Live· 38 threats · last 7 days· last check 2026-11-04 05:57 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

This week

On fire this week

BREACHNO CVE YET

DATA EXPOSED

Binance hot wallets drained of more than $6B on 29 Oct 2026; FBI attributes the hack to North Korea's TraderTraitorBinance45 talking

SUPPLY CHAINNO CVE YET

EXPLOITED IN THE WILD

Backdoored Claude Code extension 2.1.312 and 2.1.313 served through Cursor's marketplace plants an attacker SSH key and startup persistence on developer machinesClaude Code for VS Code43 talking

CAMPAIGNNO CVE YET

Go programs on Linux listen with Multipath TCP by default, exposing servers to the remote-root kernel bug CVE-2026-98432 (Ubuntu and RHEL fixes still pending)Go13 talking

BREACHNO CVE YET

DATA EXPOSED

Polymarket breached through an unnamed third-party provider: international users' wallets drained (about $2.7M), trading haltedPolymarket8 talking

Thursday, Oct 29

HIGHCAMPAIGNDATA EXPOSEDBinance-hacker-1029TraderTraitorBinance hot wallets drained of more than $6B on 29 Oct 2026; FBI attributes the hack to North Korea's TraderTraitorBinance45 talkingVendor2026-09-19 01:23 UTCby InfraStack Analyst45talkingWHAT TO DO HIGHCAMPAIGNDATA EXPOSEDDebugBear RUM compromisePolymarket breached through an unnamed third-party provider: international users' wallets drained (about $2.7M), trading haltedPolymarket8 talkingVendor2026-10-29by InfraStack Analyst8talkingWHAT TO DO CRITICALCAMPAIGNEXPLOITEDC3RB3RCerberC3RB3R (Cerber) ransomware is encrypting internet-exposed Synology NAS devices and their backups; Synology confirms attacks on outdated DSMSynology DSM3 talkingVendor2026-10-29by InfraStack Analyst3talkingFIX 7.4-90075 HIGHCAMPAIGNEXPLOITEDARTEXBLOODALCHEMYChina-linked VAPOR PANDA uses the ARTEX AI agent framework to break into 200+ government, pharma, defense and telecom organisations at once, then plants the BLOODALCHEMY backdoor3 talkingInfrastructure2026-10-29by InfraStack Analyst3talkingWHAT TO DO HIGHCAMPAIGNEXPLOITEDMalicious Hugging Face models posing as Qwen2 test checkpoints install a crypto miner and reverse shell on GPU inference servers when loaded with trust_remote_code (back after takedown)Hugging Face Hub2 talkingAI agents & MCP2026-10-29 22:09 UTCby InfraStack Analyst2talkingWHAT TO DO HIGHCAMPAIGNEXPLOITEDNIK C2nik_panelNIK C2: new Windows malware framework seen in the wild steals credentials, logs keystrokes, can lock screens for ransom, and uses the victim's own OpenAI API key to analyze stolen dataWindows1 talkingOther2026-10-29 10:00 UTCby InfraStack Analyst1talkingWHAT TO DO MEDIUMCAMPAIGNSearchjacked319 hidden Chrome extensions (13.4M users) hijack the default search engine and route every search through operator proxies that log queries and pick redirects (Socket 'Searchjacked')Google Chrome3 talkingOther2026-10-29by InfraStack Analyst3talkingWHAT TO DO HIGHTECHNIQUEEMBRACEBuilt-in browsers in AI coding assistants (Cursor, GitHub Copilot, Codex, VS Code, Claude Desktop) let a web page or local file run code, read the whole disk or fake the address bar; Codex and VS Code unpatched (EMBRACE)Codex1 talkingAI agents & MCP2026-10-29by InfraStack Analyst1talkingWHAT TO DO

Friday, Oct 30

Monday, Nov 2

HIGHCAMPAIGNEXPLOITEDDanfoss freezer attacksInternet-exposed Danfoss supermarket refrigeration controllers hijacked to heat fridges and freezers to 50°C overnight; attacks now reported in 12 countries including RomaniaDanfoss AK-SM 800A7 talkingInfrastructure2026-10-13by InfraStack Analyst7talkingFIX R4.3.1 CRITICALCAMPAIGNEXPLOITEDcPGuard breachOPSSHIELD breachcPGuard server security software update channel hijacked: attackers pushed a backdoor that steals root password hashes, SSH keys and cloud tokens (OPSSHIELD confirms)cPGuard2 talkingVendor2026-11-02 20:14 UTCby InfraStack Analyst2talkingFIX 5.88.25 CRITICALNOT SCOREDSMS of DeathAndroid "SMS of Death": one malformed WAP Push text crashes the phone service and drops calls, including emergency callsandroid4 talkingRuntime2026-10-30by InfraStack Analyst4talkingFIX security patch level 2026-11-01 (Android 14, 15, 16, 16-qpr2, 17)CRITICALCAMPAIGNEXPLOITEDAttackers log in as admin on outdated BTCPay Server instances (2.4.1 and older) and drain their hot walletsBTCPay ServerVendor2026-11-02 15:03 UTCby InfraStack Analyst–FIX 2.4.7 HIGHCAMPAIGNEXPLOITEDXCPEx.cpeAndroid TV set-top boxes from OEM Videostrong ship with a factory-installed backdoor (XCPE) that sold access for ad fraud, residential proxies and more malware; 1.3M+ devices (Google)Videostrong Android TV set-top boxesVendor2026-11-02 14:00 UTCby InfraStack Analyst–WHAT TO DO HIGHCAMPAIGNDATA EXPOSEDMercado Bitcoin, Brazil's largest crypto exchange, breached: about $46M drained from its wallets, deposits and withdrawals haltedMercado BitcoinVendor2026-11-02 20:19 UTCby InfraStack Analyst–WHAT TO DO HIGHCAMPAIGNDON'T CLICKFake IT support on Microsoft Teams gets remote control via Quick Assist, then abuses misconfigured AD CS (ESC1, ESC8) for domain-admin certificates and steals data (Microsoft)Microsoft TeamsInfrastructure2026-11-02 11:08 UTCby InfraStack Analyst–WHAT TO DO

