://hard.fyi/live/emudhra-weak-certificate-keys-oct-2026/","json":"https://hard.fyi/api/live?id=emudhra-weak-certificate-keys-oct-2026"},{"id":"bluemoon-chrome-windows-attacks-aug-2026","category":"patch","status":"live","title":"BlueMoon phishing attacks chained Chrome and Windows zero-days to install espionage malware","tldr":"BlueMoon used phishing links and three Chrome/Windows flaws to install spying malware on targeted Windows PCs. Fixes are available for Chrome, Edge and affected supported Windows versions. Update browsers and Windows; suspected infections need investigation.","action":"Update Chrome through Help → About Google Chrome, or Edge through Help and feedback → About Microsoft Edge, then relaunch; Chrome 153.0.8010.36 and Edge 152.0.4191.66 are the minimum versions covering both browser flaws. Install all available Windows security updates, and ask IT to replace unsupported Windows versions. If you opened a suspicious link or find an unfamiliar Gemini extension, ask IT or a trusted security specialist to investigate: updating does not remove an existing infection.","product":"Google Chrome and Microsoft Edge on Microsoft Windows","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-85046","CVE-2026-87491","CVE-2026-85880"],"tags":["google","chrome","microsoft","windows","zero-day","phishing","espionage","bluemoon"],"fixed":["Chrome 152.0.7977.82/.83 Windows/macOS; 152.0.7977.82 Linux: CVE-2026-85046","Chrome 153.0.8010.36/.37 Windows/macOS; 153.0.8010.36 Linux: CVE-2026-87491","Edge 152.0.4191.62: CVE-2026-85046; 152.0.4191.66: CVE-2026-87491","Windows 10 1607 / Server 2016: 10.0.14393.9512","Windows 10 1809 / Server 2019: 10.0.17763.9245","Windows 10 21H2: 10.0.19044.7725","Windows 10 22H2: 10.0.19045.7725","Windows Server 2012: 6.2.9200.26349","Windows Server 2012 R2: 6.3.9600.23398","Windows Server 2022: 10.0.20348.5622"],"started":"2026-08-28","closed":null,"updated":"2026-11-03T21:07:14.116Z","url":"https://hard.fyi/live/bluemoon-chrome-windows-attacks-aug-2026/","json":"https://hard.fyi/api/live?id=bluemoon-chrome-windows-attacks-aug-2026"},{"id":"viq-australian-court-files-breach-feb-2026","category":"breach","status":"live","title":"VIQ Australian court files accessed by unauthorised offshore transcription staff","tldr":"Australian court files were accessed by unauthorised offshore transcription staff working through VIQ. Its Australian business has wound down, but investigations remain open. If your case used VIQ, ask your lawyer or court registry whether your information was affected.","action":"If your court matter used VIQ transcription, ask your lawyer or the relevant court registry whether your recordings or transcripts were affected and what notification or support is available. Highlight any confidential address, child-safety or family-violence information so they can assess protective steps.","product":"VIQ Solutions Australian court transcription services","audience":"both","severity":"high","patch":"na","exploited":false,"cves":[],"tags":["viq-solutions","australia","courts","data-breach","privacy"],"fixed":[],"started":"2026-02-17","closed":null,"updated":"2026-11-03T21:02:47.983Z","url":"https://hard.fyi/live/viq-australian-court-files-breach-feb-2026/","json":"https://hard.fyi/api/live?id=viq-australian-court-files-breach-feb-2026"},{"id":"apple-coregraphics-targeted-attacks-sep-2026","category":"patch","status":"live","title":"Apple fixes CoreGraphics zero-day CVE-2026-86950 linked to targeted attacks","tldr":"A CoreGraphics flaw could let a malicious file run code on affected iPhones, iPads and Macs. Targeted exploitation was reported. Fixes now include older devices: install the latest Apple software update offered for your device.","action":"On iPhone or iPad, open Settings → General → Software Update and install the latest offered update; the fixes start at 18.7.11 or 26.7.1 for the affected branches. On a Mac, use System Settings → General → Software Update; the fixes start at Sequoia 15.8.1 or Tahoe 26.7.1.","product":"Apple iPhone, iPad and Mac","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-86950"],"tags":["apple","ios","ipados","macos","coregraphics","zero-day"],"fixed":["iOS and iPadOS 18.7.11","iOS and iPadOS 26.7.1","macOS Sequoia 15.8.1","macOS Tahoe 26.7.1"],"started":"2026-09-28","closed":null,"updated":"2026-11-03T20:19:51.150Z","url":"https://hard.fyi/live/apple-coregraphics-targeted-attacks-sep-2026/","json":"https://hard.fyi/api/live?id=apple-coregraphics-targeted-attacks-sep-2026"},{"id":"synology-c3rb3r-ransomware-oct-2026","category":"patch","status":"live","title":"Synology NAS devices hit by C3RB3R ransomware through unpatched DSM flaws","tldr":"Ransomware is targeting Synology NAS storage devices running outdated DSM. Update to the latest DSM your model supports, enable automatic updates and keep the management interface off the public internet. Fixes are available.","action":"Update your Synology NAS to the latest DSM supported by its model and enable automatic updates; ask whoever manages it to check the branch-specific fixes below. Remove public internet access to its management interface. Keep an offline backup disconnected from the NAS.","product":"Synology NAS devices running DiskStation Manager (DSM)","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2024-10441","CVE-2024-50629","CVE-2024-10445","CVE-2026-13639","CVE-2026-13684"],"tags":["synology","nas","dsm","ransomware","actively-exploited"],"fixed":["SA-24:20: DSM 7.2.2-72806-1 or above","SA-24:20: DSM 7.2.1-69057-6 or above","SA-24:20: DSM 7.2-64570-4 or above","SA-24:20: DSM 7.1.1-42962-7 or above","SA-24:20: DSM 6.2.4-25556-8 or above","SA-26:13: DSM 7.4-90075 or above","SA-26:13: DSM 7.3.2-86009-4 or above","SA-26:13: DSM 7.2.2-72806-9 or above","SA-26:13: DSM 7.2.1-69057-12 or above"],"started":"2026-10-29","closed":null,"updated":"2026-11-03T18:56:19.504Z","url":"https://hard.fyi/live/synology-c3rb3r-ransomware-oct-2026/","json":"https://hard.fyi/api/live?id=synology-c3rb3r-ransomware-oct-2026"},{"id":"chrome-four-critical-flaws-oct-2026","category":"patch","status":"live","title":"Chrome fixes four critical flaws, including CVE-2026-118306 sandbox escape","tldr":"Four critical Chrome flaws could let malicious web pages run code, including outside Chrome's protective sandbox. Fixes are available for desktop and Android. Update Chrome and relaunch it; Chromebook users should install the latest ChromeOS update.","action":"On a computer, open Chrome's menu → Help → About Google Chrome, install the latest update and relaunch; the first fixed desktop builds are 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux. Update Chrome on Android through Google Play to 156.0.8078.73 or later. On a Chromebook, install ChromeOS 16836.30.0 or later; ask IT to update managed devices.","product":"Google Chrome on Windows, Mac, Linux and Android; ChromeOS and ChromeOS Flex for CVE-2026-118331","audience":"both","severity":"high","patch":"patched","exploited":false,"cves":["CVE-2026-118306","CVE-2026-118331","CVE-2026-118348","CVE-2026-118344"],"tags":["google","chrome","android","chromeos","browser","code-execution"],"fixed":["Google