Compromised DevOps laptop caused $6.3B Binance breach
Binance covers all losses from North Korean-linked attack on employee device that enabled unauthorized withdrawals.
95
Security
Exploited now
Vulnerabilities being exploited right now, new KEV entries, and fresh public proof-of-concept code
Critical stories
24hAllGoogle dismantles XCPE botnet operated by Videostrong
Google banned Videostrong from Android devices after 1.3 million set-top boxes enrolled in the botnet.
90
BeyondTrust Remote Support Faces Fresh Probes for Critical Flaw
Probes target BeyondTrust Remote Support versions 26.2.3 and earlier; CISA added to KEV with active exploitation.
90
Critical Vulnerabilities in Incus and LXD Allow Full Cluster Access
Unauthenticated attackers can impersonate trusted certificates to gain full access to Incus and LXD clusters without credentials.
90
CISA orders fixes for exploited Ivanti Connect Secure flaws
Attackers chained both flaws with CVE-2026-104935 for VPN footholds; federal deadlines are November 2 and November 13.
86
Linux kernel CVE-2026-98432 enables unauthenticated RCE
The race condition in TCP SYN handling for IPv4 allows unauthenticated remote code execution in the Linux kernel.
80
Critical Langflow Flaws Allow Unauthenticated Code Execution
Four flaws in Langflow 1.0.0-1.12.8 enable unauthenticated RCE and auth bypass; upgrade to 1.13.0 fixes them.
75
ChatGPT flaw lets attackers hijack accounts with one link
Researchers demonstrated that a malicious shared ChatGPT conversation could steal private chats and exfiltrate data via one crafted link; OpenAI fixed the issue on October 26.
75
Critical CVEs
this weekAll- Remote Code Execution in s2Member WordPress plugin <=260927
- CSRF in NetMotion Secure Access 14.60 allowing admin account creation
- Authentication bypass in NetMotion Secure Access before 14.61
- Arbitrary file deletion in Ultra Addons for Contact Form 7 plugin up to 3.5.54
- Unauthenticated file upload in Joomla Custom Tables < 3.7.8
- Unauthenticated SQL Injection in Joomla DJ-Classifieds < 3.11.3
- Authenticated arbitrary file upload in Joomla DJ-Classifieds < 3.11.3
- Template Injection RCE in Amazon Virtual Engineering Workbench
Exploitation in the news
7 daysAllGoogle dismantles XCPE botnet operated by Videostrong
Google banned Videostrong from Android devices after 1.3 million set-top boxes enrolled in the botnet.
90
Chinese hackers use ARTEX AI in automated attacks against 200 orgs
Vapor Panda employed the ARTEX AI framework to conduct simultaneous intrusions across more than 200 organizations in 14 countries.
75
Ubuntu delays critical Linux kernel TCP vulnerability patch
Ubuntu has not patched CVE-2026-98432 which allows remote root on servers, despite Debian and others shipping the fix.
70
What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
Exploited CVEs are concentrated in takeover classes such as server-side RCE and privilege escalation.
60
Ransomware gang claims Michigan State University incident
The BYOD ransomware gang claims a cyber incident at Michigan State University that triggered campus-wide actions, following their October attack on the University of New Mexico.
55
VOLTA infostealer uses AI to rank victims by value
The malware deletes itself after collecting data and forwards AI-ranked victim profiles via Telegram.
75
Polymarket Returns $3.9 Million to Traders After DNS Hijack
Polymarket returns $3.9 million to traders after a DNS compromise at DebugBear enabled malicious JavaScript to steal assets from logged-in sessions.
75
North Korean group steals $6.43B from Binance
Volt Typhoon uses silent train for zero-day attacks; Cursor extension has SSH backdoor and Polymarket loses $2.7M to hack.
85
Trigger.dev says attacker accessed some customers' environment variables
The company says it blocked the exploit and emailed affected account owners mitigation steps.
72
Threat Actors Use LLMJacking to Monetize Compromised Cloud Models
Mandiant documented LLMJacking intrusions where threat actors hijacked enterprise LLM access for fraudulent charges exceeding $1M cumulatively across multiple sectors.
75
Exploit & PoC posts
7 daysAll90
85
30
88
82
60
72
70
88
50
70
80
CISA KEV additions
30 daysAll- Predictable identifiers in Ivanti Connect Secure enable file upload
- CVE-2026-111357<1%7.0Local root privilege escalation in Ivanti Connect Secure 22.8R2.4
- CVE-2026-9722927%10.0Unauthenticated RCE in GitLab CE/EE via CI/CD regex
- CVE-2026-76418<1%8.6Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth
- CVE-2026-4630016%7.8Shared-frag marker loss in Linux kernel skb coalescing (LPE)
- CVE-2026-41709<1%2.7Insufficient logging in VMware ESX for admin operations
- CVE-2026-4835645%9.3Unrestricted dangerous file upload in Adobe Commerce and Magento
- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
New public PoCs
14 daysAll- CVE-2025-41450<1%8.2Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2
- CVE-2026-105863<1%9.2Auth token claim injection in Payload CMS
- CVE-2026-115904<1%9.6OS command injection in Topluyo Desktop for Linux before 2026.9.2410
- CVE-2026-331862%9.1gRPC-Go is the Go language implementation of gRPC
- CVE-2026-149001%9.8The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php…
- CVE-2026-74583<1%7.8Linux kernel: net/sched: cls_route: fix fastmap use-after-free on filter
- CVE-2026-112688<1%8.8Memory corruption parsing a file in Apple iOS, iPadOS, and macOS
- CVE-2026-53157<1%7.8Linux kernel: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a phonet_device from…
- CVE-2026-91511%8.5An OS command injection vulnerability exists in the VPN module of TP-Link Archer AX12 v1, AX17 v1
- CVE-2026-116512<1%9.8Unauthenticated RCE in Project Manager plugin through 4.1.1
WordPress plugins & themes
223 high or critical · 7dAll- Remote Code Execution in s2Member WordPress plugin <=260927
- Arbitrary file deletion in Ultra Addons for Contact Form 7 plugin up to 3.5.54
- Missing Authorization in Product Gallery Slider for WooCommerce before 2.3.26
- Stored XSS in WordPress File Upload wp-file-upload before 5.2.1
- SQL Injection in StellarWP BookIt before 2.6.0.6
- Authenticated RCE in NextGEN Gallery through 4.4.1
E-commerce platforms
30 daysAll- Missing Authorization in Product Gallery Slider for WooCommerce before 2.3.26
- Unauthenticated SQL injection in FunnelKit Automations through 3.8.5.2
- Stored XSS in Shipping Zones by Drawing for WooCommerce ≤3.3.0
- Unauthenticated PHP object injection in PDF Invoice for WooCommerce ≤7.1.1
- Stored XSS in WooCommerce PDF Invoices plugin through 5.16.4
- Stored XSS in PDF Invoices & Packing Slips for WooCommerce