Live

Attackers are exploiting CVE-2026-0770 to run code on Langflow AI-building servers without logging in. Restrict access and check for compromise. CISA links version 1.9.0, but a vendor-confirmed fix could not be verified.

Attackers exploited VeloCloud Orchestrator, which manages business networks. Released fixes cover three branches, but Arista has not confirmed complete coverage. Ask your IT provider to update, restrict management access and check for compromise.

Attackers used StyleSmuggler to compromise Adobe Commerce and Magento shops without logging in. Apply Adobe's VULN-39341 hotfix plus October security fixes, check for backdoors and rotate exposed credentials. Monthly patches alone are insufficient.

Attackers are exploiting an old Ajax.NET Professional flaw on website servers. The official AjaxNetProfessional package has a fix; several other packages do not. Ask your website developer to migrate to official version 24.10.10.1 and check for intruders.

Arista's on-prem VeloCloud Orchestrator has a maximum-severity input flaw (CVE-2026-93952) under attack. Fixed only in 5.2.3.16 and 6.4.2.8; 6.1 and 7.0 have no fix listed. Organisations should patch, restrict web access to admin networks and check logs.

WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway have a CVSS 10 flaw (CVE-2026-5430) that lets attackers forge admin tokens. It is being used in attacks. Business IT teams should apply WSO2's May 2026 fixes and rotate credentials. Nothing for home users.

Two Zammad helpdesk flaws, CVE-2026-102489 (remote code execution, 6.5 and older) and CVE-2026-102490 (local root, DEB/RPM packages), were used against DIVD. Update to Zammad 7.2.2 or later; 6.5 and older get no regular security fixes.

Fortinet FortiMail email gateways have a critical flaw (CVE-2026-104286) that lets anyone on the internet write files without logging in. It is being exploited. Update to 8.0.2, 7.6.7 or 7.4.9; 7.2 awaits 7.2.10 and 7.0 has no fix. Cloud is already fixed.

Check Point firewalls with IKEv1 remote-access VPN can be logged into without a valid password (CVE-2026-50751). Used in attacks since 7 May, including a Qilin ransomware case. Install Check Point's hotfix or disable IKEv1/legacy clients, then check logs from 7 May.

PHP2Shell lets attackers run code on vulnerable web servers without logging in. The original two flaws have PHP fixes, but bundled-product updates remain uneven and a separate follow-up awaits release. Ask your website host or IT team to confirm protection.

Copy Fail lets someone already running code on an affected Linux machine gain administrator control. Attackers are using it. Install your distribution's kernel security updates and restart; some specialist kernels still lack a fix.

CISA confirms attacks using Linux kernel flaw CVE-2022-0995. Someone already able to run code locally could gain higher privileges or crash the machine. Install your Linux vendor's kernel update and restart; some older Ubuntu kernels remain vulnerable.

CISA says attackers are using three Linux kernel flaws (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266). Kernel fixes exist, but coverage varies by distribution and device. Update your Linux system, router or appliance firmware; ask the vendor if unsure.

Google's March 2026 Android update fixes CVE-2026-21385, a Qualcomm memory flaw possibly used in limited, targeted attacks. CISA lists it as exploited. Install updates until your phone shows a security patch level of 2026-03-05 or later.

Google fixed an exploited Pixel modem flaw that needs no user interaction or prior privileges. Install the latest Pixel update and check for security patch level 2026-09-05 or later. Fix coverage for other devices using affected Samsung chips is unconfirmed.

CISA lists VMware Aria Operations flaw CVE-2026-22719 as exploited. It permits commands without a login during support-assisted migration. Ask IT to install the fixed release; older Telco installations need Broadcom's upgrade guidance.

Attackers are using an old Cisco IOS 12.4 web administration flaw to run router commands. The software is unsupported and no fixed release is confirmed. Ask your network provider to identify and replace affected equipment.

Attackers are using a GlobalProtect VPN flaw to enter business networks without valid credentials, including for ransomware. Ask IT to install the correct PAN-OS fix, confirm Prisma Access upgrades and investigate suspicious VPN connections.

Ivanti Connect Secure VPN appliances have a login-bypass flaw (CVE-2026-104935) that lets attackers run commands without an account, and it is being used in attacks. If you run one, update now: 25.1.1.2, 25.1.3.x or 22.8R2.5. Home users are not affected.

Attackers are targeting a Brotli flaw in business software and potentially WordPress hosting. Ask IT or your website host to patch every affected library and bundled copy, then restart or redeploy services. Some vendor fixes remain pending.

