Rotated-off cybersecurity stories, grouped by week.
Week of October 21, 2026
- Attackers hijack 333 Tor exit relays to intercept SSH connections and steal passwords (October 21, 2026)
- LiteLLM 1.107.0 supply chain compromise delivers a credential stealer and backdoor; stolen credentials abused (October 21, 2026)
- State Bank of India confirms 3,897 customer records with PII on the dark web (October 21, 2026)
Week of October 20, 2026
- CISA adds six flaws to the KEV catalog: Plex2Shell chain, SiteGuard and Siemens Software Center (October 20, 2026)
- Plex2Shell Plex Media Server chain widely exploited; Plex says exposed older servers may be compromised (October 20, 2026)
- APT28 Swallowtail espionage campaign targets defense firms and law enforcement in two NATO countries (October 20, 2026)
- eMudhra emSign intermediate CA keys were recoverable by anyone; browsers block them and remove the root (October 20, 2026)
- SafePay ransomware joint advisory reports at least 600 victims since August 2024 (October 20, 2026)
- Zeabur second breach reads 321,810 accounts and 3.2 million secret records; platform to shut down (October 20, 2026)
- Community Medical Center in Falls City shuts down network after cyberattack; critical patients diverted (October 20, 2026)
- Google Cloud outage in London region disrupts Revolut services worldwide (October 20, 2026)
- AfD confirms hosting provider was hacked; email archive published online (October 20, 2026)
Week of October 19, 2026
- ARTEX AI pentest tool tied to attacks on about 20 Japanese companies (October 19, 2026)
- Stolen UpdraftCentral keys used to install backdoors on WordPress sites (October 19, 2026)
- Attackers backdoor five OVHcloud CLI releases on GitHub to steal secrets (October 19, 2026)
- Arcadia forensic report confirms RAIDEN attack chain; 1,423,428 unauthorized emails sent (October 19, 2026)
- FirstVDS confirms customer data theft through VMmanager 6 vulnerability (October 19, 2026)
- Bullhorn cyber incident takes staffing platform offline worldwide; restoration under way (October 19, 2026)
- One hacker used AI agents to break into more than 100 company websites, Reuters reports (October 19, 2026)
Week of October 12, 2026
- CISA adds actively exploited Ivanti Connect Secure zero-day to the KEV catalog (October 13, 2026)
- Ledger wallets sold through CryptoBilis carried a recovery-phrase-stealing implant (October 13, 2026)
- Microsoft Patch Tuesday fixes a record 1,400-plus flaws, including an exploited Windows Shell zero-day (October 13, 2026)
- DOJ charges 14 in North Korean remote IT worker scheme; FBI seizes about 187 laptops and KVM devices in Texas (October 13, 2026)
- Czech NÚKIB warns Russian actors are phishing Signal users through linked devices (October 13, 2026)
- UK Housing Ombudsman case system offline after third-party incident; contact details may have been copied (October 13, 2026)
- Ahold Delhaize cyber incident shuts down Albert Heijn distribution; centres restarting (October 12, 2026)
- DOJ and UK NCA disrupt West African scam networks in joint operation (October 13, 2026)
- Cisco Secure Email Gateway zero-day exploited in the wild (CVE-2026-76519) (October 14, 2026)
- CISA adds Palo Alto PAN-OS flaw to the KEV catalog (CVE-2026-0322) (October 14, 2026)
- CISA adds two Ahsay AhsayCBS flaws to the KEV catalog (October 14, 2026)
- UK Legal Aid Agency breach update finds stolen records dating back to 1978 (October 14, 2026)
- Brooklyn DA and FBI seize 241 domains in crypto investment scam takedown (October 14, 2026)
- Microsoft and Health-ISAC take down phishing kit marketplaces behind more than a billion malicious messages (October 14, 2026)
- Anne Arundel County confirms August breach; files copied from limited systems (October 15, 2026)
- Nasdaq network disruption at Carteret causes data gaps across US equities feeds, now resolved (October 15, 2026)
- AdFection: zero-click Candiru spyware delivered through targeted online ads (October 15, 2026)
- BAE Systems cybersecurity incident halts Bankruptcy Noticing Center nationwide (October 15, 2026)
- CISA adds Atlassian flaw to the KEV catalog (CVE-2026-21589) (October 15, 2026)
- BeyondTrust Remote Support zero-day exploited since August (CVE-2026-102764) (October 15, 2026)
- Malware found in some Rank Math SEO PRO 3.0.123 downloads in supply-chain compromise (October 16, 2026)
- Attackers tampered with AOMEI Backupper update servers in minutes-long windows to deliver a backdoor (October 16, 2026)
- Energize Lab Eilik and Eiliko robots expose millions of private chats and can be remotely hijacked (October 16, 2026)
- CISA adds Fortinet flaw to the KEV catalog (CVE-2025-61624) (October 16, 2026)
- Compromised ConnectWise Cloud Backup credential used to sign in to 173 Microsoft 365 tenants (October 17, 2026)
- OpenCode discloses breach; provider keys may have been exposed in distillation attack (October 17, 2026)
- Cysic halts cross-chain bridge after unauthorized mint of 10 million CYS (October 18, 2026)
Week of October 5, 2026
- Leak exposes ransom payments to Silent Ransom Group (October 7, 2026)
- Denmark national population register (CPR) data taken through IT firm Pays ApS (October 5, 2026)
- ASOS confirms social-engineering root cause in October breach (October 8, 2026)
- Lawson discloses breach of 2.15 million Lawson ID accounts (October 8, 2026)
- TFG London cyberattack takes IT systems offline at Phase Eight, Hobbs and Whistles (October 11, 2026)
- Gates warns of AI-powered cyberattacks within a year (October 11, 2026)