LUXOR COMMANDER · CMP-202611-3cdpd5 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Starting around 8 p.m. US Central on 14 Nov 2026 (02:00 UTC 15 Nov), mining machines at several hosted mining sites were switched without permission to the OCEAN pool, with rewards set to go to an attacker's Bitcoin address. At its peak this was about 13 EH/s from roughly 64,000 machines. CoreX Hosting raised the first alarm. One affected operator says its whole mining site was taken over and names Luxor's Commander mining management software as the way in. Other operators report similar unauthorized pool changes a few days earlier. CoreX says the activity has mostly stopped (down to about 100 PH/s). The attackers mined no block, so the victims lost mining revenue but the attackers got no payout. Whether Luxor Commander was really compromised is not confirmed, and Luxor has made no statement in these sources. The full scope is unknown.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Posts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.