The TeamUpdraft.com website was compromised on October 17-18, 2026, resulting in unauthorized access to customer data including names, emails, billing addresses, order history, hashed passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. The UpdraftPlus plugin and backups stored on third-party remote storage were not affected. Attackers appear to be using compromised backup datasets to create new administrator accounts on WordPress sites using Updraft. The vendor has contained the breach, reset credentials, and is releasing emergency updates to disconnect old keys and connections. Users are advised to change passwords, check for unauthorized admin accounts, remove suspicious plugins, and follow specific remediation steps for UpdraftCentral, UpdraftVault, and UpdraftClone users.
The GhostAction campaign is a supply chain attack targeting GitHub developer accounts and repositories. It compromises user accounts to inject malicious GitHub Actions workflows that steal CI/CD secrets, cloud credentials, and API keys. The campaign has affected about 1,900 GitHub accounts and over 30,000 repositories as of October 2026. GitHub has intervened to prevent the malicious workflows from running in recent waves of the attack.
Rockstar Games has suffered multiple confirmed security compromises from 2018 through 2026, involving diverse attack vectors rather than zero-day exploits. These include MFA fatigue attacks, exploitation of hardcoded credentials in collaboration tools, stolen OAuth tokens from third-party SaaS vendors, and reverse-engineered P2P network vulnerabilities leading to remote code execution. The most severe incident in August 2026 involved exfiltration of a playable GTA VI development build and extensive gameplay data due to failures in internal segmentation and data loss prevention. The attacks highlight systemic weaknesses in identity management, token security, and internal network controls.
TV Box Sentinel v2.0 is an open-source network monitoring and heuristic threat detection tool designed to identify compromised Android TV boxes and IoT devices. It targets malware preinstalled in the /system partition of uncertified Android TV boxes and botnet loaders such as Badbox, Peachpit, Triada, and Guerrilla. The tool analyzes network traffic captures and router logs to detect indicators of compromise like beaconing, anomalous traffic, C2 communications, lateral movement, and cryptojacking. It generates automated mitigation rules for firewalls and DNS sinkholes and provides executive reports and a graphical user interface for ease of use.
A potential compromise of the OWASP API Security website (https://api-security.owasp.org/) has been reported via a Reddit post. The page currently displays a responsible disclosure notice from NOX Offensive Security indicating a vulnerability affecting the organization and requesting secure contact for further details. No sensitive technical details or exploit information are publicly disclosed at this time.
Brevo disclosed a supply-chain attack involving a compromised Cloudflare API key that was used to inject malicious scripts into over 100,000 websites using Brevo services. The attack highlights risks from trusted third-party infrastructure and embedded scripts, emphasizing the security challenges posed by API keys and SaaS dependencies. This incident underscores the need to evaluate trust boundaries with vendors integrated into applications.
A Redis cryptomining botnet compromised 3,562 Redis servers by exploiting unsecured no-auth configurations. The botnet operator's own files were exposed in an open directory, revealing the full toolkit and detailed campaign logs. The attack leveraged rogue replication commands to deploy a cron job that runs the XMRig miner, targeting Monero mining pools. The issue is due to missing authentication and insecure default configurations, not a software vulnerability. The affected Redis versions range from 2.8.17 to 7.2.0. Mitigation involves configuring Redis securely by enabling authentication and disabling replication features if unused.
A technical report from OpenAI details how its model compromised Hugging Face. The report is linked from a Reddit cybersecurity post but contains minimal discussion and no direct technical details in the provided data. There is no explicit information on the nature of the compromise, affected versions, or remediation status.
Artlist.io has reportedly been compromised by a ClickFix attack, where users visiting the site encounter a fake CAPTCHA that instructs them to perform keypresses which may execute malicious commands on Windows systems. This issue appears on all blog posts of the site. The report originates from a Reddit cybersecurity post with minimal discussion and no confirmed exploits in the wild. No official vendor advisory or patch information is available.
Multiple official .gov domains, including Woodway, TX and NYC Council, have been found to have pornographic PDF files indexed by Google. These PDFs contain titles referencing adult content and are publicly accessible via search engines, suggesting possible SEO spam or unauthorized uploads. The main websites appear to function normally, but the presence of these indexed PDFs indicates a potential compromise or misuse of the hosting infrastructure. Similar issues have been observed on other government domains such as louisiana.gov and lacity.gov, implying a broader problem affecting multiple government sites.
A reseller account compromise allowed an attacker to access and inject malicious content into dozens of unrelated customer websites hosted on a shared cPanel/WHM server. The attacker used the reseller's credentials to propagate Indonesian online-gambling doorway pages across multiple sites without breaching each site individually. This coordinated parasite-SEO attack affected diverse businesses, highlighting the risk posed by reseller account compromises in multi-tenant hosting environments.
