Selected incidents, exploited vulnerabilities, campaigns and crypto thefts from the past six months, explained in plain language with sources.
63 incidents in the period. Pick a category to read only those.
About the chart. The following chart indicates the main incidents in the past 6 months. Each dot is one incident, placed by date over the period shown. IT incidents sit above the first line, OT incidents below it, and crypto incidents in the band underneath. Hollow dots mean only the month is known, so their position is approximate. Select a dot to jump to that incident.
IT, above the line: networks, cloud services and business systems.
OT, below the line: equipment that runs physical processes, such as water pumps, manufacturing and power.
Crypto, the lower band: thefts and attacks on exchanges, wallets, bridges and blockchain protocols.
Firewalls, SD-WAN controllers, remote-support tools and VPN gateways keep turning up as the first thing attackers use. Several were exploited before a fix existed.
Groups such as ShinyHunters and Everest steal data and demand payment to keep it private. The weak point is often a shared platform, a vendor account or a stolen login rather than the victim's own network.
See: CanvasShinyHunters campaignsStadler RailRansomware levels
Security scanners, AI gateways, developer tools and backup services run with access to secrets or customer environments, so tampering with them hands attackers cloud and code credentials. LiteLLM was compromised twice in seven months.
A single cloud provider, backup service, learning platform, hosted-desktop service or vendor portal was the way in or the point of failure for hundreds of organizations at once. Customers who kept backups only with the provider had nothing to restore from.
See: IDCF CloudConnectWise Cloud BackupCanvasStadler RailGMO Desktop Cloud
Water controllers on cellular modems and refrigeration controllers reachable online were taken over without any advanced technique. Old equipment that can no longer be patched made it easier.
See: Minnesota waterCISA water warningColorado waterFrench refrigerationEurope freezers
US agencies tie much of the water and energy activity to Iran-linked actors, and researchers describe Russian state-linked groups working inside industrial networks. Attribution is still open in several incidents.
See: Iran-linked PLC attacksSandwormOil tankersZionSiphonCal Water claim
Microsoft's monthly patch counts hit new records, Microsoft says a China-aligned group used an agentic AI tool against more than 2,250 Microsoft 365 tenants through a backup service, and OT researchers warn that AI shortens the time needed to find exposed devices. Prioritizing what is actually exploited matters more every month.
See: October Patch TuesdaySharePointFrench refrigerationConnectWise Cloud BackupPHP2Shell
A handful of large thefts account for most of the value. The biggest began with a supplier, stolen credentials, compromised infrastructure, tampered hardware or a flawed verification step rather than a classic code bug, and Binance's reported $6.3 billion loss on October 29 began, by its own account, with an engineer's laptop. Attributions to North Korea come from analytics firms and victims, not governments.
See: BitgetLedger resellerColdcard walletsCrypto losses by quarterBinanceArkéa
The few fixes that matter most right now, picked from the incidents on this page. Each is being exploited or has already caused losses. Check the vendor's own notice before you act. Last checked November 5, 2026.
Attackers were probing for them from October 17, four days before the fixes came out. CISA listed both as exploited on October 26, and researchers have seen working intrusions that chained a Linux kernel flaw to take root control of servers. Every PHP installation that serves web pages is in scope, including PHP built into appliances. PHP considers Apache with mod_php the highest-risk setup, according to CISA.
Attackers chained these flaws to run code and take root control of a VPN appliance, starting October 3, and Volexity says the activity gets past Ivanti's own Integrity Checker Tool. CISA lists CVE-2026-111357 and CVE-2026-118527 as exploited, with federal deadlines of November 2 and November 13. Ivanti first fixed two of the flaws, and Help Net Security now reports that all three are fixed.
Attackers pushed refrigeration controllers into defrost cycles at hundreds of French supermarkets on October 11 and 12. On November 2 a second wave hit food stores in Sweden, Belgium, Ireland, Luxembourg, the Netherlands, Finland and Estonia. Danfoss says most affected French systems were older products that no longer receive security updates, and the AK-SM 800 has had none since May 2021. DutchNews reports that the affected Dutch systems were not on a secure network and still used a default password.
VulnCheck saw attackers send one unauthenticated request to a Node-RED administration interface and run commands on the device, then leave web shells for lasting access. Exploitation was seen from October 30 to November 1. Siemens disclosed the flaw in August for SIMATIC IoT2050 Advanced devices that have Node-RED installed. VulnCheck's article says the flaw was not in CISA's catalog at that time.
A flaw in how some firmware created seed phrases lets attackers guess them. Funds were swept in several waves from July 30, and Galaxy Research estimates losses above $115 million. A firmware update only protects seeds created after it. It does not repair a seed that already exists.
In the Binance theft, TRM says the attacker used pre-signed EIP-7702 authorizations to make an Ethereum hot wallet run attacker-controlled code. The delegation stayed in place for hours, so deposits that arrived later could be swept too. Binance has not yet published its root cause.
A quick look at how incidents are spread over time and across countries, May to November 2026. The full dashboard has every chart and the list of incidents behind them.
ITOTCrypto
† Provisional: the sources for this month are still catching up. Crypto uses the monthly totals counted by hack trackers.
ITOT
IT and OT incidents. Crypto sources rarely give a country.
According to a November 5 report on DigiCert's disclosure, the certificate provider confirmed unauthorized access to an internal business system that held archived customer data. The records include names, business email addresses, phone numbers and business addresses, and for a small minority of accounts also passports, driver's licenses, utility bills or other documents showing a name and address. DigiCert has not said how many people or organizations are affected. The report puts the access between June 27 and July 2, 2026, says DigiCert confirmed it on October 19 and filed a preliminary incident report the next day. It says a February 2025 infrastructure migration moved the system out of a network segment restricted by VPN, which left it reachable from the internet without a security review. A self-registration feature then let new accounts, which were not subject to the multi-factor authentication required of staff, read archived information because of a gap in permission checks. DigiCert says its certificate authority services, CertCentral and DigiCert ONE were not affected, that investigators found no certificate issued, validated or revoked in connection with the unauthorized account, and that customers do not need to replace active certificates. It has disabled self-registration, moved remaining exposed endpoints behind private network infrastructure, reset business system passwords, completed a permissions review and now requires security approval for network access changes. It is reviewing the identity documents to find affected individuals and plans to notify them.
Identity documents are hard to replace, and the cause was an ordinary change: a migration quietly left a system reachable from the internet. DigiCert's statement that certificate services were untouched matters because website trust rests on them, but the figures on affected people are still missing.
Chainstack, a company that provides blockchain nodes and APIs to developers, disclosed that an outside attacker got into part of its infrastructure through a third-party component. The attacker first reached a development environment on October 26, then moved into parts of production. Chainstack detected the intrusion on October 31 and cut off the attacker's access the same day. A customer account database was exposed, holding organization names, account holder names, member email addresses and password hashes. Systems holding node credentials were also reached. Chainstack has no evidence that those credentials were read but is treating them as exposed. The Hacker News reports that the incident is assessed to be part of a large-scale, AI-powered campaign reported the week before. Chainstack has not given further technical detail and has not said how many customers are affected. It is hardening its systems and asks customers to rotate node credentials, regenerate platform API keys and update passwords, including any reused elsewhere.
Node credentials and API keys are how customers connect applications to blockchain networks, so they should be replaced even without proof of misuse. Password hashes can be cracked if passwords were weak or reused, and customer emails give scammers a ready list to target.
