-
October 23October 17 to 24, 2026
October bridge and chain exploits are small one by one, and a $718 million monthly figure is unverified
Cysic's BNB Chain bridge lost about $727,000 on October 17 after attackers used access to a supporting database to feed it a forged message that minted 10 million unauthorized tokens. The WAX multi-chain bridge lost about $90,500 on October 22 because a missing input check accepted a negative fee value. Initia halted its chain after a flaw in how its MoveVM caches scripts let attackers mint tokens, with losses of about $2.6 million to $2.7 million. Chainalysis data cited by Blockworks puts October DeFi losses at $718 million across 11 hacks, 82% from bridges, but one analyst could not confirm that against a primary Chainalysis release and found the verified bridge incidents total far less. Separately, CoinDCX denied a report of about $16 million leaving its wallets, saying the addresses date from its 2025 breach.
Why it matters, what to do and sources
Why it matters
The pattern matches the larger thefts: the weak point is the off-chain infrastructure and verification logic around a bridge, not arithmetic inside the contracts.
What defenders can take from it
- Harden the databases and services that feed instructions to a bridge, and be able to halt within minutes. Initia halted about 42 minutes after the exploit began.
- Treat monthly loss totals as estimates and check which tracker produced them.
Sources
-
October 21Exploitation attempts from October 17, fixes October 21, 2026
PHP ships emergency fixes for two critical 'PHP2Shell' flaws after attackers start probing days earlier
The PHP project released emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, two critical flaws that let an unauthenticated attacker run code on a web server through PHP's memory handling and upload-progress feature. Researchers at Wiz, Calif and OpenAI are credited with finding them. Details leaked before the planned October 22 disclosure, so the release was brought forward. Amazon Threat Intelligence reports exploitation attempts from October 17, four days before the fixes, and says the flaws are now being broadly exploited, although it is unclear how many attacks succeed. The NSA advised taking sites that cannot be patched offline, and UK government websites went dark as a precaution. VulnCheck says hundreds of public proof-of-concept repositories exist but very few contain working exploits, and that it has built a working bypass of the ASLR memory protection.
Why it matters, what to do and sources
Why it matters
PHP runs a large share of websites, so a long tail of unpatched and unsupported servers is expected. Defenders are warned not to assume the disclosure date was the earliest exploitation.
What defenders can take from it
- Update to a fixed PHP release now, or take sites that cannot be patched offline.
- Watch for unexpected child processes spawned by PHP workers such as php-fpm or Apache, a sign of exploitation.
- Inventory forgotten and out-of-support PHP installations, since those will stay exploitable.
Sources
-
October 21October 21, 2026
LiteLLM release pipeline hijacked to publish a credential-stealing version, the second time this year
On October 21 attackers published LiteLLM version 1.107.0 to PyPI and to its official Docker images. It carried an infostealer and a remote access trojan, and was live for roughly two hours (11:39 to 13:23 UTC on PyPI). LiteLLM says the attackers used GitHub CLI tokens stolen from three engineers' accounts, reportedly found in the logs of an internal deployment, to disable branch protections and run its release workflow against a lookalike repository, so the build looked legitimate. LiteLLM says earlier versions are safe and its private enterprise release was not affected. There is no CVE. Datadog tied the earlier March compromise to TeamPCP; none of the sources reviewed attribute this one.
Why it matters, what to do and sources
Why it matters
LiteLLM sits between applications and AI providers, so it holds provider API keys, cloud identities and database credentials. It has about 23 million weekly downloads.
What defenders can take from it
- If 1.107.0 was installed or a Docker image was pulled in that window, treat the host as compromised and rotate every key it could reach.
- Pin to a confirmed-safe version such as 1.106.2 instead of installing the latest.
- Maintainers: lock release workflows to approved repositories and treat developer CLI tokens as high-value secrets.
Sources
-
October 21October 21, 2026
GitLab fixes a maximum-severity remote code execution flaw reaching back to version 7.0
On October 21 GitLab released patches for CVE-2026-110264, scored 10.0. An integer overflow while compiling a crafted regular expression could let an unauthenticated attacker run code on self-managed GitLab CE and EE servers. The affected code dates to 2014. GitLab.com is already fixed. GitLab did not say whether the flaw has been exploited, and as of October 22 it was not on CISA's exploited list. Servers patched on October 12 for an earlier critical regex flaw (CVE-2026-97229) are still affected, and there is no workaround.
Why it matters, what to do and sources
Why it matters
A self-hosted GitLab server holds source code, pipeline settings and secrets, so a takeover can reach well beyond the server itself.
What defenders can take from it
- Upgrade to the fixed release for your version line, for example 19.5.1, 19.4.3 or 19.3.6. The October 12 patch is not enough.
- Keep self-managed GitLab off the public internet where you can, and review recent logs for unusual regular-expression input.