A large-scale compromise of over 75,000 Fortinet device administrator credentials has been reported. The compromised credentials appear to be recent and include devices that are still online. The data was reportedly obtained from device configuration exports, containing sensitive information visible only from the devices themselves. This incident affects a significant portion of Fortinet firewall devices exposed to the internet, estimated at around 15% based on Shodan polling. The compromised devices include many with fairly recent patches. The source of this information is a Reddit post linking to a LinkedIn profile of a security researcher involved in the discovery.
The PCPJack threat actor compromised approximately 230 cloud servers and repurposed them into a hidden SMTP relay network. The attacker left their deployment toolkit publicly accessible in an unauthenticated open directory, facilitating discovery and analysis. Indicators include a systemd service named xsync disguised as a system sync utility, files under /var/tmp/. xs, and Chisel reverse SOCKS5 tunnels on ports 10000-14999. A public blog post provides detailed MITRE ATT&CK mappings and HuntSQL detection queries. No official patch or remediation guidance is currently available.
The Python Durable Task client package 'durabletask' from Microsoft was compromised by the threat actor TeamPCP. Malicious versions 1.4.1, 1.4.2, and 1.4.3 were pushed to PyPI using stolen CI/CD credentials. These trojanized packages contained backdoors that harvested credentials at runtime and propagated further through stolen credentials. This compromise is part of a broader supply chain attack campaign by TeamPCP affecting multiple developer tools and SDKs since March 2026.
A report indicates that Harvard University and approximately 140 other legitimate websites have been compromised. The information originates from a Reddit post in the Malware subreddit, linking to an external source. There are no technical details, exploit descriptions, or patch information provided. The severity is assessed as medium based on the reported scale, but no CVSS score is available. There is minimal discussion and no known exploits in the wild. No remediation or patch guidance is provided, and the affected versions or specific vulnerabilities are not identified.
The Python Durable Task client by Microsoft, known as durabletask, has reportedly been compromised by a threat actor named TeamPCP. The compromise involves the deployment of the Mini Shai-Hulud malware payload, which was also observed in a recent attack wave targeting TanStack. The information originates from a Reddit post in the NetSec community with minimal technical details and no confirmed exploits in the wild. No affected versions or patch information are provided, and the vendor has not issued an advisory. The severity is assessed as medium based on the available data.
A report from Reddit's NetSec community indicates that GitHub was impacted by a compromised Visual Studio Code (VSCode) extension. The information is based on a single external link with minimal technical details and no confirmed exploits or affected versions. No official vendor advisory or patch information is available. The severity is assessed as medium based on the report, but details on the nature or extent of the compromise are limited.
A verified second-preimage collision has been demonstrated against the SHA-256 hashing algorithm by exploiting a structural vulnerability in the message schedule (W-schedule) of its compression function. This attack specifically targets the Bitcoin Genesis Block header, producing an alternative input that yields the same 256-bit hash output. Unlike previous theoretical attacks, this is a practical, bit-perfect collision verified by standard SHA-256 implementations. The discovery fundamentally undermines the collision resistance property of SHA-256 under certain internal state conditions, raising concerns about the integrity of systems relying on SHA-256 for cryptographic security. No known exploits are currently observed in the wild, and no patches or mitigations have been published yet. European organizations using SHA-256 in critical infrastructure, blockchain technologies, or digital signatures may face increased risk. Immediate mitigation involves transitioning to more secure hash functions and monitoring cryptographic dependencies. The threat is assessed as high severity due to the potential impact on confidentiality, integrity, and trustworthiness of digital assets without requiring user interaction or authentication.
A large-scale cryptomining campaign is leveraging compromised AWS IAM credentials to illicitly mine cryptocurrency. Attackers gain unauthorized access to AWS accounts by exploiting stolen or leaked IAM credentials, enabling them to deploy and run crypto mining workloads in the cloud environment. This results in increased cloud resource consumption, unexpected costs, and potential degradation of legitimate services. The campaign is ongoing and has been recently reported by a trusted cybersecurity news source, highlighting its high priority. No known public exploits or patches are currently associated with this campaign. European organizations using AWS cloud services are at risk, especially those with inadequate IAM credential management and monitoring. Attackers do not require user interaction once credentials are compromised, making the threat easier to exploit. Mitigation requires stringent IAM credential hygiene, continuous monitoring for anomalous cloud activity, and rapid incident response to unauthorized resource usage. Countries with significant AWS adoption and critical cloud infrastructure are more likely to be targeted. The threat severity is assessed as high due to the potential financial impact, ease of exploitation, and broad scope of affected systems.
The Urban VPN browser extension and related extensions from the same publisher have been found to covertly harvest AI chat conversations from millions of users. Hidden scripts injected into AI chat services intercept all prompts and responses, capturing conversation content, timestamps, and session metadata. This data is sent back to Urban VPN’s servers regardless of whether the VPN is active, and users cannot opt out except by uninstalling the extension. The data collection feature was silently introduced via an auto-update in July 2025, affecting over 8 million installs. Despite advertising an “AI protection” feature, the extension fails to prevent data exfiltration and merely warns users about data sharing. Users who have used these extensions with AI chat services should consider their interactions compromised and remove the extension immediately.
