urn:cyber-watch:feed A plain-language record of the main IT, OT and crypto cybersecurity incidents, exploited vulnerabilities and thefts of the last six months, with sources. 2026-10-28T00:00:00Z urn:cyber-watch:cr-oct-bridges 2026-10-23T00:00:00Z

Cysic's BNB Chain bridge lost about $727,000 on October 17 after attackers used access to a supporting database to feed it a forged message that minted 10 million unauthorized tokens. The WAX multi-chain bridge lost about $90,500 on October 22 because a missing input check accepted a negative fee value. Initia halted its chain after a flaw in how its MoveVM caches scripts let attackers mint tokens, with losses of about $2.6 million to $2.7 million. Chainalysis data cited by Blockworks puts October DeFi losses at $718 million across 11 hacks, 82% from bridges, but one analyst could not confirm that against a primary Chainalysis release and found the verified bridge incidents total far less. Separately, CoinDCX denied a report of about $16 million leaving its wallets, saying the addresses date from its 2025 breach.

urn:cyber-watch:it-php2shell 2026-10-21T00:00:00Z

The PHP project released emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, two critical flaws that let an unauthenticated attacker run code on a web server through PHP's memory handling and upload-progress feature. Researchers at Wiz, Calif and OpenAI are credited with finding them. Details leaked before the planned October 22 disclosure, so the release was brought forward. Amazon Threat Intelligence reports exploitation attempts from October 17, four days before the fixes, and says the flaws are now being broadly exploited, although it is unclear how many attacks succeed. The NSA advised taking sites that cannot be patched offline, and UK government websites went dark as a precaution. VulnCheck says hundreds of public proof-of-concept repositories exist but very few contain working exploits, and that it has built a working bypass of the ASLR memory protection.

urn:cyber-watch:it-litellm 2026-10-21T00:00:00Z

On October 21 attackers published LiteLLM version 1.107.0 to PyPI and to its official Docker images. It carried an infostealer and a remote access trojan, and was live for roughly two hours (11:39 to 13:23 UTC on PyPI). LiteLLM says the attackers used GitHub CLI tokens stolen from three engineers' accounts, reportedly found in the logs of an internal deployment, to disable branch protections and run its release workflow against a lookalike repository, so the build looked legitimate. LiteLLM says earlier versions are safe and its private enterprise release was not affected. There is no CVE. Datadog tied the earlier March compromise to TeamPCP; none of the sources reviewed attribute this one.

urn:cyber-watch:it-gitlab 2026-10-21T00:00:00Z

On October 21 GitLab released patches for CVE-2026-110264, scored 10.0. An integer overflow while compiling a crafted regular expression could let an unauthenticated attacker run code on self-managed GitLab CE and EE servers. The affected code dates to 2014. GitLab.com is already fixed. GitLab did not say whether the flaw has been exploited, and as of October 22 it was not on CISA's exploited list. Servers patched on October 12 for an earlier critical regex flaw (CVE-2026-97229) are still affected, and there is no workaround.

urn:cyber-watch:it-beyondtrust 2026-10-16T00:00:00Z

BeyondTrust disclosed CVE-2026-102764 (severity 9.3), a flaw in how an internal messaging component of Remote Support checks where messages come from, which lets a remote attacker perform file operations on the appliance. By BeyondTrust's timeline, a China-nexus espionage group tracked as Armory Castle (also UNC5221 or Warp Panda) used it as a zero-day on a single self-hosted appliance on August 29. SaaS customers were patched by October 9. CISA listed the flaw on October 16 with a federal deadline of October 19.

urn:cyber-watch:it-aljazeera-spyware 2026-10-16T00:00:00Z

Al Jazeera reported that dozens of its journalists' devices were infected with spyware designed to collect sensitive data, and called it an assault on press freedom. As relayed by Democracy Now, Citizen Lab corroborated the findings: an Israeli advertising-technology company, Discover-Tech, used personalized ads to deliver spyware from Candiru, a firm the US government blacklisted in 2021. The infections are described as zero-click, meaning the target did not need to tap anything.

