Matters to security leadership: threats, exposure and response.
November 2, 2026 · Azure's edge falls over, and a record crypto heistCISA added a GitLab CE/EE integer-overflow RCE (CVE-2026-97229, CVSS 10.0) and a Cisco Secure Firewall ASA/FTD denial-of-service flaw (CVE-2026-76418, CVSS 8.6) to its Known Exploited Vulnerabilities catalog on 29 October, both with a 1 November federal deadline. A day later it added two Ivanti Connect Secure flaws that chain with an earlier auth bypass to reach unauthenticated root. Volexity reported active exploitation; fixes are in ICS 25.1.1.3 and 22.8R2.6.
November 2, 2026 · Azure's edge falls over, and a record crypto heistBinance disclosed an incident affecting about 6.3 billion dollars in assets, with close to 3 billion frozen on-chain by Tether, Circle and Arbitrum. On 1 November the FBI attributed the theft to North Korea's TraderTraitor group (also tracked as Jade Sleet and UNC4899). Reporting says the attackers compromised a DevOps engineer's laptop, reached a service container, pre-signed consecutive withdrawal authorizations, and moved the funds in about 20 minutes.
November 2, 2026 · Azure's edge falls over, and a record crypto heistCloudflare detailed eight eMudhra intermediate CA certificates whose private keys were literal small integers (4, 56, 66 and others), letting anyone recover the signing key and forge a certificate for any domain. These intermediates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome. Cloudflare saw about 22,000 handshake attempts using the weak keys and a forged certificate dated under an hour after the public bug report. A week later, more than half of probes still accepted the chain.
November 2, 2026 · Azure's edge falls over, and a record crypto heistA tampered copy of Anthropic's Claude Code extension, version 2.1.313, was published to the Cursor marketplace and stayed live about 11 hours on 29 October, reaching up to 5,000 developers. It collected username, Git email and public IP and attempted a reverse SSH tunnel and persistence across Windows, macOS and Linux. Anthropic said a malicious actor used access to the marketplace to publish a copy it did not build.
November 2, 2026 · Azure's edge falls over, and a record crypto heistHosting platform Northflank disclosed a breach on 30 October in which stored environment variables were decrypted and customers' AI API keys were stolen and misused. Northflank told customers to assume all stored environment variables were compromised and to rotate every key, database password, token and secret. It followed similar breaches at Railway earlier in the month.
November 2, 2026 · Azure's edge falls over, and a record crypto heistA use-after-free in the kernel's IPv4 TCP path affecting multipath TCP listeners is tracked as CVE-2026-98432 and rated CVSS 9.8 by the kernel CVE team. Eight stable kernels shipped around 30 October with the fix. Anthropic reported that an AI model wrote a working exploit for the race.
November 2, 2026 · Azure's edge falls over, and a record crypto heistCloudflare mitigated 18.2 million network-layer DDoS attacks in the third quarter, up 38 percent year over year, and blocked 14.4 trillion HTTP DDoS requests. Short-burst attacks under 10 minutes and under 1 Gbps rose 208 percent. Cloudflare attributes the growth to booter and stresser-for-hire services.
November 2, 2026 · Azure's edge falls over, and a record crypto heistGoogle announced Gemini 4 Carbon on 28 October, claiming benchmark leads on vulnerability discovery and patch generation, including 88.2 percent on SEC-bench Pro and 71.0 percent on CWE-bench. Access starts gated to a subset of cyber defenders through Google's Fairwind Program. Introductory pricing is 2 dollars per million input tokens and 10 per million output, rising later to 4 and 20.
November 2, 2026 · Azure's edge falls over, and a record crypto heistGitHub introduced a preview npm package firewall that inspects downloads at install time and blocks suspicious packages before they install, the same week as the Northflank and Claude Code extension supply-chain incidents.
November 2, 2026 · Azure's edge falls over, and a record crypto heistOn 26 October the European Commission accepted Temu's action plan to remedy its breach of the Digital Services Act and reduce the availability of illegal products. The Commission accepted a remediation plan rather than moving straight to a fine. It was a quiet week for binding EU rule changes otherwise.
November 2, 2026 · Azure's edge falls over, and a record crypto heistPer a Google paper covered by InfoQ, its Gemini-based security agent PageBreak has autonomously found more than 500 cross-site scripting vulnerabilities across Google web apps since going into full operation in January, reporting only after validation.
