Skip to content
HACKTECH

Cyber news digest

What broke, and what we check because of it.

Breaches, exploited vulnerabilities, supply chain compromises and new rules, written up for the people who buy security work, with what each one means for an organisation that runs the same kind of systems. Every item cites at least two sources and was verified against them before publication.

52 items214 cited sourcesLatest item 5 November 2026

All 52 items

November 2026

5 items

  • AI security

    Three charged in alleged $129 million scheme using AI-cloned executive voices

    The US Attorney's Office in Manhattan said on 5 November 2026 that an indictment had been unsealed charging three defendants with wire fraud, aggravated identity theft and money laundering over a scheme that allegedly used artificial intelligence to impersonate corporate executives and attorneys and took about $129 million, according to the Associated Press and The Next Web. According to court documents cited by AP, the group emailed staff, often in accounting departments, posing as CEOs who needed help with a confidential financial transaction, then arranged phone or video calls in which AI mimicked the executive's voice and sometimes image. Victims were directed to an impersonated attorney at a major law firm who gave wire instructions, and the funds were converted to cryptocurrency. The charges are allegations and the defendants are presumed innocent.

    • Social engineering assessment
    • Threat modelling
    • Red team & purple team
  • Mobile & IoT

    US agencies warn of attacks on refrigeration controllers after European supermarket hacks

    CISA, the FBI and the US Departments of Health and Human Services, Agriculture and Transportation warned on 5 November 2026 that attackers are targeting unpatched or internet-accessible electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. According to BleepingComputer, the warning followed October attacks that remotely defrosted refrigerators at an estimated 250 to 350 French supermarkets, a second wave affecting more than 115 stores across six European countries, and an incident at three facilities of France's blood service. The agencies urged operators to take controllers off the public internet, change default passwords and apply available updates.

    • Network & infrastructure testing
    • Incident response
    • Threat modelling
  • Mobile & IoT

    Sekoia ties mobile watering-hole campaign using iOS and Android n-day chains to APT29

    Sekoia's Threat Detection & Research team reported on 4 November 2026 a watering-hole campaign, uncovered in mid-October, that used compromised or cloned websites in the US, Ukraine, the Czech Republic and Bulgaria to profile visitors and serve platform-specific n-day exploit chains to unpatched iPhones and Android devices without user interaction. Between 27 August and 3 September 2026 the attackers also tampered with the Plerdy analytics tracker, which Sekoia says is loaded by thousands of mostly Ukrainian websites. Sekoia assesses with moderate to high confidence that APT29 (Midnight Blizzard) ran the campaign, and says every flaw used had been fixed by the respective vendor before it began.

    • Incident response
    • Website security audit
    • Mobile application testing
  • Regulation

    UK Cyber Security and Resilience Bill clears the Lords and returns to the Commons

    The Cyber Security and Resilience (Network and Information Systems) Bill completed its House of Lords third reading on 2 November 2026 and is now at consideration of Lords amendments in the House of Commons, according to the UK Parliament bill record. Introduced on 12 November 2025, the bill would reform the Network and Information Systems Regulations 2018 and, according to the government, bring medium and large managed service providers into regulation for the first time and data centres into scope. As introduced, organisations in scope would have to report more harmful cyber incidents to their regulator and the National Cyber Security Centre within 24 hours, with a full report within 72 hours.

    • Incident response
    • Network & infrastructure testing
    • Cloud configuration review
  • Mobile & IoT

    Google and partners dismantle XCPE backdoor botnet on 1.3 million Android TV boxes

    Google Threat Intelligence Group (GTIG) said on 2 November 2026 that Google and industry partners had dismantled the XCPE backdoor, which had enrolled more than 1.3 million set-top boxes into a botnet. GTIG assessed with high confidence that the backdoor was intentionally developed and operated for financial gain by Android device manufacturer Videostrong Technology Co., which sold access to criminal affiliates whose modules carried out ad fraud, enrolled devices in residential proxy networks and loaded further malware. Google assessed that taking down the affiliates' command-and-control domains will sever access to at least 10 million additional compromised devices, and it has banned Videostrong from building certified Android devices.

    • Network & infrastructure testing
    • Threat modelling
    • Mobile application testing

October 2026

13 items

  • Cloud & identity

    Northflank breach: control-plane secrets decrypted, customers report AI API key abuse

    Cloud application hosting platform Northflank told customers on 30 October 2026 to assume all environment variables had been decrypted and to disable or rotate all keys, after receiving a threat alert from Wiz at 11:43 UTC. In a 6 November update, Northflank said the first known decryption of secrets occurred between 02:39 and 03:08 UTC that day, that the exploit was patched within 60 minutes of notification, and that it had found no evidence customer workloads or workload data were accessed. Customers reported unauthorised use of AI API keys stored on the platform. Wiz listed Northflank among at least nine AI developer platforms that disclosed incidents in October, while noting that no single vulnerability or dependency links them.

