Revolve Group, the US online fashion retailer, said in a Form 8-K dated 29 October 2026 and filed with the US Securities and Exchange Commission on 30 October that it recently became aware of unauthorised access to certain of its systems, started its cyber incident response protocols and confirmed the unauthorised activity was remediated. Revolve says that, based on its investigation, an unauthorised actor may have obtained, through automated means, the name, contact information, payment card number and payment card expiration date for certain customers who saved payment information with their online shopping account on its e-commerce platform. It says it notified federal law enforcement, engaged external cybersecurity experts, that the incident has not caused operational disruption or interrupted service to customers, and that it does not believe the incident will have a material impact on its business. Revolve did not say when the access happened or how many customers are affected. According to The Record, Revolve did not answer its questions about when the attack occurred, and told regulators in Texas that 127,200 people in the state had information stolen, with another 1,328 in Vermont and notifications also filed in Massachusetts (state filing figures as reported by The Record, not independently verified). (sources: Revolve Form 8-K; The Record)
Revolve Group, Inc. — Form 8-K, Item 8.01 Other Events (dated 29 Oct 2026, filed 30 Oct 2026)
ClickHouse says in its security changelog that an issue discovered in ClickHouse Server could, under certain conditions, allow an unauthenticated user with network access to execute arbitrary code on the server. It lists the fix under 'Fixed in ClickHouse v26.10.3.7, 2026-10-30' and says the fix has been pushed to the open-source versions v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stable and v26.10.3.7-stable, and that a fix has been applied to all ClickHouse Cloud and BYOC deployments; it credits Elshad Toklayev. ClickHouse, as the CVE Numbering Authority, published CVE-2026-116366 on 30 October 2026 (11:00 UTC; 7:00 pm Perth) under the title 'Unauthenticated RCE vulnerability against ClickHouse Server', classed as CWE-190 (integer overflow or wraparound), with a CVSS 4.0 base score of 9.5 (Critical; network attack vector, high attack complexity, no privileges or user interaction). The CVE record lists open-source ClickHouse 26.3 before 26.3.62.3-lts, 26.8 before 26.8.36.3-lts, 26.9 before 26.9.27.3-stable and 26.10 before 26.10.3.7-stable as affected, and also lists ClickHouse Cloud builds before 25.12.1.1713, 26.2.1.835, 26.4.1.2704, 26.6.1.2439, 26.8.1.597 and 26.10.2.84. Neither ClickHouse's changelog nor the CVE record describes the conditions needed or reports exploitation. (source: ClickHouse security changelog; CVE record)
ClickHouse — Security changelog (Fixed in ClickHouse v26.10.3.7, 2026-10-30: CVE-2026-116366)
ServiceNow published CVE records on 29 October 2026 (UTC) for three ServiceNow AI Platform issues, each pointing to its knowledge base article KB3228994, titled 'October 2026 CVE Advisory Notification'. ServiceNow says CVE-2026-103093 (CVSS 4.0 9.4, Critical), 'Sandbox Escape via Table Rotation', could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system. CVE-2026-103094 (CVSS 4.0 7.1, High) could cause a user's plaintext password to be persisted in a system table, exposing it to a user not otherwise entitled to view it. CVE-2026-6877 (CVSS 4.0 5.3, Medium) is a domain separation bypass in the SR – CSM – Task Plan Templates Store application that could let a user with a specific role create records in domains they cannot access. ServiceNow says it deployed an update to hosted instances, provided the update to partners and self-hosted customers, and is not currently aware of malicious exploitation. The knowledge base article itself did not render for the desk; details here are from ServiceNow's CVE records. (source: ServiceNow CVE records via cve.org)
CVE-2026-103093 record (ServiceNow CNA) — Sandbox Escape via Table Rotation in ServiceNow AI Platform (published 29 Oct 2026 UTC)
Florida's Department of Education (FLDOE) said it became aware on 19 October 2026 of a data breach involving the Florida Student Financial Aid website, according to The Record, which reported the department's statement on 30 October. According to The Record, the exposed information includes names, addresses, phone numbers, genders, email addresses, Social Security numbers and dates of birth, and the breach affects nearly 5 million people who have applied for financial aid in Florida. The Record quotes the department's statement: 'An unauthorized party gained access to a system or database containing company or customer information,' and says FLDOE is working with the Florida Digital Service and the Florida Department of Law Enforcement. According to The Record, FLDOE has taken the financial aid site down, warned that other department websites and services may see temporary disruptions, says the incident has been contained and was reported to the Office of the Attorney General, and says financial aid, scholarships, grants and student loans are not affected and disbursements will not be delayed. The department declined to comment to The Record on the nature of the incident or the attackers. Cyberstack could not read the department's own notice. (source: The Record)