Sources
-
October 16Exploited August 29, disclosed October 16, 2026
China-linked group exploited a BeyondTrust Remote Support zero-day
BeyondTrust disclosed CVE-2026-102764 (severity 9.3), a flaw in how an internal messaging component of Remote Support checks where messages come from, which lets a remote attacker perform file operations on the appliance. By BeyondTrust's timeline, a China-nexus espionage group tracked as Armory Castle (also UNC5221 or Warp Panda) used it as a zero-day on a single self-hosted appliance on August 29. SaaS customers were patched by October 9. CISA listed the flaw on October 16 with a federal deadline of October 19.
Why it matters, what to do and sources
Why it matters
Remote-support tools have privileged reach into many endpoints, which makes them valuable to espionage groups.
What defenders can take from it
- Self-hosted customers should patch immediately and follow CISA's advisory, including checking for earlier compromise.
- Limit internet exposure of remote-support appliances.
Sources
-
October 162026
Al Jazeera devices infected with spyware delivered through targeted ads
Al Jazeera reported that dozens of its journalists' devices were infected with spyware designed to collect sensitive data, and called it an assault on press freedom. As relayed by Democracy Now, Citizen Lab corroborated the findings: an Israeli advertising-technology company, Discover-Tech, used personalized ads to deliver spyware from Candiru, a firm the US government blacklisted in 2021. The infections are described as zero-click, meaning the target did not need to tap anything.
Why it matters, what to do and sources
Why it matters
Advertising networks can be used as a delivery route to specific people, which is hard for the target to notice or block.
What defenders can take from it
- High-risk users such as journalists and activists should keep devices fully updated and turn on lockdown-style protections where available.
- Organizations that protect at-risk staff should have a route to specialist help.
Sources
-
October 16October 10 to 22, 2026
China-aligned group used an AI pentest tool against ConnectWise Cloud Backup and more than 2,250 Microsoft 365 tenants
ConnectWise disclosed on October 16 that application identities of its Cloud Backup product, formerly SkyKick and used by IT service providers to back up customers' Microsoft 365 data, were accessed without authorization. It took the service offline on October 17, finished resetting credentials by October 19 and began restoring in phases on October 21. Microsoft attributes the campaign to Storm-0940, a China state-aligned group, which used an open-source agentic AI penetration-testing framework called ARTEX for scanning, password spraying and abuse of OAuth apps. Microsoft says the group tried to sign in to more than 2,250 customer tenants. Most attempts failed, but it gained privileged cloud persistence at several organizations, in some cases in under three hours. ConnectWise says it has no sign that backup data was taken and warns that access already set up inside customer tenants needs separate review. China's embassy rejected the accusation.
Why it matters, what to do and sources
Why it matters
One trusted app with permission inside many customers' Microsoft 365 environments gave the attackers a single door to many victims. Microsoft calls it one of many AI-driven attacks since early October.
What defenders can take from it
- Review which third-party apps have consent in your Microsoft 365 tenant and remove ones you do not use.
- Ask your IT provider whether it uses ConnectWise Cloud Backup or SkyKick, and what it found.
- After service is restored, confirm backup jobs are completing and that a test recovery works.
Sources
-
October 142026
Palo Alto Networks patches an exploited PAN-OS zero-day
Palo Alto Networks released fixes on October 14 for CVE-2026-0322 (severity 8.6) and said it had seen very limited exploitation. The flaw is in the management interface and lets an authenticated attacker with network access run code as root on PA-Series and VM-Series firewalls and Panorama. Cloud NGFW and Prisma Access are not affected. CISA set a federal deadline of October 17. The same week brought a fix for an exploited Ivanti Connect Secure zero-day and a Cisco warning about an exploited Secure Email Gateway flaw.
Why it matters, what to do and sources
Why it matters
A firewall is meant to protect the network, so root access on one gives an attacker a strong position. It is also the second exploited PAN-OS flaw in about five months.
What defenders can take from it
- Allow management interfaces only from trusted internal networks.
- Upgrade to a fixed version now, and review who has management accounts.
Sources
-
October 14Published October 13 to 14, 2026
Booz Allen: AI models reached every goal in a lab test against industrial control equipment
This is a lab experiment, not a real attack. Booz Allen tested frontier AI models against an isolated industrial testbed at its lab in Chantilly, Virginia, built to resemble a manufacturing plant with real controllers, a SCADA platform, a motor drive, sensors and a robotic arm. The models were given only network boundaries, with no source code, engineering documents or OT guidance, and the company says they reached every objective across eight scenarios. In one run a model went from a perimeter breach to acting inside the control network in just over 16 minutes. In another it located the robotic arm and moved it. Existing defenses slowed or blocked some actions but no single safeguard consistently stopped the models, and the models were not named. Reporting says the AI mostly used the devices' own protocols and default passwords, not new exploits, and that the tests paused for human approval before physical actions. Dark Reading adds that Booz Allen left some unpatched vulnerabilities in place, so the timing excludes time to develop new exploits, and outlets differ slightly on what the final physical step was. The results come from the company's own report and have not been independently reproduced.
Why it matters, what to do and sources
Why it matters
The finding is about speed and skill, not a new kind of flaw. Tasks that normally need several experts, such as finding devices, researching them and planning steps, were done by software in minutes, which leaves less time for human defenders to react and weakens the idea that obscure industrial systems are safe because they are hard to understand.
