Critical9.2KEVEPSS 82%Check Point ResearchCVE-2026-111497
This report summarizes multiple significant cyber threats and incidents disclosed in early November 2026. Major breaches include a $6.3 billion cryptocurrency theft from Binance via compromised internal infrastructure, a malicious JavaScript attack on Polymarket's platform, and data breaches affecting Japan Airlines and the Florida Department of Education. The report also highlights the use of AI by threat actors such as the GOLD OGRE ransomware group and North Korean cyber operators to enhance attack capabilities. Several critical vulnerabilities are noted, including CVE-2026-111497 (HTTP2Shell) affecting Brotli decompression, a critical Linux kernel TCP networking flaw (CVE-2026-98432), and a Drupal Commerce Core access control vulnerability (CVE-2026-118539). Cisco patched a high-severity SSL VPN crash vulnerability (CVE-2026-76418) that was exploited in the wild. Additional threat intelligence includes malware campaigns and advanced persistent threat activity targeting various sectors globally.
The Florida Department of Education's student financial aid website was breached, potentially exposing personal data of approximately 4.9 million individuals. The compromised data may include names, Social Security numbers, dates of birth, addresses, phone numbers, email addresses, and gender codes. The breach was discovered on October 19, 2026, and has since been contained. The department has not disclosed the attack vector or threat actor. Existing student aid and disbursements remain unaffected.
In September 2026, online fashion retailer Revolve suffered a data breach impacting at least 180,000 customers. Hackers accessed the company's online shopping platform and stole personal information including names, addresses, payment card numbers, and expiration dates of customers who had saved this data. The breach did not disrupt operations or customer service. Revolve promptly initiated incident response, contained the breach, and engaged law enforcement and cybersecurity experts. Affected individuals were notified but were not offered free credit monitoring services. The company has not disclosed the attacker identity or attack method.
Chainalysis, a blockchain analytics company, disclosed a data breach resulting from an AI-driven cyberattack using offensive agentic techniques to gain unauthorized access to its systems and internal tools. The breach did not compromise investigation content, transaction or query results, clear-text passwords, or other credentials. However, some non-sensitive customer data, including user IDs, full names, email addresses, and organization role labels, was accessed. The company is investigating the full scope and has not disclosed the number of affected individuals. Chainalysis is actively patching vulnerabilities and strengthening security, recommending users enable MFA and be vigilant for suspicious authentication prompts.
A hacker leaked over 41,000 records of US Department of Homeland Security employees, allegedly stolen from an Okta single sign-on system. The leaked data includes personal and work information such as names, work emails, phone numbers, job titles, office locations, and access details to internal systems and applications. The breach affects employees from multiple DHS agencies, including Customs and Border Protection, Immigration and Customs Enforcement, Homeland Security Investigations, and CISA. The leak provides attackers with detailed access information, potentially enabling targeted attacks on critical personnel and systems.
In October 2026, hackers breached Sony Network Communications' Japanese ISP So-net, stealing approximately 2.6 million customer records. The compromised data includes personal information such as names, dates of birth, gender, phone numbers, email addresses, user IDs, and internet connection IDs. Additionally, 54,401 email account passwords from multiple mail services and 16 bank account records were exposed. The breach was detected four days after the intrusion, prompting So-net to take the affected server offline and reset passwords for impacted email accounts. The cause of the unauthorized access remains under investigation, and the incident has been reported to Japan's Personal Information Protection Commission.
In June 2026, iRhythm, a medical equipment provider specializing in wearable cardiac monitors, suffered a data breach impacting over 8.1 million individuals. Hackers accessed personal information and iRhythm account and device data from third-party-hosted business applications and attempted to extort a ransom. The compromised data includes names, addresses, dates of birth, email addresses, phone numbers, and device-related identifiers. iRhythm has not found evidence of identity theft or impact on its medical devices or operations. Notifications have been sent to affected individuals and regulatory bodies, including the US Department of Health and Human Services.
A leaked SquareML access key potentially exposed personal and health information of 238,000 Denver Health Medical Plan members. The key was publicly accessible from June 27, 2025, until it was revoked on August 18, 2026. The compromised account was read-only, limiting the ability to alter or export data. The exposed data includes names, dates of birth, demographic details, health metrics, and hospital admission information, but excludes Social Security numbers and financial data. There is no evidence that the data was accessed or misused, only that it may have been.
This report summarizes multiple cyber threats and incidents observed in late October 2026, including large-scale breaches, supply-chain attacks, AI-enabled cybercrime tools, and critical software vulnerabilities. Notable incidents include a cyberattack on Japanese cloud provider Onamae Desktop Cloud affecting over 26,000 servers, a data breach at India's State Bank of India exposing nearly 3,900 customer records, and a supply-chain compromise of the LiteLLM AI gateway. AI-enabled tools are facilitating large-scale fraud and ransomware attacks targeting critical sectors in the United States. Critical PHP vulnerabilities enabling remote code execution are being widely exploited, with most instances unpatched. Oracle and GitLab have released patches for numerous critical vulnerabilities, including a critical remote code execution flaw in GitLab and a privilege escalation vulnerability in Arista VeloCloud Orchestrator that has been exploited in the wild.