urn:cyber-watch:it-connectwise 2026-10-16T00:00:00Z

ConnectWise disclosed on October 16 that application identities of its Cloud Backup product, formerly SkyKick and used by IT service providers to back up customers' Microsoft 365 data, were accessed without authorization. It took the service offline on October 17, finished resetting credentials by October 19 and began restoring in phases on October 21. Microsoft attributes the campaign to Storm-0940, a China state-aligned group, which used an open-source agentic AI penetration-testing framework called ARTEX for scanning, password spraying and abuse of OAuth apps. Microsoft says the group tried to sign in to more than 2,250 customer tenants. Most attempts failed, but it gained privileged cloud persistence at several organizations, in some cases in under three hours. ConnectWise says it has no sign that backup data was taken and warns that access already set up inside customer tenants needs separate review. China's embassy rejected the accusation.

urn:cyber-watch:it-panos 2026-10-14T00:00:00Z

Palo Alto Networks released fixes on October 14 for CVE-2026-0322 (severity 8.6) and said it had seen very limited exploitation. The flaw is in the management interface and lets an authenticated attacker with network access run code as root on PA-Series and VM-Series firewalls and Panorama. Cloud NGFW and Prisma Access are not affected. CISA set a federal deadline of October 17. The same week brought a fix for an exploited Ivanti Connect Secure zero-day and a Cisco warning about an exploited Secure Email Gateway flaw.

urn:cyber-watch:ot-ai-agents 2026-10-14T00:00:00Z

This is a lab experiment, not a real attack. Booz Allen tested frontier AI models against an isolated industrial testbed at its lab in Chantilly, Virginia, built to resemble a manufacturing plant with real controllers, a SCADA platform, a motor drive, sensors and a robotic arm. The models were given only network boundaries, with no source code, engineering documents or OT guidance, and the company says they reached every objective across eight scenarios. In one run a model went from a perimeter breach to acting inside the control network in just over 16 minutes. In another it located the robotic arm and moved it. Existing defenses slowed or blocked some actions but no single safeguard consistently stopped the models, and the models were not named. Reporting says the AI mostly used the devices' own protocols and default passwords, not new exploits, and that the tests paused for human approval before physical actions. Dark Reading adds that Booz Allen left some unpatched vulnerabilities in place, so the timing excludes time to develop new exploits, and outlets differ slightly on what the final physical step was. The results come from the company's own report and have not been independently reproduced.

urn:cyber-watch:it-patch-tuesday 2026-10-13T00:00:00Z

Microsoft fixed roughly 1,400 vulnerabilities on October 13. Published counts range from 1,407 to 1,413 depending on method, against about 970 in September. One zero-day, a Windows Shell bypass of the Mark of the Web protection (CVE-2026-96951), was already being exploited, and two others were publicly disclosed. Microsoft ties the rising volume to AI-assisted vulnerability discovery. One analysis puts monthly industry-wide CVE disclosures up 145% in two years, from 3,173 in June 2024 to 7,765 in June 2026.

urn:cyber-watch:it-ahold 2026-10-12T00:00:00Z

The parent company of Food Lion, Stop & Shop and Hannaford said in mid-October it was dealing with a cybersecurity issue and took some systems offline, including brand websites and apps, while stores stayed open. On October 20 it confirmed the incident also disrupted services at stores across Europe and said it had filed a police report with the Dutch police. Belgian e-commerce was fully operational again, and US e-commerce was expected back in the coming days. Unfulfilled online orders were refunded. The company says the incident was caused by the malicious actions of others, but public reporting does not name an attacker or say whether systems were encrypted. It is the second major attack on the group since a November 2024 breach that exposed data on about 2.2 million people.