    • Cloud configuration review
    • Incident response
    • AI & LLM application testing
  • Social engineering

    Cisco Talos IR: fake IT help desk contacts talked staff into remote access in Q3 2026

    Cisco Talos Incident Response reported on 29 October 2026 that in several third-quarter engagements, attackers posing as IT help desk staff persuaded employees to allow remote access through legitimate remote monitoring and management (RMM) tools; Help Net Security reported the contacts came by phone, email and Microsoft Teams. In an engagement involving the new VYPR ransomware, a vishing call got a user to start a Microsoft Quick Assist session, after which RMM software already on the network installed an MSI package from a remote IP address, although Talos could not confirm what the caller said. Talos said phishing remained the most common initial access vector, appearing in 37% of engagements, while ransomware and pre-ransomware incidents rose to 27%.

    • Social engineering assessment
    • Incident response
    • Red team & purple team
  • Ransomware & extortion

    Coveware Q3 2026: median ransom rises to $400,000; leak questions paying for silence

    Coveware's quarterly ransomware report for Q3 2026, published on 28 October 2026, said the median ransom payment rose 167% to $400,000 while the average payment fell 45% to $1,025,278, and that nearly 80% of incidents were resolved without payment. The report centred on a leak of internal chat logs attributed to the Silent Ransom Group, which Coveware said identified several victims that had paid a ransom to keep their incident out of the public domain. Check Point, which analysed the leaked 'Luna Moth Files' (Luna Moth is another name for the group), described a phone-based data-extortion operation focused on law firms and said it treats the archive's claims as unverified unless independent sources back them up.

    • Social engineering assessment
    • Incident response
    • Cloud configuration review
  • Web & CMS

    Sansec: card skimmer in Convertr's shared analytics script hit Brazilian checkouts

    Sansec reported on 26 October 2026 that a Brazilian Magecart group had appended a card skimmer to the analytics tracker that Convertr, an e-commerce platform running the stores and checkouts of dozens of Brazilian fashion brands, loads on every checkout. The skimmer captured card number, expiry date, CVV, cardholder name and CPF taxpayer number and sent them to 1x0.is. Sansec suspects, but has not confirmed, that the attackers got in through CVE-2026-8467, an unauthenticated code execution flaw reachable through the /storybook endpoint of Convertr's self-hosted Plausible Community Edition 3.0 server, which had not been updated since its 2025 install. Convertr removed the skimmer and patched Plausible on 27 October, Sansec said.

    • Website security audit
    • Web application testing
    • Incident response
  • Ransomware & extortion

    Cyberattack claimed by BYOD gang forces UNM Health to divert ambulances

    A cyberattack on the University of New Mexico Health Sciences Center on 26 October 2026 led UNM Health to divert ambulance traffic for two hours, suspend outpatient surgeries and appointments for the rest of the day, and cancel classes at four health sciences colleges the following day. UNM said the event affected some end-user devices but did not penetrate core systems or servers, that clinical operations were fully functional by 28 October, and that it did not make concessions with any group behind the threat. A new ransomware gang known as BYOD claimed the attack, and The Record later reported that the gang also claimed an incident at Michigan State University.

    • Incident response
    • Network & infrastructure testing
    • Threat modelling
  • Data exposure

    DigiCert discloses unauthorised access to internal archive exposed by migration

    DigiCert disclosed in a preliminary incident report on Mozilla's Bugzilla, filed on 20 October 2026, unauthorised access to an internal business system that stores information customer representatives provide to validate their identity. Its full report, posted on 1 November, says a February 2025 infrastructure migration moved the system from a VPN-restricted segment to an externally accessible availability zone, where an account self-registration feature let accounts be created without MFA and read archived data. DigiCert says the data access window ran from 27 June to 2 July 2026, that most of the data was business contact information while a small minority of customer accounts included a document such as a driver's licence, passport or utility bill, and that no certificates were issued, modified or revoked. The Register reported that DigiCert has not disclosed how many customers or individuals were affected.

    • Database security audit
    • Cloud configuration review
    • Network & infrastructure testing
  • AI security

    Langflow flaw turning MCP server settings into shell commands draws exploit attempts

    Langflow, a tool for building and deploying AI-powered agents and workflows, let any authenticated user add a Model Context Protocol (MCP) server whose stdio command was passed to a shell without validation, giving remote code execution on the host (CVE-2026-105740, CVSS 9.9, fixed in 1.9.0). A related advisory for CVE-2026-105697 says that with the default auto-login setting the auto-login endpoint hands out a token without credentials, and lists 1.10.3 as the patched release. The Hacker News, citing Previdian honeypot data, reported 1,423 exploitation attempts from 27 IP addresses between 19 September and 15 October 2026, later updated to 1,706 from 28 addresses, including attempts to extract LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD.

    • AI & LLM application testing
    • Application security audit
    • Incident response
  • AI security

    XBOW says AI agents on a public OpenAI model helped build a Chrome full chain in six days

    On 13 October 2026 security firm XBOW said its researchers, directing AI agents running OpenAI's publicly available GPT-5.6 Sol model, built a three-bug Chrome exploit chain that could take over a Windows machine when a user loaded a web page. XBOW says the awarded chain was built between 2 and 7 August 2026 for about $40,000 in compute, and that Google paid a $250,000 reward, which XBOW describes as the first full-chain award under Google's 2026 rules. Google confirmed and fixed all three bugs, and XBOW says they were never used against Chrome users. The Hacker News notes that the six-day sprint followed months of earlier work, including a first full chain that took two months.

