Coder published GitHub advisory GHSA-vx42-ghc9-gw65 on 1 September 2026 (Critical). An unidentified actor gained access to Coder's Cloudflare infrastructure and added unauthorised IP addresses to the pool used for the Coder module registry (registry.coder.com). Those addresses hosted a malicious copy of registry artefacts. For a short window the registry served malicious packages to a subset of users. The implanted code was designed to identify credentials and exfiltrate them to a lookalike domain (coder-infra.com). Coder says it has no indication that any customer data maintained by Coder was impacted. Users who downloaded a Coder Registry module between 07:35 UTC and 21:45 UTC on Monday 31 August 2026 may be affected (new templates or template versions; also workspace creation if module caching is disabled). Coder recommends reviewing firewall, DNS and VPC logs for outbound traffic to coder-infra.com, purging cached modules from the affected window, rotating potentially exposed credentials, and updating Coder. Patched versions: 2.37.0, 2.36.4, 2.35.7, 2.34.9. Affected: versions before 2.37.0.
Coder GHSA-vx42-ghc9-gw65 (1 Sep 2026)
tech cloud
Incidents
Tue 1 Sep
Updated Sun 25 Oct
NovoCure Limited's Form 8-K dated 1 September 2026 (Item 8.01) says that in mid-August 2026 a subsidiary became aware of unauthorised access to some information systems. The company activated its cybersecurity response plan, implemented containment measures, and engaged independent forensic experts. Exposed data to date: internal company patient ID numbers for over 1,400 U.S. patient records (IDs used only internally; no names or other identifying data for those records); identifying information for fewer than 50 other patients in the western U.S.; general contact information for healthcare providers; and employee contact details such as job titles and phone numbers. Novocure states no access to medical treatment devices was obtained, operations were not compromised, and systems remain fully functional. It does not currently expect a material financial impact and says it will make required notifications, including to impacted patients. Vector and threat actor are not named in the filing.
NovoCure Form 8-K (1 Sep 2026)
breaches
Incidents
Tue 1 Sep
Updated Tue 3 Nov
ESET (WeLiveSecurity, 10 September 2026) says the Russia-aligned group UAC-0099 used a technique ESET calls GuardBreaker in the early stages of an attack against a target in Ukraine: a decoy request for guidance on building a nuclear weapon was inserted into the comments of a VBScript, so that an LLM-based code scanner's safety refusal would make it stop inspecting the rest of the file before reaching the malicious code. The script's purpose was to download and install MATCHBOIL, a loader used exclusively by this group to deliver additional payloads. Do not treat this card as a TeamPCP reprise (already on Cyberstack as afp-teampcp-2026). (source: ESET WeLiveSecurity) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: ESET WeLiveSecurity)
ESET WeLiveSecurity — GuardBreaker: Derailing AI-assisted malware analysis with a code comment (10 Sep 2026)
ai
Incidents
Tue 1 Sep
Updated Tue 27 Oct
Nutex Health Inc. told the US SEC in an 8-K dated 31 August 2026 that an unauthorised third party accessed and exfiltrated information from its servers, including patient, employee, credentialed-provider, business and financial data that is private or confidential. A third party has threatened to post that information. The Houston company says it has not identified a material impact on operations or financial reporting systems to date, and it has not named the actor. After an earlier 24 August 8-K, a purported Texas class action (Haley v. Nutex Health, Inc., S.D. Tex.) was filed on 27 August 2026. According to The Record from Recorded Future News (1 September), the Gentlemen ransomware gang took credit for the attack on Monday and added Nutex to its leak site; that leak-site claim is not company attribution. (source: The Record) No Australia link is reported. Correction (27 Oct 2026): the gang's claim is now credited to The Record; the SecurityWeek link and the details only it gave (an alias for the gang and a leak-site deadline) have been removed, and a duplicate link to the same 8-K has been dropped. (source: The Record)
Nutex Health Form 8-K (31 Aug 2026)
breaches
Incidents
Tue 1 Sep
Updated Sun 25 Oct
Datadog Security Research describes a password-spraying campaign against AWS root-user console logins at more than 150 organisations between 24 July and 23 August 2026. The median number of failed attempts per organisation was two; some saw as many as eight. Datadog says a failed root ConsoleLogin call requires the root user's email address, so the attacker either already had a list of root user email addresses or brute-forced a list until finding valid ones. Datadog says it has not observed a successful authentication attempt, so it cannot determine the attacker's intent. Organisations should review CloudTrail for unusual root ConsoleLogin failures and keep root use exceptional.