urn:cyber-watch:ot-french-fridges 2026-10-12T00:00:00Z

Overnight on October 11 to 12, attackers remotely pushed refrigeration systems into defrost mode. Temperatures reached 50 degrees Celsius in some cold rooms, food was spoiled and some fires started. Affected chains include Intermarché, Carrefour (80 stores), Coopérative U, Monoprix and Netto, and reporting cites upward of 350 stores. Paris prosecutors opened a criminal investigation. France's CERT-FR said numerous remote controllers were compromised and on October 13 widened its alert from Danfoss AK-SM and AK-SC equipment to Copeland and Dixell XWEB devices. Danfoss said many affected units were end-of-life models it no longer patches, and others ran old firmware. Reported effects include defrost cycles stretched from about one hour to eight and delayed alarms, and some stores closed for a time. Authorities have not attributed the attack and no group has claimed it, and other countries may be affected. Forescout says a key open question is whether the attackers reached the controllers through individually exposed interfaces or through shared maintenance infrastructure. Other counts go above 500 stores: the Mousquetaires group (Intermarché, Netto) said 300 of its stores were hit and Coopérative U said 80. The Paris prosecutor's cybercrime section is leading the investigation with the national anti-cybercrime office. Claroty counted 2,765 exposed Danfoss controllers still online, and CERT-FR's October 13 update warned the attack campaigns were probably still active. A summary from Spain's INCIBE puts losses at tens of millions of euros.

urn:cyber-watch:cr-ledger 2026-10-09T00:00:00Z

Thefts began around October 9 from more than 300 wallets, mostly in Southeast Asia, with estimates of $90 million to $93 million across several blockchains. Ledger confirmed on October 10 that an affected customer's device contained an unauthorized hardware implant. Ledger says a highly organized criminal group bought genuine devices, fitted implants able to read recovery phrases, and fed them back into the supply chain through resellers. The confirmed cases involved purchases through the reseller CryptoBilis. Ledger says its chip, operating system and servers were not compromised and its own sales channel was unaffected. One report says a researcher found a similarly modified device at a German retailer. Ledger has told recent reseller customers not to set up new devices.

urn:cyber-watch:it-canonical-ddos 2026-10-08T00:00:00Z

Canonical's web properties, including ubuntu.com and developer pages, had intermittent outages from a distributed denial-of-service attack on October 8. No group has claimed it. An April attack that disrupted updates was claimed by a group calling itself the Islamic Cyber Resistance in Iraq 313 Team. This item is based on a weekly news review, so treat details as preliminary.

urn:cyber-watch:it-idcf 2026-10-07T00:00:00Z

At about 3:40 a.m. on October 7, ransomware hit East Japan Region 1 of IDCF Cloud, run by IDC Frontier, a SoftBank subsidiary. The company says 495 companies and local governments were affected, and websites of a prefecture and city governments went dark. On October 8 IDC Frontier said data in four zones of the region was unlikely to be recoverable by the provider, so restoration depends on customers' own backups. As of October 14 other zones and regions were reported unaffected, with safety checks continuing. No group has claimed it and the ransom note named none, and IDC Frontier has not said how the attackers got in. A frozen-food logistics firm, Nissui Logistics, had a separate outage whose link to the attack is unclear.

urn:cyber-watch:cr-dprk 2026-10-01T00:00:00Z

Chainalysis, which published its tracing findings on October 1, attributes more than $1 billion of 2026 crypto theft to North Korea-linked actors, and Elliptic separately counts more than 51 suspected North Korean incidents that also push the total past $1 billion. The total includes the April thefts from Drift (about $285 million) and KelpDAO (about $292 million), which now fall before this six-month window, and, on the firms' assessment, Bitget (about $387 million). One report puts North Korea-linked theft in the first half at about $643 million, roughly 55% of all thefts in that period.

urn:cyber-watch:cr-bitget 2026-09-24T00:00:00Z

Bitget detected unauthorized transfers on September 24 and suspended withdrawals. The first estimate was $351.6 million, later revised to about $387.5 million to $388 million, taken from hot and warm wallets. Bitget says cold storage was not affected, that its protection fund covers all customer losses, and that the attacker used a vulnerability in third-party security software to obtain internal credentials and insert fraudulent withdrawal instructions. No CVE or vendor has been named, so that claim is unverified. Bitget engaged Mandiant and SlowMist, resumed bitcoin withdrawals around September 27 and 28, and said North Korea is very likely responsible. Chainalysis later traced stolen XRP into bitcoin. No law-enforcement agency has confirmed attribution.

urn:cyber-watch:it-ransomware-trend 2026-09-15T00:00:00Z

NCC Group counted 1,073 ransomware victims in August, a 2026 high. Breachsense counted 964 for August and 789 for September across 79 active groups, so totals differ by method. Qilin (164 incidents) and The Gentlemen (116) led in August. Healthcare was the most targeted sector in September for the fourth month in a row, and the United States accounted for 41% of victims.