The Record — Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach (30 Oct 2026)
Hardware wallet maker Trezor said in a blog post on 30 October 2026 that its security team received a responsible-disclosure report on 28 October of a hardware implant in a Trezor Safe 5 bought in August 2026 from CryptoBilis, until October an official Trezor reseller in Southeast Asia, through the marketplace Tokopedia. Trezor says it has not yet received the device to confirm the report, but based on the customer's description, photos and a video interview it is treating the report as credible and warning customers now as a precaution; its lab will examine the device when it arrives. According to the report, which Trezor says it has not verified itself, an extra circuit board with a cellular module and antenna sits between the main board and the screen, reads what the screen shows, including the wallet backup (recovery phrase), and sends it out over a mobile network whenever the device is plugged in. Trezor says the implant appears to operate similarly to those seen in Ledger devices but will not draw comparisons while investigations continue, and does not know who is behind it. Trezor says no CryptoBilis buyer has reported a loss of funds, that the reporting customer had moved his funds before finding the board, and that it has no reports involving any other reseller. Trezor removed CryptoBilis as a reseller on 9 October 2026, after Ledger began investigating fund losses among its own CryptoBilis buyers. Trezor's advice covers every Trezor model bought from CryptoBilis since March 2026, including through any store selling CryptoBilis-supplied devices; it will ship a new device or give a voucher to those buyers, and warns that scammers are likely to use the incident for phishing by email, letter and phone. (source: Trezor) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Trezor)
Trezor Blog — Implant reported in a Trezor sold by CryptoBilis (30 Oct 2026)
Cloud deployment platform Northflank opened a security incident on its status page on 30 October 2026, marked as a major outage affecting the Northflank Platform. At 13:40 UTC (9:40 pm Perth) Northflank told users to rotate environment variables immediately; at 13:58 UTC (9:58 pm Perth) it said to assume all environment variables had been decrypted and to disable or rotate all keys. In an update at 15:12 UTC (11:12 pm Perth) Northflank said all users should assume their environment variables are decrypted and begin rotation immediately, listing secrets on workloads, secret groups and global secrets, and said multiple users are confirming that their AI keys have been used. The incident timeline on the page starts with a Wiz threat alert at 11:43 UTC (7:43 pm Perth), reviewed by Northflank engineers a minute later, followed by an initial network policy patch at 12:02 UTC (8:02 pm Perth), further patches at 12:50 and 13:05 UTC, and a request for support from the Wiz CIRT at 13:00 UTC. Northflank has not said on the page how the variables were exposed or how many customers are affected. (source: Northflank status page) UPDATE (1 Nov 2026): Later updates on Northflank's status page (still marked Identified, major outage) say secret rotation for Postgres and MongoDB was enabled for all users at 15:12 UTC on 30 October (11:12 pm Perth), with a recommendation to disable public expose on add-ons. At 19:28 UTC (3:28 am Perth, 31 Oct) Northflank said its investigation was ongoing with no further confirmed findings and its guidance was unchanged: assume all environment variables have been compromised and rotate all secrets and credentials. At 23:38 UTC on 30 October (7:38 am Perth, 31 Oct) it said users have reported unauthorised use of AI API keys supplied to the platform, told users to revoke existing credentials with their issuing providers, generate replacements and review AI provider usage and billing logs, and said these reports may be consistent with the broader pattern of attacks targeting AI credentials described in Wiz's 'Black October' report. At 01:04 UTC on 31 October (9:04 am Perth) it enabled audit logs for all customers, including free users, and at 13:34 UTC (9:34 pm Perth) it said secret rotation for MySQL and Redis is available to all customers. BleepingComputer reported on 31 October (2:01 am Perth, 1 Nov) that Northflank had not answered its questions about the breach and its impact. (sources: Northflank status page; BleepingComputer) UPDATE (1 Nov 2026): Northflank's status page said at 22:32 UTC on 31 October (6:32 am Perth, 1 Nov) that secret rotation for Minio add-ons is available to all customers, and at 23:31 UTC (7:31 am Perth) that secret rotation is available for RabbitMQ add-ons; it again asked users to rotate all secrets if they have not already. The incident is still listed as Identified, with a major outage. (source: Northflank status page)
Northflank status — Security incident (30 Oct 2026, times in UTC)
