Live· 80 threats · last 30 days· last check 2026-11-04 06:00 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

Last 30 days

Newest early warnings

BREACHNO CVE YET

DATA EXPOSED

WorkOS breached: attacker using the ARTEX AI framework got into an internal sales app and took customer contacts, account histories and sales/support call summariesWorkOS

MALWARENO CVE YET

Fake iCollections for macOS download site on GitHub Pages (icollections.github[.]io) serves a malicious DMGiCollections

CAMPAIGNNO CVE YET

Better Auth Expo plugin flaw lets anyone take over an account knowing only the victim's email (GHSA-4wq4-2ppv-q3hg, fixed in 1.7.16)@better-auth/expo

MALWARENO CVE YET

EXPLOITED IN THE WILD

3AM ransomware affiliate uses an AI agent loop to steal Veeam backup credentials, add rogue domain admins and link separate AD domains before encrypting (Bitdefender)Veeam Backup & Replication

Tuesday, Nov 3

Monday, Nov 2

CRITICALCAMPAIGNEXPLOITEDcPGuard breachOPSSHIELD breachcPGuard server security software update channel hijacked: attackers pushed a backdoor that steals root password hashes, SSH keys and cloud tokens (OPSSHIELD confirms)cPGuard2 talkingVendor2026-11-02 20:14 UTCby InfraStack Analyst2talkingFIX 5.88.25 HIGHCAMPAIGNDATA EXPOSEDMercado Bitcoin, Brazil's largest crypto exchange, breached: about $46M drained from its wallets, deposits and withdrawals haltedMercado BitcoinVendor2026-11-02 20:19 UTCby InfraStack Analyst–WHAT TO DO CRITICALCAMPAIGNEXPLOITEDAttackers log in as admin on outdated BTCPay Server instances (2.4.1 and older) and drain their hot walletsBTCPay ServerVendor2026-11-02 15:03 UTCby InfraStack Analyst–FIX 2.4.7 HIGHCAMPAIGNEXPLOITEDXCPEx.cpeAndroid TV set-top boxes from OEM Videostrong ship with a factory-installed backdoor (XCPE) that sold access for ad fraud, residential proxies and more malware; 1.3M+ devices (Google)Videostrong Android TV set-top boxesVendor2026-11-02 14:00 UTCby InfraStack Analyst–WHAT TO DO HIGHCAMPAIGNEXPLOITEDDanfoss freezer attacksInternet-exposed Danfoss supermarket refrigeration controllers hijacked to heat fridges and freezers to 50°C overnight; attacks now reported in 12 countries including RomaniaDanfoss AK-SM 800A7 talkingInfrastructure2026-10-13by InfraStack Analyst7talkingFIX R4.3.1 HIGHCAMPAIGNDON'T CLICKFake IT support on Microsoft Teams gets remote control via Quick Assist, then abuses misconfigured AD CS (ESC1, ESC8) for domain-admin certificates and steals data (Microsoft)Microsoft TeamsInfrastructure2026-11-02 11:08 UTCby InfraStack Analyst–WHAT TO DO

Sunday, Nov 1

HIGHCAMPAIGNDATA EXPOSEDn0nn0n ransomware breaks in with stolen or weak passwords (credential stuffing on FortiGate SSL-VPN, leaked AWS keys, RDP/WinRM), steals and wipes data and backups, and uses AI coding agents to write its tools; 93 victims including 38 port and maritime orgsFortiGate SSL-VPNInfrastructure2026-10-28 08:02 UTCby InfraStack Analyst–WHAT TO DO MEDIUMCAMPAIGNEXPLOITEDAI agent impersonationScanner disguised as ChatGPT, Claude and Perplexity bots hunts web servers for exposed .env files, cloud credentials and SSH keys (Cequence)WAF / bot management allowlists for AI crawlersInfrastructure2026-10-28by InfraStack Analyst–WHAT TO DO