What defenders can take from it
- Remove default passwords and unneeded device protocols from industrial networks.
- Segment networks so one breach cannot reach controllers, and remove implicit trust between zones.
- Detect consequential changes to industrial equipment quickly, and limit what an attacker can affect after gaining access.
Sources
-
October 132026
Microsoft's October Patch Tuesday sets a record at about 1,400 fixes
Microsoft fixed roughly 1,400 vulnerabilities on October 13. Published counts range from 1,407 to 1,413 depending on method, against about 970 in September. One zero-day, a Windows Shell bypass of the Mark of the Web protection (CVE-2026-96951), was already being exploited, and two others were publicly disclosed. Microsoft ties the rising volume to AI-assisted vulnerability discovery. One analysis puts monthly industry-wide CVE disclosures up 145% in two years, from 3,173 in June 2024 to 7,765 in June 2026.
Why it matters, what to do and sources
Why it matters
Patch volume now exceeds what many teams can test and deploy, so prioritization decides outcomes.
What defenders can take from it
- Patch exploited and publicly disclosed flaws first, then the rest by exposure.
- Confirm that systems reached the target build, not just that an update was installed.
Sources
-
October 122026
Ahold Delhaize says a cyberattack disrupted services in Europe and the US
The parent company of Food Lion, Stop & Shop and Hannaford said in mid-October it was dealing with a cybersecurity issue and took some systems offline, including brand websites and apps, while stores stayed open. On October 20 it confirmed the incident also disrupted services at stores across Europe and said it had filed a police report with the Dutch police. Belgian e-commerce was fully operational again, and US e-commerce was expected back in the coming days. Unfulfilled online orders were refunded. The company says the incident was caused by the malicious actions of others, but public reporting does not name an attacker or say whether systems were encrypted. It is the second major attack on the group since a November 2024 breach that exposed data on about 2.2 million people.
Why it matters, what to do and sources
Why it matters
Retail groups depend on shared back-end systems, so a precautionary shutdown can disrupt many brands at once.
What defenders can take from it
- Practice running the business with e-commerce and shared systems offline, and decide in advance who can order a shutdown.
Sources
-
October 12October 11 to 12, 2026
Hackers force defrost cycles in refrigeration systems at hundreds of French supermarkets
Overnight on October 11 to 12, attackers remotely pushed refrigeration systems into defrost mode. Temperatures reached 50 degrees Celsius in some cold rooms, food was spoiled and some fires started. Affected chains include Intermarché, Carrefour (80 stores), Coopérative U, Monoprix and Netto, and reporting cites upward of 350 stores. Paris prosecutors opened a criminal investigation. France's CERT-FR said numerous remote controllers were compromised and on October 13 widened its alert from Danfoss AK-SM and AK-SC equipment to Copeland and Dixell XWEB devices. Danfoss said many affected units were end-of-life models it no longer patches, and others ran old firmware. Reported effects include defrost cycles stretched from about one hour to eight and delayed alarms, and some stores closed for a time. Authorities have not attributed the attack and no group has claimed it, and other countries may be affected. Forescout says a key open question is whether the attackers reached the controllers through individually exposed interfaces or through shared maintenance infrastructure. Other counts go above 500 stores: the Mousquetaires group (Intermarché, Netto) said 300 of its stores were hit and Coopérative U said 80. The Paris prosecutor's cybercrime section is leading the investigation with the national anti-cybercrime office. Claroty counted 2,765 exposed Danfoss controllers still online, and CERT-FR's October 13 update warned the attack campaigns were probably still active. A summary from Spain's INCIBE puts losses at tens of millions of euros.
Why it matters, what to do and sources
Why it matters
This is everyday commercial equipment, not a power plant, and the weaknesses were known: Claroty's Team82 had published research on the Danfoss AK-SM 800A controller on August 9, and a Danfoss bulletin already described earlier attacks.
What defenders can take from it
- Remove building and refrigeration management systems from direct internet exposure.
- Replace controllers that no longer receive updates, and hold service providers to strict remote-access rules.
- Check CERT-FR's alert for the affected product lines.
- Watch for unauthorized defrost commands and suppressed alarms, and keep independent temperature sensors that the control system cannot switch off.
Sources
- OCCRP: hackers turn French supermarket refrigerators into furnaces
- TechInformed: French supermarket cyberattack triggers wider security alert
- BleepingComputer: cyberattack shuts down refrigerators at French supermarkets
- BetaNews: attack on French supermarket fridges hit outdated Danfoss controllers
- Industrial Cyber: French supermarket cyberattack exposes risks of unsecured remote access and legacy refrigeration systems
- INCIBE-CERT: cyberattack on supermarket refrigeration systems in France
-
October 9October 9 to 15, 2026
Tampered Ledger wallets sold through a reseller drain an estimated $90 million to $93 million
Thefts began around October 9 from more than 300 wallets, mostly in Southeast Asia, with estimates of $90 million to $93 million across several blockchains. Ledger confirmed on October 10 that an affected customer's device contained an unauthorized hardware implant. Ledger says a highly organized criminal group bought genuine devices, fitted implants able to read recovery phrases, and fed them back into the supply chain through resellers. The confirmed cases involved purchases through the reseller CryptoBilis. Ledger says its chip, operating system and servers were not compromised and its own sales channel was unaffected. One report says a researcher found a similarly modified device at a German retailer. Ledger has told recent reseller customers not to set up new devices.