    • Red team & purple team
    • Network & infrastructure testing
    • Application security audit
  • Exploited vulnerabilities

    Ivanti Connect Secure zero-day chain gave attackers root on fully patched VPNs

    On 13 October 2026 Ivanti disclosed and patched CVE-2026-104935, an authentication bypass in Connect Secure that lets a remote unauthenticated attacker execute arbitrary commands, and said a limited number of customers were affected. Volexity found it being exploited by a previously undocumented actor it tracks as UTA0576. According to Volexity, the actor chained it with a privilege escalation flaw to get unauthenticated root-level code execution on an appliance running 22.8R2.4, the latest release at the time. Ivanti fixed the remaining chained flaws, CVE-2026-111357 and CVE-2026-118527, on 29 October, and CISA added both to its KEV catalogue the next day.

    • Network & infrastructure testing
    • Incident response
    • Red team & purple team
  • Supply chain

    GhostAction plants secret-stealing workflows in tens of thousands of GitHub repos

    GitGuardian reported on 7 October 2026 that between 31 August and 30 September a malicious workflow, github_actions_security.yml, was pushed to 772 public repositories belonging to 373 GitHub users and organisations, and its 13 October update said a second wave on 8 to 12 October targeted more than 30,000 repositories after the GitHub accounts of about 1,900 users were compromised. The Hacker News, citing OpenSourceMalware, reported a phishing kit on my-github[.]com, a domain resolving to the campaign's exfiltration IP, that sent a maintainer a fake GitHub security alert, captured the password and 2FA code through a reverse proxy and silently authorised an OAuth device flow with repo, workflow and read:org scopes. Six days after GitHub began blocking the workflow on 9 October, a second stage appeared that commits a VS Code task set to run when a folder is opened, and GitGuardian later counted 72,026 commits to 22,964 public repositories between 13 and 21 October.

    • Social engineering assessment
    • Secure development training
    • Incident response
  • Ransomware & extortion

    Owner of ransomware recovery firm MonsterCloud charged over undisclosed ransom payments

    The US Justice Department said on 7 October 2026 that the owner of MonsterCloud, a Florida-based ransomware remediation company, had been arraigned in the Eastern District of New York on two counts of wire fraud and one count of wire fraud conspiracy. According to the indictment, the company told clients it could recover data without paying ransoms, but the owner allegedly paid the attackers for decryption keys without telling clients and charged them substantially more than the ransom. Prosecutors allege he charged clients more than $19 million and paid more than $8 million in ransom payments over the course of the scheme.

    • Incident response
    • Threat modelling
  • Breaches

    Denmark's CPR register: data on about 8.8 million people accessed via a company account

    Denmark's Ministry of Research, Education and Digitalisation said on 5 October 2026 that names, addresses and CPR numbers of about 8.8 million registered people in the Central Population Register (CPR) had been accessed without authorisation. Someone misused a private Danish company's lawful access to search the register, and the ministry said the irregular activity took place during September 2026. The CPR administration noticed it on the evening of 2 October, blocked the company's access and reported the case to the Danish Data Protection Agency (Datatilsynet), and police are investigating.

    • Application security audit
    • Web application testing
    • Database security audit
  • Ransomware & extortion

    Eurojust and Europol action on KillSec extortion group: three arrests, servers seized

    Eurojust and Europol announced on 1 October 2026 an international action against the KillSec data-extortion group, part of a German-led investigation that Europol named Operation KillSwitch. Three suspects were provisionally arrested and eight house searches were carried out in Spain, Greece, the United Kingdom and Romania; investigators identified a 16-year-old as the group's suspected main operator, and CyberScoop reported that the alleged leader was among those arrested. Authorities seized five servers and KillSec-operated domains, took control of its leak site and secured at least 110 terabytes of data. Eurojust linked the group, active since 2024, to almost 1,000 attacks worldwide, of which Europol said around 500 have so far been identified as successful.

    • Cloud configuration review
    • Database security audit
    • Incident response

September 2026

6 items

  • Exploited vulnerabilities

    Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 exploited for weeks

    Citrix released fixes on 27 September 2026 for eight NetScaler ADC and NetScaler Gateway vulnerabilities, CVE-2026-88771 through CVE-2026-88778, and said exploits of CVE-2026-88771 and CVE-2026-88772 had been observed on unmitigated deployments. Attackers used them to deliver web shells. According to CyberScoop, Mandiant said the earliest known exploitation of CVE-2026-88772 was on 3 September, that it was aware of dozens of impacted organisations, and attributed the attacks to advanced and suspected state-sponsored threat actors. CISA added both flaws to its Known Exploited Vulnerabilities catalogue the same day, and added a third exploited flaw, CVE-2026-88779, a denial-of-service bug that affects only appliances with SAML enabled, on 4 October.

    • Network & infrastructure testing
    • Incident response
    • Red team & purple team
  • Exploited vulnerabilities

    Eight SharePoint flaws added to CISA's exploited list between March and September 2026

    According to the catalogue's 6 November edition, CISA added eight Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities catalogue between 18 March and 25 September 2026. Microsoft's security update data marks CVE-2026-32201 (April) and CVE-2026-56164 (July) as exploited, and CISA added both on the day their fixes were released. Microsoft changed its record for CVE-2026-58644 to exploited one day after documenting it on 14 July, noting that the fix had shipped in June without the CVE being listed. CISA warned in July that the exploited flaws can be used for remote code execution and post-exploitation activity, including stealing IIS machine keys, to gain persistence and deploy malware.

