CyberStack — Australia cyber news desk

Latest cyber news, threats, security, and guidelines. Stack up.

Latest

Incident

Published 2026-11-02 New

Verified 2026-11-03

Michigan State University says suspicious activity found in early October looked like a potential credential compromise and forced password resets for every NetID

Michigan State University told The Record that it became aware of suspicious cyber activity in early October 2026 and immediately began investigating. To protect accounts and systems, the university's IT team required everyone with an MSU NetID to reset their password to a new one of at least 15 characters, in an email sent to campus on 1 October, The Record reports. A spokesperson said that, based on the investigation to date, the activity appeared to be a potential credential compromise, that current evidence does not indicate a successful compromise of the university's central Active Directory environment, and that there is no evidence other MSU data was accessed, changed or stolen. According to The Record, the BYOD ransomware gang claimed responsibility. University officials said the claims were tied to the October incident, and the university did not respond to follow-up questions about them, The Record reports. MSU has not confirmed any data theft. (source: The Record)

Product: Michigan State University (MSU NetID accounts)
Versions: n/a — organisation cyber incident
Exploited in Australia?: unknown
Patch to: MSU students and staff: make sure your NetID password was reset as the university required, do not reuse it elsewhere, and be wary of emails, texts or calls that mention this incident or ask for passwords.

Primary: The Record (2 Nov 2026)

breaches education

Incident

Published 2026-11-02 New

Updated 2026-11-03

Verified 2026-11-03

Russia's federal statistics agency Rosstat confirms it was targeted by a cyberattack but says it found no evidence that protected information leaked, according to The Record

Russia's federal statistics agency, Rosstat, confirmed that it had been targeted by a cyberattack, according to The Record. In a statement to Russian state news agency TASS, Rosstat said its security systems had detected suspicious activity in time for specialists to respond, that it had found no evidence that protected information had been leaked or its databases compromised, and that it was working with cybersecurity experts and law enforcement to identify the source of the attacks, according to The Record. The Record reports that groups claimed responsibility and that their claims could not be independently verified. (source: The Record) Correction (03 Nov 2026): the card date has moved from 3 to 2 November 2026, the date The Record shows on its report. (source: The Record)

Product: Rosstat (Russia's federal statistics agency)
Versions: n/a — incident
Exploited in Australia?: unknown
Patch to: n/a — no action advised in the cited report

Primary: The Record (2 Nov 2026)

breaches

Incident

Published 2026-10-30 New

Verified 2026-11-03

Abrigo took its Sageworks lending and credit-risk platform for US banks and credit unions offline on 30 October after identifying irregular activity in its environment; most of it was back on 2 November, except borrower-facing features

Abrigo, which provides cloud software to US community banks and credit unions, said on its status page on 30 October 2026 that it identified irregular activity in its environment and, out of an abundance of caution, disabled the Sageworks application at about 11:25 am US Eastern time (11:25 pm Perth). The incident covers Sageworks Analysis, the Sageworks API and Online Portal Now. Abrigo's updates over 30 October to 1 November said its team continued to investigate and that notices were going to Product and IT & Security contacts at customer institutions; on 2 November at 07:11 US Eastern time (8:11 pm Perth) it said the Sageworks platform was available again with the exception of borrower-facing capabilities, and that it was monitoring. Abrigo's status updates do not say what the irregular activity was or whether any data was accessed. (source: Abrigo status page) BleepingComputer reported on 2 November that Abrigo serves more than 2,400 institutions, that Sageworks handles sensitive information including banking customer details, and that Abrigo had not responded to its request for details, so it is unclear whether the outage was caused by a breach or a technical issue. (source: BleepingComputer)

Product: Abrigo Sageworks (Sageworks Analysis, Sageworks API, Online Portal Now) lending and credit-risk software for US banks and credit unions
Versions: n/a — service incident
Exploited in Australia?: unknown
Patch to: Banks and credit unions using Sageworks: follow the notices Abrigo is sending to your Product and IT & Security contacts. Abrigo has not said what the irregular activity was, so check Sageworks API integrations and their logs for activity you do not recognise.

Primary: Abrigo status — Sageworks Analysis, Sageworks API and Online Portal Now Unplanned Maintenance (updates 30 Oct to 2 Nov 2026) · BleepingComputer — Fintech platform Sageworks taken offline after suspected cyberattack (2 Nov 2026; 3 Nov 3:00 am Perth)

breaches

Incident

Published 2026-10-30

Verified 2026-10-31

Chainalysis says an external actor using offensive agentic techniques got into its systems and internal tools this month and accessed some customer user IDs, full names, email addresses and organisation role labels; it found no sign investigation content, passwords, MFA secrets or session tokens were accessed

Blockchain analytics firm Chainalysis says in a security incident post dated 30 October 2026 that it was recently the target of a cybersecurity incident, similar to many other tech platforms in recent weeks. In the text of the email it sent to impacted customers, which it publishes in the post, Chainalysis says that this month it detected an external actor using offensive agentic techniques to gain unauthorised access to Chainalysis systems and internal tools, and that its teams have been working to investigate the activity, patch vulnerabilities and harden its systems. It says some non-sensitive customer data, such as user IDs, full names, email addresses and organisation role labels for users provisioned on its platform, was accessed, and that it is working out which records were accessed for each organisation. It says it has found no indication that investigation content (such as graphs, notes or cases), transaction or query results, passwords in clear text, MFA secrets or user session tokens were accessed. Chainalysis says it has engaged third-party cybersecurity experts, has proactively notified all of its customers (some had been notified earlier), and that the incident is not related to the recent crypto theft at Binance. It has not said when the access began, how the attacker got in, or how many users are affected. (source: Chainalysis)

Product: Chainalysis platform (customer user accounts)
Versions: n/a — data breach
Exploited in Australia?: unknown
Patch to: Chainalysis users: be very wary of unexpected password reset requests or authentication prompts, and turn on two-factor authentication if your organisation has not already (Chainalysis advice; your account manager can help). Expect phishing that uses your name, email address and role.

Primary: Chainalysis — Chainalysis Security Incident Information (30 Oct 2026)

breaches crypto ai

Incident

Published 2026-10-30

Verified 2026-10-31

Online fashion retailer Revolve tells the SEC an unauthorised actor may have obtained, through automated means, names, contact details, payment card numbers and expiry dates of some customers who saved card details in their online accounts

Revolve Group, the US online fashion retailer, said in a Form 8-K dated 29 October 2026 and filed with the US Securities and Exchange Commission on 30 October that it recently became aware of unauthorised access to certain of its systems, started its cyber incident response protocols and confirmed the unauthorised activity was remediated. Revolve says that, based on its investigation, an unauthorised actor may have obtained, through automated means, the name, contact information, payment card number and payment card expiration date for certain customers who saved payment information with their online shopping account on its e-commerce platform. It says it notified federal law enforcement, engaged external cybersecurity experts, that the incident has not caused operational disruption or interrupted service to customers, and that it does not believe the incident will have a material impact on its business. Revolve did not say when the access happened or how many customers are affected. According to The Record, Revolve did not answer its questions about when the attack occurred, and told regulators in Texas that 127,200 people in the state had information stolen, with another 1,328 in Vermont and notifications also filed in Massachusetts (state filing figures as reported by The Record, not independently verified). (sources: Revolve Form 8-K; The Record)

Product: Revolve e-commerce platform (customer accounts with saved payment cards)
Versions: n/a — data breach
Exploited in Australia?: unknown
Patch to: Revolve customers who saved a card in their account: check card statements for charges you don't recognise, ask your bank or card issuer about replacing the card, and remove saved cards you don't need. Be wary of emails or texts about the incident that ask you to confirm card details.