Russian home goods retailer Poryadok, which operates 48 stores across 32 Russian cities, confirmed that a cyberattack caused disruption that forced it to close some of its stores and suspend online services for five consecutive days, The Record reported on 30 October 2026. "We have been hit by a cyberattack, but we are already actively working to restore our services and gradually return operations to normal," the company said in a statement, according to The Record. The Record says Poryadok first reported technical problems on Sunday, saying its website, mobile app and physical stores were temporarily unavailable, and that customers have been unable to collect orders, access loyalty accounts or contact customer support. According to The Record, the company did not disclose how hackers breached its systems or when normal operations would resume, said it expected to reopen its stores and restore access to order information and loyalty bonuses without giving a timeline, and its website indicated that only some stores were still affected. The Record says it was not immediately clear who carried out the attack or whether any customer information had been compromised. (source: The Record)
The Record — Russian popular home goods chain faces days of disruption following cyberattack (30 Oct 2026)
AI security testing firm Hacktron published research on 30 October 2026 saying that an email address containing a shell command in backticks gave any registered user code execution on the backend of GNU Savannah, the Free Software Foundation's code forge that hosts Bash, Coreutils and other GNU projects. According to Hacktron, Savannah's Savane software accepted the address at registration, then inserted it unsanitised into a gpg command line when a user clicked 'Test GPG keys'. Hacktron says it used the resulting shell to read the database credentials, made its own account a superuser, impersonated Bash maintainer Chet Ramey and confirmed that his settings page would accept an extra SSH key with push access to the upstream Bash repository: "We did not add a key and we did not touch the repository." It says an unpatched 2023 kernel flaw, GameOver(lay) (CVE-2023-2640 and CVE-2023-32629), then gave it root on the Savannah backend and a key to a GNU backup host. Hacktron says the FSF traced the vulnerable code to the Savane release of 7 March 2026, affecting savannah.gnu.org and savannah.nongnu.org. Its timeline says it reported the issue on 11 May 2026, the FSF installed a fixed kernel and removed its account on 14 May, and a wider audit produced 26 confirmed Savane vulnerabilities (2 critical, 6 high, 16 medium, 2 low), which the FSF fixed. (source: Hacktron) In a statement dated 19 June 2026, the FSF said all reported issues had been patched and that "we have found no reason to believe that sensitive project data or credentials were accessed, nor that there has been any compromise of Savannah's software supply chain", and that it was taking additional precautionary steps and contacting other Savane instances. (source: Free Software Foundation) iTnews reported the research on 30 October; its article dates the report and the FSF statement to 2025, while Hacktron's timeline and the FSF's own statement give 2026. (source: iTnews)
Hacktron — Securing Internet-Critical Software: How We Could Have Backdoored Bash (30 Oct 2026)
iTnews reported on 30 October 2026 that New Zealand researchers Will Frame, who runs the free Restealer infostealer monitoring service, and Jacob Torrey, head of labs at Thinkst Applied Research, deliberately infected their own machines with malware to plant a new type of Canarytoken built from session cookies in infostealer operators' databases. (source: iTnews) The researchers told iTnews: "There's an [approximately] three day window post-compromise where nothing happens, then a few initial checks to see if the credentials are valid, then you can tell once they've been sold as the login attempts shoot up." Frame said the early checks were almost certainly log providers checking the logs before releasing them to subscribers. (source: iTnews) According to iTnews, Frame said infostealer log subscriptions range from as little as US$300 for lifetime access from newcomers to US$5,000–US$10,000 from larger providers, with session cookies, which can let an attacker into an account that has already passed a multifactor authentication check, included in whole logs at no extra cost. iTnews says the pair will present the full results at the Kawaiicon security conference in Wellington on Friday 30 October. (source: iTnews)
iTnews — Researchers feed infostealer gangs booby-trapped session cookies (30 Oct 2026)
Synology said in a notice dated 29 October 2026 that it has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DiskStation Manager (DSM), in attacks that aim to encrypt data and extort ransom. Synology strongly urges all users running vulnerable versions to update DSM immediately, recommends enabling automatic updates, and refers customers to its advisory Synology-SA-24:20. That advisory, rated Critical by Synology (published 5 Nov 2024, last updated 28 Mar 2025), covers three flaws: CVE-2024-10441 (remote code execution in the system plugin daemon, CVSS 9.8), CVE-2024-50629 (limited file read, 5.3) and CVE-2024-10445 (limited file write, 4.3). Synology has not said which of the three is being exploited. (source: Synology) According to BleepingComputer, the attacks deploy C3RB3R ransomware, Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices, and users are advised to block internet access to the DSM management web interface.