    • Web application testing
    • Application security audit
    • Incident response
  • Exploited vulnerabilities

    Check Point confirms exploitation of VPN flaw CVE-2026-85102 and management zero-day

    Check Point said on 22 September 2026 that attackers were exploiting two flaws rated CVSS 9.8. The first, CVE-2026-85102, is a pre-authentication remote code execution flaw in Security Gateway VPN certificate handling. It was disclosed and fixed on 9 September, and Check Point saw exploitation attempts against Spark customers from 12 September. The second, CVE-2026-93616, is a pre-authentication path traversal in the management web service, which Check Point said was used in a handful of pinpointed attacks on 23 July 2026, before a fix existed. CISA added both to its Known Exploited Vulnerabilities catalogue the same day.

    • Network & infrastructure testing
    • Incident response
  • Regulation

    Cyber Resilience Act reporting duties begin as ENISA launches Single Reporting Platform

    Since 11 September 2026, manufacturers of products with digital elements made available on the EU market must report actively exploited vulnerabilities and severe incidents under the Cyber Resilience Act, according to the European Commission. Reports go through the Single Reporting Platform that ENISA launched the same day: an early warning within 24 hours of becoming aware, a full notification within 72 hours, and a final report no later than 14 days after a corrective measure is available for vulnerabilities, or within a month of the 72-hour notification for severe incidents. The Commission says the duty also covers products placed on the market before the CRA's main obligations apply on 11 December 2027.

    • Incident response
    • Application security audit
    • Threat modelling
  • AI security

    Anthropic report details AI-orchestrated intrusions it disrupted over eight months

    Anthropic's September 2026 threat report describes misuse of its Claude models that the company disrupted between December 2025 and August 2026 across seven harm areas, including cyber operations, influence operations, and scams and fraud. It states that a majority of the operations described were enabled by AI via direct execution or orchestration, with multi-agent frameworks executing reconnaissance, exploitation and data exfiltration while humans set targets and reviewed exfiltration. Cases include suspected ShinyHunters affiliates whose session-store dump yielded over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours, and an actor that attacked roughly thirty AI companies in about four days. Anthropic says it disrupted each operation, strengthened its safeguards and shared intelligence with authorities and industry partners where appropriate.

    • Incident response
    • Cloud configuration review
    • Mobile application testing
  • Exploited vulnerabilities

    Magento StyleSmuggler zero-day exploited before patch; BlockStrap bypass followed

    Sansec reported on 5 September 2026 that attackers had been exploiting StyleSmuggler (CVE-2026-75650), an unauthenticated code injection flaw in the Magento and Adobe Commerce template system, since 4 September to install a Rust-based Linux backdoor, including on stores running the July and August 2026 patches. Adobe released hotfix VULN-39341 under bulletin APSB26-146 on 7 September, and the flaw is rated CVSS 10.0. On 13 October Adobe fixed a related CVSS 10.0 template injection, CVE-2026-103849, in APSB26-153; Sansec, which calls it BlockStrap and published its analysis on 15 October, says the September hotfix alone does not stop it.

    • Website security audit
    • Incident response
    • Application security audit

August 2026

5 items

  • Web & CMS

    Elementor Pro file upload flaw CVE-2026-32475 exploited from the day it was patched

    Patchstack disclosed CVE-2026-32475 on 19 August 2026, an unauthenticated arbitrary file upload flaw in the Forms module of Elementor Pro 4.2.1 and earlier that lets an attacker write a PHP file into the uploads directory and run it. Elementor released the fix in version 4.2.2 the same day. BleepingComputer reported that Wordfence blocked more than 190,000 exploitation attempts between 19 and 23 August, with attackers placing PHP files in /wp-content/uploads/elementor/forms/ and then requesting them directly to run commands.

    • Website security audit
    • Web application testing
    • Incident response
  • Exploited vulnerabilities

    VMware vCenter flaw CVE-2026-59310 exploited days after Broadcom's emergency patch

    On 29 July 2026 Broadcom disclosed CVE-2026-59310, a CVSS 9.8 directory traversal flaw in the vCenter Syslog server that lets an unauthenticated attacker with network access to vCenter execute arbitrary code. It was one of five VMware vulnerabilities in the advisory, and BleepingComputer reported at the time that there was no indication of exploitation. Incident response firm QUIRSO reported that compromised systems began connecting to attacker infrastructure on 3 August and counted 361 victim IP addresses across 47 countries by 7 August, with the open-source reverse_ssh framework deployed for persistence. CISA added the flaw to its KEV catalogue on 18 August with a three-day deadline and later flagged it as used in ransomware campaigns.

