https://hard.fyi/situations/ Only when it matters: what is happening, and what to do. en-au Sat, 31 Oct 2026 22:00:00 GMT https://hard.fyi/images/brand/apple-touch-icon.pnghttps://hard.fyi/situations/ https://hard.fyi/situations/2026-11-01-linux-tcp-remote-root/ https://hard.fyi/alerts/#2026-11-01-linux-tcp-remote-root Sat, 31 Oct 2026 22:00:00 GMT Alert CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP code: while a connection is being set up, the kernel can free some data too early and then read it again. The kernel's own rating is 9.8 out of 10. Anthropic, whose researcher reported it, says an unreleased Claude model built an exploit that ran commands as root on a server with a multipath TCP listener, in about 53 minutes. That exploit hasn't been published, and nobody has reported attacks. Debian, Oracle, SUSE and Amazon have fixed kernels for some versions; Ubuntu and Red Hat Enterprise Linux didn't as of 30 October. What to do: Ask whoever runs servers for you (the family office, a business, the person who set up a home server or NAS) whether they run Linux, and to install the fixed kernel and reboot as soon as their distribution ships it. Until then, they can block IPv4 packets that carry IP options at the firewall. https://hard.fyi/situations/2026-11-01-name-com-domain-hijack/ https://hard.fyi/alerts/#name-com-domain-hijack Sat, 31 Oct 2026 22:00:00 GMT Alert Late on Friday 30 October, US time, at least twelve crypto websites registered through Name.com started sending visitors to a copy of the site rigged with Step Drainer, a kit that tricks people into approving transfers out of their wallets. Ten of the domains were bought through Vercel Domains, which uses Name.com underneath. Name.com says 15 domains were affected and all have been restored. About US$138,000 has been traced so far. Neither company has said how the attackers got in. What to do: If anyone in the family connected a crypto wallet to a DeFi site on 30 or 31 October, check and revoke its approvals at revoke.cash, and move what's left to a fresh wallet if they signed anything. If the family owns a domain through Vercel or Name.com, check its nameservers haven't changed, turn on two-step sign-in and ask for a registry lock. https://hard.fyi/situations/2026-10-22-ai-key-platforms/#update-2 https://hard.fyi/alerts/#ai-key-platforms/u/2 Sat, 31 Oct 2026 04:41:00 GMT Alert Northflank, a platform that runs customers' apps and databases, said on 30 October that attackers got at the secrets customers store with it, and that customers should assume every one was decrypted. Several customers say their AI keys have already been used. Wiz, the security firm that raised the alarm, now counts nine AI developer platforms hit since 6 October, which it calls Black October, and says it has seen stolen keys tried within 30 minutes of being taken. What to do now: If your company, family office or anyone building software for you uses Northflank, Railway, OpenCode, Fireworks AI or any similar platform, ask them to change every key and password stored there today, check their AI providers' usage and bills, and set spending limits on AI accounts. https://hard.fyi/situations/2026-10-31-binance-hack/ https://hard.fyi/alerts/#binance-hack Fri, 30 Oct 2026 22:00:00 GMT Alert On 29 October, attackers moved about US$6.3 billion out of Binance across ten blockchains in about 20 minutes. TRM Labs and Chainalysis blame North Korea's TraderTraitor group, which the FBI linked to the US$1.5 billion Bybit theft. Binance paused deposits and withdrawals, says it froze about US$3 billion, and says it will cover every loss. What to do: If anyone in the family holds crypto on Binance, check the balance in the Binance app yourself, and don't act on any call, text or email about the hack: Binance won't ask you to move funds or share a code. Expect fake 'recovery' offers. Once withdrawals resume, keep on any exchange only what you're trading. https://hard.fyi/situations/2026-10-31-scribd-breach/ https://hard.fyi/alerts/#scribd-breach Fri, 30 Oct 2026 22:00:00 GMT Alert Scribd says someone got into its systems, moved on to other internal systems and reached user data. For most people that's basic account details. For a smaller group it's the email address with the card's issuer, country, expiry date, last four digits and payment history, though not the full card number. Notices are going out in phases, by email from Epiq. What to do: If anyone in the family uses Scribd, Everand, SlideShare or Fable, change that password, and anywhere it's reused. Treat any call, text or email about the account or the card as suspect, even if it quotes the last four digits: Scribd says it won't ask for passwords or personal details. https://hard.fyi/situations/2026-10-22-ai-key-platforms/#update-1 https://hard.fyi/alerts/#ai-key-platforms/u/1 Thu, 29 Oct 2026 11:50:00 GMT Alert Railway says the attacker was inside its systems from 20 to 22 October, that stored keys and passwords in up to 1.85% of workspaces (about 100,000) may have been exposed, and that it can't yet rule out that customers' source code was read. On 26 October it said the incident was resolved for existing customers, but keys taken before then work until they're changed. What to do now: If your company, family office or anyone building software for you uses Railway, OpenCode or Fireworks AI, ask them to change every stored key and password if they haven't yet, and to set spending limits on AI accounts. If they use Railway, also ask them to check their GitHub and database access logs, as Railway recommends. https://hard.fyi/situations/2026-10-22-php2shell/#update-2 https://hard.fyi/alerts/#php2shell/u/2 Thu, 29 Oct 2026 11:50:00 GMT Alert CISA, the US cybersecurity agency, added both php2shell flaws to its list of vulnerabilities being used in attacks on 26 October. A researcher has since seen attackers run their own code on an unpatched test server, Amazon says attempts began on 17 October, four days before the fix, and on 28 October CISA listed a Linux flaw it says can be chained with them to take full control of a server. What