Synology — Synology urges users to update DSM following ransomware attacks on outdated DSM versions (29 Oct 2026)
Researcher Mark B (GitHub: MarkBlah) published a write-up on 29 October 2026 at smsofdeath.com of 'SMS of Death', a zero-click remote denial-of-service flaw in Android's telephony framework (WapPushOverSms, frameworks/opt/telephony). The researcher says WapPushOverSms.decodeWapPdu() reads a WAP Push header length, casts it to a signed 32-bit integer with no range check and uses it as an array size, so an eight-byte message (01 06 88 80 80 80 00 BE) sent as a data SMS to port 2948 throws an uncaught NegativeArraySizeException that kills com.android.phone. Per the researcher, the message never appears in the inbox, active calls drop (including emergency calls), each message causes 1-2 seconds without service, carrier redelivery re-crashes the phone, about 20 messages can make a device unusable for an extended period, and the queued message can crash the phone on every boot; on an Android 12 test device this produced a reboot into recovery roughly every 90 seconds. The researcher says the crash was reproduced from Android 12 up to Android 16 on Pixel and Samsung Galaxy devices, that it was reported to Google on 5 May 2026, and that Google's fix (commit 735d967, 'Fix remote DoS in decodeWapPdu', authored 15 June 2026) catches the exception and deletes the triggering message; it shipped in the October 2026 Android security release for Android 14 through 17, so Android 12 and 13 devices do not receive it. A recovery method over ADB (deleting the queued rows from content://sms/raw), credited to @sakisdog, is on the site. The researcher has published a working proof-of-concept app and source on GitHub. BleepingComputer reported on 31 October (11:35 pm Perth) that the flaw is tracked as CVE-2026-58882 and is not listed in Google's October 2026 Android security bulletin; the bulletin, read by this desk, does not list CVE-2026-58882. (sources: smsofdeath.com; GitHub MarkBlah/smsofdeath; BleepingComputer) UPDATE (3 Nov 2026, Perth; Android Security Bulletin): Google's Android Security Bulletin for November 2026, published 2 November, lists CVE-2026-58882 (Android bug A-517376969) as a Critical denial-of-service flaw in the System component, with updated AOSP versions Android 14, 15, 16, 16 QPR2 and 17, fixed at security patch level 2026-11-01; the bulletin does not flag it as exploited. The researcher had said the fix shipped in the October 2026 release; Google's bulletin places it at the November 2026-11-01 patch level. (source: Android Security Bulletin)
smsofdeath.com — SMS of Death: zero-click Android telephony DoS (researcher write-up, disclosed 29 Oct 2026)
In a Mozilla Blog post dated 29 October 2026, 'Defending the patch gap against automated attackers', Mozilla's Bobby Holley says AI models can now identify software vulnerabilities as effectively as top security researchers. Mozilla says the Firefox team has worked since February with early access to frontier models from Anthropic and OpenAI and has shipped more than seven times the number of security fixes compared with the same period in 2025. It describes the patch gap as the window between a security fix appearing in the code and that code reaching most users, during which an attacker could reverse-engineer an incoming fix and attack the prior version. Mozilla says AI models can dramatically accelerate this and lower the barrier to entry, and that it has seen evidence that models like GLM 5.3 can exploit some of the fixes for bugs originally uncovered by more advanced models. Steps Mozilla says Firefox has already taken: cutting the release cycle in half so new builds ship every week; keeping regression tests confidential until after a fix has shipped, because it observed GLM 5.3 is much less effective at patch-gapping without one; and scanning all new commits for newly introduced bugs. Mozilla says it will also group classes of fixes so that the patch gaps for different layers of Firefox's defences (for example a renderer exploit and a sandbox escape) do not overlap, and that getting this right may take some time. Mozilla also says October has seen a sharp increase in vulnerability disclosures and exploit activity as defenders and attackers get more capable models. (source: Mozilla Blog)
Mozilla Blog — Defending the patch gap against automated attackers (29 Oct 2026)
