Cloudflare reports 18.2 million L3 DDoS attacks in Q3
That is about 8,226 network-layer attacks an hour, up from 13.2 million in Q2, plus 14.4 trillion HTTP DDoS requests.
52
- Mentions · 7d79
- Mentions · 30d303
- All mentions568
- First seenAug 12, 2026
- Last mentioned7h ago
Timeline
568 articles · newest firstApple Intelligence is coming to China with iOS 27.3
A November 4 beta adds earlier features and Alibaba’s Qwen, not the new Siri; the full release is set for December.
58
Vapor Panda used agentic AI tool ARTEX against about 140 targets
CrowdStrike says the China-linked campaign has hit more than 200 organizations in at least 14 countries since October 17.
84
CrowdStrike: Vapor Panda used ARTEX against over 200 organizations
From October 17 the China-linked group hit ministries, telecoms, and U.S. defense-related targets; post-exploitation is confirmed at nine.
86
Unauthorized relays disable Codex and Claude Code sandboxes at 12 firms
A post-install script points the genuine CLIs at relay servers, swaps API keys, and sets danger-full-access; abuse has not been observed.
62
PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
88
Suspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
86
Grey-market relays reroute Codex and Claude Code traffic
Symantec says lookalike-domain scripts disable sandboxes and send prompts, files and tokens through operator servers at about a dozen firms.
74
Cloudflare mitigated 18.2 million DDoS attacks in Q3 2026
Attacks rose 208% year over year, but 98% stayed under 1 Gbps and most ended within ten minutes.
58
Lumen says Volt Typhoon banks Silent Train access in infrastructure
Lumen says the group rotates exploited SOHO, IoT and enterprise devices, including multiple zero-days, against high-value targets.
78
Hugging Face crypto-mining models return; a copy stays live
Pluto found 31 repositories posing as Qwen2 checkpoints; the flagship reached 28,412 downloads and a copy remained online.
74
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
84
ThreatsDay: Fortinet fixes, PHP2Shell scans, Authenticator token flaw
Fortinet is withholding flaw details until November 10 while Hudson Rock reports 40,573 exposed FortiGate secrets.
64
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
84
Essay argues cheap AI agents will make cyberattacks routine
It cites an authorized NSA Mythos test, a claimed Cairn campaign, and slower patching times.
28
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
CVE-2026-20127, patched in February 2026, lets attackers add rogue peers and steal IPsec key material from controllers.
84
U.S. probed alleged Chinese spy effort targeting Nvidia CEO
Anonymous sources told the Times that a Megaspeed executive close to Jensen Huang may have sought Nvidia plans and China export policy.
52
Cloudflare blocked over 8,200 network DDoS attacks an hour in Q3
Most attacks lasted under ten minutes and stayed below 1 Gbps, while terabit-scale floods fell nearly 69% from the prior quarter.
58
Warp Panda used VMware ESX zero-day; firewalls rooted and crashed
CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.
84
CISA adds VMware ESX and Linux kernel flaws to KEV
Agencies must fix CVE-2026-41709 by November 11, 2026, and Fragnesia CVE-2026-46300 by October 31, 2026.
74
Wiz says AI agents are running hands-on intrusions
Named cases include ARTEX at Korean banks and ConnectWise, Hermes at Thailand's finance ministry, and AI-assisted API attacks in Japan.
68
Wiz says AI agents are doing hands-on intrusion work
Named cases include ARTEX and Hermes, plus three Wiz investigations that begin with an exposed Flowise service.
68
Mistral releases open weights for trillion-parameter Mistral Large 4
Nicknamed Le Chonk, ML4 is on Hugging Face and Mistral's API, and the company claims 47 percent fewer tokens than GLM-5.3.
78
Talos Q3 2026 IR trends: help-desk vishing and rising ransomware
Phishing led initial access in just over one-third of engagements, down from over 50 percent, while ransomware rose to 27 percent.
