Significant Cyber Incidents
Major breaches, ransomware attacks, and nation-state operations affecting businesses worldwide. Sourced from Cyber Scoop, The Record, SecurityWeek, DataBreaches.net and more.
No need to hack when it’s leaking: Artex edition
Zack Whittaker reports: Security researchers have discovered hundreds of copies of a Chinese-made AI hacking tool publicly exposed to the internet for anyone to access, potentially allowing outsiders to launch cyberattac…
County of Sussex, New Jersey Notice of Data Privacy Incident
November 6, 2026 8:00 PM EST NEWTON, N.J., Nov. 6, 2026 /PRNewswire/, Sussex County Prosecutor’s Office (SCPO) experienced a data privacy event that involved personal information. On or about August 10, 2026, SCPO receiv…
Coding Agents Copy Your Secrets to a Hidden File. Thousands Are on GitHub
Shmulik Cohen and Matan Giladi write: Apiiro research found 2,539 real secrets in 1,994 public GitHub repositories: database passwords, cloud keys, API tokens, SSH root logins. Among them: a database vendor’s own admin-l…
Norad targeted by cyberattack
From Norway’s aid agency, Norad, November 3: Norad has been targeted by a cyberattack in which the perpetrators may have gained access to the names and email addresses of 20,614 registered users of Norad’s Grant Portal. …
SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
CVE-2026-19868 can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA. The post SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins appe…
State attorneys general secure up to $10 million and corrective action plan from Perry Johnson companies after 2023 breach
A press release from NYS Attorney General Letitia James: NEW YORK - New York Attorney General Letitia James and a coalition of three other attorneys general today secured $10 million from Perry Johnson & Associates, Inc.…
Medical services company settles with 4 states over 2023 hack of sensitive patient records
The case, brought by AGs in Connecticut, New Jersey, New York and Michigan, targeted the medical transcription, coding and imaging subsidiaries of the Nevada-based Perry Johnson Companies.…
Certificate authority DigiCert reports data breach involving business customer info
DigiCert explained that over the summer, an internal business system was "externally accessible when that was not intended," and someone had created an unauthorized account.…
Japan Announces Emergency Cybersecurity Package Following a Wave of Attacks
The emergency package comes after dozens of companies and government agencies were hit by unauthorized access to their systems and leaks of client data, prompting uneasiness across Japan. The post Japan Announces Emergen…
Authorities accuse trio of using AI deepfakes to defraud $129M from businesses
The middle-aged men allegedly targeted accounting staff at victim companies and impersonated CEOs and lawyers to trick victims into sending large wire transfers. The post Authorities accuse trio of using AI deepfakes to …
7 Best Vulnerability Scanning Tools for Security Teams in 2026
Compare 7 vulnerability scanning tools for small teams, covering setup, network and app testing, prioritisation, rescans and remediation tracking.…
FBI agent pleads guilty to stealing $2.4 million in crypto from nation-state hackers
Patrick Steven Yaroch, 37, is facing up to 20 years in prison on wire fraud and money laundering charges after admitting to using his position on an FBI investigative squad to steal more than $2.4 million in cryptocurren…
Railway Engineer Admits Running AI Agents Against Rival Cloud Platform
A Railway engineer admitted testing AI agents on Primcloud, whose founder says they sought customer secrets and scanned……
In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within Days
Noteworthy stories that might have slipped under the radar: Synology warns about NAS ransomware attacks, Flowise ‘hello’ attacks, Chainalysis breach impact expands. The post In Other News: Trezor Implant, LLMJacking Bill…
CEO-spoofing scammers used AI to help steal more than $100 million, feds say
The U.S. is working on extraditing three suspects from Europe in a case involving more than $100 million in fraud from CEO impersonations.…
DigiCert Data Breach Impacts Business Customer Information
Hackers created an account on an internal system and accessed names, email addresses, phone numbers, and business addresses. The post DigiCert Data Breach Impacts Business Customer Information appeared first on SecurityW…