urn:cyber-watch:it-edge-kev 2026-09-15T00:00:00Z

CISA's known-exploited-vulnerability additions between August and October included SonicWall SMA1000 appliances (two flaws on September 2), MikroTik RouterOS (three flaws across September 10 and 25), JFrog Artifactory, BerriAI LiteLLM and Kestra (all September 2), and repeated Microsoft SharePoint entries. Under its directive BOD 26-04, US federal agencies must prioritize listed flaws on internet-exposed assets that give full control, and check for prior compromise before patching. On October 14 CISA also listed two chained flaws in the AhsayCBS backup server (CVE-2026-105133 and CVE-2026-105134). Huntress first saw exploitation on October 7 and had seen five organizations targeted by October 8, and Ahsay said on October 12 that its earlier patches did not fully fix them.

urn:cyber-watch:cr-q3-trend 2026-09-15T00:00:00Z

Hacken counts $1.18 billion stolen across 107 incidents in the third quarter, the highest since early 2025. About 77% came from compromised suppliers, developer tools or infrastructure rather than flaws in smart contracts, and the four largest incidents made up about 80% of the value. PeckShield counted 50 incidents worth $136 million in August and 55 worth about $766 million in September, while CertiK counted 97 incidents and about $768 million for September. TRM Labs counted about $972 million across 207 incidents in the first half. Totals differ by tracker and method.

urn:cyber-watch:cr-liquid 2026-09-06T00:00:00Z

On September 6, attackers drained about 4,000 BTC, roughly $319 million, from the reserve wallet of the Liquid Network, a Bitcoin sidechain built and run by Blockstream. TRM Labs' reconstruction points to a flaw in how the Elements software caches the results of range-proof checks, which may have let an invalid output pass as already verified. The attackers minted unbacked L-BTC and requested a withdrawal, and the signers approved it because the software treated the chain as valid. Blockstream said none of its signing keys were compromised and has patched the bug. On September 7 the attackers returned about 3,400 BTC (about 85%) and kept about 598 BTC, calling it a bounty and describing themselves as white-hat hackers, which is unverified. As of September 8 the network was paused and redemptions halted.

urn:cyber-watch:cr-tectonic 2026-08-30T00:00:00Z

On August 30, an attacker inflated the price of Tectonic's thinly traded TONIC token about 100-fold within 20 minutes, according to on-chain researcher Weilin Li, and used it as collateral to borrow other assets from the largest lending protocol on Cronos. Early estimates put the loss near $75 million. About 36 minutes after the attack began, validators halted the chain, then agreed to roll it back by about one hour and 54 minutes. Cronos later said the attacker had borrowed about $120 million, that the rollback reversed about $111 million of it, and that about $9.2 million had already left through bridges and remains unrecovered. Crypto.com said its app and exchange were not affected.

urn:cyber-watch:it-supply-chain 2026-08-15T00:00:00Z

A campaign that Microsoft attributes to a group called TeamPCP compromised developer and security tooling. Attackers hijacked the release pipeline of the Trivy scanner, then reached Checkmarx KICS and LiteLLM. On April 22 a malicious Bitwarden CLI package (version 2026.4.0) was live on npm for 93 minutes, built to steal developer credentials such as GitHub tokens and cloud keys. Bitwarden said vault data and production systems were not affected. In August, CloudSEK published a lookup of thousands of potentially affected organizations. In October a separate compromise hit LiteLLM again (see its own entry); none of the sources reviewed link that one to TeamPCP.

urn:cyber-watch:ot-colorado 2026-08-15T00:00:00Z

Colorado officials said that in late August, foreign actors changed equipment settings, disabled remote access and alarms, and altered pumping cycles at two small private water providers, each serving fewer than 200 people. Operators regained control, and officials said treatment and water quality were not affected. The utilities and the attackers have not been named. Officials said they know of Iranian activity against water systems but there is no confirmation that these incidents belong to the same campaign. The EPA says more than 100 water and wastewater systems in 12 states have been targeted this year.