66
US intelligence suspects Megaspeed executive informed for China
The New York Times says Trump was briefed about a year ago and Jensen Huang was not warned; Nvidia denies any sensitive leak.
58
Volt Typhoon used rotating Silent Train relays for zero-days
Lumen says exploited products included Versa, N-able, Cisco SD-WAN, VeloCloud and possibly Quest KACE; KeyDrift hit Cisco controllers.
86
Chinese labs reportedly distill OpenAI GPT-6 Astra outputs
The Information says DeepSeek and Moonshot used Astra, including hidden reasoning, to train Kimi K3.1 Pro and V4.1-Flash 1017.
62
Cloudflare: short DDoS bursts rose 208% in Q3 2026
Attacks over 1 Tbps fell to 251 from 805 after takedowns of four large IoT botnets.
46
Volt Typhoon used Silent Train for US zero-day intrusions
Lumen says four confirmed zero-day campaigns hit management platforms, with credential theft and chains of compromised devices.
84
WARP PANDA used VMware ESXi zero-day against US law firms
CVE-2026-41709 bypasses ESXi command logging; CrowdStrike does not say it gave initial access.
76
26,400 working cloud and AI keys found in public Gitee repos
A scan of 7.25 million repositories kept only keys that still authenticated, led by 9,473 Alibaba Cloud AccessKey pairs.
74
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
78
Volt Typhoon used Silent Train relays to hide zero-day attacks
Lumen links the relay network to four confirmed zero-days and one likely flaw, with sessions rebuilt in under two minutes.
84
Unauthorized AI relay disables Codex and Claude Code sandboxes
Symantec says the relay has installed genuine CLIs at a dozen organizations, mostly in mainland China, since early 2026.
52
Volt Typhoon Exploits Zero-Days to Breach Critical Infrastructure
Volt Typhoon built Silent Train framework using zero-days in Quest KACE, N-central, Cisco SD-WAN and VeloCloud to access U.S. critical infrastructure.
80
Cisco SD-WAN CVE-2026-20127 exploited to install KeyDrift key-stealing malware
The malware hooks vdaemon to copy AES-256 key material; Cisco calls exploitation limited and lists fixed trains.
84
Warp Panda used low-severity ESXi flaw CVE-2026-41709 as a zero-day
CISA added the logging bug to KEV and gave US federal agencies two weeks to install the patched ESXi builds.
78
CISA lists VMware ESX logging flaw exploited by Warp Panda
CVE-2026-41709 lets an admin skip some logs; federal agencies must patch by November 11, 2026.
74
Hirundo says weight edits can remove Qwen3-Coder's pro-CCP bias
Even after the change, generated apps still failed a security benchmark more than half the time.
36
Volt Typhoon used Silent Train in four zero-day campaigns
Black Lotus Labs says the rotating SOHO and IoT relay network hit hundreds of victims, including US critical infrastructure.
84
Related CVEs
by mentions- CVE-2026-10276419%9.3Message-origin spoofing enables file ops on BeyondTrust Remote Support
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-2012789%10.0Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-4630016%7.8Shared-frag marker loss in Linux kernel skb coalescing (LPE)
- CVE-2025-88753%9.4Insecure Deserialization Code Execution in N-able N-central (KEV)
- CVE-2024-21887100%9.1Command Injection RCE in Ivanti Connect Secure and Policy Secure
- CVE-2015-5477100%7.5Remote denial of service in ISC BIND via TKEY queries
Appears with
- Microsoftvendor · 99
- Anthropicvendor · 77
- Anthropicorganization · 70
- CISAorganization · 62
- Googlevendor · 60
- FBIorganization · 59
- OpenAIvendor · 57
- OpenAIorganization · 46
- Microsoftorganization · 45
- Claudeai model · 45
- CrowdStrikeorganization · 32
- DeepSeekvendor · 31
- Microsoft 365product · 31
- Alibabavendor · 29
- Nvidiavendor · 26
- DeepSeekai model · 24
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.