Quest Diagnostics, a major American clinical laboratory company, disclosed a data breach involving unauthorized access to its Quanum LSM system, resulting in exposure of patient records. The breach was confirmed publicly but specific technical details and affected versions were not provided. No known exploits or active attacks have been reported. The incident highlights risks to sensitive healthcare data due to unauthorized system access.
Capcom suffered a data breach impacting approximately 11.7 million email addresses from its CAPCOM ID service. The breach also involved unauthorized changes to login passwords for 196 accounts. Additional personal information such as dates of birth, gender, country/region, and nicknames were compromised for 43 users. Capcom has reset affected passwords and notified impacted users. The company reported the incident to authorities and continues to investigate while maintaining service availability.
Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager platform, potentially compromising certain patient records. The breach was discovered recently and is under investigation, with the company working alongside federal law enforcement and cybersecurity experts. The exact number of affected patients and the scope of the data accessed remain unknown. Quest Diagnostics has experienced similar breaches in the past, affecting tens of thousands to millions of patient records. The company confirmed this breach is unrelated to recent PHP vulnerabilities affecting many websites. The incident highlights ongoing cybersecurity challenges in healthcare data protection.
LiteLLM version 1.107.0 was compromised in a supply chain attack where attackers used leaked GitHub CLI OAuth tokens to push malicious packages to PyPI and Docker. The malicious packages were available for about three hours and downloaded over 49,000 times. The malware included an information stealer and a remote access trojan (RAT) that harvested sensitive credentials and secrets, then communicated with attacker-controlled servers. The incident was traced to leaked tokens exposed via logs and involved disabling branch protections and redirecting release workflows. Enterprise customers using private repositories were not affected. Users are advised to remove the compromised version and rotate credentials.
Railway, a cloud platform hosting developer applications and services, detected suspicious activity on its environment variable storage systems, potentially exposing decrypted secrets such as API keys and credentials. The company warns users to immediately rotate all stored secrets and credentials due to possible unauthorized access. The incident is linked to a series of attacks targeting AI inference providers. Railway has paused deployments during the ongoing investigation and will notify affected users directly.
Capcom has confirmed a data breach impacting its CAPCOM ID membership service, resulting in the exposure of over 11.7 million customer email addresses and associated information. The breach affects a large number of users but specific technical details and the nature of the exposed information beyond email addresses have not been disclosed.
Eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to insufficient randomness in the certificate generation process. This cryptographic weakness allows attackers to derive private keys from public certificates, enabling unauthorized TLS certificate signing and potential man-in-the-middle (MitM) attacks. Major browser and OS vendors have revoked trust in these intermediates, and eMudhra has revoked the eight compromised certificates. Organizations are advised to audit PKI assets, reissue certificates from trusted CAs, enforce strict revocation checking, and update trust stores to mitigate risk. Palo Alto Networks provides solutions and guidance to assist with managing this incident and preventing exploitation.
The Onamae Desktop Cloud, a VPS service provider in Japan, suffered a security breach where attackers compromised its infrastructure and installed malware on up to 26,739 customer servers. This incident impacts a significant number of virtual private servers hosted by the provider. No specific technical details or remediation status are provided in the available information.
Zeabur, a developer hosting and deployment platform, suffered a second security breach within two months. Attackers used leaked internal credentials stored in plaintext to compromise infrastructure, stealing over 3.2 million environment variable records and data for 321,810 accounts. The breach involved unauthorized root access to multiple servers and the addition of SSH keys by attackers. Zeabur failed to rotate administrator credentials after the first breach and left admin portals publicly accessible. Following this incident, Zeabur announced it will shut down its services by the end of 2026.
Nikkei, a major Japanese media company, disclosed a data breach affecting over 1.8 million records. The breach involved unauthorized access to a cloud service using previously compromised credentials. Approximately 150,000 records contained personally identifiable information such as names, addresses, email addresses, phone numbers, and dates of birth. No credit card or financial information was compromised. Nikkei revoked the compromised credentials promptly and notified regulators. As of the latest update, there is no evidence of misuse of the stolen data or disruption to services.
Paradigm Healthcare Services experienced a data breach detected in October 2025 affecting over 970,000 Medi-Cal members. The breach involved unauthorized access to files containing protected health information such as names, dates of birth, gender, and Medi-Cal member identification numbers. Notification to affected individuals was delayed until September 2026, nearly 11 months after detection. Paradigm took systems offline, involved law enforcement, and engaged incident response experts. There is no evidence provided that the stolen information has been used for fraud or identity theft. Details about the attack vector, threat actor, or data exfiltration remain undisclosed.