Primary: Revolve Group, Inc. — Form 8-K, Item 8.01 Other Events (dated 29 Oct 2026, filed 30 Oct 2026) · The Record (30 Oct 2026)

breaches

Incident

Published 2026-10-30

Verified 2026-10-31

Florida Department of Education says an unauthorised party accessed its Student Financial Aid website, exposing names, Social Security numbers and dates of birth; The Record reports nearly 5 million aid applicants are affected

Florida's Department of Education (FLDOE) said it became aware on 19 October 2026 of a data breach involving the Florida Student Financial Aid website, according to The Record, which reported the department's statement on 30 October. According to The Record, the exposed information includes names, addresses, phone numbers, genders, email addresses, Social Security numbers and dates of birth, and the breach affects nearly 5 million people who have applied for financial aid in Florida. The Record quotes the department's statement: 'An unauthorized party gained access to a system or database containing company or customer information,' and says FLDOE is working with the Florida Digital Service and the Florida Department of Law Enforcement. According to The Record, FLDOE has taken the financial aid site down, warned that other department websites and services may see temporary disruptions, says the incident has been contained and was reported to the Office of the Attorney General, and says financial aid, scholarships, grants and student loans are not affected and disbursements will not be delayed. The department declined to comment to The Record on the nature of the incident or the attackers. Cyberstack could not read the department's own notice. (source: The Record)

Product: Florida Student Financial Aid website (Florida Department of Education)
Versions: n/a — incident
Exploited in Australia?: unknown
Patch to: People who applied for Florida student financial aid: the state urges you to monitor your credit reports and financial accounts for irregular activity, according to The Record. Consider a credit freeze with the US credit bureaus, and be wary of calls, texts or emails about financial aid that ask for personal details.

Primary: The Record — Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach (30 Oct 2026)

breaches

Incident

Published 2026-10-30

Updated 2026-11-02

Verified 2026-11-02

Trezor warns anyone who bought a Trezor from CryptoBilis since March 2026 to move funds to a new wallet after a customer reported a suspected hardware implant in a Trezor Safe 5; Trezor has not yet examined the device

Hardware wallet maker Trezor said in a blog post on 30 October 2026 that its security team received a responsible-disclosure report on 28 October of a hardware implant in a Trezor Safe 5 bought in August 2026 from CryptoBilis, until October an official Trezor reseller in Southeast Asia, through the marketplace Tokopedia. Trezor says it has not yet received the device to confirm the report, but based on the customer's description, photos and a video interview it is treating the report as credible and warning customers now as a precaution; its lab will examine the device when it arrives. According to the report, which Trezor says it has not verified itself, an extra circuit board with a cellular module and antenna sits between the main board and the screen, reads what the screen shows, including the wallet backup (recovery phrase), and sends it out over a mobile network whenever the device is plugged in. Trezor says the implant appears to operate similarly to those seen in Ledger devices but will not draw comparisons while investigations continue, and does not know who is behind it. Trezor says no CryptoBilis buyer has reported a loss of funds, that the reporting customer had moved his funds before finding the board, and that it has no reports involving any other reseller. Trezor removed CryptoBilis as a reseller on 9 October 2026, after Ledger began investigating fund losses among its own CryptoBilis buyers. Trezor's advice covers every Trezor model bought from CryptoBilis since March 2026, including through any store selling CryptoBilis-supplied devices; it will ship a new device or give a voucher to those buyers, and warns that scammers are likely to use the incident for phishing by email, letter and phone. (source: Trezor) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Trezor)

Product: Trezor hardware wallets bought from reseller CryptoBilis (including its Tokopedia store) since March 2026; report concerns one Trezor Safe 5
Versions: n/a — suspected supply-chain tampering of a single device, not yet examined by Trezor
Exploited in Australia?: unknown
Patch to: If you bought any Trezor from CryptoBilis since March 2026, Trezor says: move funds to a new wallet with a new recovery phrase now (restoring the old phrase on another device does not help); if you have not set the device up, do not, and never enter an existing recovery phrase on it. Keep the device and contact Trezor Support for a replacement or voucher. Do not rely on weighing or opening the device. Never share a recovery phrase; Trezor Support will never ask for it.

Primary: Trezor Blog — Implant reported in a Trezor sold by CryptoBilis (30 Oct 2026)

breaches crypto

Incident

Published 2026-10-30

Updated 2026-11-01

Verified 2026-11-01

Northflank security incident: the cloud platform tells all users to assume their environment variables have been decrypted and to rotate every key now; it says multiple users confirm their AI keys have been used

Cloud deployment platform Northflank opened a security incident on its status page on 30 October 2026, marked as a major outage affecting the Northflank Platform. At 13:40 UTC (9:40 pm Perth) Northflank told users to rotate environment variables immediately; at 13:58 UTC (9:58 pm Perth) it said to assume all environment variables had been decrypted and to disable or rotate all keys. In an update at 15:12 UTC (11:12 pm Perth) Northflank said all users should assume their environment variables are decrypted and begin rotation immediately, listing secrets on workloads, secret groups and global secrets, and said multiple users are confirming that their AI keys have been used. The incident timeline on the page starts with a Wiz threat alert at 11:43 UTC (7:43 pm Perth), reviewed by Northflank engineers a minute later, followed by an initial network policy patch at 12:02 UTC (8:02 pm Perth), further patches at 12:50 and 13:05 UTC, and a request for support from the Wiz CIRT at 13:00 UTC. Northflank has not said on the page how the variables were exposed or how many customers are affected. (source: Northflank status page) UPDATE (1 Nov 2026): Later updates on Northflank's status page (still marked Identified, major outage) say secret rotation for Postgres and MongoDB was enabled for all users at 15:12 UTC on 30 October (11:12 pm Perth), with a recommendation to disable public expose on add-ons. At 19:28 UTC (3:28 am Perth, 31 Oct) Northflank said its investigation was ongoing with no further confirmed findings and its guidance was unchanged: assume all environment variables have been compromised and rotate all secrets and credentials. At 23:38 UTC on 30 October (7:38 am Perth, 31 Oct) it said users have reported unauthorised use of AI API keys supplied to the platform, told users to revoke existing credentials with their issuing providers, generate replacements and review AI provider usage and billing logs, and said these reports may be consistent with the broader pattern of attacks targeting AI credentials described in Wiz's 'Black October' report. At 01:04 UTC on 31 October (9:04 am Perth) it enabled audit logs for all customers, including free users, and at 13:34 UTC (9:34 pm Perth) it said secret rotation for MySQL and Redis is available to all customers. BleepingComputer reported on 31 October (2:01 am Perth, 1 Nov) that Northflank had not answered its questions about the breach and its impact. (sources: Northflank status page; BleepingComputer) UPDATE (1 Nov 2026): Northflank's status page said at 22:32 UTC on 31 October (6:32 am Perth, 1 Nov) that secret rotation for Minio add-ons is available to all customers, and at 23:31 UTC (7:31 am Perth) that secret rotation is available for RabbitMQ add-ons; it again asked users to rotate all secrets if they have not already. The incident is still listed as Identified, with a major outage. (source: Northflank status page)