Synology warned that attackers are encrypting files on DiskStation Manager (DSM) network storage devices that run outdated software, and that customers have reported infections. The ransomware, called C3RB3R, adds the extension .L0CK3D to encrypted files and leaves a ransom note named read-me3.txt in each affected folder. Synology's notice did not name the exploited flaw and pointed to its November 2024 advisory, SA-24:20, which lists CVE-2024-10441, a critical remote code execution flaw rated 9.8. That flaw was fixed in December 2024, and the fixed versions start at DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8. Separately, Qihoo 360 says C3RB3R has also exploited CVE-2026-13684 and CVE-2026-13639, both rated 9.8, which Synology fixed in September 2026. Security Boulevard lists the Synology notice as also extending its PHP2Shell fixes to older DSM releases. Synology has not said how many devices are affected.
Network storage often holds backups, so ransomware that reaches it can lock both the data and the copies meant to restore it. The main flaw named has had a fix for almost two years, which makes this a story about devices that were never updated.
Three weeks after the attack on French supermarkets, refrigeration controllers at food stores in several more countries started running at wrong temperatures overnight into November 2. Reports name ICA and Coop in Sweden, Delhaize, Carrefour and Spar stores in Belgium, 13 SuperValu stores in Ireland, Ahold Delhaize stores in Luxembourg, a few K-Food stores in Finland and one Selver store in Estonia. In the Netherlands, Danfoss told broadcaster NOS that at least 17 businesses were hit, mostly butchers and small neighborhood shops, and Albert Heijn said none of its branches was affected. One Swedish store had a freezer set to 50 degrees Celsius and another showed 55, some Delhaize fridges reached 15, and a Dutch frozen-food store was at minus 10 instead of minus 20. Belgian refrigeration firm Sabcobel confirmed a cyberattack, and its chief executive said the units' evaporators were switched into defrost mode. AFP reports that many units will need physical modifications to be restored. Danfoss said the European incidents involved its products, as in France, and NOS reports Copeland equipment was also hit in Belgium. DutchNews reports that the affected Dutch systems were not on a secure network and still used a default password, and that Danfoss had advised Dutch customers on October 13 to disconnect systems from the internet. Coop confirmed a hack, Ahold Delhaize called it an IT incident, Musgrave called it a cyber incident, and ICA did not confirm a cyberattack. Sweden's national cyber security center is handling several cases. No group has claimed responsibility, reporting finds no evidence yet linking these cases to the French attack or to the US military base freezer failures, and Delhaize says it is investigating whether its case is linked to the group's October cyberattack.
The same kind of attack is now hitting many countries and small shops as well as large chains. Any store whose controller can be reached from the internet, runs an old model or still has a default password is exposed, and the food losses are immediate.
Crédit Mutuel Arkéa, a French banking group, confirmed that attackers used its own account to send fraudulent transfers to other banks, and that the money may have been converted into crypto. Onchain investigator ZachXBT flagged the theft on November 2 and estimated losses above $133 million, which CoinCentral gives as about 118 million euros. He said the figure could rise because the attack ran over several days. The bank would not confirm the amount, says it can only validate the order of magnitude, and says the loss does not threaten its financial strength. It says the attackers got in through a service provider's platform, which it has not named, that there was no entry through its online bank Fortuneo and no human error, and it calls the attack sophisticated and external. It says accounts at its federations and subsidiaries were not used, customers face no financial consequences and some transfers were only delayed. It briefly suspended some transactions, most resumed the next morning, and part of the money has been blocked. According to ZachXBT the funds went through USDC-to-ETH swaps, instant exchanges, a conversion into Monero and cross-chain bridges, and he has high confidence that North Korea's Lazarus Group is not behind it. The bank has named no suspects and has told authorities and supervisors.
Criminals are using crypto's fast, hard-to-trace routes to launder money taken from a traditional bank. The weak point was a service provider's platform rather than customer accounts, and the figure is still an outside investigator's estimate.
Node-RED is a low-code tool widely used to connect sensors, machines and online services, including on industrial gateways. CVE-2026-58115 is a flaw that lets an unauthenticated person send a single request to a Node-RED administration interface and deploy a flow that runs commands. Siemens disclosed it in August for its SIMATIC IoT2050 Advanced devices that have Node-RED installed (advisory SSA-834709). VulnCheck released detection artifacts on October 27 and says a decoy system it runs recorded exploitation on October 30 from an address in Microsoft's network range. The same address made 16 attempts through November 1 and later delivered more payloads, including a Linux binary and web shells that give the attacker lasting access. VulnCheck links the attacks to instances without administrator authentication configured. VulnCheck added the flaw to its own exploited-vulnerability list, and its article says the flaw was not in CISA's catalog at that time. VulnCheck's page gives no fixed Node-RED version and no count of exposed instances, and no victim has been named.
Node-RED often sits on gateways between plant equipment and the network. If its administration page is reachable without a password, anyone can run commands on the device, which can become a foothold inside an industrial network.
Amadeus, a Spain-based travel technology company that runs the reservation systems of many airlines, detected unauthorized activity in September 2026. Malaysia Airlines, Japan Airlines, All Nippon Airways, Cathay Pacific, Korean Air and Asiana Airlines have since said some customer booking data may be affected. Reported figures are about 92,000 customers at Japan Airlines, about 37,800 passenger files at ANA and about 53,000 bookings at Cathay Pacific. Malaysia Airlines has not given a number. The records cover August 2023 to September 2026 and mostly hold names, booking references and flight details. For a smaller group they also include passport numbers, contact details or frequent-flyer profiles; Japan Airlines puts that at about 2,000 people and ANA at about 1,700 passport references. The airlines say their own systems were not compromised and report no sign that payment card data or passwords were taken. One report says the intruders used valid credentials rather than attacking each airline, and that Amadeus has revoked the affected access tokens and changed administrator passwords. No group has been named as responsible.
One supplier's breach reaches many airlines at once. Booking references and flight details let scammers write messages that look like they come from the airline, and the passport details exposed for some travelers are hard to replace.
Security firm Volexity found an attacker it tracks as UTA0576 chaining several flaws in Ivanti Connect Secure, a widely used VPN gateway, to run code and then take root control of an appliance that was fully patched at the time (version 22.8R2.4). Exploitation began on October 3, and Ivanti said it had seen limited exploitation. The chain starts with an authentication bypass and code execution flaw (CVE-2026-104935, severity 8.6) and ends with a privilege escalation to root. Help Net Security's November 2 report lists CVE-2026-111357 (privilege escalation) and CVE-2026-118527 (authenticated file upload) as the two that CISA has added to its exploited-vulnerabilities list, with federal deadlines of November 2 and November 13. In the case Volexity described, the attacker stole stored credentials, including domain logins, searched Active Directory for passwords and tried password guessing against accounts. Rapid7 says the attacker also looked for Windows LAPS passwords and BitLocker recovery keys. Volexity says the activity gets past Ivanti's Integrity Checker Tool, so a clean result does not rule out compromise. When the chain was disclosed in mid-October, Ivanti had fixes for two of the flaws and promised the third within weeks. Help Net Security now reports that all three are fixed. The attack was detected and disrupted, so the attacker's final goal is unknown, and neither Ivanti nor Volexity has said how many customers were hit.
A VPN gateway sits between the internet and the internal network, so root access gives an attacker both a foothold and stored logins. This chain worked on an appliance that was fully patched when it was attacked, and the vendor's own integrity check misses it, so patching alone does not answer the question of whether you were already breached.
