TheLeaf Threat Observatory operates honeypot sensors that mimic common internet services such as WordPress, Tomcat, phpMyAdmin, SMTP, Telnet, and RDP to capture unsolicited traffic and automated probing attempts. These sensors collect data on login attempts, credential guessing, and exploitation probes, publishing categorized observations with a delay. The project aims to provide real-world insight into automated scanning and attack techniques without enabling actual exploitation or access. It serves as an educational and research tool rather than a direct threat or vulnerability.
Google has introduced a new $250,000 top-tier reward in its Cloud Vulnerability Reward Program for security research demonstrating full administrative control over Google Cloud organizations or projects. This reward targets high-impact architectural vulnerabilities that allow attackers to gain roles/owner privileges or complete IAM control without relying on pre-existing access, compromised credentials, or social engineering. The program also evaluates remote code execution in Borg, Google's production infrastructure, under strict rules to prevent impact on service availability or data. Researchers must prove unauthorized access using a designated service account, ensuring safe and controlled testing.
Malicious versions 2.1.312 and 2.1.313 of the Anthropic Claude Code extension were distributed via the Cursor VS Code Extension Marketplace in a supply chain attack. These versions contained JavaScript code that performed host reconnaissance and attempted to establish a reverse SSH tunnel for persistence and remote access. The malicious extension was live for approximately 11 hours and potentially downloaded by around 5,000 developer systems on macOS and Windows. Cursor removed the malicious versions promptly, suspended the marketplace for investigation, rotated keys, and worked with the cloud provider to take down the attacker's server. The attack failed to establish the SSH tunnel on most systems due to lack of administrative privileges. Users are advised to remove the malicious extension versions and follow Cursor's remediation guidance to detect and eliminate persistence mechanisms.
In May 2026, a critical security incident was reported involving the Bash project infrastructure. An attacker exploited a vulnerability allowing code execution via a crafted email address, escalating privileges to superuser, impersonating the Bash maintainer, and gaining push access to the upstream Bash repository. Further exploitation of an unpatched kernel vulnerability granted root access and control over a GNU backup server. The incident was responsibly disclosed to the Free Software Foundation (FSF) and documented in an FSF incident report.
Polymarket experienced a supply chain attack via a compromised third-party provider, DebugBear, whose DNS records were hijacked through its domain registrar. Malicious JavaScript served from DebugBear's address was injected into Polymarket's site, targeting logged-in traders to manipulate their portfolios by dumping positions or transferring assets to attacker-controlled wallets. Approximately 726 wallets were affected, with Polymarket returning a total of $3.9 million to traders, covering stolen funds and losses from trading halts. DebugBear's internal systems were not compromised, and the attack appears to have targeted a single customer. The investigation is ongoing, and law enforcement is involved.
The FBI has attributed the $6 billion Binance cryptocurrency heist to North Korea’s state-sponsored hacking group TraderTraitor. The attackers compromised Binance’s infrastructure, including multiple breach points beyond an initially suspected compromised laptop, and rapidly emptied hot wallets across multiple blockchains. The stolen funds are being laundered primarily into Ethereum and then through decentralized finance (DeFi) and instant swap services. The FBI has identified over 600 cryptocurrency addresses linked to the theft and is coordinating with industry partners to block transactions from these addresses. Binance has pledged to cover all losses and has already replaced about 95% of the stolen funds using company resources. The laundering activity appears to be highly automated, with continuous fund movements across numerous addresses and chains.
/r/netsec's Q4 2026 Information Security Hiring Thread is a community post on Reddit inviting companies to share open information security job and internship positions with the /r/netsec user base. It serves as a platform for recruiting cybersecurity professionals and students nearing graduation.
Northstar Security is a startup that has emerged from stealth mode with $7 million in seed funding to develop AI-driven security solutions. The company builds a real-time Security Context Graph that maps identities, assets, applications, vulnerabilities, and business systems to identify risky combinations of security issues. Its platform helps security teams detect and remediate complex risk scenarios that may not be evident when issues are considered individually. The solution integrates with over 70 enterprise security and IT products and allows analysts to interact with findings using natural language queries. Northstar’s AI agents can initiate remediation actions under supervision. The startup aims to improve security context and reduce risk exposure for organizations.