Chrome 156.0.8078.73/.74 for Windows and Mac","Google Chrome 156.0.8078.73 for Linux","Google Chrome 156.0.8078.73 for Android","ChromeOS and ChromeOS Flex 16836.30.0, browser 156.0.8078.77: explicitly fixes CVE-2026-118331"],"started":"2026-10-27","closed":null,"updated":"2026-11-03T12:31:33.433Z","url":"https://hard.fyi/live/chrome-four-critical-flaws-oct-2026/","json":"https://hard.fyi/api/live?id=chrome-four-critical-flaws-oct-2026"},{"id":"activemq-jolokia-code-execution-apr-2026","category":"patch","status":"live","title":"Apache ActiveMQ Classic code-execution flaw CVE-2026-34197 exploited; follow-up bypasses fixed","tldr":"Attackers used a flaw in Apache ActiveMQ Classic's management interface to run code on business servers. Two later flaws bypassed its original fix. Ask IT to install a current supported release, rather than stopping at the March updates.","action":"Nothing to install on ordinary family phones or computers. If your business or family office runs ActiveMQ Classic, ask IT or the service provider to update to the appropriate current supported release—5.19.12, 6.3.3 or 6.4.0—and check for signs of compromise.","product":"Apache ActiveMQ Classic message broker","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-34197","CVE-2026-40466","CVE-2026-45505"],"tags":["apache","activemq","server","code-execution","exploited","incomplete-fix"],"fixed":["CVE-2026-34197: 5.19.4 and 6.2.3, according to Apache's current advisory.","CVE-2026-40466: 5.19.6 and 6.2.5.","CVE-2026-45505: 5.19.7 and 6.2.6."],"started":"2026-04-06","closed":null,"updated":"2026-11-03T22:24:41.640Z","url":"https://hard.fyi/live/activemq-jolokia-code-execution-apr-2026/","json":"https://hard.fyi/api/live?id=activemq-jolokia-code-execution-apr-2026"},{"id":"kentico-xperience-staging-attacks-apr-2026","category":"patch","status":"live","title":"Kentico Xperience staging flaw CVE-2025-2749 used in attacks; hotfix available","tldr":"Attackers are using a Kentico Xperience website-management flaw that lets someone with privileged staging access run code on the server. Website owners should ask their provider to install Kentico's latest cumulative hotfix and check for compromise.","action":"Nothing to install on your family's devices: this is website-server software. If your family office or business runs a Kentico Xperience website, ask its provider to install the latest cumulative hotfix and check for an existing compromise; Kentico identifies 13.0.178 as the first fixed version.","product":"Kentico Xperience 13 website-management software","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2025-2749"],"tags":["kentico","xperience","cms","path-traversal","remote-code-execution","actively-exploited"],"fixed":["Kentico Xperience 13.0.178, according to Kentico; subsequent hotfixes are cumulative"],"started":"2026-04-20","closed":null,"updated":"2026-11-03T22:23:13.612Z","url":"https://hard.fyi/live/kentico-xperience-staging-attacks-apr-2026/","json":"https://hard.fyi/api/live?id=kentico-xperience-staging-attacks-apr-2026"},{"id":"cisco-asa-ftd-ssl-vpn-dos-cve-2026","category":"patch","status":"live","title":"Cisco ASA and FTD firewalls: SSL VPN crash flaw CVE-2026-76418 exploited; fixes released","tldr":"Cisco says attackers are exploiting CVE-2026-76418, which lets anyone on the internet make ASA and FTD firewalls with SSL VPN reload. Fixed releases are out. Businesses and IT providers should upgrade now; homes are unlikely to run these.","action":"If your business or IT provider runs Cisco ASA or FTD with SSL VPN, upgrade to a fixed release listed in Cisco's advisory; until then, disable secondary authentication on tunnel groups as a stopgap. Families are unlikely to use these devices and need do nothing.","product":"Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-76418"],"tags":["cisco","asa","ftd","firewall","vpn","denial-of-service","zero-day","cisa-kev"],"fixed":["ASA 9.16.4.104","ASA 9.18.4.96","ASA 9.20.4.50","ASA 9.22.3.200","ASA 9.23.1.48","ASA 9.24.1.27 and 9.24.10.1","FTD 7.0.11","FTD 7.2.13","FTD 7.4.9","FTD 7.6.7","FTD 7.7.14","FTD 10.0.3","FTD 10.1.1"],"started":"2026-10-28","closed":null,"updated":"2026-11-03T22:04:13.230Z","url":"https://hard.fyi/live/cisco-asa-ftd-ssl-vpn-dos-cve-2026/","json":"https://hard.fyi/api/live?id=cisco-asa-ftd-ssl-vpn-dos-cve-2026"},{"id":"capcom-id-account-records-breach-oct-2026","category":"breach","status":"live","title":"Capcom ID breach exposes email addresses and login details of 11.77 million account records","tldr":"Capcom says attackers took 11.77 million CAPCOM ID records (emails, login dates, last IP address) and changed passwords on 196 accounts, now reset. Expect phishing pretending to be Capcom. Don't click links in unexpected messages; no card data was involved.","action":"Treat any email claiming to be from Capcom as suspect: don't open links or attachments in unexpected messages, and go to Capcom's site directly. If you reuse your Capcom password elsewhere, change it and turn on two-step verification where offered.","product":"Capcom ID (Capcom game account system)","audience":"home","severity":"medium","patch":"na","exploited":false,"cves":[],"tags":["capcom","capcom-id","data-breach","gaming","phishing-risk","japan","account-takeover"],"fixed":[],"started":"2026-10-19","closed":null,"updated":"2026-11-03T21:26:55.564Z","url":"https://hard.fyi/live/capcom-id-account-records-breach-oct-2026/","json":"https://hard.fyi/api/live?id=capcom-id-account-records-breach-oct-2026"},{"id":"broadcom-esx-logging-flaw-exploited-oct-2026","category":"patch","status":"live","title":"Broadcom VMware ESX logging flaw CVE-2026-41709 used in attacks; fixed builds available","tldr":"A low-rated Broadcom VMware ESX flaw (CVE-2026-41709) that lets an admin act without leaving logs is now on CISA's exploited list. Mainly a business issue: if you run ESX 8.0, 9.0 or 9.1, install the July builds. No workaround exists.","action":"If you run VMware ESX, install the fixed build for your version (9.1, 9.0 or 8.0, or VCF 5.2.4) and ask your IT provider to confirm. Families with no VMware servers have nothing to do.","product":"Broadcom VMware ESX (ESXi) hypervisor and VMware Cloud Foundation","audience":"work","severity":"low","patch":"patched","exploited":true,"cves":["CVE-2026-41709"],"tags":["broadcom","vmware","esx","esxi","hypervisor","cisa-kev","zero-day","logging"],"fixed":["ESXi-9.1.0.0-25370933","ESXi-9.0.2.0100-25595025","ESXi80U3j-25429389","VMware Cloud Foundation 5.2.4","Telco Cloud Platform: KB449886"],"started":"2026-10-28","closed":null,"updated":"2026-11-03T22:05:23.852Z","url":"https://hard.fyi/live/broadcom-esx-logging-flaw-exploited-oct-2026/","json":"https://hard.fyi/api/live?id=broadcom-esx-logging-flaw-exploited-oct-2026"},{"id":"tectonic-cronos-theft-rollback-aug-2026","category":"breach","status":"closed","title":"Tectonic crypto theft triggers Cronos rollback: US$111.2 million reversed, US$9.19 million