On October 12 GitLab patched CVE-2026-97229, an integer overflow in the regular-expression compiler that processes CI/CD pipeline files. It could let an unauthenticated attacker run code on self-managed GitLab CE and EE servers (CVSS 10.0). Rapid7 published a proof of concept on October 13, and Censys counted about 25,800 exposed vulnerable hosts. Alpine Linux says an attacker sent exploit attempts at its own GitLab server on October 20 and 21; the attack failed and Alpine rebuilt the instance. On October 29 CISA added CVE-2026-97229 to its exploited list, with a federal deadline of November 1. On October 21 GitLab fixed a second maximum-severity flaw, CVE-2026-110264, another integer overflow in the same regular-expression compiler; the affected code dates to 2014. GitLab.com is already fixed. GitLab has not said whether the second flaw has been exploited, and it was not on CISA's list as of October 30. Servers patched on October 12 are still affected by it, and there is no workaround. Alpine's experience also shows that upgrading GitLab may not be enough if you run your own Ruby: its image uses standard Ruby, and the flaw was not fixed after it updated to GitLab 19.3.6.
A self-hosted GitLab server holds source code, pipeline settings and deployment secrets, so a takeover can reach well beyond the server itself. Exploit code has been public since October 13, and real attempts followed within a week.
Starting at about 20:05 UTC on October 29, attackers moved funds out of Binance hot wallets on ten or eleven blockchains, depending on the tracker, most of it in under half an hour, with a second wave around 23:00 UTC. Binance estimates the loss at about $6.3 billion. TRM Labs counts $6.36 billion, Elliptic $6.43 billion and Chainalysis about $5.9 billion, so figures differ by method. It is about four times the Bybit theft of February 2025. Binance suspended deposits and withdrawals, says user funds are safe and says it will cover all losses from its SAFU reserve fund and company funds. Its preliminary account is that a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawals, and that it found no sign of a leaked private key. A full post-mortem has not been published. TRM and Elliptic say that on Ethereum the attacker used 50 pre-signed EIP-7702 authorizations to make a Binance hot wallet run attacker-controlled code, while on the other chains Binance wallets sent funds in ordinary signed transfers, which TRM reads as a compromise of Binance's signing infrastructure. Stablecoin issuers, Ripple, World Liberty Financial and the Arbitrum Security Council froze about $2.7 billion to $2.84 billion, according to TRM and Elliptic. The attacker still holds roughly $2.4 billion to $3.3 billion in assets that no issuer can freeze, and has been swapping and moving them. TRM attributes the theft to North Korea's TraderTraitor group with high confidence. Elliptic says North Korean involvement is likely but lists reasons for caution, including that the overlap with funds from the Bitget theft is small. On October 31 the FBI said North Korea was responsible for the theft of more than $6 billion on or about October 29, naming its TraderTraitor group (also tracked as Lazarus Group, Jade Sleet and APT38), and published 628 addresses for exchanges to block (608 Ethereum, 19 Bitcoin and 1 Solana). Binance has not itself named a culprit. Binance restarted withdrawals in phases on November 1 and added fiat withdrawals on November 2. It says it has replaced about 95% of the impacted amount with its own funds, up from 90%, and is buying the rest, mostly less-liquid tokens, on the market and over the counter. It says its post-incident report will follow the investigation. Chainalysis said on November 3 that it counts about $6.4 billion stolen and about $2.8 billion frozen, and assesses that TraderTraitor is responsible, partly because the stolen funds mixed on-chain with funds from last month's Bitget theft, which was attributed to North Korean actors. It says the attacker is moving funds among many addresses in a pattern that suggests automation.
The attackers did not break cryptography. As in the Bybit theft, they got an exchange's own systems to sign transactions for them, and a single engineer's laptop is the reported starting point. Issuer freezes saved about 44% of the money, but ETH, bitcoin and XRP have no issuer that can freeze them.
For about 11 hours on October 29 (09:27 to 20:35 UTC), a tampered build of a Claude Code extension was available on Cursor's extension marketplace. Security firm Phorion found it and lists versions 2.1.312 and 2.1.313. The injected code ran as soon as the editor loaded the extension. It added the attacker's SSH key to the user's authorized keys, tried to turn on SSH, opened a reverse SSH tunnel to the attacker's server, set up persistence that survives restarts, and sent the machine's host name, user, system, IP address, Git email and the names of credential-like environment variables. Anthropic said the incident was not a compromise of its systems or employee laptops, that it did not build or publish the tampered extension, and that its official channels are unaffected. Cursor says it removed the version immediately, shut down its marketplace as a precaution, rotated its own keys and had the attacker's server blocked. Cursor has not explained how the package reached the marketplace. One report cites up to 5,000 affected developers, but that figure comes from industry figures, not from Anthropic or Cursor.
Developer tools run with access to source code, SSH keys and cloud logins, and an extension marketplace is a trusted way to install them. Uninstalling the extension does not remove the backdoor it planted.
Florida Department of Education staff became aware of the incident on October 19 and announced it on October 29. The department estimates about 4.9 million people may be affected and says the exposed information includes Social Security numbers. It has not said what else was taken. The department believes the incident was limited to the Florida Student Financial Aid website, and says current aid payments, tuition payments, scholarships, grants and loan eligibility are not affected. It notified the state attorney general and is working with the Florida Digital Service and the Florida Department of Law Enforcement, and one report says the incident is under criminal investigation. The cause and the attacker have not been announced.
Social Security numbers are hard to replace and are used to open credit in someone's name, so misuse can appear long after the breach. A financial aid site holds them for a very large number of people.
Freezers and refrigerators at military commissaries, the grocery stores on US bases, switched to defrost mode and warmed overnight in late August, spoiling food. The Pentagon confirmed refrigeration problems around August 28 without giving a cause. At least six bases reported problems, among them Fort Huachuca in Arizona and Fort Irwin in California. On October 29 Reuters reported that investigators are treating the failures as a suspected cyberattack, with Army and Air Force investigators looking into it and US Cyber Command now involved. Reuters could not confirm which equipment the stores used, though a record for one shop lists a Danfoss control system. Claroty reported flaws in Danfoss and Copeland refrigeration controllers in August, including a hidden login that could give full control, and Danfoss has released a fix. Two people told Nextgov/FCW that officials suspect Iran-linked hackers, but that is an investigative lead with no public technical evidence. The Pentagon has not confirmed that hackers caused the failures, no suspect has been named, and no link to the October attack on French supermarkets has been established. A second wave of refrigeration tampering hit supermarkets in Europe on November 2, and reporting says there is no evidence yet linking it to the US cases.
If confirmed, it would show the same style of attack as the French supermarkets, remote changes to everyday refrigeration controllers, against a government customer. The known Claroty flaws do not prove they were used here, so the cause is still open.
On October 29 a script loaded from a third-party performance-monitoring service ran inside traders' logged-in Polymarket sessions and sent transactions to an attacker's wallet. Researchers traced the file to DebugBear's content network, where a normal real-user-monitoring script had been replaced. Polymarket has not named the provider. According to analysis of the code, it read the browser's stored login data and API credentials, found the page's trading signer and submitted signed transfers through Polymarket's relayer, so no seed phrase or private key was needed. Blockchain trackers traced about $2.5 million to one attacker wallet across more than 900 transactions, and other estimates run from about $2.65 million to $2.7 million. Hudson Rock's analysis found about $2.19 million at the wallet and says that is not a verified total, and nobody has confirmed how many users lost money. SafeState reports that Polymarket confirmed within the hour that a compromised third-party provider was responsible, paused trading, resumed it about half an hour after marking the incident resolved, and said it would reimburse affected traders. Hudson Rock found no company statement when it published. The attack affected only the international site, not Polymarket's US exchange.