November 2, 2026 · Azure's edge falls over, and a record crypto heistParameter Labs disclosed that a malicious ChatGPT share link could run attacker code in a victim's logged-in session and read private chats, abusing the HTML-preview sandbox, reported through OpenAI's bug bounty. It was covered by The Hacker News and Simon Willison.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityPHP maintainers released fixes on 21 October for CVE-2026-109618 and CVE-2026-109619, both unauthenticated remote code execution rated CVSS 9.2. The highest risk is mod_php, where an unauthenticated request can trigger the flaw before any application code runs. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Krebs reported working exploits already circulating.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityCloudflare found eight eMudhra intermediate CA certificates whose private keys were catastrophically weak, letting anyone recover the signing key and forge a certificate for any domain. These intermediates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome. Cloudflare deployed mitigations on 19 and 20 October, and eMudhra later said it will exit the global TLS certificate business.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityA malicious LiteLLM 1.107.0 was published to PyPI on 21 October with a credential stealer and a persistent backdoor that polled GitHub for commands. Attackers used stolen GitHub CLI credentials to bypass branch protection and build from a lookalike repo before PyPI removed it. The same day, Railway disclosed unauthorized access to systems holding customer environment variables, some decrypted, and told customers to rotate everything.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityOn 21 October a New Mexico court imposed 25 billion dollars in civil penalties on Meta in the state's Cambridge Analytica consumer-protection case, after a jury found about 43.9 million violations. The judge set the figure down from a much larger statutory maximum. Meta said it will appeal, and 48 other states had previously settled similar claims.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityOn 19 October DHS posted an order banning federal civilian agencies from acquiring DeepSeek products and requiring removal of DeepSeek and DeepSeek-based third-party tools, citing the Federal Supply Chain Security Act. National-security and SCI systems are excluded, and agencies can seek exceptions.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityCVE-2026-88771 is an unauthenticated remote command-execution flaw in NetScaler Gateway, exploitable in default configuration and confirmed exploited in the wild by CISA and Mandiant. Cloudflare recommends putting authentication and WAF controls in front of the appliance because patching lags exploitation.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityKrebs reported that ShinyHunters breached the FBI recruitment site in late September, taking SSNs, medical records and home addresses. Investigators suspect executives at ransom-negotiation firms ran the related extortion site, and a Canadian cybersecurity executive was arrested on 9 October. The group has extorted more than 70 million dollars this year.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityAWS announced on 22 October that its service to find, validate and prioritize code vulnerabilities and deliver fixes as pull requests is generally available. AWS positions it as replacing hours of manual investigation.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityAnthropic introduced Claude Duet on 21 October, a proactive agent that sends morning briefs, drafts replies for approval and runs tasks across more than 6,000 connectors including Stripe, Shopify, Gmail and Slack. It is a US-only research preview on a waitlist.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityThe European Commission published the reference to EN 18286:2026, an AI quality-management standard, in the Official Journal on 19 October. It supports Article 17 on quality management for high-risk AI and grants providers a presumption of conformity, designed to work with ISO/IEC 42001 and ISO 9001.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityOn 21 October the European Commission opened formal DSA proceedings to assess whether Booking.com failed to mitigate risks from fraudulent listings and phishing targeting reservation data, and whether paid listings were properly labelled as advertising.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireOn 13 October Microsoft shipped fixes for more than 1,400 vulnerabilities, roughly ten times a normal month, with at least 78 rated critical. CVE-2026-96951, a Windows Shell security-feature bypass affecting Windows 10, 11 and some Server versions, is confirmed exploited in the wild. A .NET Framework bypass, CVE-2026-108398, was publicly disclosed before the patch but not yet exploited at publication.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireOn the night of 11 October attackers set refrigeration controllers at up to about 700 French supermarkets into defrost mode overnight. Some units reached well over 50 degrees Celsius, with equipment melting, fires and sprinkler water damage, and similar incidents hit stores elsewhere in Europe. Reporting attributed the targeting to networked refrigeration control systems; no group claimed responsibility.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireOpenCode disclosed that attackers accessed a legacy system being decommissioned, exposing third-party API keys for OpenAI, Anthropic and Google that users had saved in OpenCode Console workspaces. The company said about 1.4 percent of Console users were affected, and Anthropic revoked affected Claude API keys. The open-source CLI itself was not the breached component.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireLedger confirmed an unauthorized hardware implant inside Ledger X wallets distributed by a Malaysia-based reseller. The implants used a small microcontroller and an LTE eSIM to exfiltrate recovery seed phrases captured from display and button activity. Ledger called the affected volume limited and did not disclose theft totals.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireCitizen Lab documented the first publicly confirmed zero-click mercenary spyware delivery through targeted ads. A panel let customers target by mobile ad ID, cookie or IP, and a server returned malicious JavaScript to infect selected devices, delivering Candiru spyware. The ads reached nearly 200,000 apps and sites.