Why it matters, what to do and sources
Why it matters
This was not a software bug. Genuine devices were physically altered before sale, and according to one analysis the leak channel used the device's own cellular hardware, so antivirus or network monitoring would see nothing. No attacker has been identified.
What defenders can take from it
- Buy hardware wallets only directly from the maker, and check the device and packaging for signs of tampering.
- If you bought a wallet from a reseller recently, follow the maker's integrity-check instructions before using it.
Sources
-
October 82026
Canonical's websites hit by a second DDoS attack this year
Canonical's web properties, including ubuntu.com and developer pages, had intermittent outages from a distributed denial-of-service attack on October 8. No group has claimed it. An April attack that disrupted updates was claimed by a group calling itself the Islamic Cyber Resistance in Iraq 313 Team. This item is based on a weekly news review, so treat details as preliminary.
Why it matters, what to do and sources
Why it matters
Software distribution sites are shared infrastructure. When they are unreachable, updates are delayed for many users.
What defenders can take from it
- Mirror critical packages internally so updates do not depend on one public site.
Sources
-
October 7October 7, 2026
Ransomware takes down part of Japan's IDCF Cloud, affecting 495 organizations
At about 3:40 a.m. on October 7, ransomware hit East Japan Region 1 of IDCF Cloud, run by IDC Frontier, a SoftBank subsidiary. The company says 495 companies and local governments were affected, and websites of a prefecture and city governments went dark. On October 8 IDC Frontier said data in four zones of the region was unlikely to be recoverable by the provider, so restoration depends on customers' own backups. As of October 14 other zones and regions were reported unaffected, with safety checks continuing. No group has claimed it and the ransom note named none, and IDC Frontier has not said how the attackers got in. A frozen-food logistics firm, Nissui Logistics, had a separate outage whose link to the attack is unclear.
Why it matters, what to do and sources
Why it matters
Customers who kept backups and snapshots only with the provider had nothing to restore from. The attackers' message claimed it took seven minutes to encrypt the region, which is their claim, not a confirmed figure.
What defenders can take from it
- Keep at least one backup outside your cloud provider's control, and test restoring from it.
- List which of your suppliers host on a single provider or region, and plan for that provider being offline.
Sources
-
October 1Reported October 2026
Chainalysis: North Korea-linked actors have stolen more than $1 billion in crypto this year
Chainalysis, which published its tracing findings on October 1, attributes more than $1 billion of 2026 crypto theft to North Korea-linked actors, and Elliptic separately counts more than 51 suspected North Korean incidents that also push the total past $1 billion. The total includes the April thefts from Drift (about $285 million) and KelpDAO (about $292 million), which now fall before this six-month window, and, on the firms' assessment, Bitget (about $387 million). One report puts North Korea-linked theft in the first half at about $643 million, roughly 55% of all thefts in that period.
Why it matters, what to do and sources
Why it matters
Attributions come from private analytics firms and company statements, based on on-chain patterns and timing, and are not formal government findings. The two firms count differently, so the total is an estimate.
What defenders can take from it
- Assume that staff at crypto firms are targets of long, patient social-engineering approaches.
- Verify job offers, investor meetings and support contacts through a second channel.
Sources
-
September 242026
Bitget loses about $388 million from hot wallets, and its CEO cites third-party security software
Bitget detected unauthorized transfers on September 24 and suspended withdrawals. The first estimate was $351.6 million, later revised to about $387.5 million to $388 million, taken from hot and warm wallets. Bitget says cold storage was not affected, that its protection fund covers all customer losses, and that the attacker used a vulnerability in third-party security software to obtain internal credentials and insert fraudulent withdrawal instructions. No CVE or vendor has been named, so that claim is unverified. Bitget engaged Mandiant and SlowMist, resumed bitcoin withdrawals around September 27 and 28, and said North Korea is very likely responsible. Chainalysis later traced stolen XRP into bitcoin. No law-enforcement agency has confirmed attribution.
Why it matters, what to do and sources
Why it matters
The attackers did not need to steal private keys. They went through a security product the exchange itself relied on, and one forensic report puts the earliest suspicious activity about 25 days before the theft.
What defenders can take from it
- Treat the security tools you run as part of your attack surface and keep their management interfaces off the internet.
- Add independent approval for withdrawals so that one set of stolen credentials is not enough.
Sources
-
SeptemberAugust and September 2026
Ransomware stays near record levels, led by Qilin and The Gentlemen
NCC Group counted 1,073 ransomware victims in August, a 2026 high. Breachsense counted 964 for August and 789 for September across 79 active groups, so totals differ by method. Qilin (164 incidents) and The Gentlemen (116) led in August. Healthcare was the most targeted sector in September for the fourth month in a row, and the United States accounted for 41% of victims.