The attackers did not break into Polymarket's servers or steal keys. They put malicious code into a page that traders trust, and a script meant to measure page speed could see and use everything on the page.
CVE-2026-41709, rated low (CVSS 2.7), lets a malicious administrator perform certain actions on VMware ESX hosts without them being recorded in audit logs. Broadcom fixed it in advisory VMSA-2026-0006 on July 29 and credits CrowdStrike for reporting it. CISA added it to its exploited list on October 28 with a federal deadline of November 11. The Hacker News, as relayed by CISO Platform, reports that CrowdStrike links early-2026 exploitation to Warp Panda, a China-nexus group also tracked as Armory Castle, against US legal-sector organizations. No government has made that attribution. Fixed builds are ESXi 8.0 U3j (ESXi80U3j-25429389), ESXi 9.0.2.0100-25595025, ESXi 9.1.0.0-25370933 and VMware Cloud Foundation 5.2.4.
A low score hides the point: the flaw exists to erase evidence. It matters after an intruder already has administrator access, because gaps in logging make it hard to say what they did on the virtualization layer.
On October 28 the nonprofit Distributed Denial of Secrets (DDoSecrets) published internal records on more than 41,000 Department of Homeland Security employees and contractors that it received from a hacktivist group calling itself the Department of Peace. The data includes names, phone numbers, email addresses, job titles and email or permission groups, which in some cases show who works on sensitive assignments. The group says it took the data from an Okta single sign-on service used at DHS and describes the leak as a protest against stepped-up immigration enforcement. Okta says it has no evidence its data or systems were compromised, and DHS had not commented when CyberScoop and Reuters reported. CyberScoop confirmed that many current CISA employees appear in the data, and Reuters matched details of six named employees to other records and confirmed others by phone. How the data was taken has not been established.
A staff directory with group memberships is a map of who holds which role and access, which helps phishing and targeting. A vendor's denial and an attacker's claim are both unverified until the customer's own logs show what happened.
Oracle fixed CVE-2026-101767 on October 20 in its October critical patch update. The flaw is an unauthenticated SQL injection in the Thin Client Framework servlet of E-Business Suite's Application Object Library, and it can lead to remote code execution over ordinary web requests. It is rated 9.8 out of 10 and affects versions 12.2.3 through 12.2.15. Horizon3.ai reported it to Oracle on July 24. On October 27 the threat-intelligence firm Defused recorded exploratory attacks against its decoy systems, the first public sign of attempts. No successful compromise, named attacker or campaign has been reported, and Oracle had not marked the flaw as exploited. Scans count 2,246 internet-facing E-Business Suite web properties (Censys, October 28) and more than 670 exposed instances (Shadowserver), but neither can show which of them are unpatched.
E-Business Suite often holds finance, payroll, HR and purchasing records, so a break-in can reach the most sensitive business data. A patch tells attackers where the flaw is, and probing started within a week of the fix.
GMO Internet Group's Onamae.com Desktop Cloud rents Windows desktops hosted on GMO servers and is commonly used to run automated currency-trading tools. GMO detected an intrusion on October 20 and said malware could have been installed on up to 26,739 customers' servers. It began shutting down all plans on October 21, and on October 28 it said it will not restart the platform in its current form. Customers reported unrecognized activity on foreign-exchange trading accounts, and five trading firms told Japan's Financial Services Agency that their customers were affected. On October 26 GMO said the attacker planned to publish customer information and trigger ransomware at noon on October 27, and it told customers to back up, disconnect and power down their PCs. By that afternoon GMO had confirmed no ransomware, and purported customer data later appeared online. GMO reportedly refused a ransom demand and had the publishing domain taken down on October 28, though replacement sites could appear. GMO also reported a $50 million demand on October 21, launched a bounty of up to $1 million for information leading to the attackers, offered affected customers a free replacement desktop service for six months, and announced compensation that includes 5,000 yen for every current customer and reimbursement of confirmed losses from unauthorized trades. In its latest report it said it had found no sign of malware or ransomware on the customer devices analyzed so far. The attacker has not been identified.
A hosting provider's breach reached tens of thousands of customer desktops at once, and many held trading logins. The attacker's deadline shows how malware can be planted first and timed later, but so far the threatened ransomware has not been reported.
Capcom detected unauthorized access to its CAPCOM ID account service on October 19 and confirmed that email addresses and account details for 11,774,247 accounts were exposed, including creation dates, last-login dates, login counts and last IP addresses. Passwords and card data were not taken, but attackers changed the passwords on 196 accounts, which Capcom reset. Separately, Sony Network Communications confirmed on October 27 that its So-net member database was accessed without authorization on October 19, exposing 2,585,481 records from the So-net and plala services, including 54,401 email addresses with passwords and 16 bank-account records. It detected the intrusion on October 23. Sony says no card data and no PlayStation Network accounts were involved, and the data was reportedly published online from October 24. Neither company has said who was behind its breach or how the attackers got in, and no source reviewed links the two incidents.
Email addresses and login details are enough to power convincing phishing, and for So-net users the exposed email passwords opened a route to account takeover. Sony reset all affected email passwords on October 27, eight days after the intrusion began.
CVE-2026-111497 (CVSS 9.2), also called HTTP2Shell and Broccoli2Shell, is an out-of-bounds write in the decoder of Google's Brotli compression library, versions 1.0.3 through 1.2.0. A specially crafted compressed stream can crash an application, leak memory or let an unauthenticated attacker run code. Researchers at OpenAI reported it, and Node.js and Google shipped fixes on October 21. CISA added it to its exploited list on October 27 with a federal deadline of November 10 and gave no details of the attacks. ELLIO, a lab that watches for mass scanning, logged a malicious request aimed at Node.js 24.22.0 on October 26, but that attacker's own final stage produced no shell in any of ELLIO's 50 tests. Imperva has shown code execution on an official Node.js image. The affected software goes beyond Node.js: Microsoft .NET and PowerShell, Python packages, Palo Alto's PAN-OS, and the SDDC Manager in VMware Cloud Foundation and vSphere Foundation, which Broadcom flagged on October 27.
Brotli is used across web servers, browsers and content networks, and data is often decompressed before application-level checks run, so the flaw sits in places that are easy to overlook. The practical task is finding every product that bundles the library.
The PHP project released emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, two critical flaws that let an unauthenticated attacker run code on a web server through PHP's memory handling and upload-progress feature. Researchers at Wiz, Calif and OpenAI are credited with finding them. Details leaked before the planned October 22 disclosure, so the release was brought forward. Amazon Threat Intelligence reports exploitation attempts from October 17, four days before the fixes, and says the flaws are now being broadly exploited, although it is unclear how many attacks succeed. The NSA advised taking sites that cannot be patched offline, and UK government websites went dark as a precaution. VulnCheck says hundreds of public proof-of-concept repositories exist but very few contain working exploits, and that it has built a working bypass of the ASLR memory protection. CISA added both flaws to its exploited list on October 26, with a federal deadline of October 29. Researchers at Dream reported on October 28 that an attacker used them from October 25 to take root control of 25 servers in the United States, Japan, Taiwan and South Korea, three of them belonging to a US government-affiliated organization, then kept a reverse SSH tunnel into that network and went after Active Directory. The attacker also used a Linux kernel privilege-escalation flaw, CVE-2026-46300 (Fragnesia), which CISA added to its exploited list on October 28. The affected firewall vendor was not named and the full extent of the intrusion is unknown. Palo Alto Networks says all versions of PAN-OS and Panorama are affected, and the Dutch NCSC's public inventory lists several hundred affected products.
