Situation Room
The Situation Room is HARD’s running record of serious events in cybersecurity: breaches, flaws being used in attacks, scams and turns in AI, each written up in plain English with what to do about it, and kept up to date as it develops. Every situation has a level, a hazard label and an article of its own, with a timeline and its sources.
As of 1 November 2026 it has 13 articles. Eight are current: first reported or updated in the last week.
Happening now
- Linux servers: a flaw in how connections start could let a stranger take over, and Ubuntu and Red Hat have no fix yet. A Linux flaw rated 9.8 could let someone on the internet take over a server before it even answers. High · Software flaw · First reported
- Hijacked at the registrar: crypto sites bought through Name.com and Vercel served a wallet drainer. On 30 October, attackers took over 12 crypto sites registered with Name.com, 10 of them through Vercel. High · Scam · First reported
- Northflank, a platform-as-a-service, is the ninth developer platform this month to lose the keys customers stored with it. Northflank, a platform that runs customers' apps and databases, said on 30 October that attackers got at the secrets customers store with it, and that customers should assume every one was decrypted. High · Data breach · Updated
- Binance robbed of US$6.3 billion in 20 minutes, the biggest crypto theft on record. Attackers took about US$6.3 billion from Binance on 29 October, the biggest crypto theft ever. High · Data breach · First reported
- Scribd breached: account details, and for some card details, of Scribd, Everand, SlideShare and Fable users. Scribd, which also runs Everand, SlideShare and Fable, says intruders reached user data. Watch · Data breach · First reported
- Two critical PHP flaws now have a fix. Some firms report early attacks. CISA, the US cybersecurity agency, added both php2shell flaws to its list of vulnerabilities being used in attacks on 26 October. Critical · Software flaw · Updated
- Plex Media Server under attack: update to 1.43.3.10861 or newer now. Attackers are taking over Plex Media Server installs to mine crypto and resell your internet connection. Critical · Software flaw · First reported
- An Alibaba AI model tried to upload a file to a server in Beijing during Cohere's tests. In Cohere's tests, Alibaba's open Qwen3.8 model tried to upload a file to a server in Beijing after saying it would use no tools. Watch · AI · First reported
Recent changes
New articles and updates in the last three weeks, newest first. Times are Sydney’s.
-
- Northflank, a platform-as-a-service, is the ninth developer platform this month to lose the keys customers stored with it · Update 2, Wider attacks: Northflank, a platform that runs customers' apps and databases, said on 30 October that attackers got at the secrets customers store with it, and that customers should assume every one was decrypted.
- New article: Binance robbed of US$6.3 billion in 20 minutes, the biggest crypto theft on record, at High.
- New article: Scribd breached: account details, and for some card details, of Scribd, Everand, SlideShare and Fable users, at Watch.
-
- Northflank, a platform-as-a-service, is the ninth developer platform this month to lose the keys customers stored with it · Update 1, Vendor revised: Railway says the attacker was inside its systems from 20 to 22 October, that stored keys and passwords in up to 1.85% of workspaces (about 100,000) may have been exposed, and that it can't yet rule out that customers' source code was read.
- Two critical PHP flaws now have a fix. Some firms report early attacks · Update 1, Vendor revised: PHP warned on 23 October of a third, related flaw (CVE-2026-115560) that the 21 October releases don't fix, and called it an unlikely way in.
- Two critical PHP flaws now have a fix. Some firms report early attacks · Update 2, CISA added: CISA, the US cybersecurity agency, added both php2shell flaws to its list of vulnerabilities being used in attacks on 26 October.
-
- New article: Plex Media Server under attack: update to 1.43.3.10861 or newer now, at Critical.
-
- New article: An Alibaba AI model tried to upload a file to a server in Beijing during Cohere's tests, at Watch.
-
- New article: Capcom confirms 11.7 million CAPCOM ID accounts were accessed, at Watch.
- New article: Signal calls could stay open after you hung up, fixed in Android 8.27, iOS 8.30 and Desktop 8.30, at High.
-
- New article: BIND DNS servers: a flaw that could let attackers take over, fixed in 9.20.30, at High.
-
- New article: AI with its safety rules removed now rents for US$20 a month, at Watch.
- New article: Northflank, a platform-as-a-service, is the ninth developer platform this month to lose the keys customers stored with it, at High.
-
- New article: Two critical PHP flaws now have a fix. Some firms report early attacks, at Critical.
- New article: A leading open AI model, with its safety rules removed, is free to download, at Watch.
By kind
Breaches
A company that holds people’s details says someone got at them.
- Northflank, a platform-as-a-service, is the ninth developer platform this month to lose the keys customers stored with it · high · 22 Oct 2026
- Binance robbed of US$6.3 billion in 20 minutes, the biggest crypto theft on record · high · 31 Oct 2026
- Scribd breached: account details, and for some card details, of Scribd, Everand, SlideShare and Fable users · watch · 31 Oct 2026
- Capcom confirms 11.7 million CAPCOM ID accounts were accessed · watch · 24 Oct 2026
Flaws
A flaw in software people use, being used in attacks or serious enough that it soon could be.
- Linux servers: a flaw in how connections start could let a stranger take over, and Ubuntu and Red Hat have no fix yet · high · 1 Nov 2026
- Two critical PHP flaws now have a fix. Some firms report early attacks · critical · 21 Oct 2026
- Plex Media Server under attack: update to 1.43.3.10861 or newer now · critical · 28 Oct 2026
- Signal calls could stay open after you hung up, fixed in Android 8.27, iOS 8.30 and Desktop 8.30 · high · 24 Oct 2026
- BIND DNS servers: a flaw that could let attackers take over, fixed in 9.20.30 · high · 23 Oct 2026
Scams
A trick going round, by phone, text, email or the web.
- Hijacked at the registrar: crypto sites bought through Name.com and Vercel served a wallet drainer · high · 1 Nov 2026
AI
AI models and services doing, or making possible, things that matter for security.
- An Alibaba AI model tried to upload a file to a server in Beijing during Cohere's tests · watch · 27 Oct 2026
- AI with its safety rules removed now rents for US$20 a month · watch · 22 Oct 2026
- A leading open AI model, with its safety rules removed, is free to download · watch · 21 Oct 2026
By level
Each situation’s level is HARD’s call on how soon to act. It sets the signal word on its hazard label, and an update can raise or lower it.
Archive
Every situation, by the month it was first reported.
November 2026
| Reported | Situation | Kind | Level | Status |
|---|---|---|---|---|
| Linux servers: a flaw in how connections start could let a stranger take over, and Ubuntu and Red Hat have no fix yet | Software flaw | High | Developing | |
| Hijacked at the registrar: crypto sites bought through Name.com and Vercel served a wallet drainer | Scam | High | Developing |
October 2026
Get alerts
The same warnings by email, only when something serious happens, with what to do about it.
Or follow by RSS: the Situation Room, the journal, advisories, or all three.
About the Situation Room
Each situation’s hazard label is styled on the safety labels on power tools and chemicals: Danger for critical, Warning for high and Notice for watch, with a pictogram for its kind. The same label is its share card.
When something changes, an update goes into the situation’s timeline with its own sources, and out by email, RSS and to HARD’s apps. Updates are added, never edited away, so the record of what HARD said, and when, stays whole. Articles are written from companies’ own notices and named reporting, and every source is listed under References.
To check whether a particular flaw is being used in attacks, use Search; for every flaw on CISA’s list, see Flaws.