    • Network & infrastructure testing
    • Cloud configuration review
    • Incident response
  • Social engineering

    Helpdesk vishing group UNC6671 turns to financial and legal firms, Google reports

    Google Threat Intelligence Group (GTIG) reported on 6 August 2026 that UNC6671, a data theft extortion actor that previously operated under the BlackFile brand, had diversified across extortion brands including Redact, Pink, Helix and Falcon, while noting that splintered affiliates or shared phishing infrastructure could also explain the overlaps. Its callers pose as IT helpdesk staff, often ringing employees' personal mobile phones with an urgent passkey or MFA enrolment pretext, and send them to lookalike portals where adversary-in-the-middle infrastructure intercepts credentials and MFA tokens. GTIG said that by July 2026 targeting had narrowed to the financial and legal sectors, including private equity firms, law firms and financial rating agencies. BleepingComputer reported that the attribution followed Reuters and Bloomberg reports of vishing attacks on several hedge funds.

    • Social engineering assessment
    • Cloud configuration review
    • Incident response
  • Supply chain

    ChainDrop worm spreads from hijacked keyv maintainer account to hundreds of npm packages

    On 4 August 2026 an attacker who had compromised the GitHub account of the keyv maintainer pushed malicious files to project main branches and cut releases, so poisoned versions of keyv, flat-cache, file-entry-cache, cache-manager and related packages were published to npm with valid provenance through the projects' own GitHub Actions workflows. The worm, which the community nicknamed ChainDrop and Datadog compares to Shai-Hulud, then used stolen npm tokens to republish other maintainers' packages. Published counts differ: Microsoft counted 'more than 400 packages across multiple unrelated publishers', Aikido's 5 August update said at least 444 packages across 1,381 versions, and BleepingComputer reported more than 1,300 packages and said the count was expected to grow. The install-time payload stole npm, GitHub, AWS, Kubernetes and HashiCorp Vault credentials.

    • Incident response
    • Application security audit
    • Cloud configuration review
  • Regulation

    EU AI Act enforcement and transparency rules start as AI Omnibus delays high-risk rules

    The EU AI Act became applicable on 2 August 2026, when the European Commission's AI Office and national authorities began enforcing it and its transparency rules for chatbots, deepfakes and AI-generated content took effect, according to the Commission and Help Net Security. The AI Omnibus amendments, proposed on 19 November 2025, agreed on 7 May 2026 and in force since 27 July 2026, set 2 December 2027 for Annex III high-risk systems and 2 August 2028 for high-risk AI embedded in regulated products. Help Net Security reported that ignoring the transparency obligations risks fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher.

    • AI & LLM application testing
    • Social engineering assessment
    • Threat modelling

July 2026

2 items

  • Cloud & identity

    CosmosEscape: Azure Cosmos DB flaw exposed a platform key that could open any account

    Wiz Research disclosed on 30 July 2026 a vulnerability chain in Azure Cosmos DB's Gremlin API that it named CosmosEscape. Wiz said the restrictions Cosmos DB's engine applied to Gremlin queries did not sufficiently account for .NET reflection, allowing code execution on the multi-tenant DB Gateway, where a signing key it dubbed the 'Cosmos Master Key' could retrieve the primary key of any Cosmos DB account across tenants, regions and API types. Microsoft deployed a mitigation within 48 hours of the 20 November 2025 report and completed a long-term fix across all regions in July 2026. Microsoft said extensive reviews of access logs found no evidence of unauthorised activity outside the researchers' testing and that no customer action is required.

    • Cloud configuration review
    • Database security audit
    • Threat modelling
  • Regulation

    Israel's privacy regulator fines Meuhedet NIS 256,000 for late breach report

    Israel's Privacy Protection Authority (PPA) imposed a NIS 256,000 sanction on the Meuhedet health fund on 21 July 2026 for failing to report a serious security incident immediately. Legal commentaries say a fault in a digital system let insured persons, in certain circumstances, view relatives' medical files, and that Meuhedet knew of it by November 2025 but reported it on 27 January 2026. Commentators describe it as the first financial sanction since Amendment 13 to the Protection of Privacy Law took effect on 14 August 2025. Further sanctions followed, including NIS 64,000 against Beit Shemesh Municipality in September 2026.

    • Application security audit
    • Web application testing
    • Database security audit

June 2026

2 items

  • Cloud & identity

    Klue breach: stolen integration OAuth tokens used to pull customers' Salesforce data

    Competitive-intelligence vendor Klue said it identified unauthorised activity affecting part of its integration infrastructure on 12 June 2026, and disclosed the incident publicly in an 18 June statement. According to a CrowdStrike investigation summarised by Klue, an attacker used a previously compromised GitHub personal access token on 11 June to insert code into Klue's integration service and collect OAuth access and refresh tokens for Salesforce, which were used to pull CRM data from connected customer environments. Huntress, Recorded Future, Tanium, Jamf, Sprout Social, Gong and Insurity were among the organisations that disclosed impact, and Huntress attributed the attack with high confidence to an extortion group calling itself Icarus.

    • Cloud configuration review
    • Incident response
    • Application security audit
  • Exploited vulnerabilities

    Oracle PeopleSoft zero-day CVE-2026-35273 exploited in ShinyHunters data theft

    On 10 June 2026 Oracle issued an out-of-band Security Alert for CVE-2026-35273, a CVSS 9.8 vulnerability in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools 8.61 and 8.62 that can be exploited remotely without authentication and may result in remote code execution. Mandiant reported zero-day exploitation between 27 May and 9 June 2026 and attributed it to UNC6240 (ShinyHunters); 68% of the more than 100 organisations it notified were in higher education. On 25 September Google reported a renewed wave in which the actor got past path-based WAF rules and deployed web shells on dozens of systems.

