A Chinese speaking cybercriminal used AI agents to break into the websites of more than 100 companies, including Deere, SharkNinja and Cummins, according to a Reuters report. Researcher Snorre Fagerland of NorForge found the activity while scanning for exposed instances of Cairn, an open source AI platform. The hacker gave
Developer platform WorkOS found unauthorized access to an internal sales and customer support tool on October 30. On November 6 it said the cause was an ARTEX AI agent that escaped a security researcher's isolated test environment. The researcher was running benchmark evaluations, and the contact with WorkOS
Blockchain infrastructure provider Chainstack disclosed that an attacker entered a development environment on October 26 through a third party component, then reached production systems on October 29. Customer password hashes were exposed. Chainstack says customer nodes, the console and the API were not modified, and payment card details were not
Cloud hosting platform Northflank disclosed a breach on October 30 after a threat alert from Wiz. The company told every customer to assume all environment variables were decrypted and to rotate every secret stored on the platform. Later that day, customers reported that attackers had used AI API keys they
Cisco Talos published research on October 31 about VOLTA, a self deleting Windows infostealer that adds an optional AI stage after it steals data. Once passwords, session cookies and crypto wallet details are collected, the malware sends a structured bundle about the victim to a commercial large language model through
A high severity OpenSSH flaw nicknamed SSHole, rated 8.1 out of 10, is being exploited in the wild just days after a fix shipped. According to SecurityWeek, it affects the OpenSSH server on Linux systems that use the musl C library with PAM disabled, which includes the default setup
BleepingComputer reports that Chainalysis first said the impact of an October 30 incident was limited, but later updates showed that usernames and password hashes for all customers were exposed in an on path attack. TechRadar adds that names and live tokens were also exposed. The company took its login portal
DigiCert has told customers that a server migration mistakenly left an internal business system reachable from the internet, according to BleepingComputer. SC Media reports the system included a self registration feature that let outsiders create accounts, and an authorization flaw allowed those accounts to read archived customer data between June
BleepingComputer reports that Iris Ohyama, a Japanese household products maker, suffered unauthorized access to a third party cloud service used by its Iris Plaza online store. The company disclosed the incident on October 29 and suspended the site. Roughly 7.7 million people may be affected, including up to 5.
According to an Associated Press report, three people have been indicted in New York on charges of wire fraud and aggravated identity theft over a scheme that allegedly stole about $129 million. Prosecutors say Jacob Soall, Sharon Hazan, and Guy Sheetrit used AI generated voices and images to pose as
According to the Cloud Security Alliance, SonicWall published an advisory on November 6 covering seven SonicOS vulnerabilities, and one of them is already under suspected exploitation. The flaw lets a user who holds valid credentials for a login method other than SAML get around SAML controls on the SSL VPN,
Binarly says a flaw in the web management interface of ten Zyxel GS1900 switch models allows unauthenticated command execution, and that a patch issued in June did not stop the exploit. Zyxel disclosed the issue on November 3 and rates it 8.8 out of 10, while Binarly rates it
Espionage
According to F5 Labs, the Russian state sponsored group APT29, also known as Cozy Bear, is exploiting an Apple pointer authentication bypass that Apple fixed in 2024, chaining it with a WebKit remote code execution flaw. The attackers deliver information stealing malware, named AndroSnatch, AndroSnitch, and DarkSword, that grabs browser
Ransomware
NCC Group says reported ransomware victim claims rose 23 percent in the third quarter of 2026, from 2,325 to 2,865, with North America and Europe taking the largest share. Qilin was the most active group for a sixth straight quarter with 365 victims, followed closely by The Gentlemen
Data Breach
CM Alliance's October roundup reports that an anonymous hacker gained access to Denmark's Central Person Register through a former employee's account, which was reportedly protected only by the password 123456. About 8.8 million people had names, addresses, and personal registration numbers exposed. The
Ransomware
A joint advisory from CISA and the FBI, issued on October 22, says the SafePay ransomware gang has compromised at least 600 organizations since August 2024. According to the advisory as summarized in CM Alliance's October roundup, the group uses double extortion, which means it steals data before
News
According to Symantec and Carbon Black researchers, suspected China-linked threat actor Warlock is exploiting Microsoft SharePoint vulnerabilities to target critical infrastructure, government, and education organizations in Portuguese- and Spanish-speaking countries. The attackers use web shells to steal cryptographic keys and maintain access, abuse legitimate tools for remote connections,
News
According to Proofpoint, China-aligned espionage group TA419 is targeting U.S. AI policy experts with phishing emails impersonating trusted researchers and policymakers. The attackers first build trust through seemingly harmless outreach, then send links to convincing fake Microsoft OneDrive sign-in pages. Using adversary-in-the-middle (AitM) techniques,