Product: Northflank cloud deployment platform (PaaS): secrets on workloads, secret groups and global secrets
Versions: n/a — platform incident
Exploited in Australia?: unknown
Patch to: Northflank users: treat every environment variable and secret stored on the platform (workload secrets, secret groups, global secrets) as exposed. Revoke each credential with the provider that issued it, generate a replacement and update it in Northflank, starting with AI provider keys; use Northflank's rotation for Postgres, MongoDB, MySQL, Redis, Minio and RabbitMQ add-ons, disable public access to add-ons, then check provider usage and billing logs and Northflank's audit logs for activity you did not make.

Primary: Northflank status — Security incident (30 Oct 2026, times in UTC) · BleepingComputer — Northflank security breach leads to abuse of customers' AI API keys (31 Oct 2026; 1 Nov, 2:01 am Perth)

breaches cloud

Incident

Published 2026-10-30

Verified 2026-10-30

Russian home goods retailer Poryadok confirms a cyberattack that closed some of its stores and suspended its website, app and online services for five days, The Record reports

Russian home goods retailer Poryadok, which operates 48 stores across 32 Russian cities, confirmed that a cyberattack caused disruption that forced it to close some of its stores and suspend online services for five consecutive days, The Record reported on 30 October 2026. "We have been hit by a cyberattack, but we are already actively working to restore our services and gradually return operations to normal," the company said in a statement, according to The Record. The Record says Poryadok first reported technical problems on Sunday, saying its website, mobile app and physical stores were temporarily unavailable, and that customers have been unable to collect orders, access loyalty accounts or contact customer support. According to The Record, the company did not disclose how hackers breached its systems or when normal operations would resume, said it expected to reopen its stores and restore access to order information and loyalty bonuses without giving a timeline, and its website indicated that only some stores were still affected. The Record says it was not immediately clear who carried out the attack or whether any customer information had been compromised. (source: The Record)

Product: Poryadok (Russian home goods retail chain): website, mobile app, stores, customer support and loyalty program
Versions: n/a — organisation cyberattack
Exploited in Australia?: unknown
Patch to: Poryadok customers: rely on the retailer's official channels for updates on orders, returns and loyalty bonuses. The Record says it was not clear whether customer information was compromised, so treat unexpected calls or messages about orders or refunds with caution.

Primary: The Record — Russian popular home goods chain faces days of disruption following cyberattack (30 Oct 2026)

breaches

Incident

Published 2026-10-29

Updated 2026-10-31

Verified 2026-10-31

UK surveillance watchdog IPCO says GCHQ estimates the removable media it cannot immediately locate runs into the thousands, and is still concerned GCHQ lacks a clear picture of how much is lost; GCHQ says the findings have been addressed

The UK Investigatory Powers Commissioner's Office (IPCO) says in its 2025 annual report, ordered by the House of Commons to be printed on 29 October 2026, that GCHQ has scoped the maximum number of items of removable media (USB sticks, external hard drives, compact discs, memory cards and other portable storage) that it cannot immediately locate and are therefore unaccounted for, some of which may contain data handled under the Investigatory Powers Act. IPCO calls this a very significant number, which GCHQ currently estimates to be in the thousands, and says GCHQ has a programme of work to locate as many as possible, after which it will be able to report how many devices are confirmed lost. The Commissioner writes that he remains concerned GCHQ has not yet established a sufficiently clear understanding of the scale, location and recoverability of the lost media, although the issues were first raised with him several years ago; IPCO says it is disappointed with the time GCHQ has taken to investigate, that a new GCHQ tool to monitor the issue, storage and location of removable media will come into use in 2026, and that it will require regular written progress reports throughout 2026. (source: IPCO) The Record reported on 30 October that a GCHQ spokesperson said its management system for removable media was previously not sufficiently robust to track the items registered for use, that it has taken action against all of IPCO's recommendations and the findings have been addressed comprehensively; the spokesperson declined to say whether unauthorised people had accessed any of the missing media. The Record notes the report does not allege any devices have fallen into the hands of adversaries. (source: The Record) Correction (31 Oct 2026): removed the reference to the Australian Information Security Manual (cyber.gov.au ISM, Guidelines for media) and its control numbers as a source, because this desk could not read that page in full; the card's facts come from IPCO's annual report and The Record. (source: IPCO)

Product: GCHQ removable media (USB sticks, external drives, discs, memory cards)
Versions: n/a — lost or unaccounted-for media
Exploited in Australia?: unknown
Patch to: Lesson for any organisation that uses removable media: keep a register of authorised media and check it against what you can actually find on a regular basis, label media with its classification, encrypt it, and have a clear way to report lost or stolen media.

Primary: IPCO — Annual Report 2025 (HC 253, ordered to be printed 29 Oct 2026; paragraphs 4.66–4.68) · Vendor: IPCO — Annual reports · The Record — British spy agency cannot account for thousands of data storage devices, watchdog says (30 Oct 2026)

breaches government

Incident

Published 2026-10-29

Verified 2026-10-30

US Justice Department: Syrian Electronic Army hacker Ahmad Umar Agha ('Th3Pr0') sentenced to 42 months for hacking about 47 Western media, business, NGO and government targets for the Assad regime

The US Justice Department said on 29 October 2026 that a federal district court in the Eastern District of Virginia sentenced Ahmad Umar Agha, also known as Th3Pr0, to 42 months in prison for his central role in a hacking conspiracy organised and led by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence Directorate, from as early as 24 August 2011 to 31 January 2024. According to the department, Agha hacked about 47 Western media entities, businesses, NGOs and US and allied government entities to spread the former Syrian government's propaganda; the conspiracy also collected intelligence for that government and tried to cause US service members to refuse duty. The department says Agha's hack of a news agency's Twitter account let him post on 23 April 2013 a false claim that President Obama was injured in two explosions at the White House, causing a temporary $136 billion flash crash in the value of Dow stocks, and that he redirected visitors to the US Marine Corps recruitment website, through the company hosting it, to an image urging Marines to refuse orders; about 3,500 visitors saw it. Court filings cited by the department say one victim company lost about $35,000 a day for roughly six months and one NGO lost $480,000 in total. Agha and co-conspirator Firas Dardar were charged by complaint in June 2014 and indicted in May 2018; the department says Dardar remains a fugitive. The FBI Washington Field Office investigated. (source: US Department of Justice) The Record reports that Agha was taken into US custody last year and that the department has not given details of his arrest. (source: The Record)

Product: n/a — law enforcement: state-directed hacking conspiracy (Syrian Electronic Army)
Versions: n/a — prosecution
Exploited in Australia?: unknown
Patch to: Nothing to patch. The case is a reminder to protect official social media and website hosting accounts with phishing-resistant MFA and to lock down password-reset email addresses, since the department describes account takeovers and a hosting-provider redirect as the core techniques.