The Next Target for Data Breach Lawsuits - Law Firms That Represent Breached Parties
Mark Rasch writes: Imagine a company gets hacked and hires a law firm to manage the response. The lawyers coordinate the forensic investigation, determine which notification laws apply, and advise management about what t…
NI: Parents warned to be on alert after school data breach
Robbie Meredith reports: Parents have been told to be alert for unexpected emails or phone calls after a Northern Ireland school app used by almost 50,000 people was affected by a data breach. The Equipple app is used by…
DigiCert data breach exposes customer information, identity documents
Lawrence Abrams reports: DigiCert warns it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity…
Any long password will do: SSH flaw lets hackers into Alpine systems, routers and more
Ernestas Naprys reports: A massive decade-old flaw affects Alpine and other distributions that run OpenSSH on the musl library. Containers, routers, IoT devices, and other applications are critically vulnerable. Emergenc…
OpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the Line
Rated Critical for cybersecurity, OpenAI’s new model beats GPT-5.6 Cyber at exploitation while staying in scope more reliably. The post OpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the Line appeared fir…
US Agencies Urge Organizations to Harden Refrigeration Controllers
The recommendations come amid attacks targeting fridges and freezers in supermarkets and blood banks in Europe. The post US Agencies Urge Organizations to Harden Refrigeration Controllers appeared first on SecurityWeek .…
ARTEX Offensive AI Tool Activity Far Exceeds Reported Campaigns, Censys Finds
A new Censys report showed that the use of ARTEX, an AI pentesting tool popular with threat actor, could be spreading far beyond initially reported campaigns…
Insignary Releases Free Insignary-Chk Tool to Detect PHP2Shell and Node2Shell Exposure
Toronto, Canada, 6th November 2026, CyberNewswire…
Grocery Giant Ahold Delhaize Estimates Financial Toll of October Cyberattack
The October incident will cut fourth-quarter sales by up to €250 million and has led Ahold Delhaize to lower its 2026 outlook. The post Grocery Giant Ahold Delhaize Estimates Financial Toll of October Cyberattack appeare…
Researchers Find Residential Proxies on White House Network
In a month, 28 residential proxy services used 6 addresses, mainly between 5 p.m. and midnight, Eastern Time. The post Researchers Find Residential Proxies on White House Network appeared first on SecurityWeek .…
OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass
On Linux distributions using musl libc without PAM, some accounts accept any password between 257 and 1024 characters. The post OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass appeared first on SecurityWeek .…
CISA, FBI Urge Action to Protect Industrial Refrigeration Networks
The CISA advisory follows a swathe of attacks in which hackers have tampered with the temperatures of internet-exposed supermarket refrigeration systems…
CISA Warns Hackers Are Exploiting 18-Year-Old WordPress Core Vulnerability
CVE-2026-119977 lets hackers hijack WordPress sites during core updates. CISA confirms exploitation as users are told to patch……
OpenAI Model Wrote Its Own Network Code to Get Around Sandbox Restrictions
After its sandbox proxy failed, an internal OpenAI model crafted raw packets and probed AWS services trying to reach the internet. The post OpenAI Model Wrote Its Own Network Code to Get Around Sandbox Restrictions appea…
Half of Security Leaders Report Sensitive Data Exposure Through AI Tools
BlackFog found a lack of visibility into data being shared with AI tools, even those approved for use in the enterprise…
EU accuses TikTok of trapping users in harmful ‘rabbit holes’
The European Commission accused TikTok on Friday of failing to prevent its recommendation algorithm from drawing users into “rabbit holes” of content about sadness, self-harm and body image.…
How Governments Detect VPN Traffic, and Why Encryption Alone Doesn’t Hide It
Learn how governments detect VPN traffic using IP addresses, protocol fingerprints and active probing, and why encryption alone cannot prevent blocking.…
Air Force cyber official: need to invest in digital forensics