Why it matters, what to do and sources
Why it matters
These counts only include victims listed on leak sites. Many victims pay before being listed, so real numbers are higher.
What defenders can take from it
- Keep offline, tested backups and require multi-factor authentication on all remote access.
- Rehearse your incident response plan, including who decides about payment.
Sources
-
SeptemberAugust to October 2026
Network edge devices and AI tooling keep appearing on CISA's exploited list
CISA's known-exploited-vulnerability additions between August and October included SonicWall SMA1000 appliances (two flaws on September 2), MikroTik RouterOS (three flaws across September 10 and 25), JFrog Artifactory, BerriAI LiteLLM and Kestra (all September 2), and repeated Microsoft SharePoint entries. Under its directive BOD 26-04, US federal agencies must prioritize listed flaws on internet-exposed assets that give full control, and check for prior compromise before patching. On October 14 CISA also listed two chained flaws in the AhsayCBS backup server (CVE-2026-105133 and CVE-2026-105134). Huntress first saw exploitation on October 7 and had seen five organizations targeted by October 8, and Ahsay said on October 12 that its earlier patches did not fully fix them.
Why it matters, what to do and sources
Why it matters
The list shows what attackers actually use: remote-access gear, routers, and developer and AI tooling that is often exposed to the internet.
What defenders can take from it
- Use the CISA list to decide what to patch first. It is free and updated continuously.
- Inventory internet-facing appliances, and check for signs of compromise before applying fixes.
Sources
-
SeptemberThird quarter 2026
Crypto theft reaches $1.18 billion in the third quarter, mostly through suppliers and infrastructure
Hacken counts $1.18 billion stolen across 107 incidents in the third quarter, the highest since early 2025. About 77% came from compromised suppliers, developer tools or infrastructure rather than flaws in smart contracts, and the four largest incidents made up about 80% of the value. PeckShield counted 50 incidents worth $136 million in August and 55 worth about $766 million in September, while CertiK counted 97 incidents and about $768 million for September. TRM Labs counted about $972 million across 207 incidents in the first half. Totals differ by tracker and method.
Why it matters, what to do and sources
Why it matters
The money is concentrated in a few large thefts, and most of them started with people or third-party systems, not clever code exploits.
What defenders can take from it
- Spend security effort on key management, vendor access and staff verification as well as on code audits.
- Treat any single loss figure as an estimate and check which tracker produced it.
Sources
-
September 6September 6 to 7, 2026
Liquid Network drained of about $319 million in bitcoin, and 85% is returned
On September 6, attackers drained about 4,000 BTC, roughly $319 million, from the reserve wallet of the Liquid Network, a Bitcoin sidechain built and run by Blockstream. TRM Labs' reconstruction points to a flaw in how the Elements software caches the results of range-proof checks, which may have let an invalid output pass as already verified. The attackers minted unbacked L-BTC and requested a withdrawal, and the signers approved it because the software treated the chain as valid. Blockstream said none of its signing keys were compromised and has patched the bug. On September 7 the attackers returned about 3,400 BTC (about 85%) and kept about 598 BTC, calling it a bounty and describing themselves as white-hat hackers, which is unverified. As of September 8 the network was paused and redemptions halted.
Why it matters, what to do and sources
Why it matters
It was the biggest theft of 2026 at that point, and the money came back only because the attackers chose to return it. The signers followed their rules and still approved a bad transaction.
What defenders can take from it
- Treat shortcuts in verification code, such as caches, as security-critical and test them against invalid input.
- Add withdrawal limits and delays so a bug cannot empty a reserve in minutes.
Sources
-
August 302026
Tectonic exploit forces the Cronos chain to halt and roll back
On August 30, an attacker inflated the price of Tectonic's thinly traded TONIC token about 100-fold within 20 minutes, according to on-chain researcher Weilin Li, and used it as collateral to borrow other assets from the largest lending protocol on Cronos. Early estimates put the loss near $75 million. About 36 minutes after the attack began, validators halted the chain, then agreed to roll it back by about one hour and 54 minutes. Cronos later said the attacker had borrowed about $120 million, that the rollback reversed about $111 million of it, and that about $9.2 million had already left through bridges and remains unrecovered. Crypto.com said its app and exchange were not affected.
Why it matters, what to do and sources
Why it matters
The rollback saved most of the money but erased legitimate transactions from that window, a trade-off only some networks can make. The attack follows the price-manipulation pattern seen in the 2022 Mango Markets case.
What defenders can take from it
- Do not accept thinly traded tokens as collateral without strict limits.
- Decide ahead of time who may halt or roll back a chain, and how that decision gets made.
