Live· 24 threats on fire this week· last check 2026-10-30 06:45 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

SeverityThreatCategorySourcesFirst publicSocialAffects you

Thursday, Oct 29

high⚡ Early warningExploitedBinance-hacker-1029Binance hot wallets drained of about $3.3-5.6B in a suspected hack; Binance investigating, vector unknown

Binance Binance exchange hot wallets, 29 Oct 2026

VendorI

2026-10-29

by InfraStack analyst

8 talkingAffects you?

high⚡ Early warningExploitedDebugBear RUM compromisePolymarket breached through an unnamed third-party provider: international users' wallets drained (about $2.7M), trading halted

Polymarket international platform (Polymarket.com), 29 Oct 2026

VendorI

2026-10-29

by InfraStack analyst

7 talkingAffects you?

medium⚡ Early warningSearchjacked319 hidden Chrome extensions (13.4M users) hijack the default search engine and route every search through operator proxies that log queries and pick redirects (Socket 'Searchjacked')

CMP-202610-319-hidden-chrome-extensions-13-4m-users-hijack-the-default-

OtherI

2026-10-29

by InfraStack analyst

2 talkingAffects you?

high⚡ Early warningExploitedMalicious Hugging Face models posing as Qwen2 test checkpoints install a crypto miner and reverse shell on GPU inference servers when loaded with trust_remote_code (back after takedown)

CMP-202610-malicious-hugging-face-models-posing-as-qwen2-test-checkpoin

AI agents & MCPI

2026-10-29 22:09 UTC

by InfraStack analyst

1 talkingAffects you?

high⚡ Early warningExploitedNIK C2nik_panelNIK C2: new Windows malware framework seen in the wild steals credentials, logs keystrokes, can lock screens for ransom, and uses the victim's own OpenAI API key to analyze stolen data

CMP-202610-nik-c2-new-windows-malware-framework-seen-in-the-wild-steals

OtherI

2026-10-29 10:00 UTC

by InfraStack analyst

1 talkingAffects you?

high7.5Rapid ResetTwisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

Twisted <= 26.4.0 · fix 26.10.0rc1 · pypi

PackageG

2026-10-29 16:41 UTC

by GitHub Advisories

–Affects you?

high⚡ Early warningExploitedAttackers break in through Windows camera management software (CMS.exe) and plant a reverse shell and sideloaded beacons (Huntress)

CMP-202610-attackers-break-in-through-windows-camera-management-softwar

VendorI

2026-10-27 13:00 UTC

by InfraStack analyst

–Affects you?

high⚡ Early warningExploitedYobaYobaLoaderYobaDropperFake ChatGPT and Claude desktop apps on GitHub (GPT-5.6 Sol, GPT-6 Astra, Claude Opus) use signed OpenAI/Anthropic installers to load Yoba malware and a crypto miner

CMP-202610-fake-chatgpt-and-claude-desktop-apps-on-github-gpt-5-6-sol-g

AI agents & MCPI

2026-10-27 13:00 UTC

by InfraStack analyst

–Affects you?

medium⚡ Early warningclaude-mem setup uploadclaude-mem installer (v15.2.0+) silently uploads the last 30 days of Claude Code, Codex, Gemini CLI and OpenCode prompts to cmem.ai, which passes them to unknown LLM providers

claude-mem >= 15.2.0

AI agents & MCPI

2026-10-29 13:56 UTC

by InfraStack analyst

–Affects you?

high⚡ Early warningExploitedVAPOR PANDAARTEXBLOODALCHEMYChina-linked VAPOR PANDA uses the ARTEX AI agent framework to break into 200+ government, pharma, defense and telecom organisations at once, then plants the BLOODALCHEMY backdoor

CMP-202610-china-linked-vapor-panda-uses-the-artex-ai-agent-framework-t

InfrastructureI

2026-10-29

by InfraStack analyst

–Affects you?

high⚡ Early warningEMBRACEBuilt-in browsers in AI coding assistants (Cursor, GitHub Copilot, Codex, VS Code, Claude Desktop) let a web page or local file run code, read the whole disk or fake the address bar; Codex and VS Code unpatched (EMBRACE)

Codex all versions as of 2026-10-29

AI agents & MCPI

2026-10-29

by InfraStack analyst

–Affects you?

Sunday, Oct 25

high⚡ Early warningTailwormUnpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnet

Tailscale <= 1.104.2

InfrastructureI

2026-10-25

by InfraStack analyst

5 talkingAffects you?