unrecovered","tldr":"An attacker borrowed US$120.4 million against manipulated Tectonic collateral. Cronos halted and rolled back transactions, reversing US$111.2 million. Affected users should check balances and follow Tectonic's official reopening instructions.","action":"If you used Tectonic or moved funds on Cronos on 30 August, check your balances and transaction history with the service you used and ask it to reconcile missing transfers. Follow Tectonic's official reopening instructions before making new deposits or borrowing.","product":"Tectonic crypto lending service and Cronos blockchain","audience":"home","severity":"critical","patch":"na","exploited":true,"cves":[],"tags":["tectonic","cronos","crypto","defi","crypto-theft","blockchain-rollback"],"fixed":[],"started":"2026-08-30","closed":"2026-10-19","updated":"2026-11-03T21:21:59.354Z","url":"https://hard.fyi/live/tectonic-cronos-theft-rollback-aug-2026/","json":"https://hard.fyi/api/live?id=tectonic-cronos-theft-rollback-aug-2026"},{"id":"drift-platform-crypto-theft-apr-2026","category":"breach","status":"closed","title":"Drift trading platform loses roughly US$295 million; recovery claims open","tldr":"Attackers seized control of Solana trading platform Drift and stole roughly US$295 million. Affected users can claim DFX recovery tokens, but launch payouts covered only about 1% of losses. Check official claim terms: redeeming ends future rights on those tokens.","action":"If you lost funds, follow [Drift's official claims notice](https://www.drift.trade/updates/dfx-claim-and-redemptions) using the wallet that held your account on 1 April; claims close at 00:00 UTC on 1 January 2028. Read the terms and current payout before redeeming, because it permanently burns your DFX and ends future recovery rights attached to those tokens. If you did not hold assets on Drift, there is nothing to update.","product":"Drift Protocol cryptocurrency trading platform on Solana, subsequently called Velocity","audience":"both","severity":"critical","patch":"na","exploited":true,"cves":[],"tags":["drift","solana","crypto","crypto-theft","social-engineering","north-korea"],"fixed":[],"started":"2026-04-01","closed":"2026-10-20","updated":"2026-11-03T20:36:10.859Z","url":"https://hard.fyi/live/drift-platform-crypto-theft-apr-2026/","json":"https://hard.fyi/api/live?id=drift-platform-crypto-theft-apr-2026"},{"id":"kelpdao-rseth-bridge-theft-apr-2026","category":"breach","status":"closed","title":"KelpDAO bridge loses US$292 million in rsETH theft; token backing subsequently restored","tldr":"Attackers stole 116,500 rsETH from KelpDAO’s bridge using compromised LayerZero infrastructure. Backing has been restored, but holders of retired rsETH tokens should check Kelp’s official recovery guide before the June 2027 deadline.","action":"If you hold rsETH, check your network and token contract against [Kelp’s official recovery guide](https://blogs.kerneldao.com/blog/recovering-rseth-from-sunset-networks), or ask your custodian to check. Eligible retired tokens have a 15 June 2027 deadline; contact claims@kelpdao.xyz if unsure before transferring or burning anything. Kelp says it never messages first or asks for your seed phrase.","product":"KelpDAO rsETH cross-chain bridge using LayerZero","audience":"both","severity":"critical","patch":"na","exploited":true,"cves":[],"tags":["kelpdao","layerzero","crypto","crypto-theft","defi","ethereum","arbitrum"],"fixed":[],"started":"2026-04-18","closed":"2026-10-12","updated":"2026-11-03T20:29:21.010Z","url":"https://hard.fyi/live/kelpdao-rseth-bridge-theft-apr-2026/","json":"https://hard.fyi/api/live?id=kelpdao-rseth-bridge-theft-apr-2026"},{"id":"bitget-hot-wallet-theft-sep-2026","category":"breach","status":"closed","title":"Bitget restores withdrawals after US$387.5 million crypto theft; recovery continues","tldr":"Attackers stole US$387.5 million from Bitget’s exchange wallets, later reported as about US$388 million. Withdrawals fully resumed on 2 October. Bitget says customer balances were unaffected. Use official channels and beware recovery scams.","action":"Nothing for you to patch: Bitget says it repaired its systems and restored withdrawals. Check service information through Bitget’s official app or website, and be wary of impersonators and unofficial recovery services.","product":"Bitget cryptocurrency exchange","audience":"home","severity":"critical","patch":"na","exploited":true,"cves":[],"tags":["bitget","crypto","crypto-theft","exchange","hot-wallet"],"fixed":[],"started":"2026-09-24","closed":"2026-10-20","updated":"2026-11-03T20:25:55.762Z","url":"https://hard.fyi/live/bitget-hot-wallet-theft-sep-2026/","json":"https://hard.fyi/api/live?id=bitget-hot-wallet-theft-sep-2026"},{"id":"nipigon-hospital-ransomware-patient-data-sep-2026","category":"breach","status":"closed","title":"Nipigon hospital ransomware closed outpatient tests and scans; later notice confirms patient-data theft","tldr":"Ransomware disrupted Nipigon hospital’s outpatient tests and scans. A later hospital notice confirms stolen patient information. Check whether you fall within its affected groups and watch for impersonation scams.","action":"Check the hospital’s notice for affected groups. Verify unexpected requests for personal information independently; send incident questions or suspected misuse reports to privacy@ndmh.ca.","product":"Nipigon District Memorial Hospital","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["nipigon","ransomware","healthcare","data-breach","canada"],"fixed":[],"started":"2026-09-14","closed":"2026-10-13","updated":"2026-11-03T21:58:56.103Z","url":"https://hard.fyi/live/nipigon-hospital-ransomware-patient-data-sep-2026/","json":"https://hard.fyi/api/live?id=nipigon-hospital-ransomware-patient-data-sep-2026"},{"id":"serbia-pegasus-novispy-surveillance-sep-2026","category":"breach","status":"closed","title":"Pegasus and NoviSpy infections target Serbia’s pro-democracy movement","tldr":"Pegasus and NoviSpy-related spyware compromised Serbian activists’ phones. Later findings extended to a university rector. Update devices, enable iPhone Lockdown Mode if at risk, and get expert help immediately after a spyware alert.","action":"Keep phones updated; if you face targeted surveillance, enable iPhone Settings → Privacy & Security → Lockdown Mode → Turn On Lockdown Mode, then restart as prompted. Verify any Apple threat alert by signing in directly at account.apple.com and immediately contact SHARE Foundation in Serbia or Access Now’s Digital Security Helpline. Ask those experts about screening close family members and collaborators too.","product":"Apple iPhone and Android phones targeted with Pegasus and NoviSpy-related spyware","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["serbia","pegasus","novispy","spyware","iphone","android","targeted-surveillance"],"fixed":[],"started":"2026-09-02","closed":"2026-10-19","updated":"2026-11-03T21:54:05.504Z","url":"https://hard.fyi/live/serbia-pegasus-novispy-surveillance-sep-2026/","json":"https://hard.fyi/api/live?id=serbia-pegasus-novispy-surveillance-sep-2026"},{"id":"foster-city-ransomware-data-breach-mar-2026","category":"breach","status":"closed","title":"Foster