Saturday, Oct 31

HIGHTECHNIQUESMS of DeathAndroid 'SMS of Death' (CVE-2026-58882): one crafted text message crashes the phone's cellular service, with public exploit code; Android 12 and 13 get no fixAndroidRuntime2026-10-31 15:35 UTCby InfraStack Analyst–FIX 2026-10 security update (Android 14-17)MEDIUMCAMPAIGNDATA EXPOSEDChainalysis breached by an attacker using AI agent tooling: names, emails, user IDs and roles of customer platform users exposedChainalysis2 talkingVendor2026-10-31by InfraStack Analyst2talkingWHAT TO DO HIGHCAMPAIGNVOLTAVOLTA-AUTODOXERVOLTA infostealer for Windows steals passwords, sessions, cloud/SSH keys and crypto wallets, then uses LLMs via OpenRouter to rank each victim's most valuable assets (Talos)Windows1 talkingOther2026-10-31by InfraStack Analyst1talkingWHAT TO DO

Friday, Oct 30

Thursday, Oct 29

Wednesday, Oct 28

Tuesday, Oct 27

Monday, Oct 26

HIGHTECHNIQUEJava's blocked.certs fix for the compromised eMudhra CAs can be bypassed by re-encoding the intermediate certificateJava3 talkingRuntime2026-10-21by InfraStack Analyst3talkingWHAT TO DO MEDIUMTECHNIQUESGLang prefill/decode disaggregation can leak other users' prompts and outputs when a prompt exceeds the prefill KV cache poolsglang1 talkingAI agents & MCP2026-10-26by InfraStack Analyst1talkingWHAT TO DO

Sunday, Oct 25

HIGHTECHNIQUETailwormUnpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnetTailscale5 talkingInfrastructure2026-10-25by InfraStack Analyst5talkingWHAT TO DO

Saturday, Oct 24

HIGHCAMPAIGNEXPLOITEDdeepveindrillingMagento stores injected with scanner-evading JavaScript loader via CMS blocks (deepveindrilling.com)Magento4 talkingVendor2026-10-24by InfraStack Analyst4talkingWHAT TO DO

Friday, Oct 23

MEDIUMCAMPAIGNDATA EXPOSEDDreamHost forces email and FTP/SFTP password resets in an unexplained ongoing incidentDreamHostInfrastructure2026-10-23by InfraStack Analyst–WHAT TO DO MEDIUMCAMPAIGNEXPLOITEDCyberStrikeAIChinese-speaking crews use AI agents (CyberStrikeAI, 44 agents) to break into exposed legacy web systems, VPNs and WebLogic in JapanYamaha RTX1210Infrastructure2026-10-23by InfraStack Analyst–WHAT TO DO

Wednesday, Oct 21

HIGHCAMPAIGNEXPLOITEDOperation FlashHoleLazarus (Operation FlashHole) abuses South Korea's mandatory INISAFE CrossWeb EX banking security software to run in-memory malware controlled through GitHub issuesINISAFE CrossWeb EXVendor2026-10-21 02:07 UTCby InfraStack Analyst–WHAT TO DO CRITICALCAMPAIGNEXPLOITEDlitellm 1.107.0 compromiselitellm 1.107.0 on PyPI and Docker shipped a credential stealer and remote code loaderlitellm2 talkingPackage2026-10-21by InfraStack Analyst2talkingWHAT TO DO

Friday, Oct 16

HIGHCAMPAIGNDATA EXPOSEDStorm-0940SkyKick credential abuseStolen ConnectWise Cloud Backup (SkyKick) app credential used to break into Microsoft 365 tenantsConnectWise Cloud Backup3 talkingVendor2026-10-16by InfraStack Analyst3talkingWHAT TO DO HIGHTECHNIQUEWPSplinterUnpatched Broadcom Wi-Fi WPS flaw (WPSplinter) lets anyone in radio range run code on routers and access points without the Wi-Fi passwordBroadcom Wi-Fi SDK (WPS Monitor)Infrastructure2026-10-16by InfraStack Analyst–WHAT TO DO

Early warnings · last 30 days