Primary: US Department of Justice — Syrian Man Sentenced for Wide-Ranging Hacking Conspiracy Conducted on Behalf of the Bashar Al Assad Regime (29 Oct 2026) · The Record — Syrian Electronic Army hacker gets prison time for attacks on Western targets (30 Oct 2026)

breaches

Incident

Published 2026-10-29

Updated 2026-10-31

Verified 2026-10-31

Cursor: a malicious version of the Claude Code extension (Anthropic.claude-code 2.1.313), not developed by Anthropic, was available in Cursor's VS Code extension marketplace on 29 October and tried to install an SSH backdoor; Cursor says at most 5,000 users were affected

Cursor said in a security notice dated 29 October 2026 that a maliciously modified version of Anthropic's Claude Code extension, Anthropic.claude-code version 2.1.313, was available in the Cursor VS Code extension Marketplace between about 2:27am PT and 1:35pm PT that day (about 17:27 on 29 October to 04:35 on 30 October Perth time), and that the version was not developed by Anthropic. Cursor says at most 5,000 users were affected and that it will contact them directly. According to Cursor, the extension collects host and user information (including hostname, username, OS, environment variable names, configured Git email and public IP), adds an attacker-controlled SSH key labelled svc-telemetry to authorized_keys, tries to enable the local SSH service and open a persistent reverse SSH tunnel via a LaunchAgent on macOS or a scheduled task on Windows, and reports host details to the attacker's server. Cursor says enabling the SSH service needs admin rights the extension does not have on most macOS and Windows hosts, so on those hosts that step fails and the attacker could not have logged in through the tunnel, but the key, persistence and host-detail report still happen. Cursor says it removed the version, shut down the marketplace as a precaution, audited access and confirmed no other extensions were tampered with, rotated its keys, rebuilt and restored the marketplace, and worked with the hosting provider to take the attacker's server offline. It says it has no evidence that other versions of the extension or the official distribution are affected, and it published indicators of compromise and remediation scripts for macOS and Windows. (source: Cursor) UPDATE (31 Oct 2026): Felix Rieseberg, a member of Anthropic's technical staff, said in a post on X on 30 October (10:08 pm Perth): 'We're working with Cursor on this incident, but it wasn't a compromise of Anthropic's systems or employee laptops. A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish.' (source: Felix Rieseberg on X) According to The Register, his post goes on to say the versions on Anthropic's official channels are not affected and that this only impacts Cursor users, and neither Cursor nor Anthropic has said how the malicious package reached the marketplace. (source: The Register)

Product: Anthropic.claude-code extension version 2.1.313 as distributed through the Cursor VS Code extension Marketplace (macOS and Windows builds named in Cursor's indicators)
Versions: Malicious: Anthropic.claude-code 2.1.313 from the Cursor marketplace, installed or updated between about 2:27am and 1:35pm PT on 29 Oct 2026 (Cursor). Cursor says it has no evidence other versions or the official distribution are affected.
CVSS: not applicable (malicious package, no CVE)
Exploited in Australia?: unknown
Patch to: If you installed or updated Anthropic.claude-code 2.1.313 from Cursor's marketplace during the window, check ~/.ssh/authorized_keys (and on Windows C:\ProgramData\ssh\administrators_authorized_keys) for a key labelled svc-telemetry, as Cursor describes. If it is there, isolate the host, run Cursor's remediation script for macOS or Windows, consider rebuilding, and rotate credentials and sessions reachable from that host from a trusted system. Cursor warns that uninstalling the extension may not be enough because the payload drops standalone persistence scripts. Hunt for the indicators in Cursor's notice, including connections to 134[.]209[.]82[.]225 on TCP 22 and 8099.

Primary: Cursor — Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace (29 Oct 2026) · The Register — Anthropic: That Claude Code extension compromise… couldn't be us (30 Oct 2026) · Felix Rieseberg (Anthropic technical staff) on X, 30 Oct 2026, 10:08 pm Perth

breaches ai

Incident

Published 2026-10-29

Updated 2026-11-03

Verified 2026-11-03

Polymarket briefly halted trading after a compromise at website-monitoring provider DebugBear served crypto-draining JavaScript to its users; Polymarket says it will fully reimburse affected traders

BleepingComputer reported on 29 October 2026 (US Eastern time) that prediction market platform Polymarket temporarily suspended trading after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript. Polymarket said: "One of our third party providers was compromised, and we have referred this to relevant law enforcement," and "Anyone who has been impacted will be made whole," according to BleepingComputer. (source: BleepingComputer) BleepingComputer says Polymarket placed its exchange into cancel-only mode at 2:05 p.m. ET (2:05 am Perth time on 30 October) and that the incident was marked resolved at 3:05 p.m. ET (3:05 am Perth time on 30 October). BleepingComputer says trading resumed about an hour after the suspension and quotes Polymarket: "Trading is now fully back online. We'll make this right and are fully reimbursing all affected traders." (source: BleepingComputer) According to BleepingComputer, Hudson Rock researchers identified malicious JavaScript distributed through DebugBear's CDN that was designed to steal cryptocurrency and prediction-market holdings from Polymarket users; BleepingComputer's own analysis found it was designed to hijack authenticated Polymarket trading sessions, liquidate users' prediction-market positions and transfer assets to an attacker-controlled wallet, and that the wallet transferred approximately 28.6 million POL, valued at roughly $2.57 million, to three additional wallets. BleepingComputer said on 29 October that Polymarket had not disclosed how many users were affected, how much cryptocurrency was stolen, or how the reimbursement process would work. (source: BleepingComputer) According to BleepingComputer, DebugBear, a website performance-monitoring service, confirmed it is investigating an ongoing security incident and told customers: "We're impacted by an ongoing security incident. If you use our RUM product, please remove the embed code from your website." (source: BleepingComputer) Correction (31 Oct 2026): the card date has moved from 30 to 29 October 2026, the date BleepingComputer's report shows. (source: BleepingComputer) UPDATE (3 Nov 2026): In a postmortem on its status page dated 30 October (20:07 UTC, 4:07 am Perth time on 31 October), Polymarket said a third-party vendor whose performance-monitoring script loaded on polymarket.com was compromised and the attacker replaced the script with one built to target Polymarket users; for some people who had the site open during a small window, it used their active session to sell positions and move funds out of their wallet. Polymarket said it removed the compromised script and cleared every cache, paused trading and the relayer, reset all active login sessions, is redeploying third-party scripts with additional integrity controls and continuous monitoring, and has referred the case to law enforcement. It said it is returning $3.9M to traders in total, the $2.7M plus $1.2M to cover pause-related losses, with no claims or tickets needed, and that 95% of affected wallets had been refunded in full as of the afternoon it posted. (source: Polymarket status page) According to The Record, DebugBear said its initial findings indicate it was compromised through its domain registrar and that it had not seen any indication of a compromise of its internal systems. (source: The Record) Correction (03 Nov 2026): removed DebugBear's and Polymarket's posts on X as sources; removed details no other source gives. (source: Polymarket status page; BleepingComputer; The Record)