Wanda Jones-Heath said it’s key to keeping pace with incidents and threats, speaking at a Datadog event Thursday. The post Air Force cyber official: need to invest in digital forensics appeared first on CyberScoop .…
Hackers Tamper With Refrigeration Controls at France’s National Blood Service
Hackers altered refrigeration controls at three French blood service sites, but staff protected plasma supplies and prevented damage to blood products.…
OpenAI debuts GPT-6 Cyber, touting better performance, and safety guardrails
After a summer of sandbox escaping hacks, OpenAI said their new model was trained to be more cautious around user intent and less sensitive to “reward hacking” behaviors. The post OpenAI debuts GPT-6 Cyber, touting bette…
Ninth Circuit: Breach Of Confidence Confers Standing In Health Data Security Case
Claire E. Castles, Amanda Fitzsimmons, Nathaniel P. Garrett, Rebekah Byers Kcehowski, Mary Alexander Myers, and Alexander H. Southwell of Jones Day write: Departing from the risk-based approach many courts have applied s…
Residential Proxy Traffic Traced to White House Network
White House network addresses were used as exits by 28 residential proxy services…
Zyxel Switch Patch Missed Flaw Behind Wave of Attacks
Zyxel’s June GS1900 patch did not block the exploit used against 996 switches, Binarly found…
OpenMatter Network Positions Decentralized Computing as an Alternative to Data Centers for AI
Melbourne, Florida, 5th November 2026, CyberNewswire…
India Warns of New AI-Driven Cyber-Attacks Targeting Financial and Crypto Businesses
The Indian CERT said a new cyber malicious group tracked as ‘Crafty Flacon’ is using Chinese-made AI tools to attack fintech and crypto organizations…
Chinese Nation-State Threat Activity Falls Sharply in Q2 and Q3 2026
Trellix observed a 41.4% drop in China-nexus activity between April and September, which may reflect changing PRC strategic priorities…
Beyond Cold Storage: Why Hardware Wallets Need Open Source and Clear Signing
Hardware wallets protect private keys, but clear signing, open-source firmware and on-device verification let users see malicious crypto transactions.…
GhostMap Bug Leaves Android Phones Stuck in Reboot Loop
Bitdefender warns that unfixed GhostMap bug could force users to factory reset their device…
What Democratic control of Congress means for cybersecurity
There’s a lame-duck session before Dems take over, but the leaders of the homeland security panels are already teeing up their agendas. The post What Democratic control of Congress means for cybersecurity appeared first …
Officials extradite Canadian man to US for alleged cryptomining spree
Ryan Roach and his alleged co-conspirator, Mathiew Stubbings, are accused of compromising U.S. universities’ computers and taking over processing power to mine for cryptocurrency. The post Officials extradite Canadian ma…
Defense and aerospace firm settles with government over allegedly failing to meet cybersecurity contract requirements
ILC settled for $13 million, and its parent company said it resolved the issues before settling without an admission of liability. The post Defense and aerospace firm settles with government over allegedly failing to mee…
Oklahoma man charged with mailing threats, substances to election officials nationwide
Robin Patrick Martin was charged with conveying false or misleading information and hoaxes and mailing threatening communications in an effort to intimidate election officials. The post Oklahoma man charged with mailing …
Europol dismantles investment scheme that impacted potential victims in 50 countries
Authorities seized more than 100 servers and searched locations linked to the alleged operation across 17 countries. The post Europol dismantles investment scheme that impacted potential victims in 50 countries appeared …
Ballot scanner malfunctions, flurry of federal legal actions test election officials on final day of voting
Rumors of malfeasance spread on X despite no evidence, as election officials continue to fight off numerous legal challenges from the Trump administration in the last 48 hours. The post Ballot scanner malfunctions, flurr…
CrowdStrike moves to acquire Fiddler and Dreadnode, adding AI observability and testing to its security platform
CrowdStrike is extending its platform to watch, test and explain autonomous AI agents, as enterprises face behavior-based risks that conventional security tools cannot catch. The post CrowdStrike moves to acquire Fiddler…