PHP runs a large share of websites, so a long tail of unpatched and unsupported servers is expected. Defenders are warned not to assume the disclosure date was the earliest exploitation. Many appliances and vendor products embed PHP, so patching your own web servers is not enough.
On October 26 the University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages. UNM Health limited new admissions, diverted ambulances and suspended outpatient surgeries and appointments, and classes at its health schools were cancelled. By October 27 UNM said its critical systems were back online and clinics had resumed. It said the event affected some end-user devices but did not reach core systems or servers, and it has not said what kind of attack it was. A group calling itself Byod, which posts on a leak site, claimed the attack and says it compromised about 36,000 machines and holds Social Security numbers, payroll, student and patient records, and internal emails. Those claims are unverified, and it is not clear whether ransomware was used. UNM says it has made no concessions to the group, and the FBI is running a forensic analysis as part of a criminal investigation. UNM had not confirmed any data theft as of October 28 and says the FBI's forensic review will show whether patient data was exposed. The group also says it will provide free decryption keys to healthcare facilities, and that it will keep the stolen data.
UNM Hospital houses New Mexico's only Level I trauma center, so even a short outage meant diverted ambulances. Recovery within about a day shows the value of practiced downtime procedures.
After PHP's October 21 emergency fixes (see the PHP2Shell entry), industrial suppliers have been checking whether their products embed a vulnerable PHP. SecurityWeek reports that Siemens, Schneider Electric, ABB and others confirmed some products are affected. Schneider Electric named three: EcoStruxure Security Expert, ProLeiT LINEoptimize and EcoStruxure Control Engineering. Johnson Controls released patches for several Illustra camera lines and fixed Visonic PowerManage in version 5.0.45. HMS says it patched or removed vulnerable PHP in its Talk2M remote-access services and Argos documentation server and found no signs of compromise. CONTEC has released fixes for its CONPROSYS Linux SDK, M2M controllers, gateways and PACs. Rockwell Automation had confirmed no affected products as of its notice, Hitachi Energy was still investigating, and Moxa said none of its products are affected. Engineering.com notes that core industrial software such as ERP, PLM and MES is generally not built on PHP, so the exposure is mainly in web-facing components.
Embedded PHP in industrial products rarely updates itself, and these web interfaces are often reachable from business networks. Because the flaws are already exploited on ordinary web servers, any industrial web interface that can be reached from the internet should be treated as at risk.
Cysic's BNB Chain bridge lost about $727,000 on October 17 after attackers used access to a supporting database to feed it a forged message that minted 10 million unauthorized tokens. The WAX multi-chain bridge lost about $90,500 on October 22 because a missing input check accepted a negative fee value. Initia halted its chain after a flaw in how its MoveVM caches scripts let attackers mint tokens, with losses of about $2.6 million to $2.7 million. Chainalysis data cited by Blockworks puts October DeFi losses at $718 million across 11 hacks, 82% from bridges, but one analyst could not confirm that against a primary Chainalysis release and found the verified bridge incidents total far less. Separately, CoinDCX denied a report of about $16 million leaving its wallets, saying the addresses date from its 2025 breach. The Binance theft on October 29, covered in its own entry, pushed October past any earlier month on record, according to Crypto Times.
The pattern matches the larger thefts: the weak point is the off-chain infrastructure and verification logic around a bridge, not arithmetic inside the contracts.
On October 23 Moldovan government IT staff noticed data being pulled out of state systems. To stop the theft, officials shut down 82 public digital services and 30 government networks. The country's e-government agency says the attackers took sensitive details on about 750,000 citizens, roughly a third of the 2.35 million population. The data includes names, birth details, family information, insurance and pension records, driver's licence data, photos, property records and financial details such as bank accounts and debts. Reporting says the attackers got in through a logging service that was exposed to the internet without authentication, and that they tried to get back in on Sunday and Tuesday and failed. Officials have not said who is responsible. Services are being restored one at a time after each passes a security audit. It is Moldova's second major breach this year, after a hack of its healthcare database in April.
The stolen records tie a person's identity to their family, property and money, which is what fraudsters need to impersonate people or pressure them. The reported way in was a support tool left open to the internet, a reminder that small oversights can open a national system.
On October 21 attackers published LiteLLM version 1.107.0 to PyPI and to its official Docker images. It carried an infostealer and a remote access trojan, and was live for roughly two hours (11:39 to 13:23 UTC on PyPI). LiteLLM says the attackers used GitHub CLI tokens stolen from three engineers' accounts, reportedly found in the logs of an internal deployment, to disable branch protections and run its release workflow against a lookalike repository, so the build looked legitimate. LiteLLM says earlier versions are safe and its private enterprise release was not affected. There is no CVE. Datadog tied the earlier March compromise to TeamPCP; none of the sources reviewed attribute this one.
LiteLLM sits between applications and AI providers, so it holds provider API keys, cloud identities and database credentials. It has about 23 million weekly downloads.
BeyondTrust disclosed CVE-2026-102764 (severity 9.3), a flaw in how an internal messaging component of Remote Support checks where messages come from, which lets a remote attacker perform file operations on the appliance. By BeyondTrust's timeline, a China-nexus espionage group tracked as Armory Castle (also UNC5221 or Warp Panda) used it as a zero-day on a single self-hosted appliance on August 29. SaaS customers were patched by October 9. CISA listed the flaw on October 16 with a federal deadline of October 19.
Remote-support tools have privileged reach into many endpoints, which makes them valuable to espionage groups.
Al Jazeera reported that dozens of its journalists' devices were infected with spyware designed to collect sensitive data, and called it an assault on press freedom. As relayed by Democracy Now, Citizen Lab corroborated the findings: an Israeli advertising-technology company, Discover-Tech, used personalized ads to deliver spyware from Candiru, a firm the US government blacklisted in 2021. The infections are described as zero-click, meaning the target did not need to tap anything.
Advertising networks can be used as a delivery route to specific people, which is hard for the target to notice or block.
ConnectWise disclosed on October 16 that application identities of its Cloud Backup product, formerly SkyKick and used by IT service providers to back up customers' Microsoft 365 data, were accessed without authorization. It took the service offline on October 17, finished resetting credentials by October 19 and began restoring in phases on October 21. Microsoft attributes the campaign to Storm-0940, a China state-aligned group, which used an open-source agentic AI penetration-testing framework called ARTEX for scanning, password spraying and abuse of OAuth apps. Microsoft says the group tried to sign in to more than 2,250 customer tenants. Most attempts failed, but it gained privileged cloud persistence at several organizations, in some cases in under three hours. ConnectWise says it has no sign that backup data was taken and warns that access already set up inside customer tenants needs separate review. China's embassy rejected the accusation.
One trusted app with permission inside many customers' Microsoft 365 environments gave the attackers a single door to many victims. Microsoft calls it one of many AI-driven attacks since early October.
Palo Alto Networks released fixes on October 14 for CVE-2026-0322 (severity 8.6) and said it had seen very limited exploitation. The flaw is in the management interface and lets an authenticated attacker with network access run code as root on PA-Series and VM-Series firewalls and Panorama. Cloud NGFW and Prisma Access are not affected. CISA set a federal deadline of October 17. The same week brought a fix for an exploited Ivanti Connect Secure zero-day and a Cisco warning about an exploited Secure Email Gateway flaw.
