-
Ivanti zero-days have enabled attackers to compromise Connect Secure remote access gateways by combining three vulnerabilities. The company has now patched two additional flaws linked to attacks dating back to at least October 1, 2026. Two Additional Vulnerabilities Complete the Attack Chain The newly addressed vulnerabilities are CVE-2026-111357 and CVE-2026-118527. The first allows high-severity privilege…
-
The FBI has attributed the $6.3 billion Binance crypto heist to North Korean state-sponsored hackers known as TraderTraitor. The attack occurred around October 29, 2026, with approximately $6.36 billion stolen across ten blockchains in what the report describes as the largest cryptocurrency theft on record. FBI Identifies Hundreds of Cryptocurrency Addresses The agency’s attribution follows…
-
Alpine Linux rebuilt its GitLab server and reset all user passwords after attackers targeted a critical vulnerability on October 20–21. Although investigators found no evidence of successful code execution, missing logs prevented them from ruling out a compromise. Attackers Target Alpine Linux Development Infrastructure The attacks focused on CVE-2026-97229, a maximum-severity remote code execution vulnerability…
-
An invisible SMS of Death attack can interrupt Android phone calls and leave vulnerable devices stuck in repeated crashes, security researcher Mark Blaszczyk warns. His findings describe an attack that requires no user interaction and could force affected owners to reset their phones. Hidden Messages Crash Android’s Phone Service The vulnerability involves WAP Push, a…
-
A Trezor implant warning has prompted customers to stop using potentially affected hardware wallets purchased through reseller CryptoBilis. The company received a credible report of suspicious hardware inside a Safe 5 device, but has not yet examined it. The report concerns an Indonesian customer who bought the wallet through Tokopedia in August 2026. According to…
-
Claude Code malware reached up to 5,000 developers after attackers distributed a modified extension through Cursor’s marketplace on October 29. The malicious package attempted to install persistent SSH backdoors and collected information about affected computers. The compromised release, version 2.1.313, remained available from approximately 2:27 a.m. to 1:35 p.m. Pacific Time. However, the potential exposure…
-
OpenAI has announced higher ChatGPT Pro limits and reversed a planned reduction for existing $200 subscribers following customer feedback. The changes took effect on October 29 and cover the $100, $200 and $500 Pro tiers, alongside Business Premium. The announcement primarily concerns ChatGPT Work and Codex, which share usage allowances under eligible subscriptions. Meanwhile, OpenAI…
-
A Binance security probe is examining a potential breach involving billions of dollars in cryptocurrency after reports of large transfers from exchange wallets. Blockchain analysts identified approximately $5.78 billion across associated addresses, but Binance has not confirmed that attackers stole those assets. The exchange said its teams were urgently investigating a potential security issue and…
-
A Hugging Face malware campaign returned within days of takedowns, using fake AI model repositories to install cryptocurrency miners and backdoors. Researchers identified 31 malicious repositories across seven accounts, with the most popular model attracting more than 28,000 downloads. The repositories impersonated small Qwen2 test checkpoints and targeted GPU servers running self-hosted inference platforms, including…
-
The JAL data breach has exposed information belonging to approximately 92,000 customers following unauthorised access to Amadeus’s Passenger Service System. Japan Airlines said the incident involved reservation details, while a smaller group also had passport numbers and contact information exposed. JAL Group uses the system to manage reservations, ticketing and check-in for Japan Airlines and…