Breaches, ransomware and supply-chain compromises, with the lesson for people who run systems.
Brief2 min read
The exchange says two engineers were targeted in a recruitment-themed social engineering attack, and that the loss came from a multi-stage campaign rather than one phishing email.
Brief2 min read
The vendor says attackers are exploiting a flaw patched in December 2024 against devices that never took the update. The advisory gives no CVE, no version range and no count of victims.
Brief2 min read
The project says the thefts hit self-hosted instances running BTCPay Server 2.4.1 or earlier. It hasn't published how the attacks worked or how much was taken.
ExploitedCVE-2026-109618CVSS 9.22 min read
Anadolu's October incident timeline reports that researchers at Wiz used Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol to find the bugs, build working exploits and help validate the fixes.
Brief1 min read
Florida education officials say a financial-aid website breach may have exposed personal information; the investigation remains ongoing.
Brief1 min read
Revolve says an unauthorized actor may have obtained customer and saved payment information; the company has remediated the unauthorized activity.
Brief1 min read
The FBI attributes a theft of more than $6 billion from Binance to TraderTraitor and identifies addresses associated with laundering.
Brief1 min read
Michigan State describes suspicious activity and password resets, while a ransomware gang makes separate claims of stolen student information.
Brief2 min read
Synology says attackers are exploiting a flaw patched in December 2024 against outdated DiskStation Manager installs, and is telling customers to update now.
Brief2 min read
Trezor says it has credible reports of an extra circuit board with a cellular module inside a Safe 5 bought in Southeast Asia, but has not yet examined the device itself.
Brief2 min read
A threat actor using the handle "Department of Peace" posted a database of DHS employee data and says it came from an Okta single sign-on system. Okta says it has no evidence of a compromise.
Brief2 min read
The health system sent ambulances elsewhere for about two hours, suspended outpatient surgeries and appointments, and later said a ransomware gang had claimed the intrusion.
