Topic
mSeven reports "suspicious activity" linked to mSecure and advises changing passwords, re-enrolling 2FA and removing passkeys. It won't say what was affected. Here's what users should do now.
CISA added CVE-2026-119977 to KEV. The WordPress flaw allows unauthenticated code execution during core updates. Fixes shipped October 28 for every branch back to 4.7. Update now and check your logs.
Google shut down the servers behind XCPE, a botnet of 1.3M+ Android TV boxes, and attributes the backdoor to manufacturer Videostrong. Germany, the US and the UK each count tens of thousands of infected devices.
The FBI attributes the theft of more than $6 billion from Binance to North Korea's TraderTraitor. What we know, what has changed since the original post, and what you should do.
Chainalysis reports an intrusion into internal tools by an attacker using AI agent techniques. Names, emails, user IDs and roles were exposed. What we know and what customers should do now.
Attackers are encrypting Synology NAS devices on outdated DSM with C3RB3R ransomware. Synology points to a 2024 flaw, 360 to two from September 2026. Both are patched. Here's what to do now.
CVE-2026-58882: one crafted SMS crashes Android's phone service, even during emergency calls. Exploit code is public. Android 14 to 17 have a fix, while Android 12 and 13 likely won't get one.
A hijacked DebugBear performance script served malicious code on Polymarket that abused logged-in sessions. Losses: roughly $2.2M to $2.7M. Polymarket says it will reimburse all affected traders.
A customer reports an extra board in a Trezor Safe 5 that allegedly sends the recovery phrase over a mobile network. Unconfirmed, but Trezor tells all CryptoBilis buyers since March 2026 to move funds.
Binance reports an incident affecting about $6.3B in assets, with nearly $3B frozen. Binance says it likely began with a DevOps engineer's laptop. What we know, what's still open, and what you should do.
Version 2.1.313 of the Claude Code extension was tampered with and planted SSH backdoors, mainly hitting Cursor users. Uninstalling isn't enough. Here's what to check now.
Attackers are already exploiting a flaw in Drupal Commerce Core (CVE-2026-118539), and they don't need to log in. It's fixed in 3.3.13 and 8.x-2.41. Shop owners should update and audit their orders.
CISA lists GitLab flaw CVE-2026-97229 (CVSS 10.0) as actively exploited. Alpine Linux was targeted, and a second regex bug makes the first October patch insufficient. What self-hosters should do now.
CVE-2026-98432 in the Linux kernel's IPv4 TCP code: Anthropic's Claude found it and wrote a root exploit. Debian, Oracle and SUSE have patches. Ubuntu and RHEL don't have fixes out yet.
A race condition in WordPress core updates allows unauthenticated code execution (4.7 to 7.1.3, CVSS 8.1, no CVE). Wordfence blocked nearly 63,000 attempts in 24 hours. Fix: 7.1.4 plus backports.
A rogue AGENTS.md in a Downloads folder tried to make Codex install a malicious npm package. It was stopped before code ran, but lab tests often succeeded. There is no patch.
The Gheist campaign uses stolen GitHub tokens to plant workflows that dump secrets into Actions logs. GitHub now holds such runs in public repos, but private repos and Enterprise Server stay exposed.
An out-of-bounds write in Google's Brotli decoder (CVE-2026-111497, CVSS 9.2) affects Node.js, .NET, PowerShell, Python packages and Bun. CISA reports exploitation. Patches are out.
The PHP2Shell flaws are now being exploited successfully, and CISA lists them as actively exploited. Patches have been out since October 21. Unit 42 has retracted its link to an attack on a government agency.
The BlackX bootkit got past Secure Boot on fully patched Windows PCs at Central Asian diplomatic bodies, because the needed revocations were never switched on. Kaspersky suspects APT41.
US lab giant Quest Diagnostics reports unauthorized access to its Quanum Lab Services Manager. Patient data is affected, and there is still no victim count. Here's what is known and what to do.
Attackers accessed CAPCOM ID: 11,774,247 email addresses with login metadata and IP addresses were exposed, and 196 accounts had their passwords changed. Expect targeted phishing.
CVE-2026-110447 (CVSS 9.2) in Nextcloud's built-in Collabora CODE Server is being exploited to plant web shells. A fix exists: 26.4.303 or later. Disabling the app does not protect you.
A new open-source tool lets AI take finished programs apart and rewrite them in Rust. Before the AI got near it, I had to build a cage. More got stuck than I expected.
I had Claude take apart two programs without function names, one of them a real file from Ubuntu. Almost every name was right. Why that doesn't reassure me.
In part 2 Claude matched every function name in known software. Was that understanding or memory? So I wrote a program no one can know. The result, and a mistake in my own experiment.
An SQL injection in on-prem VeloCloud Orchestrator (CVE-2026-114625, CVSS 9.9) is under active attack. A read-only login is enough to gain operator rights. Patches exist for 5.2, 6.1 and 6.4.
On Oct 21 a poisoned LiteLLM 1.107.0 hit PyPI and Docker. It steals cloud logins, secrets and AI API keys. Safe version: 1.106.2. If you ran 1.107.0, rotate everything and rebuild.
Several free OpenRouter models handle tool calls well. With 50 requests a day, though, they're for experimenting, not for real work. And some hosts are allowed to train on your prompts.
A viral post warns of AI agents attacking the internet. I checked the core claims. Much of it holds up, the tone does not. And this is what actually helps.
Blog, cloud, Git and a few websites run on a Mac mini at my place. No open ports on the router, one tunnel to the outside. An overview.
48 hours, seven incidents, from PHP to a private key with the value 4. As a 45-second video, built with AI.