City ransomware halts municipal services; personal-data notices follow restoration","tldr":"Ransomware disrupted Foster City’s municipal services in March. Services returned on 16 April, but personal records may have been taken. Affected people should check their notification letters, use offered identity protection and monitor accounts.","action":"If you receive a Foster City notification, check which information it identifies and enrol in the offered identity protection before your letter’s deadline. Monitor bank, card and health insurance statements, and consider freezing your credit with Equifax, Experian and TransUnion if identity details were involved. For questions about whether you were affected, call the city’s published incident line on (844) 959-7167.","product":"Foster City municipal services and personal records","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["foster-city","ransomware","data-breach","local-government","identity-theft"],"fixed":[],"started":"2026-03-19","closed":"2026-10-15","updated":"2026-11-03T21:50:00.434Z","url":"https://hard.fyi/live/foster-city-ransomware-data-breach-mar-2026/","json":"https://hard.fyi/api/live?id=foster-city-ransomware-data-breach-mar-2026"},{"id":"irhythm-patient-data-theft-jun-2026","category":"breach","status":"closed","title":"iRhythm patient health and contact data stolen through social engineering of third-party business applications","tldr":"Cardiac-monitor maker iRhythm says attackers tricked their way into third-party-hosted business apps and stole patient data in June, then demanded payment. Notices went out from 2 October. If you get one, watch for medical identity theft and fake iRhythm contacts.","action":"If you wear or have worn a Zio monitor and receive an iRhythm notice, use the support line it gives, watch your insurance statements for unfamiliar claims, and consider a credit freeze. Treat unexpected calls or emails claiming to be iRhythm as suspect.","product":"iRhythm Technologies patient records (Zio cardiac monitoring service)","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["irhythm","data-breach","health-data","social-engineering","extortion","patients","medical-identity-theft"],"fixed":[],"started":"2026-06-15","closed":"2026-10-09","updated":"2026-11-03T21:34:09.854Z","url":"https://hard.fyi/live/irhythm-patient-data-theft-jun-2026/","json":"https://hard.fyi/api/live?id=irhythm-patient-data-theft-jun-2026"},{"id":"stablr-minting-key-unbacked-tokens-may-2026","category":"breach","status":"closed","title":"StablR attacker mints unbacked USDR and EURR stablecoins; redemption still suspended","tldr":"An attacker used one compromised minting key to create unbacked USDR and EURR stablecoins on 23–24 May, crashing their prices. As of late October, redemption is still suspended with no resumption date or compensation scheme.","action":"If you hold EURR or USDR, you can't redeem them for now, so don't buy more and don't trust any message offering a redemption. Follow StablR's own notices at stablr.com; it says it will never ask for private keys, seed phrases or payment.","product":"StablR EURR and USDR stablecoins","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["stablr","stablecoin","eurr","usdr","crypto-theft","multisig","depeg","mica"],"fixed":[],"started":"2026-05-23","closed":"2026-10-19","updated":"2026-11-03T21:31:49.457Z","url":"https://hard.fyi/live/stablr-minting-key-unbacked-tokens-may-2026/","json":"https://hard.fyi/api/live?id=stablr-minting-key-unbacked-tokens-may-2026"},{"id":"berlin-government-rhysida-extortion-aug-2026","category":"breach","status":"closed","title":"Berlin state government network breach: Rhysida steals and publishes data after refused extortion demand","tldr":"Rhysida stole data from Berlin's state administration in August 2026 and published it on 4 September after Berlin refused to pay. The government confirms theft but not scope. Affected people are to be told by authorities; if you hear from Berlin, check it is genuine.","action":"Nothing to patch. If you live or work in Berlin or deal with its administration, expect a notice from the authorities; treat unexpected emails, calls or messages about this leak with caution and contact the authority directly through its official website. Change any reused passwords.","product":"Berlin state government administrative network (German state administration)","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["breach","ransomware","rhysida","extortion","berlin","germany","government","data-leak"],"fixed":[],"started":"2026-08-07","closed":"2026-10-16","updated":"2026-11-03T21:29:19.520Z","url":"https://hard.fyi/live/berlin-government-rhysida-extortion-aug-2026/","json":"https://hard.fyi/api/live?id=berlin-government-rhysida-extortion-aug-2026"},{"id":"tving-subscriber-data-breach-jun-2026","category":"breach","status":"closed","title":"Tving breach exposes subscriber information from 39.54 million accounts","tldr":"South Korean streaming service Tving lost information from 39.54 million accounts, including former users. Check your breach notice, change reused passwords and verify unexpected compensation messages through Tving directly.","action":"Open Tving's app or website directly and check your breach notification, including if you previously closed your account. Change your Tving password and any other account using the same password. Verify compensation messages through Tving directly, and do not give callers verification codes or money.","product":"Tving streaming service","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["tving","cj-enm","south-korea","streaming","data-breach"],"fixed":[],"started":"2026-06-03","closed":"2026-10-13","updated":"2026-11-03T20:55:48.381Z","url":"https://hard.fyi/live/tving-subscriber-data-breach-jun-2026/","json":"https://hard.fyi/api/live?id=tving-subscriber-data-breach-jun-2026"},{"id":"ets-california-student-records-oct-2026","category":"breach","status":"closed","title":"ETS breach exposes California pupils’ records, including disability information","tldr":"An intruder copied California pupils’ records from ETS, including disability information for some. Current and former pupils are affected. Use CDE’s official notice to enrol in two years of free identity protection by 19 March 2027.","action":"If you or your child attended a California public school from 2023 onwards, or left since 2006 without a confirmed transfer, check CDE’s official ETS notice even if no letter arrives. Follow its instructions to enrol in free Experian IdentityWorks protection by 19 March 2027; no credit card is required. Treat unexpected school-related messages cautiously and verify them through the school or CDE before sharing personal information.","product":"Educational Testing Service (ETS) California public-school assessment