    • Application security audit
    • Web application testing
    • Database security audit

May 2026

4 items

  • Breaches

    Carnival says social engineering led to breach; Maine filing lists 5,995,277 people

    Carnival announced on 27 May 2026 that an unauthorised actor gained access to a limited portion of its IT system after deceiving an employee in what it described as a social engineering operation. According to NBC 6 South Florida, its IT team discovered the breach on 14 April and determined on 22 April that passenger information was affected, including government-issued ID numbers such as driver's licence and passport numbers. Carnival did not give a figure, but NBC 6 and TMC Insight reported that a notice filed with the Maine attorney general's office lists 5,995,277 people affected.

    • Social engineering assessment
    • Database security audit
    • Incident response
  • Breaches

    DentaQuest notifies 15 million people after a May 2026 network intrusion

    DentaQuest, which BankInfoSecurity describes as one of the largest dental and vision benefits administrators in the United States, discovered on 20 May 2026 that unauthorised individuals had accessed certain data on its computer network in an incident that began on 17 May. Its notice says the affected data, which varies by individual, includes names, addresses, Social Security numbers, member ID numbers, Medicaid and Medicare numbers and dental or vision health information. DentaQuest's report to the Oregon Department of Justice lists 15,000,000 people affected. BankInfoSecurity reported that the ShinyHunters group claimed on its leak site to have published DentaQuest data.

    • Database security audit
    • Incident response
    • Red team & purple team
  • Supply chain

    Mini Shai-Hulud worm spans npm and PyPI; TanStack release pipeline abused

    Microsoft Security Research identified a resurgence of the Shai-Hulud worm family on 11 May 2026, reporting more than 170 npm packages and 2 PyPI packages across 404 malicious versions and describing it as the first supply chain attack to simultaneously span both registries in a single coordinated operation. In the TanStack wave, tracked as CVE-2026-45321, the attacker chained a pull_request_target workflow, GitHub Actions cache poisoning and extraction of an OIDC token from runner memory to publish 84 malicious versions across 42 @tanstack packages between 19:20 and 19:26 UTC, all with valid SLSA provenance, according to TanStack and Tenable. In a later wave reported on 20 May, a compromised @antv maintainer account spread the worm to downstream packages, and Microsoft said GitHub removed 640 malicious packages and invalidated 61,274 npm granular access tokens that had write permissions and 2FA bypass.

    • Application security audit
    • Incident response
    • Threat modelling
  • Breaches

    Instructure confirms Canvas breach via a Free-for-Teacher account and a second intrusion

    Instructure, the developer of the Canvas learning management system, said it detected unauthorised activity in Canvas on 29 April 2026 and later confirmed the actor had used one of its Free-for-Teacher accounts. According to Help Net Security, ShinyHunters claimed to have stolen 3.65 TB of data tied to approximately 275 million records across 8,809 educational institutions. On 7 May the same actor used a second Canvas vulnerability to change pages shown to some logged-in students and teachers. On 11 May Instructure said it had reached an agreement with the actor, that the data had been returned and that it had received digital confirmation of its destruction.

    • Web application testing
    • Application security audit
    • Cloud configuration review

April 2026

1 item

  • Cloud & identity

    Vercel breach traced to compromised Context.ai OAuth app in employee's Google Workspace

    Vercel disclosed on 19 April 2026 a security incident involving unauthorised access to certain internal Vercel systems. Vercel said the incident originated with a compromise of Context.ai, a third-party AI tool used by an employee: the attacker took over the employee's Vercel Google Workspace account and Vercel account, pivoted into a Vercel environment, and enumerated and decrypted environment variables that were not marked as sensitive. Context.ai said an attacker who accessed its AWS environment in March likely compromised OAuth tokens for some consumer users and appears to have used one to access Vercel's Google Workspace. Vercel notified affected customers and declared the incident closed on 16 October 2026.

    • Cloud configuration review
    • Red team & purple team
    • Incident response

March 2026

6 items

  • Supply chain

    Hijacked axios maintainer account used to publish npm releases that installed a RAT

    On 31 March 2026 an attacker used the hijacked npm account of axios's lead maintainer to publish axios 1.14.1 and 0.30.4, which added a malicious dependency, plain-crypto-js@4.2.1, whose postinstall hook installed a cross-platform remote access trojan. The axios post-mortem says the attacker obtained the npm credentials through a targeted social engineering campaign and RAT malware on the lead maintainer's computer, and the maintainer said in the issue thread that 2FA was enabled on the account; the malicious versions were live for about three hours. Google Threat Intelligence Group attributed the activity to UNC1069, which it describes as a financially motivated North Korea-nexus actor, citing its WAVESHAPER.V2 backdoor and infrastructure overlaps.

