urn:cyber-watch:feed A plain-language record of the main IT, OT and crypto cybersecurity incidents, exploited vulnerabilities and thefts of the last six months, with sources. 2026-10-19T00:00:00Z urn:cyber-watch:it-beyondtrust 2026-10-16T00:00:00Z

BeyondTrust disclosed CVE-2026-102764 (severity 9.3), a flaw in how an internal messaging component of Remote Support checks where messages come from, which lets a remote attacker perform file operations on the appliance. By BeyondTrust's timeline, a China-nexus espionage group tracked as Armory Castle (also UNC5221 or Warp Panda) used it as a zero-day on a single self-hosted appliance on August 29. SaaS customers were patched by October 9. CISA listed the flaw on October 16 with a federal deadline of October 19.

urn:cyber-watch:it-aljazeera-spyware 2026-10-16T00:00:00Z

Al Jazeera reported that dozens of its journalists' devices were infected with spyware designed to collect sensitive data, and called it an assault on press freedom. As relayed by Democracy Now, Citizen Lab corroborated the findings: an Israeli advertising-technology company, Discover-Tech, used personalized ads to deliver spyware from Candiru, a firm the US government blacklisted in 2021. The infections are described as zero-click, meaning the target did not need to tap anything.

urn:cyber-watch:it-panos 2026-10-14T00:00:00Z

Palo Alto Networks released fixes on October 14 for CVE-2026-0322 (severity 8.6) and said it had seen very limited exploitation. The flaw is in the management interface and lets an authenticated attacker with network access run code as root on PA-Series and VM-Series firewalls and Panorama. Cloud NGFW and Prisma Access are not affected. CISA set a federal deadline of October 17. The same week brought a fix for an exploited Ivanti Connect Secure zero-day and a Cisco warning about an exploited Secure Email Gateway flaw.

urn:cyber-watch:it-patch-tuesday 2026-10-13T00:00:00Z

Microsoft fixed roughly 1,400 vulnerabilities on October 13. Published counts range from 1,407 to 1,413 depending on method, against about 970 in September. One zero-day, a Windows Shell bypass of the Mark of the Web protection (CVE-2026-96951), was already being exploited, and two others were publicly disclosed. Microsoft ties the rising volume to AI-assisted vulnerability discovery. One analysis puts monthly industry-wide CVE disclosures up 145% in two years, from 3,173 in June 2024 to 7,765 in June 2026.

urn:cyber-watch:it-ahold 2026-10-12T00:00:00Z

The parent company of Food Lion, Stop & Shop and Hannaford said it was dealing with a cybersecurity issue and took some systems offline as a precaution. Websites and apps for several chains were unavailable, and unfulfilled online orders were refunded. The company began a controlled relaunch of certain systems. Public reporting so far does not name a cause or an attacker.

urn:cyber-watch:ot-french-fridges 2026-10-12T00:00:00Z

Overnight on October 11 to 12, attackers remotely pushed refrigeration systems into defrost mode. Temperatures reached 50 degrees Celsius in some cold rooms, food was spoiled and some fires started. Affected chains include Intermarché, Carrefour (80 stores), Coopérative U, Monoprix and Netto, and reporting cites upward of 350 stores. Paris prosecutors opened a criminal investigation. France's CERT-FR said numerous remote controllers were compromised and on October 13 widened its alert from Danfoss AK-SM and AK-SC equipment to Copeland and Dixell XWEB devices. Danfoss said many affected units were end-of-life models it no longer patches, and others ran old firmware. No group has claimed the attack, and other countries may be affected.

urn:cyber-watch:it-canonical-ddos 2026-10-08T00:00:00Z

Canonical's web properties, including ubuntu.com and developer pages, had intermittent outages from a distributed denial-of-service attack on October 8. No group has claimed it. An April attack that disrupted updates was claimed by a group calling itself the Islamic Cyber Resistance in Iraq 313 Team. This item is based on a weekly news review, so treat details as preliminary.

urn:cyber-watch:cr-dprk 2026-10-01T00:00:00Z

Chainalysis, which published its tracing findings on October 1, attributes more than $1 billion of 2026 crypto theft to North Korea-linked actors, and Elliptic separately counts more than 51 suspected North Korean incidents that also push the total past $1 billion. The total includes Drift (about $285 million), KelpDAO (about $292 million) and, on the firms' assessment, Bitget (about $387 million). One report puts North Korea-linked theft in the first half at about $643 million, roughly 55% of all thefts in that period.