records","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["ets","california","education","data-breach","children","identity-theft"],"fixed":[],"started":"2026-10-02","closed":"2026-10-16","updated":"2026-11-03T20:25:33.163Z","url":"https://hard.fyi/live/ets-california-student-records-oct-2026/","json":"https://hard.fyi/api/live?id=ets-california-student-records-oct-2026"},{"id":"napoleon-perdis-customer-data-breach-jun-2026","category":"breach","status":"closed","title":"Napoleon Perdis customer records published after breach at supplier Retail Express","tldr":"About 339,000 Napoleon Perdis customer records were published free by an attacker in June. The company says a supplier, Retail Express, was compromised; customers were emailed in October. Expect scam calls and emails, and don't act on unexpected messages.","action":"If you shopped with Napoleon Perdis before June 2025, treat unexpected calls, texts or emails mentioning the brand or your orders as suspect and don't click links. Check your bank statements, and contact the company directly using details from its official website.","product":"Napoleon Perdis customer records (held by supplier Retail Express)","audience":"home","severity":"medium","patch":"na","exploited":true,"cves":[],"tags":["data-breach","napoleon-perdis","retail-express","australia","supply-chain","customer-data","oaic"],"fixed":[],"started":"2026-06-09","closed":"2026-10-17","updated":"2026-11-03T21:38:01.095Z","url":"https://hard.fyi/live/napoleon-perdis-customer-data-breach-jun-2026/","json":"https://hard.fyi/api/live?id=napoleon-perdis-customer-data-breach-jun-2026"},{"id":"fortinet-cli-path-traversal-oct-2026","category":"patch","status":"closed","title":"Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager path traversal CVE-2025-61624 exploited","tldr":"Fortinet says CVE-2025-61624, a CLI file write/delete flaw in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, is exploited. It needs a privileged login. Update to FortiOS 7.4.10/7.6.5 or later; older branches have no fix and must migrate.","action":"Fortinet administrators should upgrade to a fixed release (for example FortiOS 7.4.10 or 7.6.5) and move off unfixed branches using Fortinet's upgrade tool. Until then, apply Fortinet's virtual patch and review who holds admin accounts.","product":"Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager","audience":"work","severity":"medium","patch":"partial","exploited":true,"cves":["CVE-2025-61624"],"tags":["fortinet","fortios","fortipam","fortiproxy","fortiswitchmanager","path-traversal","known-exploited","cisa-kev"],"fixed":["FortiOS 7.6.5 or later","FortiOS 7.4.10 or later","FortiPAM 1.7.1 or later","FortiProxy 7.6.5 or later","FortiProxy 7.4.12 or later","FortiSwitchManager 7.2.8 or later","FortiSwitchManager 7.0.7 or later"],"started":"2026-10-16","closed":"2026-10-16","updated":"2026-11-03T21:55:16.088Z","url":"https://hard.fyi/live/fortinet-cli-path-traversal-oct-2026/","json":"https://hard.fyi/api/live?id=fortinet-cli-path-traversal-oct-2026"},{"id":"coinsbuy-wallet-drain-theft-aug-2026","category":"breach","status":"closed","title":"Coinsbuy crypto payment platform wallets drained of about US$8 million; cause not yet published","tldr":"Coinsbuy, a crypto payment processor, lost about US$7.9–8.07M from platform wallets on Ethereum and TRON on 9 Aug 2026. It says clients were made whole from reserves. Cause unpublished; only a small part frozen. Nothing for families to do.","action":"Nothing for you to do unless you use Coinsbuy to take crypto payments. If you do, check your balances and settlement history, and ask Coinsbuy directly to confirm your funds were covered.","product":"Coinsbuy crypto payment processing platform","audience":"work","severity":"medium","patch":"na","exploited":true,"cves":[],"tags":["coinsbuy","crypto-theft","ethereum","tron","payment-processor","data-breach","monero"],"fixed":[],"started":"2026-08-09","closed":"2026-10-15","updated":"2026-11-03T21:39:38.036Z","url":"https://hard.fyi/live/coinsbuy-wallet-drain-theft-aug-2026/","json":"https://hard.fyi/api/live?id=coinsbuy-wallet-drain-theft-aug-2026"},{"id":"coldcard-weak-seed-theft-jul-2026","category":"patch","status":"closed","title":"Coldcard weak-seed flaw enables theft of more than 1,830 BTC","tldr":"A Coldcard firmware flaw let thieves recover keys from weak wallet seeds. Every affected model and track now has fixed firmware, but updating cannot protect an old affected seed: create a new seed on fixed firmware and carefully move the funds.","action":"Install official firmware for your model and track: Mk2/Mk3 4.2.0, Mk4/Mk5 standard 5.6.3, Q standard 1.5.3Q, Mk4/Mk5 Edge 6.6.1X or Q Edge 6.6.1QX. If your seed was generated on affected firmware, follow Coinkite's migration guide to create and back up a new seed, verify its address on the device, test a small transfer, then move the remaining funds; keep the old backup until everything is confirmed. Never enter seed words into a website or send them to support.","product":"Coldcard Mk2, Mk3, Mk4, Mk5 and Q Bitcoin hardware wallets","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":[],"tags":["coinkite","coldcard","hardware-wallet","bitcoin","crypto-theft","weak-randomness"],"fixed":["Coldcard Mk2/Mk3 4.2.0 or later","Coldcard Mk4/Mk5 standard 5.6.0 or later","Coldcard Q standard 1.5.0Q or later","Coldcard Mk4/Mk5 Edge 6.6.0X or later","Coldcard Q Edge 6.6.0QX or later"],"started":"2026-07-30","closed":"2026-10-16","updated":"2026-11-03T20:04:33.136Z","url":"https://hard.fyi/live/coldcard-weak-seed-theft-jul-2026/","json":"https://hard.fyi/api/live?id=coldcard-weak-seed-theft-jul-2026"},{"id":"cisco-unified-cm-ssrf-attacks-jun-2026","category":"patch","status":"closed","title":"Cisco Unified Communications Manager SSRF flaw CVE-2026-20230 exploited; fixes available","tldr":"Attackers exploited Cisco’s business phone-system servers through CVE-2026-20230. Systems with WebDialer enabled are exposed. Ask IT to install 14SU6, 15SU5 or the applicable Cisco patch; disabling WebDialer is a temporary mitigation.","action":"If your workplace uses Cisco Unified Communications Manager, ask its IT team to install 14SU6, 15SU5 or the version-specific COP patch Cisco specifies. Until patched, administrators can temporarily disable Cisco WebDialer Web Service under Cisco Unified Serviceability → Tools → Service Activation. Families do not need to update their phones for this server flaw.","product":"Cisco Unified Communications Manager and Unified Communications Manager Session Management Edition","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-20230"],"tags":["cisco","unified-cm","ssrf","actively-exploited","business-phone-system"],"fixed":["Cisco Unified CM and Unified CM SME 14SU6","Cisco Unified CM and Unified CM SME 15SU5","Cisco Unified CM and Unified CM SME release 15 with the applicable version-specific COP patch; consult its README"],"started":"2026-06-03","closed":"2026-10-14","updated":"2026-11-03T22:18:16.011Z","url":"https://hard.fyi/live/cisco-unified-cm-ssrf-attacks-jun-2026/","json":"https://hard.fyi/api/live?id=cisco-unified-cm-ssrf-attacks-jun-2026"},{"id":"balbooa-forms-upload-attacks-jul-2026","category":"patch","status":"closed","title":"Balbooa