urn:cyber-watch:ot-tankers 2026-08-07T00:00:00Z

US Coast Guard and FBI teams boarded the tanker VL Prosperity on August 21 and a second tanker on August 24 after indications that both vessels' networks were compromised. Iranian state media reported the VL Prosperity lost communications for more than 30 hours around August 7 near the Strait of Gibraltar. Bloomberg later reported investigators found that hackers accessed a digital system connected to the ship's propulsion, and investigators have not said whether they tried to manipulate it. Crew claims relayed by Iranian media about engine speed and cooling are unverified. The Coast Guard has not attributed the attacks and reported no operational disruption, danger to crew or environmental harm. By September, US agencies were tracking cyber threats against nearly 20 vessels. North Carolina Ports separately reported a cyberattack on August 6 that forced manual operations.

urn:cyber-watch:cr-coldcard 2026-07-31T00:00:00Z

Starting July 31, attackers began draining bitcoin from wallets created on Coldcard Mk3 devices. Galaxy Research estimates losses above $115 million, possibly over $130 million, says it has spoken with more than 200 victims, and believes at least 15 separate attackers were exploiting the flaw. Coinkite, the maker, said a firmware bug present since version 4.0.1 in March 2021 made the device fall back to weaker software-generated randomness when creating seeds, which let attackers guess recovery phrases. Coinkite said the bug went unnoticed for years and urged users to update or move their funds off the device.

urn:cyber-watch:ot-cisa-water 2026-07-30T00:00:00Z

On July 30, CISA warned water and wastewater operators that threat actors target utilities of all sizes, and that even mature programs should check external connections, including cellular modems installed by operators, vendors or integrators that may not be documented. In an update reported in late August, CISA said it saw malicious activity against more than 100 internet-exposed systems in the sector in July, most commonly controllers connected directly to a cellular modem. It reported no significant disruption to water service. The FBI has urged utilities to disconnect systems from the internet where possible and be ready to revert to manual controls.

urn:cyber-watch:ot-minnesota 2026-07-26T00:00:00Z

Between July 26 and 27, a coordinated cyberattack disrupted water and wastewater operations across more than 30 Minnesota communities, according to Tenable's summary. Some automated controls were affected and Maple Plain declared a local state of emergency. In Plymouth, only equipment connected over cellular links was hit and manual operation kept water flowing. Separately, cyber activity caused a pressure drop at the Clayton County Water Authority in Georgia, prompting a boil-water advisory for 300,000 customers, with service restored within hours. A federal investigation is pending and attribution is not confirmed, although the timing matches the Iran-linked controller activity in CISA's advisory. SecurityWeek reports that the FBI and EPA later said water systems in at least seven states were targeted.

urn:cyber-watch:ot-iran-plc 2026-07-22T00:00:00Z

A joint advisory from US agencies including CISA, the FBI, NSA and EPA, first published April 7, said Iranian-affiliated actors were exploiting internet-exposed Rockwell Automation and Allen-Bradley programmable logic controllers (PLCs) and disrupting US organizations in government services, water and energy, with disruptions since at least March. A July 22 update added detection guidance for malicious changes to reusable code modules in PLC programs, and said activity against ports used by Schneider Electric and Siemens equipment suggests opportunistic targeting of other vendors. Researchers link the activity to CyberAv3ngers, a group tied to Iran's IRGC.

urn:cyber-watch:it-stadler 2026-07-21T00:00:00Z

The Swiss rail manufacturer said criminals used compromised login details to reach a data-exchange platform shared with a supplier in mid-July, exposing the supplier's technical information. The Everest group demanded about 10 million Swiss francs (roughly $12.3 million). Stadler refused, filed a criminal complaint and said its own IT systems, production and trains in service were not affected. Everest later listed Stadler on its leak site, according to SOCRadar.

urn:cyber-watch:it-shinyhunters-wave 2026-07-15T00:00:00Z

In May the ShinyHunters group named Charter Communications, the parent of Spectrum, in a pay-or-leak extortion campaign. In July, data tied to about 1.6 million unique email addresses from RingCentral appeared in material the group published. These figures come from analysis of the group's own postings, and security reporters note that the group has a record of overstating its hauls.