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireOn 8 October the UK sanctioned payment platform Cryptomus over Russia-linked money laundering, freezing UK-held assets and barring UK firms from dealing with it. TRM Labs tied more than 7 billion dollars of processed transactions to ransomware, darknet markets and sanctions evasion.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireA high-engagement GitHub issue filed on 12 October reports that the Codex CLI installs a persistent, self-updating background daemon by default, raising concerns about consent, auto-update behaviour and running an always-on process.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireAn OpenAI software engineer was arrested in connection with the alleged bugging of an executive conference room, reported on 13 October. Details beyond the arrest and the allegation are limited.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireNorway's DPA fined Xandr 8.6 million euros for unlawfully processing Grindr users' advertising IDs, IP addresses and location in real-time bidding. Because the data revealed sexual orientation, a special category, explicit consent was required, and the DPA found the relied-on consent invalid, stressing that each joint controller must verify valid consent for its own processing.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireAdopted on 13 October, EDPB Statement 1/2026 flags data-protection risks of smart glasses, including covert recording of bystanders and risk in sensitive environments. It recommends visible recording indicators and states that manufacturers cannot transfer GDPR obligations to users.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireA CSO Online piece arguing that recent incidents framed as agents going rogue actually stem from skipping decades-old containment and monitoring practices drew 952 points and 630 comments on 14 October.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireA defense of passkeys drew 677 points and 819 comments on 14 October, days after a critical essay on the same topic, with heavy debate on vendor lock-in, account recovery and portability.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionDanish authorities disclosed that attackers abused a private company's legitimate access to the Central Person Register (CPR), running about 14 million automated searches in September before detection in early October. Exposed data includes names, addresses and CPR numbers for roughly 8.8 million people, about 80 percent of the register. A party claiming responsibility said access came via an IT company account protected by the password 123456.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionThe Dutch DPA fined Uber 824,990,000 euros for breaches of GDPR Article 22 on automated individual decision-making and Article 13 on information duties. Uber used fully automated decisions to temporarily or permanently deactivate driver accounts on suspicion of fraud or low ratings, causing income loss, without giving drivers enough information. Uber has appealed, so there is no final judicial decision yet.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionA researcher published CVE-2026-107181, an IPC-injection flaw in Telegram Desktop through version 7.2.8 combined with an unauthorized URI scheme that enables arbitrary local file read and exfiltration, leading to account takeover from a single malicious link click. It is rated CVSS 8.1 and fixed in version 7.2.9.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionKrebs reported that before recent arrests, the ShinyHunters group extorted Jeppesen ForeFlight, a former Boeing subsidiary. Related reporting ties the group to mass exploitation of CVE-2026-35273, a PeopleSoft and Oracle vulnerability, beginning in June, with published firewall mitigations bypassed through URL-encoding.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionThe Swedish DPA fined Miljödata about 160,000 euros under GDPR Article 32 for insufficient technical and organizational security, including the lack of automated real-time intrusion and anomaly monitoring. About 2.2 million individuals were affected.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionThe Italian DPA fined IQVIA Solutions Italy 7 million euros for unlawful processing of patients' health data, citing GDPR Articles 5, 9 and 13.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionA critical essay arguing against passkeys reached the front page on 11 October with 1,150 points and 577 comments, driving debate on portability, vendor lock-in and account-recovery tradeoffs.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedCISA added three exploited flaws to its Known Exploited Vulnerabilities catalog. CVE-2026-86950 is an out-of-bounds write in Apple's CoreGraphics (CVSS 8.8), fixed in iOS and macOS updates and triggered by processing a malicious file. CVE-2026-76504 is a critical authentication bypass in Cisco Catalyst SD-WAN Manager (CVSS 9.8) with no workaround. CVE-2026-104286 is a path-traversal flaw in Fortinet FortiMail (CVSS 9.8) allowing unauthenticated file write.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedGerman AI firm Aleph Alpha released Kolibri on 3 October, a mixture-of-experts model with 78 billion total and 3 billion active parameters and up to a 1M-token context, published on Hugging Face under Apache 2.0. Aleph Alpha positions it as sovereign, built and trained in Germany and Finland under EU and German law and designed around the EU AI Act and GDPR.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedDebian published DSA-6528-1 on 29 September, fixing an unusually large batch of Linux kernel CVEs that may lead to privilege escalation, denial of service or information leaks. Debian stable is fixed in kernel 6.12.111-1, and the advisory drove a widely read Hacker News thread.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedDutch authorities arrested a 24-year-old convicted cybercriminal for allegedly aiding ShinyHunters data thefts and extortions, including a telecom breach affecting millions of Dutch citizens. After the arrest, the group escalated with public claims that were self-reported and unverified.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedThe European Commission opened a consultation on the EU KIDS Act on 2 October, closing 3 December, targeting child online safety and platform accountability. Feedback will feed the legislative process.