Forms upload flaw CVE-2026-56291 exploited to take over Joomla websites; fix available","tldr":"Attackers used CVE-2026-56291 to take over Joomla websites running Balbooa Forms 2.4.0 or earlier. Version 2.4.1 fixed this flaw; update to the current 2.4.4.0 and have previously exposed sites checked for compromise.","action":"If your family or business runs a Joomla website, ask its developer or hosting provider whether it uses Balbooa Forms and have it updated to 2.4.4.0. If it previously ran 2.4.0 or earlier, ask them to check for malicious files, unexpected administrator accounts and other signs of compromise, even if it has already been updated.","product":"Balbooa Forms extension for Joomla websites","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-56291"],"tags":["balbooa","joomla","forms","file-upload","remote-code-execution","actively-exploited"],"fixed":["Balbooa Forms 2.4.1"],"started":"2026-07-08","closed":"2026-10-20","updated":"2026-11-03T22:16:23.792Z","url":"https://hard.fyi/live/balbooa-forms-upload-attacks-jul-2026/","json":"https://hard.fyi/api/live?id=balbooa-forms-upload-attacks-jul-2026"},{"id":"checkpoint-vpn-gateway-management-rce-sep-2026","category":"patch","status":"closed","title":"Check Point gateways and management servers: CVE-2026-85102 and CVE-2026-93616 exploited; fixes available","tldr":"Check Point says two critical, no-login flaws are being used in attacks: CVE-2026-85102 (VPN on gateways and Spark firewalls) and CVE-2026-93616 (management servers). Fixes exist for supported versions. Install them now and review VPN logs.","action":"If you run Check Point gateways, Spark firewalls or management servers, or someone manages them for you, ask your IT provider to install the fixes in Check Point's notices sk1000117 and sk1000171 now. Nothing for home users to do unless you run these business products.","product":"Check Point Security Gateway, Spark Firewall, Security Management, Multi-Domain, Log Server and SmartEvent","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-85102","CVE-2026-93616"],"tags":["check-point","firewall","vpn","zero-day","cisa-kev","spark","management-server"],"fixed":["CVE-2026-85102: LivePatch Take 26 (R82.10, R82, R81.20); Jumbo Hotfix R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+, R81.10 Take 190+; Spark R82.00.10 build 2325+, R81.10.17 build 4968+","CVE-2026-93616: R82.20 Security Hotfix (no reboot); Jumbo Hotfix R82.20 Take 10, R82.10 Take 45, R82 Take 127, R81.20 Take 170, R81.10 Take 192 or later; LivePatch does not fix it"],"started":"2026-09-22","closed":"2026-10-13","updated":"2026-11-03T22:07:39.370Z","url":"https://hard.fyi/live/checkpoint-vpn-gateway-management-rce-sep-2026/","json":"https://hard.fyi/api/live?id=checkpoint-vpn-gateway-management-rce-sep-2026"},{"id":"onlyoffice-docs-upload-path-traversal-oct-2026","category":"patch","status":"closed","title":"ONLYOFFICE Docs Server path traversal CVE-2021-3199 used in attacks; fixed in 5.6.3, update old servers","tldr":"CISA says attackers are exploiting CVE-2021-3199, a 2021 flaw in old ONLYOFFICE Docs servers (before 5.6.3, JWT in use) that can give them remote code execution. If your organisation runs ONLYOFFICE Docs, confirm it is current; ONLYOFFICE recommends 10.0.","action":"If you or your organisation run a self-hosted ONLYOFFICE Docs or Document Server, check its version now and update it (ONLYOFFICE recommends 10.0; 5.6.3 is the minimum fix). Ask your IT provider to check older servers for signs of compromise, since attacks may already have happened.","product":"ONLYOFFICE Docs (Document Server), self-hosted","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2021-3199"],"tags":["onlyoffice","onlyoffice-docs","path-traversal","remote-code-execution","cisa-kev","exploited","self-hosted"],"fixed":["5.6.3","ONLYOFFICE 10.0 (recommended by the vendor)"],"started":"2026-10-08","closed":"2026-10-14","updated":"2026-11-03T21:58:25.740Z","url":"https://hard.fyi/live/onlyoffice-docs-upload-path-traversal-oct-2026/","json":"https://hard.fyi/api/live?id=onlyoffice-docs-upload-path-traversal-oct-2026"},{"id":"cisco-secure-email-gateway-file-write-oct-2026","category":"patch","status":"closed","title":"Cisco Secure Email Gateway CVE-2026-76519 exploited: crafted email attachment gives attackers root; fixes available","tldr":"Cisco Secure Email Gateway flaw CVE-2026-76519 (CVSS 9.8) is being exploited. A crafted email attachment can give an unauthenticated attacker root. Fixes exist (15.5.5-014, 16.5.0-780, or Content Scanner Tools 25.3.0.5525). Businesses running the gateway should update now.","action":"Nothing for most families, as this is business equipment. If you or a family office run a Cisco Secure Email Gateway, update to 15.5.5-014 or 16.5.0-780, or apply Content Scanner Tools 25.3.0.5525 or later, and ask your IT provider to check for signs of compromise.","product":"Cisco Secure Email Gateway (AsyncOS, physical and virtual)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-76519"],"tags":["cisco","secure-email-gateway","asyncos","zero-day","exploited","email-security","cisa-kev"],"fixed":["AsyncOS 15.5.5-014","AsyncOS 16.5.0-780","Content Scanner Tools 25.3.0.5525 or later","AsyncOS 16.0: migrate to a fixed release"],"started":"2026-10-14","closed":"2026-10-14","updated":"2026-11-03T21:57:03.931Z","url":"https://hard.fyi/live/cisco-secure-email-gateway-file-write-oct-2026/","json":"https://hard.fyi/api/live?id=cisco-secure-email-gateway-file-write-oct-2026"},{"id":"ahsaycbs-auth-bypass-rce-attacks-oct-2026","category":"patch","status":"closed","title":"AhsayCBS backup server: login bypass and command flaws CVE-2026-105133, CVE-2026-105134 used in attacks","tldr":"Attackers are chaining two flaws in Ahsay's AhsayCBS backup server to run commands without a password. Ahsay's first patches were incomplete. IT providers should install hotfix v10.3.4.45 or v9.15.2.70, reboot, and check for web shells and miners.","action":"If you run AhsayCBS, or your IT provider does, install hotfix v10.3.4.45 (version 10) or v9.15.2.70 (versions 7 to 9) from Ahsay's partner portal, then reboot. Keep the admin console off the internet and have the server checked for web shells and miners since 4 October.","product":"Ahsay AhsayCBS backup management server (versions 7 to 10)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-105133","CVE-2026-105134"],"tags":["ahsay","ahsaycbs","backup","cisa-kev","authentication-bypass","command-injection","webshell","cryptominer"],"fixed":["AhsayCBS v10.3.4.45 hotfix","AhsayCBS v9.15.2.70 hotfix"],"started":"2026-10-04","closed":"2026-10-15","updated":"2026-11-03T21:56:12.242Z","url":"https://hard.fyi/live/ahsaycbs-auth-bypass-rce-attacks-oct-2026/","json":"https://hard.fyi/api/live?id=ahsaycbs-auth-bypass-rce-attacks-oct-2026"},{"id":"atlassian-data-center-file-access-cve-2026-21589","category":"patch","status":"closed","title":"Atlassian Data Center products: file-access flaw CVE-2026-21589 exploited; patches