Product: Polymarket (polymarket.com); DebugBear Real User Monitoring (RUM) JavaScript
Versions: n/a — third-party script compromise
Exploited in Australia?: unknown
Patch to: Sites using DebugBear RUM: remove the embed code now, as DebugBear advises, and review what the script could reach. Everyone embedding third-party JavaScript on logged-in pages: restrict it with a Content Security Policy and Subresource Integrity where possible, and keep an inventory of who can change code on your pages. Polymarket users: check your positions and wallet history, and rely only on official Polymarket channels about reimbursement.

Primary: Polymarket status — Security incident - 3rd party vendor compromised (postmortem 30 Oct 2026, 20:07 UTC) · BleepingComputer — Polymarket halts trading after crypto-draining script breach, $2.5M traced (29 Oct 2026) · The Record — Polymarket pledges to give $3.9 million back to victims after site compromise (3 Nov 2026)

breaches cloud

Incident

Published 2026-10-29

Updated 2026-11-02

Verified 2026-11-02

Binance says its investigation has found additional points of breach beyond a possibly compromised DevOps laptop in a security incident with an estimated $6.3 billion impact; about $3 billion frozen, withdrawals paused, and it has reserved over $6.34 billion to cover losses

Binance said in a post on its X account at 5:29 am Perth time (AWST) on 30 October 2026 (21:29 UTC, 29 October): "Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe." The post said its security teams are reviewing all relevant information with urgency and warned users not to trust unofficial links, messages, or requests for account information. (source: Binance on X) In a later post at 8:13 am Perth time on 30 October (00:13 UTC), Binance said: "We are working non-stop to resolve this issue. Binance will cover all losses." It said all deposits and withdrawals are temporarily suspended while its team conducts security checks, freezes funds, and works with law enforcement, and that it will share a full post-mortem once the investigation is complete. (source: Binance on X) BleepingComputer reported on 29 October 2026 (US Eastern time) that the statements followed reports of billions of dollars in cryptocurrency being transferred from multiple Binance hot wallets to a newly created Ethereum address. According to BleepingComputer, Tether CEO Paolo Ardoino said on X that Tether had frozen more than $1.567 billion in USDT and Circle CEO Jeremy Allaire said Circle had frozen more than $800 million in USDC linked to the incident. BleepingComputer notes that Arkham Intelligence's figure of about $5.78 billion is the value of assets held across the wallets it tracks, not a confirmed amount stolen from Binance, and that at the time of its report Binance had not confirmed whether the transfers were unauthorized, how the suspected breach occurred, or the total value of any stolen assets. (source: BleepingComputer) UPDATE (30 Oct 2026, Perth; Binance on X): At 8:52 am Perth time (00:52 UTC) Binance said: "The current verified total frozen amount is around $3 billion." At 10:25 am Perth time (02:25 UTC) it said: "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak." The same post says "The estimated total impact sits at around $6.3B", with about $3 billion frozen on-chain so far, and that Binance will cover all losses from the SAFU fund and the company's funds. Binance says it has revoked the affected address authorisation, engaged law enforcement and blockchain intelligence partners to trace and recover funds, and will publish a detailed technical post-mortem and an updated Proof of Reserves. In a service update at 12:36 pm Perth time (04:36 UTC), Binance said deposits "remain unaffected and continue to operate as normal" and that withdrawals remain paused while it completes "a security revamp of the withdrawal service and its related addresses", which it expects to finish within 48 hours. It said the incident "stems from multiple factors" and that its security team is tracing the full attack path through the compromised computer, which "may be the entry point of the incident". (source: Binance on X) UPDATE (30 Oct 2026, evening Perth; Binance on X): In an investigation update at 4:47 pm Perth time (08:47 UTC), Binance said: “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.” It called it “a complex attack”, said it is still gathering the facts with law enforcement, repeated that it will cover all losses from the SAFU fund and the company's funds, said it is still on track to resume withdrawals in 45 hours with deposits unaffected, that outflows ceased when it paused withdrawals, and that around $3 billion has been frozen so far. At 6:55 pm Perth time (10:55 UTC) Binance said it has begun recovering affected assets for users and has reserved over $6.34B of company funds to cover the incident, $5B of it already held in the exact token assets that were impacted, and that it is buying the remaining token assets through market and OTC channels. It said these figures do not include frozen or protected assets, and that all user funds will be verified publicly through its Proof of Reserves. (source: Binance on X) Correction (31 Oct 2026): the card date has moved from 30 to 29 October 2026, the date BleepingComputer's report shows. (source: BleepingComputer) UPDATE (31 Oct 2026; TRM Labs): Blockchain intelligence firm TRM Labs says in a blog post dated 29 October 2026 that it attributes the attack to TraderTraitor, which it calls North Korea’s elite hacking unit, based on on-chain and off-chain intelligence, and that it makes this judgment with high confidence; this is TRM’s assessment, and Binance has not named an attacker in the posts cited on this card. TRM says an attacker moved about USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC on 29 October (4:05 am Perth time, 30 October), using EIP-7702 delegation with 50 pre-signed authorisations, which in TRM’s assessment points to a compromise of Binance’s hot wallet signing infrastructure. TRM says Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion and the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB, about USD 2.7 billion in total, and that the attacker still held more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion, as of 00:30 UTC on 30 October (8:30 am Perth). (source: TRM Labs) UPDATE (02 Nov 2026, Perth; FBI): The FBI said in a cyber alert dated 31 October 2026 that North Korea was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance on or about 29 October 2026, activity the FBI refers to as "TraderTraitor". The FBI says it, the USSS and IRS-CI have observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH), expects further laundering through DeFi and instant swap services, and urges THORNode and RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with or derived from the addresses it lists. (source: FBI)

Product: Binance cryptocurrency exchange (hot wallets)
Versions: n/a — incident (per Binance at 4:47 pm AWST on 30 Oct: deposits unaffected, withdrawals paused, expected to resume in 45 hours)
Exploited in Australia?: unknown
Patch to: Binance users: rely only on official Binance channels for updates, as Binance itself advises, and ignore links, DMs or 'recovery' offers about the incident. Expect phishing that uses the incident as a lure. Do not share account details or 2FA codes with anyone claiming to help.