urn:cyber-watch:cr-bitget 2026-09-24T00:00:00Z

Bitget detected unauthorized transfers on September 24 and suspended withdrawals. The first estimate was $351.6 million, later revised to about $387.5 million to $388 million, taken from hot and warm wallets. Bitget says cold storage was not affected, that its protection fund covers all customer losses, and that the attacker used a vulnerability in third-party security software to obtain internal credentials and insert fraudulent withdrawal instructions. No CVE or vendor has been named, so that claim is unverified. Bitget engaged Mandiant and SlowMist, resumed bitcoin withdrawals around September 27 and 28, and said North Korea is very likely responsible. Chainalysis later traced stolen XRP into bitcoin. No law-enforcement agency has confirmed attribution.

urn:cyber-watch:it-ransomware-trend 2026-09-15T00:00:00Z

NCC Group counted 1,073 ransomware victims in August, a 2026 high. Breachsense counted 964 for August and 789 for September across 79 active groups, so totals differ by method. Qilin (164 incidents) and The Gentlemen (116) led in August. Healthcare was the most targeted sector in September for the fourth month in a row, and the United States accounted for 41% of victims.

urn:cyber-watch:it-edge-kev 2026-09-15T00:00:00Z

CISA's known-exploited-vulnerability additions between August and October included SonicWall SMA1000 appliances (two flaws on September 2), MikroTik RouterOS (three flaws across September 10 and 25), JFrog Artifactory, BerriAI LiteLLM and Kestra (all September 2), and repeated Microsoft SharePoint entries. Under its directive BOD 26-04, US federal agencies must prioritize listed flaws on internet-exposed assets that give full control, and check for prior compromise before patching.

urn:cyber-watch:cr-q3-trend 2026-09-15T00:00:00Z

Hacken counts $1.18 billion stolen across 107 incidents in the third quarter, the highest since early 2025. About 77% came from compromised suppliers, developer tools or infrastructure rather than flaws in smart contracts, and the four largest incidents made up about 80% of the value. PeckShield counted 50 incidents worth $136 million in August and 55 worth about $766 million in September, while CertiK counted 97 incidents and about $768 million for September. TRM Labs counted about $972 million across 207 incidents in the first half. Totals differ by tracker and method.

urn:cyber-watch:cr-liquid 2026-09-06T00:00:00Z

On September 6, attackers drained about 4,000 BTC, roughly $319 million, from the reserve wallet of the Liquid Network, a Bitcoin sidechain built and run by Blockstream. TRM Labs' reconstruction points to a flaw in how the Elements software caches the results of range-proof checks, which may have let an invalid output pass as already verified. The attackers minted unbacked L-BTC and requested a withdrawal, and the signers approved it because the software treated the chain as valid. Blockstream said none of its signing keys were compromised and has patched the bug. On September 7 the attackers returned about 3,400 BTC (about 85%) and kept about 598 BTC, calling it a bounty and describing themselves as white-hat hackers, which is unverified. As of September 8 the network was paused and redemptions halted.

urn:cyber-watch:cr-tectonic 2026-08-30T00:00:00Z

On August 30, an attacker inflated the price of Tectonic's thinly traded TONIC token about 100-fold within 20 minutes, according to on-chain researcher Weilin Li, and used it as collateral to borrow other assets from the largest lending protocol on Cronos. Early estimates put the loss near $75 million. About 36 minutes after the attack began, validators halted the chain, then agreed to roll it back by about one hour and 54 minutes. Cronos later said the attacker had borrowed about $120 million, that the rollback reversed about $111 million of it, and that about $9.2 million had already left through bridges and remains unrecovered. Crypto.com said its app and exchange were not affected.

urn:cyber-watch:ot-colorado 2026-08-15T00:00:00Z

Colorado officials said that in late August, foreign actors changed equipment settings, disabled remote access and alarms, and altered pumping cycles at two small private water providers, each serving fewer than 200 people. Operators regained control, and officials said treatment and water quality were not affected. The utilities and the attackers have not been named. Officials said they know of Iranian activity against water systems but there is no confirmation that these incidents belong to the same campaign. The EPA says more than 100 water and wastewater systems in 12 states have been targeted this year.

urn:cyber-watch:ot-tankers 2026-08-07T00:00:00Z

US Coast Guard and FBI teams boarded the tanker VL Prosperity on August 21 and a second tanker on August 24 after indications that both vessels' networks were compromised. Iranian state media reported the VL Prosperity lost communications for more than 30 hours around August 7 near the Strait of Gibraltar. Bloomberg later reported investigators found that hackers accessed a digital system connected to the ship's propulsion, and investigators have not said whether they tried to manipulate it. Crew claims relayed by Iranian media about engine speed and cooling are unverified. The Coast Guard has not attributed the attacks and reported no operational disruption, danger to crew or environmental harm. By September, US agencies were tracking cyber threats against nearly 20 vessels. North Carolina Ports separately reported a cyberattack on August 6 that forced manual operations.