A firewall is meant to protect the network, so root access on one gives an attacker a strong position. It is also the second exploited PAN-OS flaw in about five months.
This is a lab experiment, not a real attack. Booz Allen tested frontier AI models against an isolated industrial testbed at its lab in Chantilly, Virginia, built to resemble a manufacturing plant with real controllers, a SCADA platform, a motor drive, sensors and a robotic arm. The models were given only network boundaries, with no source code, engineering documents or OT guidance, and the company says they reached every objective across eight scenarios. In one run a model went from a perimeter breach to acting inside the control network in just over 16 minutes. In another it located the robotic arm and moved it. Existing defenses slowed or blocked some actions but no single safeguard consistently stopped the models, and the models were not named. Reporting says the AI mostly used the devices' own protocols and default passwords, not new exploits, and that the tests paused for human approval before physical actions. Dark Reading adds that Booz Allen left some unpatched vulnerabilities in place, so the timing excludes time to develop new exploits, and outlets differ slightly on what the final physical step was. The results come from the company's own report and have not been independently reproduced.
The finding is about speed and skill, not a new kind of flaw. Tasks that normally need several experts, such as finding devices, researching them and planning steps, were done by software in minutes, which leaves less time for human defenders to react and weakens the idea that obscure industrial systems are safe because they are hard to understand.
Microsoft fixed roughly 1,400 vulnerabilities on October 13. Published counts range from 1,407 to 1,413 depending on method, against about 970 in September. One zero-day, a Windows Shell bypass of the Mark of the Web protection (CVE-2026-96951), was already being exploited, and two others were publicly disclosed. Microsoft ties the rising volume to AI-assisted vulnerability discovery. One analysis puts monthly industry-wide CVE disclosures up 145% in two years, from 3,173 in June 2024 to 7,765 in June 2026.
Patch volume now exceeds what many teams can test and deploy, so prioritization decides outcomes.
The parent company of Food Lion, Stop & Shop and Hannaford said in mid-October it was dealing with a cybersecurity issue and took some systems offline, including brand websites and apps, while stores stayed open. On October 19 it said the investigation had confirmed the incident was caused by the malicious actions of others, that it had filed a police report with the Dutch police, and that it had found no evidence that any sensitive customer, associate or partner data was taken. The investigation continues. Its European brands Albert Heijn, Etos and Gall & Gall and its Belgian e-commerce were back online, and the US banners' websites and apps returned on October 20 after at least eight days. Unfulfilled online orders were refunded. Public reporting still names no attacker and does not say whether systems were encrypted. Ahold Delhaize said early on that it saw no reason to link the incident to the French refrigeration attacks. It is the second major attack on the group since a November 2024 breach that exposed data on about 2.2 million people. On November 2 its Delhaize brand, whose stores in Belgium and Luxembourg were among those hit by a new wave of refrigeration failures, said it is investigating whether that incident is linked to the October attack.
Retail groups depend on shared back-end systems, so a precautionary shutdown can disrupt many brands at once.
Overnight on October 11 to 12, attackers remotely pushed refrigeration systems into defrost mode. Temperatures reached 50 degrees Celsius in some cold rooms, food was spoiled and some fires started. Affected chains include Intermarché, Carrefour (80 stores), Coopérative U, Monoprix and Netto, and reporting cites upward of 350 stores. Paris prosecutors opened a criminal investigation. France's CERT-FR said numerous remote controllers were compromised and on October 13 widened its alert from Danfoss AK-SM and AK-SC equipment to Copeland and Dixell XWEB devices. Danfoss said many affected units were end-of-life models it no longer patches, and others ran old firmware. Reported effects include defrost cycles stretched from about one hour to eight and delayed alarms, and some stores closed for a time. Authorities have not attributed the attack and no group has claimed it, and other countries may be affected. Forescout says a key open question is whether the attackers reached the controllers through individually exposed interfaces or through shared maintenance infrastructure. Other counts go above 500 stores: the Mousquetaires group (Intermarché, Netto) said 300 of its stores were hit and Coopérative U said 80. The Paris prosecutor's cybercrime section is leading the investigation with the national anti-cybercrime office. Claroty counted 2,765 exposed Danfoss controllers still online, and CERT-FR's October 13 update warned the attack campaigns were probably still active. A summary from Spain's INCIBE puts losses at tens of millions of euros. France's finance minister, Roland Lescure, told Parliament on October 13 that about 700 of the country's 10,000 supermarkets were affected, according to AP, while Reuters said estimates ranged from about 400 to 700 stores. Similar tampering hit supermarkets and food shops in several other European countries on November 2; see the entry on the second wave.
This is everyday commercial equipment, not a power plant, and the weaknesses were known: Claroty's Team82 had published research on the Danfoss AK-SM 800A controller on August 9, and a Danfoss bulletin already described earlier attacks.
Thefts began around October 9 from more than 300 wallets, mostly in Southeast Asia, with estimates of $90 million to $93 million across several blockchains. Ledger confirmed on October 10 that an affected customer's device contained an unauthorized hardware implant. Ledger says a highly organized criminal group bought genuine devices, fitted implants able to read recovery phrases, and fed them back into the supply chain through resellers. The confirmed cases involved purchases through the reseller CryptoBilis. Ledger says its chip, operating system and servers were not compromised and its own sales channel was unaffected. One report says a researcher found a similarly modified device at a German retailer. Ledger has told recent reseller customers not to set up new devices.
This was not a software bug. Genuine devices were physically altered before sale, and according to one analysis the leak channel used the device's own cellular hardware, so antivirus or network monitoring would see nothing. No attacker has been identified.
Canonical's web properties, including ubuntu.com and developer pages, had intermittent outages from a distributed denial-of-service attack on October 8. No group has claimed it. An April attack that disrupted updates was claimed by a group calling itself the Islamic Cyber Resistance in Iraq 313 Team. This item is based on a weekly news review, so treat details as preliminary.
Software distribution sites are shared infrastructure. When they are unreachable, updates are delayed for many users.
At about 3:40 a.m. on October 7, ransomware hit East Japan Region 1 of IDCF Cloud, run by IDC Frontier, a SoftBank subsidiary. The company says 495 companies and local governments were affected, and websites of a prefecture and city governments went dark. On October 8 IDC Frontier said data in four zones of the region was unlikely to be recoverable by the provider, so restoration depends on customers' own backups. As of October 14 other zones and regions were reported unaffected, with safety checks continuing. No group has claimed it and the ransom note named none, and IDC Frontier has not said how the attackers got in. A frozen-food logistics firm, Nissui Logistics, had a separate outage whose link to the attack is unclear.
Customers who kept backups and snapshots only with the provider had nothing to restore from. The attackers' message claimed it took seven minutes to encrypt the region, which is their claim, not a confirmed figure.
German security researcher Marlon Starkloff of Jakkaru found in late August that the login for Sungrow's iSolarCloud platform could be tricked into skipping the password check. Setting a login-type parameter to a particular value gave access to accounts without a valid password, and the platform raised no alert. According to reporting based on Die Zeit, the researchers went from user accounts to management accounts at German installers Enpal and 1KOMMA5° and then to Sungrow's own administrator accounts. With that access an attacker could have started or stopped inverters, controlled battery storage or installed new firmware. About 250,000 Sungrow installations in Germany were in reach, with about 470,000 in Europe and about 2.2 million worldwide. An expert quoted in the report said that about 3 GW switched off at once could cause a blackout like the one in Spain. The researchers did not run such commands on other people's systems. Sungrow confirmed the flaw, closed it with an emergency fix within a day and says attackers did not exploit it.