available","tldr":"A critical Atlassian flaw (CVE-2026-21589) lets anyone on the internet read files in Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye Data Center. It is being exploited. Patch now, or take the server off the internet.","action":"If your organisation runs any of these Data Center products, update to the fixed version listed by Atlassian and check access logs for signs of compromise. If you can't patch yet, take the server off the internet or apply Atlassian's WAF or Tomcat rewrite workaround. Atlassian Cloud users need to do nothing.","product":"Atlassian Data Center products (Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, Fisheye)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-21589"],"tags":["atlassian","confluence","jira","bitbucket","bamboo","crowd","data-center","actively-exploited","cisa-kev"],"fixed":["Bitbucket Data Center 9.4.26, 10.2.8, 10.5.1","Confluence Data Center 9.2.26, 10.2.19","Jira Service Management Data Center 5.12.40, 10.3.26, 11.3.12","Jira Software Data Center 9.12.40, 10.3.26, 11.3.12","Bamboo Data Center 10.2.24, 12.1.12","Crowd Data Center 6.3.7, 7.0.3, 7.1.7, 7.2.4","Crucible 4.9.15","Fisheye 4.9.15"],"started":"2026-10-05","closed":"2026-10-20","updated":"2026-11-03T21:55:06.323Z","url":"https://hard.fyi/live/atlassian-data-center-file-access-cve-2026-21589/","json":"https://hard.fyi/api/live?id=atlassian-data-center-file-access-cve-2026-21589"},{"id":"linux-cgroups-privilege-escalation-jun-2026","category":"patch","status":"closed","title":"Linux kernel cgroups flaw CVE-2022-0492 used in attacks; fixes available since 2022","tldr":"Attackers are using an old Linux kernel flaw to gain administrative control, including escaping some containers. Fixes date from 2022. Update Linux computers and container hosts through their vendor, then restart; replace obsolete systems.","action":"If you use a Linux computer, install its distribution's current kernel security updates and restart. Ask whoever manages your servers or containers to confirm that the host kernel includes the CVE-2022-0492 fix; updating container applications alone does not update that kernel. Move obsolete Linux installations to a maintained release.","product":"Linux kernel cgroups v1 on Linux computers and container hosts","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2022-0492"],"tags":["linux","kernel","ubuntu","fedora","privilege-escalation","container-escape","actively-exploited"],"fixed":["Upstream Linux kernel 5.17-rc3","Fedora Linux kernel 5.16.6","Ubuntu 20.04 LTS linux: 5.4.0-105.119","Ubuntu 18.04 LTS linux: 4.15.0-173.182","Ubuntu 16.04 LTS linux: 4.4.0-222.255, available through Ubuntu Pro"],"started":"2026-06-02","closed":"2026-10-18","updated":"2026-11-03T22:22:09.763Z","url":"https://hard.fyi/live/linux-cgroups-privilege-escalation-jun-2026/","json":"https://hard.fyi/api/live?id=linux-cgroups-privilege-escalation-jun-2026"},{"id":"android-framework-integer-overflow-jun-2026","category":"patch","status":"closed","title":"Android Framework privilege escalation CVE-2025-48595 used in limited attacks; fixed in June 2026 update","tldr":"Google fixed CVE-2025-48595, an Android Framework flaw on Android 14 to 16 that may be used in limited, targeted attacks. CISA lists it as exploited. Install Android's June 2026 security update (patch level 2026-06-01 or later) and update apps only from Google Play.","action":"Open Settings, then System, then Software update (or Security update), and install it. Confirm the Android security patch level shows 2026-06-01 or later, ideally 2026-06-05 or later. If your phone no longer gets updates, ask the maker or consider replacing it.","product":"Android phones and tablets (Android 14, 15, 16)","audience":"home","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2025-48595"],"tags":["android","google","zero-day","privilege-escalation","cisa-kev","mobile"],"fixed":["Android security patch level 2026-06-01 or later","Security patch level 2026-06-05 includes all earlier fixes"],"started":"2026-06-01","closed":"2026-10-12","updated":"2026-11-03T22:01:45.969Z","url":"https://hard.fyi/live/android-framework-integer-overflow-jun-2026/","json":"https://hard.fyi/api/live?id=android-framework-integer-overflow-jun-2026"},{"id":"windows-shell-motw-bypass-cve-2026-96951-oct","category":"patch","status":"closed","title":"Microsoft patches exploited Windows Shell Mark of the Web bypass (CVE-2026-96951)","tldr":"Microsoft fixed CVE-2026-96951 on 13 Oct 2026, a Windows Shell flaw already used in attacks to bypass Mark of the Web warnings on downloaded files. CISA lists it as exploited. Install the October Windows updates now and be wary of unexpected files.","action":"Run Windows Update and install the October 2026 updates on every Windows 10 and 11 computer, and update Microsoft Edge. Until then, do not open unexpected files from email, chat or websites, even if no warning appears.","product":"Microsoft Windows 10 and Windows 11 (Windows Shell)","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-96951"],"tags":["microsoft","windows","zero-day","mark-of-the-web","patch-tuesday","cisa-kev","windows-shell"],"fixed":["Windows 10 1607: 10.0.14393.9612","Windows 10 1809: 10.0.17763.9376","Windows 10 21H2: 10.0.19044.7807","Windows 10 22H2: 10.0.19045.7807","Windows 11 23H2: 10.0.22631.7652","Microsoft Edge: 154.0.4258.62","Outlook.com: 20260925.100"],"started":"2026-10-13","closed":"2026-10-14","updated":"2026-11-03T21:24:41.810Z","url":"https://hard.fyi/live/windows-shell-motw-bypass-cve-2026-96951-oct/","json":"https://hard.fyi/api/live?id=windows-shell-motw-bypass-cve-2026-96951-oct"},{"id":"microsoft-adfs-privilege-escalation-jul-2026","category":"patch","status":"closed","title":"Microsoft AD FS privilege escalation CVE-2026-56155 exploited; October updates enable automatic repair","tldr":"An exploited flaw affects Microsoft's AD FS business sign-in infrastructure. Ask IT to install October 2026 or later Windows security updates on every AD FS server and verify that unsafe permissions were repaired.","action":"Ask your organisation's IT provider to install Windows security updates dated 13 October 2026 or later on every AD FS server, leave automatic repair enabled, and check AD FS Admin events 1133 or 1135 for success. Families do not need to change settings on personal devices.","product":"Microsoft Active Directory Federation Services (AD FS)","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-56155"],"tags":["microsoft","ad-fs","windows-server","privilege-escalation","actively-exploited"],"fixed":["Microsoft's current remediation requirement: Windows security updates released on or after 13 October 2026 on every AD FS server, with successful DKM container permission repair.","Windows Server 2012 and Windows Server 2012 R2 require Extended Security Updates (ESU)."],"started":"2026-07-14","closed":"2026-10-13","updated":"2026-11-03T22:21:39.690Z","url":"https://hard.fyi/live/microsoft-adfs-privilege-escalation-jul-2026/","json":"https://hard.fyi/api/live?id=microsoft-adfs-privilege-escalation-jul-2026"},{"id":"litellm-command-injection-attacks-apr-2026","category":"patch","status":"closed","title":"LiteLLM