Primary: Binance on X — investigation update: additional points of breach uncovered; withdrawals to resume in 45 hours (30 Oct 2026, 4:47 pm AWST) · Vendor: Binance on X — aware of reports of a potential security issue (30 Oct 2026, 5:29 am AWST) · BleepingComputer — Binance probes potential $5.8 billion crypto-theft hack (29 Oct 2026) · FBI — North Korea Responsible for $6 Billion+ Binance Attack (31 Oct 2026) · TRM Labs — North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (29 Oct 2026; TRM's attribution) · Binance on X — initial investigation: compromised DevOps engineer’s laptop; estimated impact around $6.3B (30 Oct 2026, 10:25 am AWST) · Binance on X — recovery has begun; over $6.34B of company funds reserved (30 Oct 2026, 6:55 pm AWST) · Binance on X — deposits and withdrawals suspended; Binance will cover all losses (30 Oct 2026, 8:13 am AWST) · Binance on X — verified total frozen around $3 billion (30 Oct 2026, 8:52 am AWST) · Binance on X — service update: deposits normal, withdrawals paused (30 Oct 2026, 12:36 pm AWST)

breaches

Incident

Published 2026-10-28

Updated 2026-11-01

Verified 2026-11-01

bunny.net says one of its infrastructure providers reported unauthorised access involving third-party server management software; it removed its CDN node in Armenia hosted with that provider and is reissuing TLS certificates

bunny.net said on its status page on 28 October 2026 (7:40 pm AWST) that last week one of its infrastructure providers reported unauthorised access involving third-party server management software, and that one of its CDN nodes, located in Armenia, was hosted on a server supplied by that provider. Bunny says that after the provider's alert it stopped routing traffic through the server within 20 minutes, reviewed and preserved the relevant security logs, securely wiped the server, revoked its access to Bunny's other systems and permanently removed it from its infrastructure. Bunny says its investigation found no evidence of unauthorised access to the CDN node or any of its data, and that the provider has also found no evidence that Bunny's server was accessed but continues to investigate; Bunny says it cannot completely rule out the possibility. If the node was accessed, Bunny says the potentially exposed information would have been temporarily cached CDN content, Pull Zone configurations and TLS certificates stored on that server; no other customer data, including bunny.net account data, was stored on the server, and no internal systems were affected. As a precaution Bunny revoked and reissued all TLS certificates for its platform domains (b-cdn.net and bunny.run) and began reissuing managed TLS certificates for custom domains. In an update on 30 October 2026 (2:40 am AWST), Bunny said reissuance of managed certificates for custom domains was ongoing in controlled batches, each with a new private key, and was taking longer than first estimated, with completion now expected by the end of 31 October; existing certificates continue to be served until replaced, and neither Bunny's investigation nor the provider's has found any new evidence of unauthorised access to its server. Bunny does not name the provider. (source: bunny.net status page) UPDATE (1 Nov 2026): In an update on 31 October 2026 (8:50 pm AWST), Bunny said it has completed the reissuance of managed TLS certificates for custom domains: all managed certificates have been reissued with new private keys and the previous certificates revoked, and no action is required from customers using managed certificates. Bunny still recommends that customers who manage their own TLS certificates revoke and reissue them with new private keys as a precaution. Bunny said it has stopped using the affected provider while that investigation continues and is changing how configurations are distributed so that each PoP only receives the configuration and TLS certificates for the sites it is actively serving, and that neither its investigation nor the provider's has found any evidence of unauthorised access to its server. (source: bunny.net status page)

Product: bunny.net CDN (one CDN node in Armenia)
Versions: n/a — security incident at an infrastructure provider
Exploited in Australia?: unknown
Patch to: Customers using Bunny-managed TLS certificates: Bunny says no action is required; as of 31 October all managed certificates have been reissued with new private keys and the previous ones revoked. If you manage your own TLS certificates on bunny.net, Bunny recommends revoking and reissuing them with new private keys as a precaution.

Primary: bunny.net Status — Security update regarding one of our infrastructure providers (posted 28 Oct 2026, 7:40 pm AWST; update 30 Oct 2026, 2:40 am AWST)

breaches cloud

Incident

Published 2026-10-28

Verified 2026-10-30

Anthropic confirms AI startup Cathedral reached a "limited set" of its sales, HR and IT systems during a bug bounty probe; Anthropic says Claude conversations and model source code were not accessed and disputes Cathedral's under-12-hours claim

The Independent reported on 28 October 2026 that US-based AI startup Cathedral, which The Independent says was founded this year by former staff of the US Department of Government Efficiency, claimed it breached Anthropic's internal network in less than 12 hours as part of a bug bounty program that encourages outsiders to look for security flaws. (source: The Independent) According to The Independent, Anthropic confirmed that Cathedral had reached a "limited set" of sales, HR and IT systems but did not access users' conversations with Claude, and the model's source code was not compromised. Anthropic said in a statement quoted by The Independent: "Our monitoring flagged some of Cathedral's activity before they reported it to us," and "We shut off their access the same day." (source: The Independent) An Anthropic spokesperson told The Independent that the activity "involved attempts over several days", pushing back on the 12-hour claim, and that Cathedral's actions went "substantially beyond" the company's bug bounty program by targeting third-party applications. (source: The Independent)

Product: Anthropic internal business systems (sales, HR and IT) and third-party applications it uses
Versions: n/a — incident
Exploited in Australia?: unknown
Patch to: No customer action has been announced. Organisations running bug bounty or penetration-test programmes: set written scope that covers third-party SaaS applications, and monitor for out-of-scope activity. Review third-party SaaS access to sales, HR and IT data.