Tuesday, Nov 3

HIGHCAMPAIGNDATA EXPOSEDLLMjackingUNC6993LLMjacking crews (UNC6993, Jet Night) use stolen cloud keys and tokens to run up AWS Bedrock, Gemini and Azure OpenAI bills of $100K+/day and resell the access (Google GTIG)AWS Bedrock3 talkingInfrastructure2026-10-30by InfraStack Analyst3talkingWHAT TO DO CRITICALCAMPAIGNEXPLOITEDAttackers exploit unauthenticated Node-RED editors (CVE-2026-58115, Siemens SIMATIC IoT2050) to deploy a Linux bot and command webshells (VulnCheck)Node-RED1 talkingInfrastructure2026-11-02by InfraStack Analyst1talkingFIX V4.3.4.1 MEDIUMCAMPAIGNFUNDS STOLENAtlasCorePolyFuckedFake Polymarket and Kalshi prediction-market sites, promoted by AI-made influencers on Instagram, take crypto deposits and ID documents and never let victims withdraw (Recorded Future)PolymarketOther2026-11-03by InfraStack Analyst–WHAT TO DO HIGHCAMPAIGNEXPLOITED3AMThreeAM3AM ransomware affiliate uses an AI agent loop to steal Veeam backup credentials, add rogue domain admins and link separate AD domains before encrypting (Bitdefender)Veeam Backup & ReplicationOther2026-11-03by InfraStack Analyst–WHAT TO DO HIGHCAMPAIGNDATA EXPOSEDAttackers sign in to Microsoft Entra ID and Azure DevOps as app service principals using stolen client secrets, hitting MSPs and their customer tenants to loot Key Vault and files (Todyl, Huntress)Microsoft Entra IDInfrastructure2026-11-03by InfraStack Analyst–WHAT TO DO HIGHCAMPAIGNDATA EXPOSEDGitBook breached: attackers got into parts of GitBook's infrastructure on 2 Nov; docs sites and editor taken offline, customer data impact unknownGitBookVendor2026-11-02 17:00 UTCby InfraStack Analyst–WHAT TO DO MEDIUMCAMPAIGNDATA EXPOSEDWorkOS breachWorkOS breached: attacker using the ARTEX AI framework got into an internal sales app and took customer contacts, account histories and sales/support call summariesWorkOSVendor2026-11-03 21:28 UTCby InfraStack Analyst–WHAT TO DO

Wednesday, Oct 28

HIGH8.6EXPLOITEDCisco ASA and FTD: crafted SSL VPN request forces device reloadCisco Secure Firewall ASA Software and Cisco Secure FTD Software3 talkingInfrastructure2026-10-28 20:18 UTCby InfraStack Analyst3talkingWHAT TO DO MEDIUMCAMPAIGNEXPLOITEDSilver FoxKong RATFake DeepSeek desktop-app sites pushed through search results install Silver Fox remote-access malware that kills antivirusDeepSeek1 talkingAI agents & MCP2026-10-15by InfraStack Analyst1talkingWHAT TO DO

Saturday, Oct 31

HIGH8.1EXPLOITEDWordPress Core: predictable upgrade paths let attackers run code on the serverWordPress2 talkingRuntime2026-10-31 06:16 UTCby InfraStack Analyst2talkingFIX 7.1.4 MEDIUMCAMPAIGNDATA EXPOSEDChainalysis breached by an attacker using AI agent tooling: names, emails, user IDs and roles of customer platform users exposedChainalysis2 talkingVendor2026-10-31by InfraStack Analyst2talkingWHAT TO DO HIGHCAMPAIGNVOLTAVOLTA-AUTODOXERVOLTA infostealer for Windows steals passwords, sessions, cloud/SSH keys and crypto wallets, then uses LLMs via OpenRouter to rank each victim's most valuable assets (Talos)Windows1 talkingOther2026-10-31by InfraStack Analyst1talkingWHAT TO DO HIGHTECHNIQUESMS of DeathAndroid 'SMS of Death' (CVE-2026-58882): one crafted text message crashes the phone's cellular service, with public exploit code; Android 12 and 13 get no fixAndroidRuntime2026-10-31 15:35 UTCby InfraStack Analyst–FIX 2026-10 security update (Android 14-17)

Sunday, Nov 1

HIGHCAMPAIGNDATA EXPOSEDn0nn0n ransomware breaks in with stolen or weak passwords (credential stuffing on FortiGate SSL-VPN, leaked AWS keys, RDP/WinRM), steals and wipes data and backups, and uses AI coding agents to write its tools; 93 victims including 38 port and maritime orgsFortiGate SSL-VPNInfrastructure2026-10-28 08:02 UTCby InfraStack Analyst–WHAT TO DO MEDIUMCAMPAIGNEXPLOITEDAI agent impersonationScanner disguised as ChatGPT, Claude and Perplexity bots hunts web servers for exposed .env files, cloud credentials and SSH keys (Cequence)WAF / bot management allowlists for AI crawlersInfrastructure2026-10-28by InfraStack Analyst–WHAT TO DO

On fire · last 7 days