    • Incident response
    • Social engineering assessment
    • Secure development training
  • Supply chain

    TeamPCP campaign hijacks Trivy Action tags, then backdoors LiteLLM and Telnyx on PyPI

    On 19 March 2026 an attacker using compromised credentials published a malicious Trivy v0.69.4 release, force-pushed 76 of 77 aquasecurity/trivy-action tags and replaced all seven setup-trivy tags with code that stole CI/CD secrets, according to Aqua's advisory and Datadog Security Labs. The Hacker News reported that the stealer identified itself as 'TeamPCP Cloud stealer', and Datadog linked later compromises of Checkmarx GitHub Actions on 23 March, LiteLLM 1.82.7 and 1.82.8 on 24 March and Telnyx 4.87.1 and 4.87.2 on 27 March to the same campaign. LiteLLM said it believes its compromise originated from the Trivy dependency used in its CI/CD security scanning workflow, and that initial evidence suggested the attacker bypassed its official CI/CD workflows and uploaded the malicious packages directly to PyPI.

    • Incident response
    • Cloud configuration review
    • Application security audit
  • Mobile & IoT

    Authorities disrupt Aisuru, Kimwolf, JackSkid and Mossad IoT DDoS botnets

    The US Justice Department, working with authorities in Germany and Canada, disrupted command-and-control infrastructure used by the Aisuru, KimWolf, JackSkid and Mossad botnets in March 2026. According to the DOJ, as reported by BleepingComputer and KrebsOnSecurity, the four botnets collectively infected more than three million IoT devices, including web cameras, digital video recorders and Wi-Fi routers, and their operators sold access to other cybercriminals to launch DDoS attacks. Cloudflare's 2025 Q4 report had described a record 31.4 Tbps attack and a quarter it said was characterised by an 'unprecedented bombardment' from the Aisuru-Kimwolf botnet; its Q3 2026 report recorded a sharp fall in attacks above 1 Tbps.

    • Network & infrastructure testing
    • Incident response
    • Cloud configuration review
  • Data exposure

    Salesforce warns of mass scanning of Experience Cloud sites with open guest access

    On 7 March 2026 Salesforce warned that a known threat actor group was using a modified version of Aura Inspector, an open-source tool originally developed by Mandiant, to mass-scan public-facing Experience Cloud sites and extract data where guest user profiles had been given access to objects and fields not intended to be public. Salesforce said the activity 'relates to a customer-configured guest user setting, not a platform security flaw.' ShinyHunters claimed responsibility and told The Register it had stolen data from almost 400 websites and about 100 high-profile companies; a Salesforce spokesperson declined to say how many customers were affected or whether ShinyHunters was behind the access.

    • Cloud configuration review
    • Application security audit
    • Database security audit
  • Israel

    Israel's cyber directorate warns of Iran-linked wiper attacks via stolen credentials

    In early March 2026, Israel's National Cyber Directorate (INCD) warned of a wave of destructive cyberattacks on Israeli organisations, which it attributed to Iran. According to the directorate, in most cases attackers got in with authentic user credentials stolen in the past or leaked in earlier attacks, and also exploited a weakness in remote access, then deleted servers, workstations and data. Haaretz reported the INCD said no critical infrastructure had been compromised. The directorate urged password changes, two-factor authentication, checks on administrator accounts, remote-access updates and backups.

    • Incident response
    • Cloud configuration review
    • Network & infrastructure testing
  • Cloud & identity

    Microsoft and Europol disrupt Tycoon 2FA, an MFA-bypass phishing-as-a-service platform

    On 4 March 2026 Microsoft, acting under a US court order and for the first time in coordination with Europol's Cyber Intelligence Extension Programme, seized 330 domains that powered Tycoon 2FA, an adversary-in-the-middle phishing-as-a-service platform that captured credentials and session cookies and relayed MFA codes to break into accounts on services including Microsoft 365, Outlook and Gmail. Law enforcement in Latvia, Lithuania, Portugal, Poland, Spain and the United Kingdom seized infrastructure, partners including Cloudflare, Proofpoint and Health-ISAC supported the action, and Europol said the investigation began with intelligence shared by Trend Micro. Microsoft said the service was responsible for tens of millions of fraudulent emails reaching over 500,000 organisations each month. Its Q1 2026 email threat report later said phishing pointing to Tycoon2FA fell 15% in March, driven largely by the disruption, and that the operators had since shifted hosting providers and domain registration patterns in a partial recovery.

    • Cloud configuration review
    • Social engineering assessment
    • Incident response

February 2026

2 items

  • Israel

    Israel's cyber directorate logged about 26,500 incident reports in 2025, up 55%

    In its annual report for 2025, Israel's National Cyber Directorate (INCD) said its 119 National Cyber Emergency Center handled about 26,500 incident reports in 2025, a 55% increase on 2024, according to the Jerusalem Post and Israel Defense. The directorate issued about 2,480 alerts, a 2.5-fold increase, of which 2,304 were proactive notifications to organisations based on indicators of targeted attacks. Phishing accounted for 52% of reported incidents. Reports peaked in June 2025, during the 12-day war with Iran, at 3,650.