Sources
-
AugustMarch to August 2026
Security tools turned into credential stealers in a supply-chain campaign
A campaign that Microsoft attributes to a group called TeamPCP compromised developer and security tooling. Attackers hijacked the release pipeline of the Trivy scanner, then reached Checkmarx KICS and LiteLLM. On April 22 a malicious Bitwarden CLI package (version 2026.4.0) was live on npm for 93 minutes, built to steal developer credentials such as GitHub tokens and cloud keys. Bitwarden said vault data and production systems were not affected. In August, CloudSEK published a lookup of thousands of potentially affected organizations. In October a separate compromise hit LiteLLM again (see its own entry); none of the sources reviewed link that one to TeamPCP.
Why it matters, what to do and sources
Why it matters
Scanners and command-line tools run inside build systems where secrets are available. In the Trivy case, 76 of 77 tags of its GitHub Action were repointed, so anyone referencing a tag by name pulled the malicious code.
What defenders can take from it
- Pin GitHub Actions and packages to exact versions or commit hashes instead of movable tags.
- If you ran an affected version, rotate every secret that build could see.
- Give build jobs the minimum secrets they need.
Sources
-
AugustLate August 2026, disclosed September 17
Foreign actors alter settings at two small Colorado water utilities
Colorado officials said that in late August, foreign actors changed equipment settings, disabled remote access and alarms, and altered pumping cycles at two small private water providers, each serving fewer than 200 people. Operators regained control, and officials said treatment and water quality were not affected. The utilities and the attackers have not been named. Officials said they know of Iranian activity against water systems but there is no confirmation that these incidents belong to the same campaign. The EPA says more than 100 water and wastewater systems in 12 states have been targeted this year.
Why it matters, what to do and sources
Why it matters
Disabling alarms and remote access is what an attacker does to blind operators. Small operators often have no security staff.
What defenders can take from it
- Keep an independent way to see abnormal pump or pressure behavior that does not rely on the same remote access.
- The EPA reports helping fix about 700 vulnerabilities at more than 500 utilities since fiscal 2025. Small operators can ask it for help.
Sources
-
August 7August to October 2026
Two Texas-bound oil tankers hit by cyberattacks, propulsion-related system reportedly accessed
US Coast Guard and FBI teams boarded the tanker VL Prosperity on August 21 and a second tanker on August 24 after indications that both vessels' networks were compromised. Iranian state media reported the VL Prosperity lost communications for more than 30 hours around August 7 near the Strait of Gibraltar. Bloomberg later reported investigators found that hackers accessed a digital system connected to the ship's propulsion, and investigators have not said whether they tried to manipulate it. Crew claims relayed by Iranian media about engine speed and cooling are unverified. The Coast Guard has not attributed the attacks and reported no operational disruption, danger to crew or environmental harm. By September, US agencies were tracking cyber threats against nearly 20 vessels. North Carolina Ports separately reported a cyberattack on August 6 that forced manual operations.
Why it matters, what to do and sources
Why it matters
A ship is a floating industrial network. Even partial access to systems linked to propulsion is unusual enough to draw federal boarding teams.
What defenders can take from it
- Maritime operators can request anonymized cyber assistance from the Coast Guard.
- Treat shipboard control networks as OT, with segmentation and strict remote-access rules.
Sources
-
July 31July 31 to mid-August 2026
Coldcard hardware-wallet flaw lets attackers guess seed phrases, with losses above $115 million
Starting July 31, attackers began draining bitcoin from wallets created on Coldcard Mk3 devices. Galaxy Research estimates losses above $115 million, possibly over $130 million, says it has spoken with more than 200 victims, and believes at least 15 separate attackers were exploiting the flaw. Coinkite, the maker, said a firmware bug present since version 4.0.1 in March 2021 made the device fall back to weaker software-generated randomness when creating seeds, which let attackers guess recovery phrases. Coinkite said the bug went unnoticed for years and urged users to update or move their funds off the device.
Why it matters, what to do and sources
Why it matters
A flaw in seed generation puts every affected wallet at risk no matter how carefully its owner stored the recovery phrase. The loss estimate comes from Galaxy Research and was still rising.
What defenders can take from it
- If you use a Coldcard Mk3, follow the maker's instructions and move funds to a wallet created with updated firmware.
- Hardware vendors should test that random-number generation really uses the hardware source on every release.
Sources
-
July 30July 30 and late August 2026
CISA says more than 100 internet-exposed water systems were targeted in July
On July 30, CISA warned water and wastewater operators that threat actors target utilities of all sizes, and that even mature programs should check external connections, including cellular modems installed by operators, vendors or integrators that may not be documented. In an update reported in late August, CISA said it saw malicious activity against more than 100 internet-exposed systems in the sector in July, most commonly controllers connected directly to a cellular modem. It reported no significant disruption to water service. The FBI has urged utilities to disconnect systems from the internet where possible and be ready to revert to manual controls.
Why it matters, what to do and sources
Why it matters
The assumption that a very small utility is too small to target no longer holds, and nothing in the advisory describes a new technique.
What defenders can take from it
- Scan your own address space for exposed controllers and modems, and document every cellular connection.
- Replace default credentials and disconnect what does not need to be online.