command injection CVE-2026-42271 used in attacks; fixes available","tldr":"Attackers are using a LiteLLM AI gateway flaw that lets even low-privilege users run code on its server. Organisations should update to 1.83.7 or later, apply relevant Red Hat fixes and check for compromise.","action":"If your business or family office runs LiteLLM, ask its IT team to update to a supported release at least as new as 1.83.7, or install the applicable Red Hat security update. If updating must wait, BerriAI says to block POST requests to /mcp-rest/test/connection and /mcp-rest/test/tools/list at the reverse proxy or API gateway. Ask IT to check for compromise as well as patching.","product":"BerriAI LiteLLM AI gateway and affected Red Hat OpenShift AI components","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-42271"],"tags":["berriai","litellm","ai-gateway","command-injection","actively-exploited","red-hat","cryptomining"],"fixed":["LiteLLM >=1.83.7; stable release v1.83.7-stable","Red Hat OpenShift AI 3.4: RHSA-2026:27784","Red Hat OpenShift AI 3.3: RHSA-2026:30056","Red Hat OpenShift AI 2.25: RHSA-2026:28960"],"started":"2026-06-08","closed":"2026-10-11","updated":"2026-11-03T22:20:25.870Z","url":"https://hard.fyi/live/litellm-command-injection-attacks-apr-2026/","json":"https://hard.fyi/api/live?id=litellm-command-injection-attacks-apr-2026"},{"id":"siteguard-server-command-injection-oct-2026","category":"patch","status":"closed","title":"SiteGuard Server Edition command injection CVE-2026-106931 exploited; fixes available","tldr":"Attackers are exploiting SiteGuard Server Edition’s statistics feature to run commands with full server privileges. Website operators should preserve diagnostic information, then install the fixed version or vendor patch.","action":"If you operate a website, ask its administrator or hosting provider whether it uses SiteGuard Server Edition. Before updating, they should download and retain diagnostic information from SiteGuard’s web management screen and investigate possible compromise. Install Ver8.00 Update 5 for Apache httpd, Nginx or IIS, or Ver7.00 Update 6 for Apache httpd or Nginx on FreeBSD; ask vendor support for the replacement-file patch if upgrading is difficult.","product":"EG Secure Solutions SiteGuard Server Edition","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-106931"],"tags":["eg-secure-solutions","siteguard","web-server","command-injection","actively-exploited"],"fixed":["SiteGuard Server Edition for Apache httpd: Ver8.00 Update 5","SiteGuard Server Edition for Nginx: Ver8.00 Update 5","SiteGuard Server Edition for IIS: Ver8.00 Update 5","SiteGuard Server Edition for Apache httpd on FreeBSD: Ver7.00 Update 6","SiteGuard Server Edition for Nginx on FreeBSD: Ver7.00 Update 6"],"started":"2026-10-20","closed":"2026-10-20","updated":"2026-11-03T22:08:49.964Z","url":"https://hard.fyi/live/siteguard-server-command-injection-oct-2026/","json":"https://hard.fyi/api/live?id=siteguard-server-command-injection-oct-2026"},{"id":"pan-os-management-code-injection-oct-2026","category":"patch","status":"closed","title":"Palo Alto Networks PAN-OS firewalls: management interface code injection CVE-2026-0322 used in attacks","tldr":"Palo Alto PAN-OS firewalls and Panorama have a flaw (CVE-2026-0322) that lets someone with a management login run code as root. Attacks are confirmed but limited. Update to your branch's fixed version and keep the management interface off the internet.","action":"If your business runs Palo Alto firewalls or Panorama, ask your IT provider to upgrade PAN-OS to the fixed version for your branch (for example 12.2.4, 11.2.16 or 10.2.18-h12) and to check the device for signs of break-in. Make sure the management interface is not reachable from the internet. Home users are not affected.","product":"Palo Alto Networks PAN-OS (PA-Series and VM-Series firewalls, Panorama)","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-0322"],"tags":["palo-alto","pan-os","firewall","panorama","code-injection","cisa-kev","exploited"],"fixed":["12.2.4","12.1.4-h12, 12.1.7-h8, 12.1.10-h2","11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16","11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3","10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12"],"started":"2026-10-14","closed":"2026-10-15","updated":"2026-11-03T22:06:50.569Z","url":"https://hard.fyi/live/pan-os-management-code-injection-oct-2026/","json":"https://hard.fyi/api/live?id=pan-os-management-code-injection-oct-2026"},{"id":"siemens-software-center-dll-sideload-oct-2026","category":"patch","status":"closed","title":"Siemens Software Center DLL side-loading flaw CVE-2026-110936 exploited in ClickFix attacks; update to V4.0.9.8","tldr":"Siemens Software Center before V4.0.9.8 has a DLL side-loading flaw (CVE-2026-110936) that attackers are using, tied to the Romulus ClickFix campaign. Update to V4.0.9.8 or later, get Siemens software only from Siemens, and never paste web-page commands into Run or PowerShell.","action":"Open Siemens Software Center so it updates to V4.0.9.8 or later, or download it from Siemens directly. Never paste commands from a web page into the Run box or PowerShell, and ask your IT team to check for unexpected DLLs beside Software Center files.","product":"Siemens Software Center (Windows)","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-110936"],"tags":["siemens","software-center","dll-sideloading","clickfix","romulus","exploited","windows","cisa-kev"],"fixed":["V4.0.9.8"],"started":"2026-10-15","closed":"2026-10-19","updated":"2026-11-03T21:55:09.843Z","url":"https://hard.fyi/live/siemens-software-center-dll-sideload-oct-2026/","json":"https://hard.fyi/api/live?id=siemens-software-center-dll-sideload-oct-2026"},{"id":"asos-app-notification-customer-breach-oct-2026","category":"breach","status":"closed","title":"ASOS breach: hackers stole customer details and used the app to send a fake 'hacked' alert","tldr":"ASOS customers got a rogue 'ASOS HACKED' app alert on 6 Oct after attackers used a phished employee login. Names, contact details and search history were taken; ASOS says cards and passwords weren't. Ignore its link and treat unexpected ASOS messages with suspicion.","action":"Ignore and don't tap links in the 'ASOS HACKED' alert. Be wary of unexpected emails, texts or calls claiming to be ASOS, which says it will never ask for passwords, security codes or payment details; ASOS says no account action is needed.","product":"ASOS customer accounts and app","audience":"home","severity":"medium","patch":"na","exploited":false,"cves":[],"tags":["asos","data-breach","retail","social-engineering","push-notification","snowflake","uk"],"fixed":[],"started":"2026-10-06","closed":"2026-10-09","updated":"2026-11-03T21:30:50.783Z","url":"https://hard.fyi/live/asos-app-notification-customer-breach-oct-2026/","json":"https://hard.fyi/api/live?id=asos-app-notification-customer-breach-oct-2026"}]}