Datadog Security Labs
tech cloud identity ai
Incidents
Mon 31 Aug
Updated Mon 2 Nov
Socket's 31 August 2026 research describes 13 malicious Composer theme packages on Packagist across five vendor namespaces (vsmov, vsphim, haiau009, chilltvcms, ophimcms) that inject JavaScript into Vietnamese movie and comic streaming sites. On mobile visitors the code runs gambling and ad-fraud redirects; on unpatched iPhones it loads a FUNNULL-hosted WebKit-to-kernel exploit chain. Socket says the renderer stages weaponise CVE-2025-31277 and CVE-2025-43529 (both on CISA KEV), then escape to the kernel; Apple told Socket the kernel escape was already fixed in iOS and macOS 26.1. A 12 August 2026 redeployment added keychain theft of crypto-wallet seeds and mnemonics for Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet and OKX, targeting iOS 18.4 through 18.6.x. Site operators should remove themes from those namespaces, rotate credentials, and audit shipped scripts; keep iPhones current past the listed builds. Correction (02 Nov 2026): removed The Hacker News as a source. (source: Socket)
Socket (31 Aug 2026)
tech supply chain
Incidents
Mon 31 Aug
Updated Sun 25 Oct
According to BleepingComputer (1 September 2026), Huntress researchers say phishing actors abused the legitimate Faronics Deploy endpoint-management platform in activity observed between 21 July and 20 August 2026, with Faronics-themed lures disguised as invoices, tax documents or other business files reaching more than 457 endpoints. BleepingComputer says victims were prompted to download and launch a legitimate, signed Faronics Deploy installer disguised as an Adobe document, reader app or plugin update, after which the attackers ran scripts through the platform, using curl or mshta to fetch more content or msiexec, to install ConnectWise ScreenConnect as a second remote-access channel. Huntress notified Faronics on 5 August; according to BleepingComputer, Faronics confirmed the activity, added anti-abuse measures and contacted affected organisations, and Huntress says the activity dropped significantly from 21 August. Huntress recommends checking C:\ProgramData\Faronics\Logs\ for a ScriptRunner.log file and looking for ScreenConnect installations where it is not normally deployed. Correction (25 Oct 2026): the card's facts are now attributed to BleepingComputer's report of Huntress's findings, and advice to email Faronics support, which that report does not contain, has been removed. (source: BleepingComputer)
BleepingComputer — Hackers abuse Faronics Deploy admin tool to install ScreenConnect (1 Sep 2026)
breaches identity
Incidents
Mon 31 Aug
Updated Mon 2 Nov
METR's 31 August 2026 security update describes two incidents in which external actors tried to gain unauthorised access. It believes no sensitive information was accessed in either case, and it is not attributing the events; the post is about human attackers, not AI agents breaking evaluations. In March 2026 a researcher with no sensitive-access privileges ran a vibe-coded app on a personal public EC2 instance behind Google authentication that held an API key for METR's public-models account; a fail-open bug silently disabled auth. METR assesses the attacker found the host via recently registered sites or certificate-transparency lists, prompted an agent for the key, added an SSH key, and burned credits for about three weeks. Accrued usage would have been worth about US$600,000 if the unnamed model provider had not given the credits free. In May 2026 attackers probed public infrastructure (credential stuffing, OAuth grants, phishing staff). METR had inadvertently exposed a read-only SQL mechanism on a public transcript viewer that could have reached unpublished eval data, including some sensitive model output that should not have been in that database; attackers probed the endpoint but METR says there is no evidence they found the issue or accessed non-public data. Correction (02 Nov 2026): removed The Hacker News as a source. (source: METR)
METR security update (31 Aug 2026)
ai cloud
Incidents
Mon 31 Aug
Updated Sun 25 Oct
Softaculous' Virtualizor incident post (31 August 2026) says IP block 162.55.80.0/24 (Hetzner space used by Softaculous services) was BGP-hijacked from about 20:57 UTC on 28 August to about 06:10 UTC on 30 August. An unauthorised announcement by AS62390 (NexonHost), transited via AS6204 (Zet.net), was more specific than Hetzner's 162.55.0.0/16 and diverted traffic, including the software-update endpoint and client-area/billing site. The attacker obtained a technically valid Let's Encrypt certificate for Virtualizor, Softaculous and related names, so diverted connections showed no certificate warning. The vendor confirmed a malicious Virtualizor update package reached a small number of installations that checked for updates during diversion; it cannot list every affected host. Known indicator: systemd unit /etc/systemd/system/java-jre-update.service. Routing has been restored. Operators should hunt that unit (and not only delete it), rotate Virtualizor API keys, and audit SSH keys, accounts and cron. The vendor shipped Virtualizor 3.2.9.9 with a mitigation tool. In a 29 September update Softaculous said it has started signing all packages of Virtualizor and its other software products, including WordPress plugins, that all API responses are also signed, and that its mirrors are now behind Cloudflare. Other Softaculous products had no identified malicious package at the time of the post. Clients who logged into the billing site during the window should reset that password.