Sources
-
July 26July 26 to 27, 2026
Coordinated attack disrupts more than 30 Minnesota water systems
Between July 26 and 27, a coordinated cyberattack disrupted water and wastewater operations across more than 30 Minnesota communities, according to Tenable's summary. Some automated controls were affected and Maple Plain declared a local state of emergency. In Plymouth, only equipment connected over cellular links was hit and manual operation kept water flowing. Separately, cyber activity caused a pressure drop at the Clayton County Water Authority in Georgia, prompting a boil-water advisory for 300,000 customers, with service restored within hours. A federal investigation is pending and attribution is not confirmed, although the timing matches the Iran-linked controller activity in CISA's advisory. SecurityWeek reports that the FBI and EPA later said water systems in at least seven states were targeted.
Why it matters, what to do and sources
Why it matters
Small utilities were hit at scale, and the ability to switch to manual operation is what limited the impact.
What defenders can take from it
- Rehearse manual operation of pumps and valves.
- Find every cellular modem and remote-access path to your controllers, including ones installed by vendors.
Sources
-
July 22Published April 7, updated July 22, 2026
US agencies warn that Iran-linked actors are disrupting industrial controllers, then widen the warning
A joint advisory from US agencies including CISA, the FBI, NSA and EPA, first published April 7, said Iranian-affiliated actors were exploiting internet-exposed Rockwell Automation and Allen-Bradley programmable logic controllers (PLCs) and disrupting US organizations in government services, water and energy, with disruptions since at least March. A July 22 update added detection guidance for malicious changes to reusable code modules in PLC programs, and said activity against ports used by Schneider Electric and Siemens equipment suggests opportunistic targeting of other vendors. Researchers link the activity to CyberAv3ngers, a group tied to Iran's IRGC.
Why it matters, what to do and sources
Why it matters
The advisory covers the whole period. It turned an alert about one vendor's products into a warning about any internet-reachable controller.
What defenders can take from it
- Take controllers off the internet, or put them behind a VPN with multi-factor authentication.
- Change default passwords and use the advisory's detection guidance on PLC program changes.
Sources
-
July 21Mid-July 2026
Stadler Rail refuses a 10 million franc demand after a supplier-platform breach
The Swiss rail manufacturer said criminals used compromised login details to reach a data-exchange platform shared with a supplier in mid-July, exposing the supplier's technical information. The Everest group demanded about 10 million Swiss francs (roughly $12.3 million). Stadler refused, filed a criminal complaint and said its own IT systems, production and trains in service were not affected. Everest later listed Stadler on its leak site, according to SOCRadar.
Why it matters, what to do and sources
Why it matters
It shows the current extortion pattern: steal data, skip the encryption, and go through a partner's platform rather than the victim's own network.
What defenders can take from it
- Require multi-factor authentication on shared partner portals.
- Decide your ransom policy before an incident, as Stadler had.
Sources
-
JulyMay to July 2026
ShinyHunters pay-or-leak campaigns reach telecom and communications firms
In May the ShinyHunters group named Charter Communications, the parent of Spectrum, in a pay-or-leak extortion campaign. In July, data tied to about 1.6 million unique email addresses from RingCentral appeared in material the group published. These figures come from analysis of the group's own postings, and security reporters note that the group has a record of overstating its hauls.
Why it matters, what to do and sources
Why it matters
The group keeps hitting large service providers that hold data on many downstream customers, so one claim can affect many organizations.
What defenders can take from it
- Treat attacker-published numbers as claims until the victim confirms them.
- Check which of your suppliers are named in extortion postings, and ask them what was taken.
Sources
-
JuneReported mid-2026
ZionSiphon malware targets Israeli water treatment and desalination systems
Darktrace flagged ZionSiphon, malware built for industrial environments and aimed at Israeli water treatment and desalination systems. According to Bitsight's summary, it scans for industrial devices over several protocols and has sabotage capability aimed at chlorine and pressure controls. Bitsight says it may have been circulating since mid-2025.
Why it matters, what to do and sources
Why it matters
Malware written specifically for industrial processes is rare, so each case shows where state-aligned developers are putting effort.
What defenders can take from it
- Monitor OT networks for devices scanning other devices over several industrial protocols.
- Keep OT networks separated from business networks and the internet.
Sources
-
JuneMay to June 2026
A run of $10 million to $36 million bridge and key thefts
After the April thefts came a series of mid-sized ones. THORChain lost about $10.7 million on May 15 when a malicious node operator abused a flaw in its threshold-signature scheme. The Verus Ethereum bridge lost about $11.6 million on May 18 because of a missing check that let a forged proof pass. The Syscoin bridge lost about $10 million on June 7 after a parsing error in proof validation allowed unauthorized tokens to be minted. On June 8, Humanity Protocol lost about $31 million to $36 million after malware on a developer's laptop exposed seven private keys. Amounts vary by tracker.
Why it matters, what to do and sources
Why it matters
Two of the four were plain verification mistakes in bridges, and one was a stolen-keys problem on a single laptop. Individually small, together they show the same weak spots again and again.
What defenders can take from it
- Keep signing keys off everyday developer machines and use hardware-backed storage.
- Have bridge proof-validation code reviewed independently, including edge cases in parsing.