urn:cyber-watch:it-sharepoint 2026-07-14T00:00:00Z

On-premises SharePoint was exploited repeatedly in July. CVE-2026-58644, an unauthenticated deserialization flaw rated 9.8, was used as a zero-day before Microsoft's July 14 fix. A sibling flaw, CVE-2026-50522, also rated 9.8, was exploited soon after public proof-of-concept code appeared around July 20, and CISA listed it on July 22. Attackers were reported stealing server machine keys to keep access. SharePoint Online is not affected.

urn:cyber-watch:ot-zionsiphon 2026-06-15T00:00:00Z

Darktrace flagged ZionSiphon, malware built for industrial environments and aimed at Israeli water treatment and desalination systems. According to Bitsight's summary, it scans for industrial devices over several protocols and has sabotage capability aimed at chlorine and pressure controls. Bitsight says it may have been circulating since mid-2025.

urn:cyber-watch:cr-bridges-keys 2026-06-15T00:00:00Z

After the April thefts came a series of mid-sized ones. THORChain lost about $10.7 million on May 15 when a malicious node operator abused a flaw in its threshold-signature scheme. The Verus Ethereum bridge lost about $11.6 million on May 18 because of a missing check that let a forged proof pass. The Syscoin bridge lost about $10 million on June 7 after a parsing error in proof validation allowed unauthorized tokens to be minted. On June 8, Humanity Protocol lost about $31 million to $36 million after malware on a developer's laptop exposed seven private keys. Amounts vary by tracker.

urn:cyber-watch:ot-calwater 2026-06-11T00:00:00Z

The Iran-linked group Handala claimed in June that it had breached California Water Service, a utility serving about two million customers, published 5 GB of data and said it could have disrupted water supply but chose not to. Dataminr reported that the data pointed to a customer billing database and an internal GNSS base-station application, and that the Chico District was a confirmed victim. Cal Water brought in Mandiant and later said it found no evidence of activity in its operational technology environment, and that the actor accessed one active customer's online account using stolen credentials. Analysts note that Handala has a record of overstating its capabilities. The US links Handala to Iran's intelligence ministry, and the group framed the claim as retaliation for US strikes in Iran.

urn:cyber-watch:it-cisco-sdwan 2026-06-04T00:00:00Z

Cisco confirmed exploitation of CVE-2026-20245, a command-injection flaw in Catalyst SD-WAN Manager, Controller and Validator that lets an attacker who already has administrator-level access run commands as root. CISA added it to its list of known exploited vulnerabilities on June 4. Mandiant later reported it was used as a zero-day at least two months before disclosure, chained with earlier SD-WAN authentication flaws (CVE-2026-20127 and CVE-2026-20182). It is the seventh Cisco SD-WAN vulnerability exploited in 2026.

urn:cyber-watch:it-dentaquest 2026-05-15T00:00:00Z

DentaQuest says a May network breach affected 15 million people, exposing Social Security numbers and dental or vision health information. It is described as the largest US health data breach reported so far in 2026.

urn:cyber-watch:it-carnival 2026-05-15T00:00:00Z

Carnival's notice says it found unauthorized activity involving an employee account on April 14. The company said an unauthorized actor used social engineering to trick an employee into giving access to a limited part of its IT systems. An industry summary puts the number of affected customers at about 6 million. The breach was made public in May.

urn:cyber-watch:ot-sandworm 2026-05-14T00:00:00Z

Nozomi Networks research reports that the Russian state-linked group Sandworm continues to target industrial and critical infrastructure using aggressive lateral movement and older malware, and that its activity intensifies after detection instead of stopping. Affected sectors include manufacturing and transportation. Targets included engineering workstations, operator screens (HMIs), PLCs, remote terminal units and other field controllers.

urn:cyber-watch:it-canvas 2026-05-07T00:00:00Z

Instructure, the company behind the Canvas learning platform, confirmed unauthorized activity in late April. The ShinyHunters extortion group claimed responsibility, set ransom deadlines and on May 7 defaced the login pages of roughly 330 institutions. Canvas was taken offline briefly and restored the next day. On May 11 Instructure said it had reached an agreement with the actor and received confirmation that the data was destroyed. Claims of hundreds of millions of records have not been verified.