urn:cyber-watch:cr-coldcard 2026-07-31T00:00:00Z

Starting July 31, attackers began draining bitcoin from wallets created on Coldcard Mk3 devices. Galaxy Research estimates losses above $115 million, possibly over $130 million, says it has spoken with more than 200 victims, and believes at least 15 separate attackers were exploiting the flaw. Coinkite, the maker, said a firmware bug present since version 4.0.1 in March 2021 made the device fall back to weaker software-generated randomness when creating seeds, which let attackers guess recovery phrases. Coinkite said the bug went unnoticed for years and urged users to update or move their funds off the device.

urn:cyber-watch:ot-cisa-water 2026-07-30T00:00:00Z

On July 30, CISA warned water and wastewater operators that threat actors target utilities of all sizes, and that even mature programs should check external connections, including cellular modems installed by operators, vendors or integrators that may not be documented. In an update reported in late August, CISA said it saw malicious activity against more than 100 internet-exposed systems in the sector in July, most commonly controllers connected directly to a cellular modem. It reported no significant disruption to water service. The FBI has urged utilities to disconnect systems from the internet where possible and be ready to revert to manual controls.

urn:cyber-watch:ot-minnesota 2026-07-26T00:00:00Z

Between July 26 and 27, a coordinated cyberattack disrupted water and wastewater operations across more than 30 Minnesota communities, according to Tenable's summary. Some automated controls were affected and Maple Plain declared a local state of emergency. In Plymouth, only equipment connected over cellular links was hit and manual operation kept water flowing. Separately, cyber activity caused a pressure drop at the Clayton County Water Authority in Georgia, prompting a boil-water advisory for 300,000 customers, with service restored within hours. A federal investigation is pending and attribution is not confirmed, although the timing matches the Iran-linked controller activity in CISA's advisory.

urn:cyber-watch:ot-iran-plc 2026-07-22T00:00:00Z

A joint advisory from US agencies including CISA, the FBI, NSA and EPA, first published April 7, said Iranian-affiliated actors were exploiting internet-exposed Rockwell Automation and Allen-Bradley programmable logic controllers (PLCs) and disrupting US organizations in government services, water and energy, with disruptions since at least March. A July 22 update added detection guidance for malicious changes to reusable code modules in PLC programs, and said activity against ports used by Schneider Electric and Siemens equipment suggests opportunistic targeting of other vendors. Researchers link the activity to CyberAv3ngers, a group tied to Iran's IRGC.

urn:cyber-watch:it-stadler 2026-07-21T00:00:00Z

The Swiss rail manufacturer said criminals used compromised login details to reach a data-exchange platform shared with a supplier in mid-July, exposing the supplier's technical information. The Everest group demanded about 10 million Swiss francs (roughly $12.3 million). Stadler refused, filed a criminal complaint and said its own IT systems, production and trains in service were not affected. Everest later listed Stadler on its leak site, according to SOCRadar.

urn:cyber-watch:it-shinyhunters-wave 2026-07-15T00:00:00Z

In May the ShinyHunters group named Charter Communications, the parent of Spectrum, in a pay-or-leak extortion campaign. In July, data tied to about 1.6 million unique email addresses from RingCentral appeared in material the group published. These figures come from analysis of the group's own postings, and security reporters note that the group has a record of overstating its hauls.

urn:cyber-watch:it-sharepoint 2026-07-14T00:00:00Z

On-premises SharePoint was exploited repeatedly in July. CVE-2026-58644, an unauthenticated deserialization flaw rated 9.8, was used as a zero-day before Microsoft's July 14 fix. A sibling flaw, CVE-2026-50522, also rated 9.8, was exploited soon after public proof-of-concept code appeared around July 20, and CISA listed it on July 22. Attackers were reported stealing server machine keys to keep access. SharePoint Online is not affected.

urn:cyber-watch:ot-zionsiphon 2026-06-15T00:00:00Z

Darktrace flagged ZionSiphon, malware built for industrial environments and aimed at Israeli water treatment and desalination systems. According to Bitsight's summary, it scans for industrial devices over several protocols and has sabotage capability aimed at chlorine and pressure controls. Bitsight says it may have been circulating since mid-2025.