Sources
-
June 11Claimed June 11, 2026
Iran-linked Handala claims a California water utility hack, and the utility finds no sign of control-system access
The Iran-linked group Handala claimed in June that it had breached California Water Service, a utility serving about two million customers, published 5 GB of data and said it could have disrupted water supply but chose not to. Dataminr reported that the data pointed to a customer billing database and an internal GNSS base-station application, and that the Chico District was a confirmed victim. Cal Water brought in Mandiant and later said it found no evidence of activity in its operational technology environment, and that the actor accessed one active customer's online account using stolen credentials. Analysts note that Handala has a record of overstating its capabilities. The US links Handala to Iran's intelligence ministry, and the group framed the claim as retaliation for US strikes in Iran.
Why it matters, what to do and sources
Why it matters
It shows how a claim about water systems can run ahead of the evidence: the data came from business systems, not plant controls.
What defenders can take from it
- Treat attacker claims about utilities as unverified until the utility or investigators confirm them.
- Protect customer-portal accounts with multi-factor authentication, and keep billing and IT networks separate from control systems.
Sources
-
June 4June 4 to 25, 2026
Cisco SD-WAN zero-day gives root access, the seventh exploited SD-WAN flaw this year
Cisco confirmed exploitation of CVE-2026-20245, a command-injection flaw in Catalyst SD-WAN Manager, Controller and Validator that lets an attacker who already has administrator-level access run commands as root. CISA added it to its list of known exploited vulnerabilities on June 4. Mandiant later reported it was used as a zero-day at least two months before disclosure, chained with earlier SD-WAN authentication flaws (CVE-2026-20127 and CVE-2026-20182). It is the seventh Cisco SD-WAN vulnerability exploited in 2026.
Why it matters, what to do and sources
Why it matters
The SD-WAN management layer controls routing and policy for an entire network. Root access there lets an attacker reconfigure the devices at every site.
What defenders can take from it
- Keep management interfaces off the internet and patch the earlier SD-WAN flaws as well.
- Collect forensic data before upgrading, as Cisco advises, so evidence is not lost.
Sources
-
May2026
DentaQuest breach exposes health data of 15 million people
DentaQuest says a May network breach affected 15 million people, exposing Social Security numbers and dental or vision health information. It is described as the largest US health data breach reported so far in 2026.
Why it matters, what to do and sources
Why it matters
Records that combine identity numbers and health details are hard to replace and are useful for fraud for years.
What defenders can take from it
- If you receive a breach notice, freeze your credit and take the offered monitoring.
- Organizations: keep identity numbers only as long as you need them, and encrypt them at rest.
Sources
-
MayDetected April 14, disclosed May 2026
Carnival discloses social-engineering breach affecting about 6 million customers
Carnival's notice says it found unauthorized activity involving an employee account on April 14. The company said an unauthorized actor used social engineering to trick an employee into giving access to a limited part of its IT systems. An industry summary puts the number of affected customers at about 6 million. The breach was made public in May.
Why it matters, what to do and sources
Why it matters
A single convincing conversation with one employee was enough. Technical controls were not the weak point.
What defenders can take from it
- Train staff, especially help desks, to verify the identity of anyone asking for access.
- Limit what a single compromised employee account can reach.
Sources
-
May 142026
Researchers: Sandworm escalates inside industrial networks it has already entered
Nozomi Networks research reports that the Russian state-linked group Sandworm continues to target industrial and critical infrastructure using aggressive lateral movement and older malware, and that its activity intensifies after detection instead of stopping. Affected sectors include manufacturing and transportation. Targets included engineering workstations, operator screens (HMIs), PLCs, remote terminal units and other field controllers.
Why it matters, what to do and sources
Why it matters
Spotting an intruder is not the end of an intrusion. This group appears to rely on access it already has rather than on new vulnerabilities.
What defenders can take from it
- Protect engineering workstations and operator screens as closely as the controllers themselves.
- Assume an intruder detected in IT may already be in OT, and plan the response for both.
Sources
-
May 7April 29 to May 12, 2026
Canvas learning platform breached and school logins defaced
Instructure, the company behind the Canvas learning platform, confirmed unauthorized activity in late April. The ShinyHunters extortion group claimed responsibility, set ransom deadlines and on May 7 defaced the login pages of roughly 330 institutions. Canvas was taken offline briefly and restored the next day. On May 11 Instructure said it had reached an agreement with the actor and received confirmation that the data was destroyed. Claims of hundreds of millions of records have not been verified.
Why it matters, what to do and sources
Why it matters
One education-technology provider serves about 9,000 institutions, and the outage landed during exam season. It was reportedly the second ShinyHunters breach of Instructure in about eight months, and the intrusion reportedly abused a free teacher-account program that the company then shut down permanently.
What defenders can take from it
- List the vendors that hold student, employee or customer data, and plan how to keep working if one goes offline.
- Warn users about phishing messages that mention the incident. The FTC issued such a warning.
- Free and trial account programs are part of your attack surface.
Sources
No incidents match these filters.