to do now: Ask anyone who runs a website for you to confirm it's on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or their vendor's fixed version. Ask them to check it for signs of a break-in since 17 October: updating doesn't remove anything an attacker already left behind. If it's on PHP 8.1 or older, ask for it to be upgraded or taken offline now. Ignore emails urging you to log in for a security update. https://hard.fyi/situations/2026-10-22-php2shell/#update-1 https://hard.fyi/alerts/#php2shell/u/1 Thu, 29 Oct 2026 11:50:00 GMT Alert PHP warned on 23 October of a third, related flaw (CVE-2026-115560) that the 21 October releases don't fix, and called it an unlikely way in. It only affects websites whose code changes how PHP stores sessions while it's running, the setting change PHP already recommended for the second flaw blocks it, and the fix comes in PHP's next regular release. https://hard.fyi/situations/2026-10-28-plex-servers-under-attack/ https://hard.fyi/alerts/#plex-servers-under-attack Tue, 27 Oct 2026 22:00:00 GMT Alert Attackers are chaining four flaws in Plex Media Server to take over servers without logging in. They install crypto miners and proxy software that sends strangers' internet traffic out through the owner's home connection. Plex says the attacks are active and widespread, and CISA added all four flaws to its list of exploited flaws on 20 October. The fix has been out since early August. What to do: Update every Plex Media Server in the family to 1.43.3.10861 or newer, and turn off Remote Access if nobody watches from outside the house. If a server ran an older version and could be reached from the internet, follow Plex's clean-up steps: reinstall, sign out all devices and change the Plex password. https://hard.fyi/situations/2026-10-27-qwen-beijing-upload/ https://hard.fyi/alerts/#qwen-beijing-upload Mon, 26 Oct 2026 22:00:00 GMT Alert Testing Qwen3.8-Flash-Next, an open model anyone can download and run, Cohere saw it look around the computer it ran on and try to upload a test file to Alibaba Cloud storage in Beijing, after saying it would use no tools. The sandbox blocked it. Fewer than 1 in 100,000 calls; cause unknown. What to do: If your company, family office or anyone building software for you runs Qwen models as agents that can run commands, ask them to cut those agents off from the internet unless they need it, and to block the hosts Cohere names. If nobody runs AI models themselves, nothing to change today. https://hard.fyi/situations/2026-10-24-capcom-id-breach/ https://hard.fyi/alerts/#capcom-id-breach Fri, 23 Oct 2026 22:00:00 GMT Alert The Resident Evil and Street Fighter maker says email addresses, sign-up dates, login counts and last-login IP addresses were exposed. Capcom has not confirmed exposure of customers' original passwords. Attackers changed 196 account passwords, which Capcom reset. Card details were not affected. For 43 accounts, birth dates, gender, country and nicknames were also taken. What to do: If anyone in the family has a CAPCOM ID, expect convincing fake Capcom or gaming emails and treat links in them as untrusted. If that password is used anywhere else, change it there. https://hard.fyi/situations/2026-10-24-signal-hang-up/ https://hard.fyi/alerts/#signal-hang-up Fri, 23 Oct 2026 22:00:00 GMT Alert CVE-2026-113380, rated 9.3: someone on a Signal call with you could stop your hang-up from ending it, leaving your microphone (and possibly camera) on. Signal fixed it in September. No known attacks. What to do: Update Signal on every phone, tablet and computer in the family, including the ones nobody uses much. https://hard.fyi/situations/2026-10-23-bind-gss-tsig/ https://hard.fyi/alerts/#bind-gss-tsig Thu, 22 Oct 2026 22:00:00 GMT Alert ISC disclosed CVE-2026-94300, rated 8.1: replayed or crafted GSS-TSIG messages can corrupt memory in BIND 9 and may allow remote code execution. No workaround, no known attacks yet. What to do: Ask whoever runs IT for you (company, family office, web host) whether they run BIND, and confirm it's on 9.20.30 or 9.21.27. https://hard.fyi/situations/2026-10-22-rules-off/ https://hard.fyi/alerts/#rules-off Wed, 21 Oct 2026 22:00:00 GMT Alert Abliteration.ai sells access to frontier AI models with their refusals removed, with a free sign-up, no identity checks and no record kept of what's asked. What to do: Nothing to change today. Make sure nobody moves money or shares a code because of a message alone: they call back on a number they already had. https://hard.fyi/situations/2026-10-22-ai-key-platforms/ https://hard.fyi/alerts/#ai-key-platforms Wed, 21 Oct 2026 22:00:00 GMT Alert Railway, a hosting platform popular with developers, says someone accessed the secrets customers store with it, some decrypted. It believes it's part of a series of attacks on platforms, aimed at AI providers, after Fireworks AI and OpenCode. What to do: If your company, family office or anyone building software for you uses Railway, OpenCode or Fireworks AI, ask them to change every stored key and password today, and to set spending limits on AI accounts. https://hard.fyi/situations/2026-10-22-php2shell/ https://hard.fyi/alerts/#php2shell Wed, 21 Oct 2026 22:00:00 GMT Alert PHP, the language behind about 7 in 10 websites, released fixes on 21 October. Some security firms report early attacks; others, and the US agency CISA, haven't seen any. PHP 8.1 and older get no official fix. What to do: Ask anyone who runs a website for you whether it now runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or their vendor's fixed version. If it's on PHP 8.1 or older, ask for a plan to upgrade or take it offline. Ignore emails urging you to log in for a security update. https://hard.fyi/situations/2026-10-19-deepseek-abliterated/ https://hard.fyi/alerts/#deepseek-abliterated Sun, 18 Oct 2026 22:00:00 GMT Alert 35 hours after DeepSeek released V4.1 Flash, a patch removing its refusals, including around cyber attacks, appeared on Hugging Face. What to do: Nothing to do today. Expect scam emails, texts and calls to keep getting more convincing.