Primary: The Independent — Anthropic hacked by AI startup in less than 12 hours, report claims (28 Oct 2026)

ai identity

Incident

Published 2026-10-28

Verified 2026-10-29

Belgium's finance ministry (FPS Finance) says a cyberattack on its digital services on 28 October was stopped; MyMinfin and some other services taken offline as a precaution, a tax filing deadline moved to 16 November, and it says no data was leaked

Belgium's Federal Public Service Finance (FOD Financiën / SPF Finances) says its digital services were hit by a cyberattack on Wednesday 28 October 2026 and that the attack was successfully stopped (FPS Finance notice in Dutch, dated 28 October and last updated 29 October; Cyberstack translation). As a precaution, MyMinfin and some other services were temporarily taken offline; FPS Finance says it is working on a restart, but that this takes time in order to rule out new risks. Because this affects tax deadlines in the near future, FPS Finance says the deadline for filing returns with specific income is postponed to 16 November 2026. FPS Finance says data protection is its priority and that it now knows no data has been leaked, and that a large part of its other applications remains available with full or partial functionality. The Register reports the deadline that moved was 31 October, for filings covering specific types of income such as sole traders and earnings from foreign companies, and The Record reports that Belgian authorities have not identified who was behind the attack or disclosed how the hackers may have gained access. (source: FPS Finance; The Register; The Record)

Product: FPS Finance (Belgium) online services, including the MyMinfin tax portal
Versions: n/a — organisation cyberattack
Exploited in Australia?: unknown
Patch to: Taxpayers in Belgium filing returns with specific income: the deadline is postponed to 16 November 2026 (FPS Finance). FPS Finance says it is working to make the affected services available again as soon as possible.

Primary: FOD Financiën — Cyberincident bij de FOD Financiën (28 Oct 2026; updated 29 Oct 2026; in Dutch) · The Register — Belgium's tax agency confirms cyberattack, pulls services offline · The Record — Cyberattack disrupts Belgian tax services before filing deadline (29 Oct 2026)

breaches

Incident

Published 2026-10-28

Verified 2026-10-29

DHS says it is aware of a potential breach after DDoSecrets published records on more than 41,000 Homeland Security employees and contractors, WIRED reports

The transparency nonprofit Distributed Denial of Secrets (DDoSecrets) on Wednesday 28 October 2026 published an archive of US Department of Homeland Security records that, according to WIRED, exposes details of more than 41,000 employees or contractors of DHS and seven of its component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection. WIRED reports that the records include email addresses, phone numbers and office addresses as well as references to internal systems and to undercover and surveillance programs, and were last updated on 19 August 2026; according to a WIRED analysis of the data, CBP staff account for more than half of the records and ICE for about 10,000. A Homeland Security spokesperson told WIRED: "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively." DDoSecrets says in a press release that the data is from DHS's Okta login system, according to WIRED; an Okta spokesperson told WIRED: "Okta is secure, and we have no evidence our data or systems were compromised." DDoSecrets told WIRED it obtained the data from a group calling itself the Department of Peace. (source: WIRED)

Product: US Department of Homeland Security employee and contractor records (source system not confirmed by DHS)
Versions: n/a — data leak
Exploited in Australia?: unknown
Patch to: DHS staff and contractors: treat unexpected calls, emails and messages that use your work details with caution; Recorded Future's Alexander Leslie told WIRED an adversary could use the data to develop convincing impersonation attempts. DHS told WIRED it will update the public when more information is available.

Primary: WIRED — Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents (28 Oct 2026; includes DHS and Okta statements)

breaches identity

Incident

Published 2026-10-28

Updated 2026-11-01

Verified 2026-11-01

Japan Airlines says hackers accessed reservation data of about 92,000 customers through its IT provider Amadeus, including passport numbers for about 2,000, according to The Record

Japan Airlines (JAL) said one of its IT providers suffered a data breach that leaked the personal records of more than 90,000 customers, according to The Record (28 Oct 2026). The Record reports that JAL published a notice on Wednesday (28 October) saying Amadeus IT Group, the company that runs its flight reservation, ticketing and check-in systems, informed it last week that hackers accessed a 'portion of customer reservation data' for Japan Airlines and Japan Transocean Air flights; in total 92,000 customers were affected, with names, reservation codes and flight information accessed, and for about 2,000 customers passport numbers, frequent flyer numbers, email addresses and phone numbers were also taken. According to The Record, JAL said the breach never affected flight operations and credit card numbers were not compromised, and that it will contact affected customers individually, including reminders to watch for phishing emails, fraudulent phone calls and websites impersonating the JAL Group. ITmedia NEWS (28 Oct) reports that JAL and Japan Transocean Air (JTA) said Amadeus reported the unauthorised access to them on 23 October; that the traces of outside access cover part of the reservation records for JAL and JTA flights from 10 August 2023 to 23 September 2026; that for the about 2,000 customers the items accessed also include nationality, ticket number and seat number; that no leak of credit card numbers or passwords has been confirmed; that Amadeus has already completed the necessary security measures and, as of 28 October, no misuse of the information had been confirmed; and that a dedicated inquiry line opens on 29 October (our translation from Japanese). Correction (31 Oct 2026): removed the Cathay Pacific notice (Personal data security incident involving a third-party service provider) as a source, with the update and the title, product and advice wording that came only from it, because this desk could not read that page in full; every fact on this card now comes from The Record and ITmedia NEWS. (source: The Record) Updated (01 Nov 2026): Star Flyer, which uses the Amadeus passenger service system through All Nippon Airways (ANA), said on 30 October (first posted 29 October) that it received an updated report from ANA that an unauthorised third party accessed reservation information for Star Flyer-operated flights within the system, and that there are indications certain personal information of its customers may have been accessed. Star Flyer lists the information that shows signs of access as customer name, booking reference number, travel date, flight routing, cabin class, email address, phone number, frequent flyer number, airline, flight number, e-ticket number and seat number, among other related details, for certain customers who made reservations with Star Flyer from 28 July 2025 to 23 September 2026. Star Flyer said the incident did not involve credit card numbers or account passwords, that it has been informed the compromised authentication credentials have been revoked and monitoring substantially enhanced, and that it is still verifying the number of people affected and will contact customers directly once their details are verified. (source: Star Flyer)

Product: Amadeus passenger service system (reservations, ticketing, check-in) used by Japan Airlines and Japan Transocean Air
Versions: n/a — data breach
Exploited in Australia?: unknown
Patch to: JAL and JTA customers: expect individual contact from the airline; be wary of phishing emails, phone calls and fake websites impersonating the airline (JAL advice, per The Record). Star Flyer customers: Star Flyer will contact affected customers directly once their details are verified, and asks customers to be cautious of phishing emails, phone calls, websites or social media advertisements claiming to be from Star Flyer (Star Flyer). Airlines and travel firms using Amadeus: check with Amadeus whether your reservation data is in scope.