Ledger wallets sold through CryptoBilis contained cryptocurrency-stealing implants; one Trezor Safe 5 is also suspected. Affected buyers should move funds to a trusted, newly created wallet with a new recovery phrase. Reusing the old phrase leaves funds exposed.

Socket found 77 linked Firefox add-ons; 40 were confirmed wallet stealers. Some began harmless and turned malicious via updates. 16 more followed in October. If you entered a recovery phrase in one, move funds to a new wallet. Remove unfamiliar wallet extensions.

Bitdefender found Midnight Mimosa malware preinstalled in cheap MediaTek Android phones (Doogee, Cubot, fake-brand clones) in 150+ countries. It can silently install apps and use the phone as a proxy. Can't be uninstalled; check for a maker firmware update or replace the phone.

Google disrupted a botnet in more than 1.3 million Android TV boxes, but infected devices remain backdoored. Videostrong and MECOOL owners should check with their seller, disconnect suspected boxes and seek a replacement or verified clean firmware.

A hijacked website script stole about US$2.7 million from Polymarket traders. Trading has resumed and refunds are automatic, but reimbursement is not confirmed complete. Check your positions, balances and refund amount.

Malicious Claude Code extensions in Cursor potentially exposed up to 5,000 developers. Distribution has stopped, but affected computers need investigation and cleanup: updating or uninstalling the extension alone does not remove its backdoor components.

Socket found 264 more Chrome extensions that redirect searches through the operators' servers, bringing the total to 319 and about 13.4 million installs. Check your extensions list and default search engine, and remove anything you didn't choose.

Dirty Frag lets someone already running code on affected Linux computers or QNAP storage gain full administrator access. Install your Linux distributor's kernel updates and restart; update QNAP firmware. Some specialised Ubuntu kernels still await fixes.

Eight eMudhra certificate keys could be recovered and used to impersonate websites. Major browsers have protections, but some apps still need separate fixes. Update browsers, operating systems and apps; malicious interception remains unconfirmed.

Attackers are using a critical flaw in Nextcloud's optional Built-in CODE Server app (richdocumentscode) to plant web shells. Update it to 26.4.303 or remove it; disabling is not enough. Check for unknown PHP files if it was exposed.

Plex2Shell attacks target internet-accessible Plex Media Servers, installing miners and routing strangers’ traffic through victims’ connections. Update to 1.43.3.10861 or later; an already compromised server also needs cleaning or rebuilding.

Attackers used a login bypass in Cisco Catalyst SD-WAN business-network systems, later linked to KeyDrift malware designed to collect encryption keys. Fixes are available. Ask IT to update all affected components and investigate any earlier compromise.

Attackers used iCagenda's event attachments to upload and run malicious files on Joomla websites. The flaw was fixed in June. Website owners should install the current release and check for earlier compromise; visitors have no software to update.

Attackers are exploiting CVE-2026-48282 in Adobe ColdFusion website servers. Businesses should install the latest cumulative update: the first fixes were 2025 Update 10 and 2023 Update 21.

Attackers are exploiting IBM Langflow OSS 1.0.0–1.10.0 to run code without signing in. Version 1.10.1 fixes this flaw. Ask whoever runs your AI systems to update, investigate exposed servers and replace exposed credentials.

Cisco Secure Email Gateway flaw CVE-2026-76461 (CVSS 9.8) lets an unauthenticated attacker gain root with a crafted email, and is being used in attacks. Fixed in 15.5.5-014, 16.0.4-302 and 16.5.0-780. No workaround. Businesses running the appliance should update now.

BeyondTrust Remote Support has a critical login-bypass flaw (CVE-2026-102764) attackers used from late August. Cloud customers are already patched. Self-hosted IT teams should apply BT26-05-RS now and check for earlier compromise.

CISA says attackers are using CVE-2026-48356, a critical file upload flaw in Adobe Commerce and Magento Open Source. Adobe fixed it in July 2026. Store owners should apply the July patch for their version and check for files uploaded earlier, since patching doesn't remove them.

Arista's on-premises VeloCloud Orchestrator has a critical SQL injection flaw (CVE-2026-114625) that attackers are exploiting. Fixes are out: 5.2.3.18, 6.1.3.10 or 6.4.2.12. If you run it, update and limit who can reach its web interface.