urn:cyber-watch:cr-bridges-keys 2026-06-15T00:00:00Z

After the April thefts came a series of mid-sized ones. THORChain lost about $10.7 million on May 15 when a malicious node operator abused a flaw in its threshold-signature scheme. The Verus Ethereum bridge lost about $11.6 million on May 18 because of a missing check that let a forged proof pass. The Syscoin bridge lost about $10 million on June 7 after a parsing error in proof validation allowed unauthorized tokens to be minted. On June 8, Humanity Protocol lost about $31 million to $36 million after malware on a developer's laptop exposed seven private keys. Amounts vary by tracker.

urn:cyber-watch:it-cisco-sdwan 2026-06-04T00:00:00Z

Cisco confirmed exploitation of CVE-2026-20245, a command-injection flaw in Catalyst SD-WAN Manager, Controller and Validator that lets an attacker who already has administrator-level access run commands as root. CISA added it to its list of known exploited vulnerabilities on June 4. Mandiant later reported it was used as a zero-day at least two months before disclosure, chained with earlier SD-WAN authentication flaws (CVE-2026-20127 and CVE-2026-20182). It is the seventh Cisco SD-WAN vulnerability exploited in 2026.

urn:cyber-watch:it-dentaquest 2026-05-15T00:00:00Z

DentaQuest says a May network breach affected 15 million people, exposing Social Security numbers and dental or vision health information. It is described as the largest US health data breach reported so far in 2026.

urn:cyber-watch:it-carnival 2026-05-15T00:00:00Z

Carnival's notice says it found unauthorized activity involving an employee account on April 14. The company said an unauthorized actor used social engineering to trick an employee into giving access to a limited part of its IT systems. An industry summary puts the number of affected customers at about 6 million. The breach was made public in May.

urn:cyber-watch:ot-sandworm 2026-05-14T00:00:00Z

Nozomi Networks research reports that the Russian state-linked group Sandworm continues to target industrial and critical infrastructure using aggressive lateral movement and older malware, and that its activity intensifies after detection instead of stopping. Affected sectors include manufacturing and transportation. Targets included engineering workstations, operator screens (HMIs), PLCs, remote terminal units and other field controllers.

urn:cyber-watch:it-canvas 2026-05-07T00:00:00Z

Instructure, the company behind the Canvas learning platform, confirmed unauthorized activity in late April. The ShinyHunters extortion group claimed responsibility, set ransom deadlines and on May 7 defaced the login pages of roughly 330 institutions. Canvas was taken offline briefly and restored the next day. On May 11 Instructure said it had reached an agreement with the actor and received confirmation that the data was destroyed. Claims of hundreds of millions of records have not been verified.

urn:cyber-watch:it-supply-chain 2026-04-22T00:00:00Z

A campaign that Microsoft attributes to a group called TeamPCP compromised developer and security tooling. Attackers hijacked the release pipeline of the Trivy scanner, then reached Checkmarx KICS and LiteLLM. On April 22 a malicious Bitwarden CLI package (version 2026.4.0) was live on npm for 93 minutes, built to steal developer credentials such as GitHub tokens and cloud keys. Bitwarden said vault data and production systems were not affected. In August, CloudSEK published a lookup of thousands of potentially affected organizations.

urn:cyber-watch:cr-kelpdao 2026-04-18T00:00:00Z

On April 18, attackers got the Kelp bridge to release 116,500 rsETH tokens, worth about $290 million, using a forged cross-chain message. LayerZero's post-mortem says the attackers took over two RPC nodes that its verifier relied on, then flooded the other nodes with a denial-of-service attack so the verifier switched to the compromised ones, and the malicious software then erased its traces. LayerZero said it preliminarily links the attack to North Korea's Lazarus Group (its TraderTraitor unit) and blames Kelp's setup, which used a single verifier. Kelp has disputed that account. LayerZero said it will no longer sign messages for applications that use a single verifier.

urn:cyber-watch:it-fbi-surveillance 2026-04-15T00:00:00Z

The FBI declared a major cyber incident in April, which triggers a legally required disclosure to Congress, after finding that one of its surveillance systems had been compromised. Reports say the breach could have exposed phone numbers of people under surveillance. TechCrunch's roundup describes a second major incident involving ATF surveillance systems.

urn:cyber-watch:cr-drift 2026-04-01T00:00:00Z

Drift, a trading protocol on the Solana blockchain, confirmed on April 2 that attackers drained about $285 million of user assets on April 1, in roughly 12 minutes. TRM Labs reports that attackers got members of Drift's Security Council to pre-sign transactions that looked routine but carried hidden permissions for administrative actions, then used a worthless token with a staged price history as collateral to withdraw real assets. Drift tied the operation to a six-month social-engineering effort by suspected North Korean actors, and TRM also judges North Korean hackers likely responsible. That view rests on on-chain indicators, not a government finding.