Primary: The Record — Japan Airlines warns of data breach as country grapples with multiple cyber incidents (28 Oct 2026) · ITmedia NEWS — JALの予約システムに不正アクセス　約9万人分の予約情報が漏えい　一部ではパスポート番号も (28 Oct 2026, Japanese) · Star Flyer — Notice Regarding Unauthorized Access to the Passenger Service System Provided by Amadeus (30 Oct 2026)

breaches

Incident

Published 2026-10-28

Updated 2026-10-29

Verified 2026-10-29

Coinbase says a security incident at analytics vendor Amplitude affected contact data of a small subset of Coinbase customers; it found no evidence of unauthorised access to Coinbase systems

Coinbase said in a post on its Coinbase Support account on X at 10:49 am Perth time (AWST) on 28 October 2026 (02:49 UTC): 'Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.' In the same post Coinbase said it had found no evidence of unauthorized access to Coinbase systems, that customer funds were not impacted, and that it is notifying impacted customers and regulatory agencies in accordance with its legal obligations. (source: Coinbase Support on X) Decrypt (28 Oct) reports that Coinbase did not say how many customers were affected, what kinds of contact data were exposed or when the incident took place, and did not name the other Amplitude customers affected. (source: Decrypt) Correction (29 Oct 2026): the post's time is now given in Perth time from the post's own timestamp, each statement is credited to the post or to Decrypt, and wording not in either source was removed. (source: Coinbase Support on X)

Product: Amplitude (analytics vendor to Coinbase)
Versions: n/a — third-party data incident
Exploited in Australia?: unknown
Patch to: Coinbase customers: expect phishing that uses leaked contact details; Coinbase says it is notifying impacted customers. Organisations using Amplitude: check for vendor notices and review what customer data you send to analytics tools.

Primary: Coinbase Support on X — statement on Amplitude security incident (28 Oct 2026) · Decrypt — Coinbase Customer Data Hit in Analytics Vendor Breach, Funds ‘Not Impacted’ (28 Oct 2026)

breaches

Incident

Published 2026-10-28

Updated 2026-10-29

Verified 2026-10-29

Lumen Black Lotus Labs: Volt Typhoon used 'Silent Train', rotating chains of hacked routers, IoT and enterprise devices, to hide at least four confirmed zero-day campaigns against management platforms including N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator

Lumen's Black Lotus Labs has published research, reported by BleepingComputer on 28 October 2026, on what it calls Silent Train, a covert framework it attributes to the China state-sponsored group Volt Typhoon. Black Lotus Labs says it has tracked Silent Train for three years, first observing consistent activity in November 2023, shortly before the initial takedown of the KV-botnet, and that the work led to hundreds of victim notifications. It describes Silent Train as rapidly rotating chains of compromised SOHO, IoT and enterprise devices that are exploited on demand, used against selected targets, cleaned up after each operation and continuously refreshed: sessions began from virtual private servers outside the US and were daisy-chained through compromised non-US devices before pivoting within the US to reach targets. It observed more than 27 device classes used, from TP-Link routers and Netgear Orbi devices to Fortinet appliances and CyberPanel servers, with device types reserved for fixed roles (Intelbras modems only as overseas relays, Netgear Orbi devices as US-based hops that interacted with victims). By early 2025, compromised enterprise platforms were kept in the chains for one to three months, making Silent Train a hybrid framework. Black Lotus Labs says its monitoring helped uncover at least four confirmed and one likely zero-day campaigns against network and endpoint management systems, SD-WAN orchestrators and other control-plane infrastructure: Versa Director (which it documented in mid-2024), N-able N-central (a chain of then-undisclosed flaws assigned CVE-2025-8875 and CVE-2025-8876), Cisco Catalyst SD-WAN (CVE-2026-20127, exploited from late 2025 and continuing well after Cisco's February 2026 disclosure), VeloCloud Orchestrator (a zero-day later designated CVE-2026-16812) and, assessed with moderate confidence, Quest KACE (more than 30 victims; activity declined after Quest's October 2025 security updates). Post-incident analysis found in-memory webshells, credential harvesting, abuse of native platform features and, in several cases, erased or altered logs. Victims included telecommunications providers, government, defense contractors, satellite and mission-critical communications services, universities, MSPs, IT firms and critical infrastructure; Hawaii, California and Texas were the most targeted regions. Activity was concentrated on weekdays between 09:00 and 22:00 China Standard Time. BleepingComputer (28 Oct) also reported the research. Correction (29 Oct 2026): the 28 October date is now credited to BleepingComputer's report. (source: BleepingComputer)

Product: Network and endpoint management and SD-WAN platforms (Versa Director, N-able N-central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator, Quest KACE); SOHO, IoT and enterprise devices used as relays (TP-Link, Netgear Orbi, Intelbras, Fortinet, CyberPanel and others)
Versions: n/a — threat research; CVEs named by Black Lotus Labs: CVE-2025-8875, CVE-2025-8876 (N-able N-central), CVE-2026-20127 (Cisco Catalyst SD-WAN), CVE-2026-16812 (VeloCloud Orchestrator)
Exploited in Australia?: unknown
Patch to: Patch internet-facing management and control-plane platforms first (endpoint and network management, SD-WAN orchestrators, out-of-band platforms); restrict admin interfaces to VPNs, jump hosts or dedicated management networks; centralise logs with longer retention; hunt for unusual admin logins, API use, remote file transfers and config changes outside normal hours; follow CISA and NCSC guidance on Volt Typhoon (Black Lotus Labs recommendations).

Primary: Lumen Black Lotus Labs — Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access · CVE: CVE-2025-8875, CVE-2025-8876, CVE-2026-20127, CVE-2026-16812 · BleepingComputer — Volt Typhoon hides zero-day attacks using 'Silent Train' framework (28 Oct 2026)

breaches network

Incident

Published 2026-10-28

Updated 2026-11-02

Verified 2026-11-02

FBI seizes the domain of 'bulletproof' hosting provider Virtualine, accused of facilitating money laundering and the distribution of child sexual abuse material, according to The Record

The FBI seized the domain of Virtualine, a 'bulletproof' hosting provider accused of facilitating a range of cybercrimes including money laundering and the distribution of child sexual abuse material, The Record reported on 28 October 2026. According to The Record, the Justice Department said on Tuesday that a court authorised the seizure of virtualine.net, a service operating under names including Secury, Massgod, Spamhouse, Lanedo and Omegatech, and the site has been replaced by a seizure notice. Citing court records, The Record says Virtualine advertised on cybercrime forums, offering hosting for 'all illegal/black hat activities' including phishing, carding and spam. The Record reports that in January, about a month after Virtualine allegedly provided an IP address to a forum used to sell sexually explicit images of minors, the company received complaints from authorities in Germany, Canada and Australia, as well as the National Center for Missing and Exploited Children and a victim's attorney, and that instead of ending service it helped the forum's operators build another site, according to the Justice Department. The Record says the FBI's Washington Field Office led the investigation with help from authorities in Germany, the Netherlands and Britain and private-sector partners OverRIPE and Lumen, and that the Justice Department did not identify Virtualine's operators or announce criminal charges at the time of the seizure. Correction (02 Nov 2026): removed The Hacker News as a source. (source: The Record)

Product: Virtualine bulletproof hosting (virtualine.net)
Versions: n/a — law-enforcement action
Exploited in Australia?: unknown
Patch to: No action for most readers; this is a law-enforcement domain seizure.

Primary: The Record — FBI seizes ‘bulletproof’ hosting site accused of facilitating child abuse, money laundering (28 Oct 2026)

breaches