GitLab's CVSS 10 flaw CVE-2026-97229 lets anyone run code on a self-managed GitLab server without logging in, and CISA says it's being exploited. Fixed in 19.4.2, 19.3.5 and 19.2.8. If you run your own GitLab, update now. GitLab.com is already patched.

Two patched Windows flaws let attackers who already have access gain greater control. CISA confirmed exploitation in April and later flagged ransomware use of CVE-2025-60710. Install current Windows security updates and restart.

Lazarus used a Windows flaw to turn an existing foothold into SYSTEM-level control and hide malware. Microsoft released fixes on 11 August. Install current Windows updates; defence-sector staff should also report suspicious recruitment downloads to IT.

BlueMoon used phishing links and three Chrome/Windows flaws to install spying malware on targeted Windows PCs. Fixes are available for Chrome, Edge and affected supported Windows versions. Update browsers and Windows; suspected infections need investigation.

A CoreGraphics flaw could let a malicious file run code on affected iPhones, iPads and Macs. Targeted exploitation was reported. Fixes now include older devices: install the latest Apple software update offered for your device.

Ransomware is targeting Synology NAS storage devices running outdated DSM. Update to the latest DSM your model supports, enable automatic updates and keep the management interface off the public internet. Fixes are available.

Four critical Chrome flaws could let malicious web pages run code, including outside Chrome's protective sandbox. Fixes are available for desktop and Android. Update Chrome and relaunch it; Chromebook users should install the latest ChromeOS update.

Attackers used a flaw in Apache ActiveMQ Classic's management interface to run code on business servers. Two later flaws bypassed its original fix. Ask IT to install a current supported release, rather than stopping at the March updates.

Attackers are using a Kentico Xperience website-management flaw that lets someone with privileged staging access run code on the server. Website owners should ask their provider to install Kentico's latest cumulative hotfix and check for compromise.

Cisco says attackers are exploiting CVE-2026-76418, which lets anyone on the internet make ASA and FTD firewalls with SSL VPN reload. Fixed releases are out. Businesses and IT providers should upgrade now; homes are unlikely to run these.

A low-rated Broadcom VMware ESX flaw (CVE-2026-41709) that lets an admin act without leaving logs is now on CISA's exploited list. Mainly a business issue: if you run ESX 8.0, 9.0 or 9.1, install the July builds. No workaround exists.

An Elements flaw let an attacker drain roughly US$320 million from Liquid's bitcoin reserves. Full L-BTC backing is restored, but direct Federation withdrawals remain restricted. SideSwap conversions are open; no wallet or key change is required.

An attacker used inflated MAMO collateral to borrow US$11.03 million from Moonwell on Base, leaving about US$9.13 million in debt after liquidations. Supplier recovery remains unresolved. Check affected positions with Moonwell before adding funds.

Attackers abused a flaw in SagaEVM's inherited Ethermint code to mint Saga Dollars without backing and took about US$7M on 21 Jan 2026. No recovery reported. SagaEVM is reportedly shutting down 23 Nov 2026: if you hold assets on it, withdraw them.

Ahold Delhaize’s cyberattack disrupted supermarket apps and orders across Europe and the US. Services returned in stages, but a group-wide all-clear remains unconfirmed. Check orders and refunds directly through your supermarket.

Bonzo Lend users face losses after a false price feed enabled US$9.05 million in borrowing. The verifier was fixed, but recovery remains incomplete. Claims are targeted for the week of 9 November; wait for official instructions.

Attackers accessed Burger King Japan’s app membership system on 2–7 October, exposing about 11.18 million records. Card numbers were not held there; password leakage was not confirmed. Watch for impersonation emails, texts and calls.

Quest Diagnostics says an intruder accessed patient records in Quanum LSM, the system clients use to order tests and get results. Quest says it is remediated, but the data and patient count are unknown. Watch for phishing and wait for a Quest letter.

Cedar County Memorial Hospital restored electronic records on 28 August after a two-week outage. Unauthorised access is confirmed; patient-data exposure remains under review. Patients concerned they were affected can request free credit monitoring.

A compromised website supplier let attackers steal about US$3 million from Polymarket customers. Polymarket said it removed the malicious code and would refund victims. Check June account activity and contact support about losses or unpaid refunds.

Sony’s Japanese So-net service lost 2,585,481 customer records, including plala (S Course) customers, plus 54,401 email credentials. Affected email users must reset their passwords through So-net’s official website. Watch for impersonation scams.

Attackers stole 23.75 million USDC from Ostium’s liquidity vault; trader collateral was unaffected. Trading resumed, but compensation remains incomplete. Affected vault holders should check the official recovery portal and read its release terms.