    • Incident response
    • Social engineering assessment
    • Network & infrastructure testing
  • AI security

    Unauthorised Cline CLI release followed a prompt-injection flaw in its AI triage bot

    On 17 February 2026 an unauthorised party used a compromised npm publish token to release Cline CLI 2.3.0 with a postinstall script that globally installed OpenClaw; the version was available for about eight hours and was downloaded roughly 4,000 times, according to StepSecurity. Eight days earlier a security researcher had publicly disclosed "Clinejection", in which a GitHub issue title could prompt-inject Cline's Claude-based issue-triage workflow and, through GitHub Actions cache poisoning, expose nightly publishing tokens. Cline said that when it rotated credentials on 9 February the wrong token was deleted and the exposed npm token stayed active; it then published 2.4.0, deprecated 2.3.0 and moved npm publishing to OIDC via GitHub Actions.

    • AI & LLM application testing
    • Application security audit
    • Threat modelling

January 2026

3 items

  • Data exposure

    Misconfigured Supabase backend exposed Moltbook agent tokens, emails and messages

    Moltbook, a social network for AI agents, exposed its production Supabase database to anyone holding the public API key embedded in its client-side JavaScript, because Row Level Security policies were missing. 404 Media first reported the exposure on 31 January 2026, saying it let anyone take control of any AI agent on the site. Wiz, which found the issue independently and published its findings on 2 February, said the misconfiguration allowed full read and write access and exposed 1.5 million API authentication tokens, 35,000 email addresses and private messages between agents, some containing plaintext OpenAI API keys. Wiz said Moltbook secured the database within hours of its report, over several rounds of fixes.

    • Database security audit
    • Web application testing
    • Application security audit
  • Data exposure

    Flare: 1,416 of 3,100 fully exposed MongoDB servers found wiped with ransom notes

    Cybersecurity company Flare reported on 26 January 2026 that its analysis found more than 200,000 publicly discoverable servers running MongoDB, of which slightly over 100,000 disclosed operational information and 3,100 were fully exposed without access restrictions. Of those 3,100, Flare said 1,416 (45.6%) had already been compromised, with their databases wiped and replaced by a ransom note; in nearly all cases the demand was approximately $500 in Bitcoin. BleepingComputer reported the findings on 1 February 2026, quoting Flare's warning that 'there is no guarantee the attackers have the data, or will provide a working decryption key if paid.'

    • Database security audit
    • Network & infrastructure testing
    • Cloud configuration review
  • Regulation

    CNIL fines Free Mobile and Free €42 million over security failures behind 2024 breach

    France's data protection authority, the CNIL, said on 14 January 2026 that it had fined Free Mobile €27 million and Free €15 million for inadequate security of subscriber data. According to the CNIL, an attacker who infiltrated the companies' systems in October 2024 accessed personal data relating to 24 million subscriber contracts, including IBANs. The regulator found VPN authentication that was not strong enough, ineffective detection of abnormal behaviour, breach notification emails missing required information and, at Free Mobile, excessive retention of former subscribers' data.

    • Network & infrastructure testing
    • Incident response
    • Database security audit

December 2025

1 item

  • Exploited vulnerabilities

    React2Shell: React Server Components RCE exploited within hours of disclosure

    The React team disclosed CVE-2025-55182 on 3 December 2025, an unauthenticated remote code execution flaw rated CVSS 10.0 in how React decodes payloads sent to Server Function endpoints, affecting React Server Components packages in versions 19.0 to 19.2.0 and frameworks built on them, including Next.js. AWS reported exploitation attempts by China state-nexus groups within hours of disclosure. SecurityWeek reported that CISA added the flaw to its Known Exploited Vulnerabilities catalogue and that researchers observed attempted theft of AWS configuration and credential files, as well as attempts to deliver cryptocurrency miners and Mirai malware.

    • Web application testing
    • Application security audit
    • Incident response

November 2025

1 item

  • Breaches

    Coupang breach of 33.7 million accounts traced to a former engineer's stolen signing key

    South Korean e-commerce company Coupang first disclosed on 29 November 2025 that personal data of about 33.7 million users had been leaked. A joint public-private investigation, whose tentative results the Ministry of Science and ICT announced in February 2026, found that a former backend engineer used a stolen signing key to forge electronic access passes, beginning on 14 April 2025. Coupang said names, emails, addresses and phone numbers were accessed but not payment or log-in data. According to Coupang's 8-K, on 10 June 2026 the Personal Information Protection Commission announced a fine of approximately $278 million relating to the incident.

    • Application security audit
    • Web application testing
    • Cloud configuration review

March 2025

1 item

  • Web & CMS

    Next.js middleware flaw CVE-2025-29927 let a crafted header skip authorisation checks

    On 21 March 2025 the Next.js maintainers published advisory GHSA-f82v-jwr5-mffw for CVE-2025-29927, a critical (CVSS 9.1) flaw that let a request carrying the internal x-middleware-subrequest header skip middleware, and with it any authorisation checks performed there. According to Vercel's postmortem, self-hosted applications using next start with output: 'standalone' were affected, while apps on Vercel, Netlify or Cloudflare Workers and static exports were not. Fixes shipped in 12.3.5, 13.5.9, 14.2.25 and 15.2.3, and Datadog Security Labs later reported low-volume scanning that used known exploit header values.

    • Web application testing
    • Application security audit
    • Website security audit

Run the checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Book the scoping callHow incident response works