Solar inverters are controlled from the manufacturer's cloud, so one flaw in a login page can become a lever on a whole fleet across a country's grid. The same fleet-wide reach would apply to any vendor whose cloud can command many inverters.
Chainalysis, which published its tracing findings on October 1, attributes more than $1 billion of 2026 crypto theft to North Korea-linked actors, and Elliptic separately counts more than 51 suspected North Korean incidents that also push the total past $1 billion. The total includes the April thefts from Drift (about $285 million) and KelpDAO (about $292 million), which now fall before this six-month window, and, on the firms' assessment, Bitget (about $387 million). One report puts North Korea-linked theft in the first half at about $643 million, roughly 55% of all thefts in that period. On October 29 and 30, TRM Labs attributed the $6.36 billion theft from Binance to TraderTraitor with high confidence, and Elliptic said North Korean involvement is likely, with caveats. If that holds, North Korea-linked theft for 2026 would exceed $7 billion. The totals above do not include it, and no government has confirmed the attribution.
Attributions come from private analytics firms and company statements, based on on-chain patterns and timing, and are not formal government findings. The two firms count differently, so the total is an estimate.
Bitget detected unauthorized transfers on September 24 and suspended withdrawals. The first estimate was $351.6 million, later revised to about $387.5 million to $388 million, taken from hot and warm wallets. Bitget says cold storage was not affected, that its protection fund covers all customer losses, and that the attacker used a vulnerability in third-party security software to obtain internal credentials and insert fraudulent withdrawal instructions. No CVE or vendor has been named, so that claim is unverified. Bitget engaged Mandiant and SlowMist, resumed bitcoin withdrawals around September 27 and 28, and said North Korea is very likely responsible. Chainalysis later traced stolen XRP into bitcoin. No law-enforcement agency has confirmed attribution.
The attackers did not need to steal private keys. They went through a security product the exchange itself relied on, and one forensic report puts the earliest suspicious activity about 25 days before the theft.
NCC Group counted 1,073 ransomware victims in August, a 2026 high. Breachsense counted 964 for August and 789 for September across 79 active groups, so totals differ by method. Qilin (164 incidents) and The Gentlemen (116) led in August. Healthcare was the most targeted sector in September for the fourth month in a row, and the United States accounted for 41% of victims.
These counts only include victims listed on leak sites. Many victims pay before being listed, so real numbers are higher.
CISA's known-exploited-vulnerability additions between August and October included SonicWall SMA1000 appliances (two flaws on September 2), MikroTik RouterOS (three flaws across September 10 and 25), JFrog Artifactory, BerriAI LiteLLM and Kestra (all September 2), and repeated Microsoft SharePoint entries. Under its directive BOD 26-04, US federal agencies must prioritize listed flaws on internet-exposed assets that give full control, and check for prior compromise before patching. On October 14 CISA also listed two chained flaws in the AhsayCBS backup server (CVE-2026-105133 and CVE-2026-105134). Huntress first saw exploitation on October 7 and had seen five organizations targeted by October 8, and Ahsay said on October 12 that its earlier patches did not fully fix them.
The list shows what attackers actually use: remote-access gear, routers, and developer and AI tooling that is often exposed to the internet.
Hacken counts $1.18 billion stolen across 107 incidents in the third quarter, the highest since early 2025. About 77% came from compromised suppliers, developer tools or infrastructure rather than flaws in smart contracts, and the four largest incidents made up about 80% of the value. PeckShield counted 50 incidents worth $136 million in August and 55 worth about $766 million in September, while CertiK counted 97 incidents and about $768 million for September. TRM Labs counted about $972 million across 207 incidents in the first half. Totals differ by tracker and method.
The money is concentrated in a few large thefts, and most of them started with people or third-party systems, not clever code exploits.
On September 6, attackers drained about 4,000 BTC, roughly $319 million, from the reserve wallet of the Liquid Network, a Bitcoin sidechain built and run by Blockstream. TRM Labs' reconstruction points to a flaw in how the Elements software caches the results of range-proof checks, which may have let an invalid output pass as already verified. The attackers minted unbacked L-BTC and requested a withdrawal, and the signers approved it because the software treated the chain as valid. Blockstream said none of its signing keys were compromised and has patched the bug. On September 7 the attackers returned about 3,400 BTC (about 85%) and kept about 598 BTC, calling it a bounty and describing themselves as white-hat hackers, which is unverified. As of September 8 the network was paused and redemptions halted.
It was the biggest theft of 2026 at that point, and the money came back only because the attackers chose to return it. The signers followed their rules and still approved a bad transaction.
On August 30, an attacker inflated the price of Tectonic's thinly traded TONIC token about 100-fold within 20 minutes, according to on-chain researcher Weilin Li, and used it as collateral to borrow other assets from the largest lending protocol on Cronos. Early estimates put the loss near $75 million. About 36 minutes after the attack began, validators halted the chain, then agreed to roll it back by about one hour and 54 minutes. Cronos later said the attacker had borrowed about $120 million, that the rollback reversed about $111 million of it, and that about $9.2 million had already left through bridges and remains unrecovered. Crypto.com said its app and exchange were not affected.
The rollback saved most of the money but erased legitimate transactions from that window, a trade-off only some networks can make. The attack follows the price-manipulation pattern seen in the 2022 Mango Markets case.
A campaign that Microsoft attributes to a group called TeamPCP compromised developer and security tooling. Attackers hijacked the release pipeline of the Trivy scanner, then reached Checkmarx KICS and LiteLLM. On April 22 a malicious Bitwarden CLI package (version 2026.4.0) was live on npm for 93 minutes, built to steal developer credentials such as GitHub tokens and cloud keys. Bitwarden said vault data and production systems were not affected. In August, CloudSEK published a lookup of thousands of potentially affected organizations. In October a separate compromise hit LiteLLM again (see its own entry); none of the sources reviewed link that one to TeamPCP.
Scanners and command-line tools run inside build systems where secrets are available. In the Trivy case, 76 of 77 tags of its GitHub Action were repointed, so anyone referencing a tag by name pulled the malicious code.
Colorado officials said that in late August, foreign actors changed equipment settings, disabled remote access and alarms, and altered pumping cycles at two small private water providers, each serving fewer than 200 people. Operators regained control, and officials said treatment and water quality were not affected. The utilities and the attackers have not been named. Officials said they know of Iranian activity against water systems but there is no confirmation that these incidents belong to the same campaign. The EPA says more than 100 water and wastewater systems in 12 states have been targeted this year.
Disabling alarms and remote access is what an attacker does to blind operators. Small operators often have no security staff.
US Coast Guard and FBI teams boarded the tanker VL Prosperity on August 21 and a second tanker on August 24 after indications that both vessels' networks were compromised. Iranian state media reported the VL Prosperity lost communications for more than 30 hours around August 7 near the Strait of Gibraltar. Bloomberg later reported investigators found that hackers accessed a digital system connected to the ship's propulsion, and investigators have not said whether they tried to manipulate it. Crew claims relayed by Iranian media about engine speed and cooling are unverified. The Coast Guard has not attributed the attacks and reported no operational disruption, danger to crew or environmental harm. By September, US agencies were tracking cyber threats against nearly 20 vessels. North Carolina Ports separately reported a cyberattack on August 6 that forced manual operations.