A Loblaw breach affected approximately two million Canadians, exposing varying combinations of contact, birth date, loyalty, purchase and partial card details. Check your individual notice, verify unexpected messages and use the identity protection offered.

Targeted advertisements delivered Candiru spyware to Al Jazeera devices without a click. Advertising platforms restricted Discover-Tech, but no complete remedy is confirmed. Block ads and seek specialist help if you face targeted surveillance.

Apple sent spyware warnings to targeted users in 110 countries on 13 August. A warning establishes targeting, not successful infection. Verify it at account.apple.com, update your devices, enable Lockdown Mode and seek specialist help.

Gyazo’s breach affected account records and image metadata, including location data and extracted text. Some images were accessed. Change your Gyazo password and similar passwords elsewhere; review older images before restoring sharing.

Unauthorised access at Amadeus exposed airline booking data, including some passport numbers. JAL reports 92,000 affected customers, ANA 37,800 and Cathay 53,000 bookings. Check airline notices and verify unexpected travel messages directly.

Ransomware closed UMMC's 35 Mississippi clinics in February; normal operations resumed on 2 March. November notices warn of possible personal and medical data exposure. Check any notification and ask UMMC whether you are affected.

Hackers copied confidential P3 crime and school-safety data, exposing tipsters and people named in reports. The 8.3 million figure counts records, not people. Ask your programme about exposure; Toronto has paused tips. Never share tip passwords with callers.

Attackers posing as IT staff stole data on about 6.39 million current and former Odido and Ben customers. The data was later published. Ask Odido what was exposed and verify unexpected calls and messages through its official app or website.

Aesto Health’s December 2025 breach affected 9,540,683 patients through their healthcare providers. Information included health, identity and financial details. Check your notice, use the offered protection and consider freezing your US credit files.

Attackers stole customer data from Manchester, Stansted and East Midlands airport services and later published it. MAG says everyone affected has been told. Watch for convincing booking-related scams; existing bookings remain valid.

Denmark's population register exposed names, addresses and CPR identification numbers for about 8.8 million people through misused company access. Access was blocked; investigations continue. Treat callers who know these details with caution.

GMO’s Onamae.com Desktop Cloud breach affects customers using hosted desktops, including FX traders. GMO revised its shutdown advice on 28 October: scan and back up before reusing PCs, reset trading passwords from another device and end all sessions.

Revolve says an attacker may have obtained shoppers’ saved card numbers, expiry dates and contact details. A filing tracker puts the potential total at 1.5 million. Check your breach notice, review transactions and contact your card issuer.

Binance is expanding withdrawals after a US$6.34 billion theft. It now reports 98% of affected tokens replenished and says it will cover losses. Customers should check their exact asset and network in Binance’s official app or website.

Florida says a student financial aid website breach may affect 4.9 million people. Past applicants should check the official notice, review financial accounts and credit reports, and consider a credit freeze or fraud alert.

UNM Health's 26 October cyberattack disrupted patient care. UNM says clinical services are restored, although an IT disruption alert remains open. Confirm cancelled care with your clinic and ignore anyone offering attack-related compensation.

Indian exchange CoinDCX lost about US$16M in USDT on 21 Oct from old deposit addresses it said were retired. It says it absorbed the loss and user balances are unaffected; Tether froze about US$2.2M. Customers need not act, but keep funds off any exchange you don't need.

Crypto casino Duelbits lost about US$7M from hot wallets on 24 Sep. It reopened on 27 Sep and says user funds are safe. No cause or recovery has been published. Users: keep only what you're willing to risk on the platform.

Times Car, Japan's car-sharing service, says data from about 6.6 million current and former accounts was stolen, including driver's licence details and ID images. Passwords were stored unreadably and cards were not exposed. Be wary of messages claiming to be Times Car.

Australian court files were accessed by unauthorised offshore transcription staff working through VIQ. Its Australian business has wound down, but investigations remain open. If your case used VIQ, ask your lawyer or court registry whether your information was affected.

Capcom says attackers took 11.77 million CAPCOM ID records (emails, login dates, last IP address) and changed passwords on 196 accounts, now reset. Expect phishing pretending to be Capcom. Don't click links in unexpected messages; no card data was involved.

A fake Padre Terminal app on Apple's App Store took imported Solana wallet keys and is linked to about US$23,000 stolen from 27 wallets. Apple removed it. Never import wallet keys into an app; the real Padre/Terminal service is web-only.