Saturday, Oct 24

high⚡ Early warningExploiteddeepveindrillingMagento stores injected with scanner-evading JavaScript loader via CMS blocks (deepveindrilling.com)

Magento Magento 2 stores missing APSB26-73/APSB25-88 or already backdoored

VendorI

2026-10-24

by InfraStack analyst

4 talkingAffects you?

Wednesday, Oct 28

high8.6ExploitedCisco ASA and FTD: crafted SSL VPN request forces device reload

vendor

InfrastructureIEKN

2026-10-28 20:18 UTC

by InfraStack analyst

3 talkingAffects you?

critical⚡ Early warningExploitedAttackers try GitLab CI regex RCE (CVE-2026-97229) on self-hosted GitLab; upgrading GitLab does not fix installs that use their own Ruby

GitLab self-managed installs without the 12 Oct 2026 fix, and source or custom-image installs on Ruby < 3.3.13 / 3.4.12 / 4.0.9 · fix 3.3.13, 3.4.12, 4.0.9

InfrastructureI

2026-10-28

by InfraStack analyst

3 talkingAffects you?

high⚡ Early warningExploitedKeyDriftSilent TrainUAT-11473Volt TyphoonVolt Typhoon's 'Silent Train' hides attacks, including zero-days on SD-WAN and IT management platforms, behind short-lived chains of hacked routers and IoT devices

VeloCloud Orchestrator unknown

InfrastructureI

2026-10-28

by InfraStack analyst

3 talkingAffects you?

medium⚡ Early warningExploitedSilver FoxKong RATFake DeepSeek desktop-app sites pushed through search results install Silver Fox remote-access malware that kills antivirus

CMP-202610-fake-deepseek-desktop-app-sites-pushed-through-search-result

AI agents & MCPI

2026-10-15

by InfraStack analyst

1 talkingAffects you?

high⚡ Early warningExploitedPhishing tricks users into enrolling their PCs in attacker-controlled Hexnode or Rippling MDM, which then keeps reinstalling ScreenConnect for remote access

CMP-202610-phishing-tricks-users-into-enrolling-their-pcs-in-attacker-c

VendorI

2026-10-28

by InfraStack analyst

1 talkingAffects you?

medium⚡ Early warningExploitedFake GrapheneOS download site (installgarphenos[.]ink) serves Mac malware as GrapheneOS.zip

CMP-202610-fake-grapheneos-download-site-installgarphenos-ink-serves-ma

OtherI

2026-10-28 22:10 UTC

by InfraStack analyst

–Affects you?

Tuesday, Oct 27

critical⚡ Early warningExploitedGMO Onamae.com Desktop Cloud (FX trading VDI) breached: stored broker logins used for unauthorized trades, $50M extortion

CMP-202610-gmo-onamae-com-desktop-cloud-fx-trading-vdi-breached-stored-

VendorI

2026-10-27 01:30 UTC

by InfraStack analyst

3 talkingAffects you?

high⚡ Early warningExploitedGhostActionGhostAction uses stolen GitHub tokens to plant credential-stealing workflows and a fake-font VS Code stealer in thousands of repos

GitHub Actions repos pushed to with stolen tokens

PackageI

2026-10-27

by InfraStack analyst

2 talkingAffects you?

high⚡ Early warningExploitedMagecart skimmer planted in Convertr's self-hosted Plausible analytics script steals card data on Brazilian checkout pages

CMP-202610-magecart-skimmer-planted-in-convertr-s-self-hosted-plausible

VendorI

2026-10-27 20:57 UTC

by InfraStack analyst

1 talkingAffects you?

high⚡ Early warningExploitedbonto.io wallet extensionsFake Phantom, Jupiter and Bitget wallet extensions on Firefox Add-ons steal recovery phrases and private keys and drain funds (bonto.io)

CMP-202610-fake-phantom-jupiter-and-bitget-wallet-extensions-on-firefox

PackageI

2026-10-27

by InfraStack analyst

1 talkingAffects you?

Friday, Oct 30

high⚡ Early warningGo MPTCP defaultGo programs on Linux listen with Multipath TCP by default, exposing servers to the remote-root kernel bug CVE-2026-98432 (Ubuntu and RHEL fixes still pending)

TECH-202610-go-programs-on-linux-listen-with-multipath-tcp-by-default-ex

RuntimeI

2026-10-29 15:57 UTC

by InfraStack analyst

2 talkingAffects you?

← Saturday, Jun 13On fire · last 7 daysMonday, Jun 15 →