This report discusses a tool enhancement for extracting embedded files from Microsoft OneNote (.one) files. The author added a JSON output feature to the onedump.py tool to facilitate batch extraction of embedded files, enabling easier analysis and file retrieval. There is no indication of a vulnerability or active exploitation associated with this activity.
Ahmad Umar Agha, a Syrian hacker affiliated with the Syrian Electronic Army, was sentenced to 42 months in a US federal court for a hacking conspiracy directed by Syrian intelligence figures. Over more than a decade, he compromised around 47 targets including Western media, companies, NGOs, and government entities, causing significant disruption and financial losses. Notable incidents include the 2013 hijacking of the Associated Press Twitter account that triggered a stock market flash crash and attacks on the Marine Corps recruiting website and White House social media accounts.
Wireshark Release Candidate 5.0.0 was published on October 31, 2026, signaling the upcoming release of a new major version of the Wireshark network protocol analyzer. No specific security vulnerabilities or threats are described in this announcement.
YARA-X version 1.22.1 is a bugfix release that addresses two bugs. This release does not include the new built-in functions for reading 64-bit integers that are present in YARA 4.6.0. YARA-X has effectively replaced YARA as the tool for pattern matching and malware research.
YARA-X version 1.22.0 was released on October 25, 2026, introducing 11 improvements and 9 bug fixes. Among the enhancements is the addition of built-in functions to read 64-bit integers in various formats. There is no indication of security vulnerabilities or threats associated with this release.
The PHP2Shell vulnerability involves critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that have been actively exploited for over a week. Attackers, notably a China-linked group, have successfully chained these PHP2Shell flaws with the Fragnesia Linux kernel privilege escalation bug to gain root access on Palo Alto Networks PAN-OS firewalls. Despite over 22.6 million exposed PHP instances potentially vulnerable, successful exploitation has been limited, with WordPress sites remaining largely unaffected. Palo Alto Networks has released patches for multiple PAN-OS versions and urges customers to restrict internet access to management interfaces. The attacks appear opportunistic and originate from a small number of IP addresses, targeting various sectors including healthcare and technology.
This report summarizes multiple cybersecurity incidents and vulnerabilities including a critical 16-year-old buffer overflow in UEFI firmware affecting most servers worldwide, a disputed AI-led intrusion at Anthropic, data breaches at the University of Copenhagen and ENGIE, and a Cloudflare AI data leak. The UEFI flaw allows local network attackers to execute code at high privilege during network boot. Anthropic disputes the scope of an AI-driven intrusion by a startup. The University of Copenhagen breach exposed personal and national ID data of over 500,000 individuals. Cloudflare fixed a cross-tenant data leak in its AI inference platform caused by a cache size mismatch and a bug in the inference engine. Other incidents include suspected Iranian cyberattacks on military freezers and attempts to breach the US Federal Election Commission systems.
This analysis discusses the security implications of passkeys as a replacement for passwords. Passkeys improve authentication security by using cryptographic credentials that are phishing-resistant and not reusable, reducing risks like credential theft and phishing. However, passkeys do not eliminate broader identity risks such as compromised account enrollment, device changes, recovery processes, or session hijacking. Attackers may target these surrounding areas rather than the authenticator itself. Continuous identity threat detection is necessary to evaluate trust beyond the moment of authentication, addressing risks throughout the identity lifecycle.
The FBI seized the domain virtualine.net, used by Virtualine, a Russian-speaking bulletproof hosting provider that supported various cybercriminal activities including hack-for-hire services, ransomware, infostealers, phishing, spam, and carding. Despite law enforcement takedown requests, Virtualine continued aiding illicit customers and hosting illegal content. The provider received significant cryptocurrency payments linked to criminal operations such as drug marketplaces, sextortion schemes, and ransomware groups. Domain seizure disrupts access but does not guarantee cessation of the operator's activities or loss of infrastructure access.
An analysis of DMARC policies for 226 large European listed companies across major stock indices found that 48 (21%) have no effective DMARC policy, allowing their corporate domains to be spoofed via email. An additional 41 companies have partial or quarantine-only policies, while 137 (61%) enforce a reject policy to block spoofed emails. The study highlights significant gaps in email domain protection among major corporations, potentially enabling email spoofing attacks that impersonate these companies' domains.