Threat Wire
BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys

CyberWatch Newsroom Live Intel

Continuous enterprise threat intelligence tracking active in-the-wild zero-days (CISA KEV), Microsoft Windows KB cumulative updates, MSRC security advisories, and CVE remediation.

Last Checked: Nov 2, 2026 - 02:28:59 UTC (Hourly Auto-Sync Active)
Newsfeed (/feed) RSS Feed JSON API
CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
Lead Cyber Advisory The Hacker News Critical

CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key

A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certificate. Once in, the attacker would act as that client, with access to the cluster and its virtual machines. If t…

Vendor: The Hacker News · Product: Threat Intelligence
View Advisory Details
All Security Bulletins 5,807 Active Zero-Days (KEV) 608 Microsoft Patch KBs 849 MSRC Live Wire 1,922 CISA Advisories 157 Threat Intel 2,629
Showing 24 of 411 advisories
Page 1 of 18
NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection Important The Hacker News
2026-11-01 The Hacker News

NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection

Cybersecurity researchers have disclosed details of what has been described as a "highly sophisticated infection chain" targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET asse…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data Moderate The Hacker News
2026-10-31 The Hacker News

Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data

American blockchain analysis firm Chainalysis said it was the target of a cybersecurity incident in which an external actor accessed non-sensitive customer data. However, the company noted that the breach did not result in unauthorized access to its investigation content, authentication credentials, or session tokens. "This month, Chainalysis detected an ext…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access Critical CVE-2026-111357 The Hacker News
2026-10-31 The Hacker News

Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function v…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats Important The Hacker News
2026-10-31 The Hacker News

A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats

A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed. The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38% Important The Hacker News
2026-10-31 The Hacker News

Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%

Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks pe…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Important The Hacker News
2026-10-30 The Hacker News

Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide

Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based "targeted intrusion adversary" it tracks under the moniker Vapor Panda (previously Vex…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Important The Hacker News
2026-10-30 The Hacker News

TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them

TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host. A malicious or compromised host can exploit the flaw to crash the viewer's TeamViewer and, depend…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours Critical The Hacker News
2026-10-30 The Hacker News

WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis Moderate The Hacker News
2026-10-30 The Hacker News

Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis

A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported. Trezor has not yet examined the device. It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase. …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Moderate The Hacker News
2026-10-30 The Hacker News

Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving

The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything. Their concerns are practical. An IPS protection could block legitimate traffic. A configuration change could interrupt a service. An endpoint poli…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in Prison Moderate The Hacker News
2026-10-30 The Hacker News

Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in Prison

Ahmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets. The conspiracy was organized and led by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's Gene…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Important The Hacker News
2026-10-30 The Hacker News

Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor

Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. The malicious update, version 2.1.313, was distributed under the extension's legitimate publisher identity,…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw Critical CVE-2026-118539 The Hacker News
2026-10-30 The Hacker News

Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. "This module enables you to sell goods and services to customers…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV Critical CVE-2026-97229 The Hacker News
2026-10-30 The Hacker News

CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-97229 (CVSS score: 10.0) - An integer overflow or wraparound vulnerability in GitLab Com…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Critical The Hacker News
2026-10-30 The Hacker News

Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen

Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets. The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far. Tether and Circle said they have frozen more than 1.567 billion USDT and 800 million USDC related to the …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Critical The Hacker News
2026-10-30 The Hacker News

ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories

Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from familiar apps, websites, and AI tools. Some are using AI to speed t…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Important CVE-2026-98432 The Hacker News
2026-10-29 The Hacker News

Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions

A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale. Anthropic said on October 27 that its AI model wrote an exploit that uses the flaw to let a remote attacker with no credentials run commands as ro…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners Moderate The Hacker News
2026-10-29 The Hacker News

Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners

Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities Important The Hacker News
2026-10-29 The Hacker News

Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities

Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities. "It shows significant gains across coding and agentic tasks as well as across key capabilities critical for cybersecurity defense, landing a firm lead in SEC-bench Pro (88.2%) for finding vulnerabilities, Exploi…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Webinar: How to Build AI Threat Readiness Into Your Security Operations Moderate The Hacker News
2026-10-29 The Hacker News

Webinar: How to Build AI Threat Readiness Into Your Security Operations

Security teams have spent years trying to detect threats faster. AI is changing the harder part: how much time defenders have left to act. Advanced AI models can now help attackers discover vulnerabilities, generate exploit code, and move through weaknesses faster than traditional security processes were built to handle. The challenge is no longer just findi…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls Important The Hacker News
2026-10-29 The Hacker News

Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls

A flaw in Telegram for Android could be chained with two other bugs to take full control of a victim's phone through a voice call, once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.10.4 of the app, released in late September, and NebuSec disclosed it o…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
1 2 3 ... 18
Notification