A ship is a floating industrial network. Even partial access to systems linked to propulsion is unusual enough to draw federal boarding teams.
Starting July 31, attackers began draining bitcoin from wallets created on Coldcard Mk3 devices. Galaxy Research estimates losses above $115 million, possibly over $130 million, says it has spoken with more than 200 victims, and believes at least 15 separate attackers were exploiting the flaw. Coinkite, the maker, said a firmware bug present since version 4.0.1 in March 2021 made the device fall back to weaker software-generated randomness when creating seeds, which let attackers guess recovery phrases. Coinkite said the bug went unnoticed for years and urged users to update or move their funds off the device.
A flaw in seed generation puts every affected wallet at risk no matter how carefully its owner stored the recovery phrase. The loss estimate comes from Galaxy Research and was still rising.
On July 30, CISA warned water and wastewater operators that threat actors target utilities of all sizes, and that even mature programs should check external connections, including cellular modems installed by operators, vendors or integrators that may not be documented. In an update reported in late August, CISA said it saw malicious activity against more than 100 internet-exposed systems in the sector in July, most commonly controllers connected directly to a cellular modem. It reported no significant disruption to water service. The FBI has urged utilities to disconnect systems from the internet where possible and be ready to revert to manual controls.
The assumption that a very small utility is too small to target no longer holds, and nothing in the advisory describes a new technique.
Between July 26 and 27, a coordinated cyberattack disrupted water and wastewater operations across more than 30 Minnesota communities, according to Tenable's summary. Some automated controls were affected and Maple Plain declared a local state of emergency. In Plymouth, only equipment connected over cellular links was hit and manual operation kept water flowing. Separately, cyber activity caused a pressure drop at the Clayton County Water Authority in Georgia, prompting a boil-water advisory for 300,000 customers, with service restored within hours. A federal investigation is pending and attribution is not confirmed, although the timing matches the Iran-linked controller activity in CISA's advisory. SecurityWeek reports that the FBI and EPA later said water systems in at least seven states were targeted.
Small utilities were hit at scale, and the ability to switch to manual operation is what limited the impact.
A joint advisory from US agencies including CISA, the FBI, NSA and EPA, first published April 7, said Iranian-affiliated actors were exploiting internet-exposed Rockwell Automation and Allen-Bradley programmable logic controllers (PLCs) and disrupting US organizations in government services, water and energy, with disruptions since at least March. A July 22 update added detection guidance for malicious changes to reusable code modules in PLC programs, and said activity against ports used by Schneider Electric and Siemens equipment suggests opportunistic targeting of other vendors. Researchers link the activity to CyberAv3ngers, a group tied to Iran's IRGC.
The advisory covers the whole period. It turned an alert about one vendor's products into a warning about any internet-reachable controller.
The Swiss rail manufacturer said criminals used compromised login details to reach a data-exchange platform shared with a supplier in mid-July, exposing the supplier's technical information. The Everest group demanded about 10 million Swiss francs (roughly $12.3 million). Stadler refused, filed a criminal complaint and said its own IT systems, production and trains in service were not affected. Everest later listed Stadler on its leak site, according to SOCRadar.
It shows the current extortion pattern: steal data, skip the encryption, and go through a partner's platform rather than the victim's own network.
In May the ShinyHunters group named Charter Communications, the parent of Spectrum, in a pay-or-leak extortion campaign. In July, data tied to about 1.6 million unique email addresses from RingCentral appeared in material the group published. These figures come from analysis of the group's own postings, and security reporters note that the group has a record of overstating its hauls.
The group keeps hitting large service providers that hold data on many downstream customers, so one claim can affect many organizations.
Darktrace flagged ZionSiphon, malware built for industrial environments and aimed at Israeli water treatment and desalination systems. According to Bitsight's summary, it scans for industrial devices over several protocols and has sabotage capability aimed at chlorine and pressure controls. Bitsight says it may have been circulating since mid-2025.
Malware written specifically for industrial processes is rare, so each case shows where state-aligned developers are putting effort.
After the April thefts came a series of mid-sized ones. THORChain lost about $10.7 million on May 15 when a malicious node operator abused a flaw in its threshold-signature scheme. The Verus Ethereum bridge lost about $11.6 million on May 18 because of a missing check that let a forged proof pass. The Syscoin bridge lost about $10 million on June 7 after a parsing error in proof validation allowed unauthorized tokens to be minted. On June 8, Humanity Protocol lost about $31 million to $36 million after malware on a developer's laptop exposed seven private keys. Amounts vary by tracker.
Two of the four were plain verification mistakes in bridges, and one was a stolen-keys problem on a single laptop. Individually small, together they show the same weak spots again and again.
The Iran-linked group Handala claimed in June that it had breached California Water Service, a utility serving about two million customers, published 5 GB of data and said it could have disrupted water supply but chose not to. Dataminr reported that the data pointed to a customer billing database and an internal GNSS base-station application, and that the Chico District was a confirmed victim. Cal Water brought in Mandiant and later said it found no evidence of activity in its operational technology environment, and that the actor accessed one active customer's online account using stolen credentials. Analysts note that Handala has a record of overstating its capabilities. The US links Handala to Iran's intelligence ministry, and the group framed the claim as retaliation for US strikes in Iran.
It shows how a claim about water systems can run ahead of the evidence: the data came from business systems, not plant controls.
Cisco confirmed exploitation of CVE-2026-20245, a command-injection flaw in Catalyst SD-WAN Manager, Controller and Validator that lets an attacker who already has administrator-level access run commands as root. CISA added it to its list of known exploited vulnerabilities on June 4. Mandiant later reported it was used as a zero-day at least two months before disclosure, chained with earlier SD-WAN authentication flaws (CVE-2026-20127 and CVE-2026-20182). It is the seventh Cisco SD-WAN vulnerability exploited in 2026.
The SD-WAN management layer controls routing and policy for an entire network. Root access there lets an attacker reconfigure the devices at every site.
DentaQuest says a May network breach affected 15 million people, exposing Social Security numbers and dental or vision health information. It is described as the largest US health data breach reported so far in 2026.
Records that combine identity numbers and health details are hard to replace and are useful for fraud for years.
Carnival's notice says it found unauthorized activity involving an employee account on April 14. The company said an unauthorized actor used social engineering to trick an employee into giving access to a limited part of its IT systems. An industry summary puts the number of affected customers at about 6 million. The breach was made public in May.
A single convincing conversation with one employee was enough. Technical controls were not the weak point.
Nozomi Networks research reports that the Russian state-linked group Sandworm continues to target industrial and critical infrastructure using aggressive lateral movement and older malware, and that its activity intensifies after detection instead of stopping. Affected sectors include manufacturing and transportation. Targets included engineering workstations, operator screens (HMIs), PLCs, remote terminal units and other field controllers.
Spotting an intruder is not the end of an intrusion. This group appears to rely on access it already has rather than on new vulnerabilities.
Instructure, the company behind the Canvas learning platform, confirmed unauthorized activity in late April. The ShinyHunters extortion group claimed responsibility, set ransom deadlines and on May 7 defaced the login pages of roughly 330 institutions. Canvas was taken offline briefly and restored the next day. On May 11 Instructure said it had reached an agreement with the actor and received confirmation that the data was destroyed. Claims of hundreds of millions of records have not been verified.
One education-technology provider serves about 9,000 institutions, and the outage landed during exam season. It was reportedly the second ShinyHunters breach of Instructure in about eight months, and the intrusion reportedly abused a free teacher-account program that the company then shut down permanently.
No incidents match these filters.