Virtualizor incident post (31 Aug 2026)
tech cloud
Incidents
Mon 31 Aug
Updated Thu 29 Oct
Berlin's official 31 August update says the city is facing extortion after the mid-August cyberattack on its administrative network and will not pay. Forensic work confirmed data left the Senate Department for Mobility, Transport, Climate Protection and the Environment between 7 and 12 August; the scope is still being assessed and personal or other non-public data may be involved. Berlin says the affected departments were disconnected on 14 August and investigations by state police, prosecutors and federal security authorities continue. BleepingComputer reports that the Rhysida ransomware group claimed the attack; Berlin's notice does not attribute the incident. UPDATE (22 Oct 2026): the stolen data has since been published. The Senate Department for Mobility, Transport, Climate Protection and the Environment's data-incident page now says analysis of the published data is still under way and warns affected people about darknet-related scams. rbb24 reported on 21 October that Rhysida had published data from two Berlin Senate departments, including ID-card copies of staff and of the department's senator Ute Bonde; the department confirmed to rbb that Bonde is affected and said the stolen data is mostly unstructured data from shared and personal staff folders. (source: rbb24, 21 Oct 2026; berlin.de SenMVKU data-incident page) Correction (23 Oct 2026): removed the reference to the ransomware group's own claim of a much larger theft. (source: BleepingComputer)
Berlin.de official update (31 Aug 2026)
breaches
Incidents
Sat 29 Aug
Updated Thu 22 Oct
Tixel, the Melbourne-based second-hand ticket marketplace, emailed users on the night of Friday 28 August 2026 to say their email address and mobile number may have been accessed after its third-party analytics provider, Metabase, was 'briefly accessed by an unauthorised party', 7NEWS reported on 29 August. Tixel said passwords, credit card and payment information and purchase history were not affected and that accounts, tickets and listings were unaffected, and warned users to watch for spam and phishing that pretends to come from Tixel. Metabase's own post-incident write-up (27 August) says a Metabase Cloud customer reported a suspicious API key on 3 August, that the attack used a previously unknown ('zero-day') vulnerability patched in releases on 6 August, that under 3% of its cloud customers were compromised (as were some open-source users and self-hosted customers with publicly accessible instances), and that Metabase believes the attack required significant large-language-model capabilities. Tixel has not said how many users are affected. Mathspace's breach of about 1.08 million Australian and New Zealand records through a self-hosted Metabase install is a separate card. Source: 7NEWS (29 Aug 2026), quoting Tixel's customer email. Correction (22 Oct 2026): an earlier version said Metabase put the attack on 3 August and the impact at just under three per cent of all its customers; Metabase's own post says 3 August is when a cloud customer reported suspicious activity and that under 3% of its cloud customers were compromised. (source: Metabase)
7NEWS — Data breach hits ticket resale website Tixel (29 Aug 2026)
breaches australia cloud
JetBrains' Cadence incident post (opened 28 August 2026, last updated 1 September 2026 12:05 CEST) confirms unauthorized access to Cadence, a JetBrains-hosted cloud-compute service for PyCharm via an optional plugin that orchestrates work with TeamCity. The Cadence host api.cadence.jetbrains.com was vulnerable to CVE-2026-63077 (card cve-2026-63077) and was exploited; activity from 8 August to 24 August 2026; discovered 23 August; server taken offline 24 August. Confirmed: personal data extracted (usernames, real names, emails, last-login times, last IPs); a full 2024 Cadence server backup compromised (treat credentials/config/artifacts in that backup as exposed); multiple AWS IAM users/secrets used with Cadence compromised from that backup; files in JetBrains Cadence S3 buckets accessed; possible access to source synchronized from PyCharm. JetBrains says no evidence secrets were taken from the live environment beyond the backup path, invalidated Cadence plugin access tokens, and lists IoC IPs (150.109.230.104, 43.153.227.206, 62.210.127.48, 210.247.242.190, 15.235.225.205, 152.233.30.18). Users must rotate all credentials used in Cadence executions and treat inputs/outputs as untrusted.
JetBrains Cadence incident post
tech cloud identity
