The PC launcher for the game "Goddess of Victory: NIKKE" was compromised via a supply chain attack involving tampered script files on the official CDN between September 27 and November 4, 2026. The altered scripts installed a remote access agent named K2F capable of executing arbitrary commands and stealing credentials from browsers, cryptocurrency wallets, and cloud services. The malware persisted by injecting a DLL into Chrome to intercept wallet recovery phrases. The initial compromise stemmed from domain hijacking of insightjs.com. The vendor detected and remediated the issue by replacing files and deploying automated detection and removal on November 5. Users who ran the Windows PC launcher during the compromise window were potentially affected.
In October 2026, attackers linked to North Korea's TraderTraitor operation stole approximately $6.34 billion from Binance through a sophisticated multi-stage supply chain compromise. The attack began with a fake job interview that tricked engineers into downloading trojanized developer tools, including a weaponized Terraform provider. Malicious backdoors named FLATROOF and ROOFDECK were embedded within legitimate-looking developer software, enabling lateral movement from compromised developer workstations to Binance's wallet signing infrastructure. ReversingLabs detected these malicious components 77 days before public disclosure, highlighting the advanced nature of the threat targeting DevOps environments.
An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the system running the product.
A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's web browser when the user accesses a website using the affected product.
Ahead of the Grand Theft Auto VI release on November 19, 2026, threat actors are exploiting consumer excitement through phishing campaigns and fraudulent schemes. These campaigns use fake downloads, false early access offers, nonexistent mobile versions, and free game promises to lure victims. Malicious sites distribute trojans, request cryptocurrency payments, use content lockers requiring survey completion, and harvest personal information. Tactics include fake storefronts impersonating Rockstar Games, fraudulent APK files with unsafe permissions, and giveaway scams with urgency counters. Post-launch threats are expected to include in-game currency fraud, credential phishing for Rockstar and gaming platform accounts, and malware through fake cheats and modifications.
vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the reading thread. A Vault token that can write but not read a KV v2 path can store such a value there, so every later read of that path through the driver fails. This requires Vault 1.19.x or earlier, because 1.20 and later reject values nested deeper than 298 levels. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3 and is fixed in 7.0.0.
The 2026 VulnCheck Exploit Intelligence Report analyzes vulnerability exploitation trends in 2025, distinguishing between 'weaponized' and 'exploited' CVEs. 'Weaponized' CVEs refer to vulnerabilities for which exploit code or tools have been developed and made available, while 'exploited' CVEs are those actually used in attacks in the wild. The report highlights that only about 1% of disclosed vulnerabilities were exploited, but those exploited caused significant impact. It also discusses the rise of AI-generated exploit code increasing noise in risk assessments and the evolving tactics of threat actors, including ransomware groups and nation-linked actors. The report aims to help organizations prioritize real threats over misleading signals.
vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than "true", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.
A business logic vulnerability in the Dokan WordPress plugin before version 5.3.3 allows vendors to reduce their commission debt by applying a discount coupon at checkout, resulting in paying less than the owed balance. This occurs because the plugin does not properly reconcile the credited amount in the vendor's reverse-withdrawal ledger with the actual payment collected. The issue is fixed in version 5.3.3.
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.
CVE-2026-123033 is an authentication bypass vulnerability in the HA heartbeat origin check of middlewared in iXsystems TrueNAS SCALE versions before 25.10.8. An attacker on the same network segment can gain unauthenticated full-administrator API access and execute commands as root by exploiting the unconditional registration of the HA peer-authentication hook. The vulnerability affects even non-HA, unlicensed, single-node Community Edition installations. The issue is fixed in version 25.10.8 by requiring connections to terminate on the HA heartbeat listener, which the attacker cannot control.
The dbt-adapter package on PyPI contains malicious code that exfiltrates basic information such as the host's IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. The package serves no legitimate purpose beyond this data exfiltration.
CVE-2026-123029 is a vulnerability in Wowza Streaming Engine versions before 4.12.2 that allows remote attackers to read local files via XML external entity processing. This occurs because the software improperly restricts XML external entity references, enabling unauthorized file access with the privileges of the Wowza Streaming Engine process. The issue is fixed in version 4.12.2.
The Essential Real Estate WordPress plugin versions before 5.3.5 contains a vulnerability where it does not verify ownership of an invoice before rendering it via an AJAX action. This flaw allows an authenticated user with low privileges to access invoices belonging to other users, exposing sensitive information such as the invoice owner's name, account email address, and financial details.
The Essential Real Estate WordPress plugin versions before 5.3.5 contain a vulnerability that allows unauthenticated users to send emails to arbitrary recipients. This occurs because the plugin does not restrict the recipient of one of its contact email actions, enabling attackers to control the sender header and message body.
The Essential Real Estate WordPress plugin versions prior to 5.3.5 have a vulnerability where two AJAX actions do not perform publication-status or authorization checks. This flaw allows unauthenticated users to access images attached to unpublished property listings.
A vulnerability in the YITH WooCommerce Gift Cards WordPress plugin versions before 4.38.1 allows attackers to redeem a gift card multiple times concurrently, spending more than the card's funded value. This occurs because the plugin does not lock or atomically update the gift card balance during checkout.
The Essential Real Estate WordPress plugin versions before 5.3.5 contain a vulnerability where an AJAX action does not perform authorization or publication-status checks. This flaw allows unauthenticated users to access full details of unpublished property listings, including sensitive personal information of listing agents such as name, email, phone number, and office address.