❎ Binance denied claims that hackers stole data from 335 million users, saying it found no evidence of a breach. The company said the listing may be a scam and warned customers to protect passwords and other sensitive information. This claim comes after a separate attack in which North Korean hackers stole cryptocurrency by compromising Binance’s wallet infrastructure.

🔑 Hackers used 4,837 compromised GitHub accounts to target more than 61,000 repositories. Malicious workflows stole GitHub, cloud, and developer credentials from at least 1,835 targets. Repository owners should check for signs of attack and immediately rotate any exposed secrets.

🇩🇰 Maersk says hackers breached a local system linked to a company it acquired, but it has found no evidence of sensitive data exposure or wider disruption. The WhiteArmor ransomware group claims it stole about 100GB of data and is demanding $5 million. Maersk is investigating and says it will update customers if needed.

🗾 Nitori says hackers may have stolen personal information from up to 37.62 million customer records. Passwords and credit card details were not exposed. The company blocked the attack and warned customers to watch for scams.

🇺🇸 🏫 Vanderbilt University is responding to a cyberattack that may affect its devices, systems, and cloud services. The BYOD ransomware group claims it stole sensitive data and encrypted university databases, but Vanderbilt has not confirmed those claims. The university urges students and staff to disconnect devices from its network and report suspicious activity to IT.

🎆 Fireworks AI says attackers breached its cloud provider and accessed its development machines. They exposed some customer account and billing details, plus incomplete model files, but not payment card numbers. Fireworks says it blocked the attack, replaced credentials, and is investigating with security experts.

🚗 Hackers stole Uber drivers’ personal details and license information through a breach at its vendor, Fireworks AI. Thousands of drivers in several states are affected, and the total may grow. Fireworks blamed a financially motivated cybercriminal group.

→ Notion says Fireworks breach exposed customer AI chat transcripts

🇮🇹 🇷🇺 Italy’s foreign minister said hackers posted his personal data on the dark web and threatened his family. Premier Giorgia Meloni blamed pro-Russian hackers and called the leak a serious concern. Tajani vowed to keep working and strengthen cybersecurity.

☁ Hackers may have exposed personal information belonging to 7.7 million Iris Plaza customers. No credit card data was stored in the affected service, and no misuse has been reported. The company has taken its shopping platform offline while it investigates.

🇫🇷 Attackers stole about $133 million from Crédit Mutuel Arkéa through a service provider’s platform. The bank says the attack is contained, some funds have been blocked, and customer assets are not at risk. It is investigating with authorities and warned customers to watch for phishing scams.

🇺🇸 Amplifon Americas says hackers stole personal and health information from more than 1.3 million people. The breach happened in early 2026, but the company took eight months to identify the affected data. The company says it has no evidence the information was used fraudulently.

→ More incidents:

😶 📡 🇹🇼 SilentAir is a suspected state-level group that intercepts calls and texts by hacking mobile networks, mainly targeting Taiwan. It has also targeted people in many other countries, including political and government figures. Enea also found a separate group, Liminal Panda, trying to break into mobile operators, but any link between the two groups is unclear.

🇪🇺 Authorities arrested 354 people in 14 countries during a crackdown on dark web marketplaces, called Operation TorNado. They seized millions in cash and cryptocurrency, drugs, and firearms. The operation builds on earlier efforts to disrupt online crime.

🇺🇸 Police in nine countries dismantled networks behind three malware tools, seizing hundreds of servers and domains. The operation uncovered 6.4 million stolen sets of credentials, which victims can check through online services. Authorities also urged WordPress users to update passwords, turn on multi-factor authentication, and fix security flaws.

🇺🇸 🇰🇵 U.S. authorities seized infrastructure used by North Korean hackers and moved to seize $1.2 billion stolen from Binance. The hackers used fake video meetings and stolen recordings to trick victims and steal more than $400 million from crypto and Web3 companies. Officials say the actions disrupted the attacks, but North Korean cybercrime continues to grow more sophisticated.

🇫🇷 🇮🇷 🧊 France says Iran was behind cyberattacks on thousands of grocery-store freezers and other cooling units. The hacks spoiled goods, but attacks on blood banks were stopped before blood was damaged. France plans sanctions, while the United States is also investigating similar attacks.

🇪🇺 🇺🇸 Three men allegedly used AI-generated CEO and lawyer impersonations to trick employees into sending about $129 million from 2024 to 2026. They targeted thousands of companies and moved the money through accounts worldwide before converting it to cryptocurrency. The suspects were arrested in Europe and face U.S. charges.

🗓️ {Cyber,Info}Sec Events — A community-maintained list of infosec conferences worldwide. Subscribe to the ICS calendar feed to get events straight into your calendar, or follow @[email protected] on Mastodon for weekly digests. Contributions and ⭐ welcome!

🇺🇸 The Trump administration nominated Palantir security chief Michael LoSapio to lead CISA — Democratic lawmakers worry his ties to Palantir could create conflicts of interest, especially because the company works with Homeland Security. Supporters praise his cybersecurity skills, while critics say senators should carefully review his independence and potential conflicts.

🇺🇸 ⚖ 💸 A former FBI agent pleaded guilty to stealing nearly $2.5 million in cryptocurrency using information from FBI investigations. He moved the funds through other crypto accounts and used some to pay personal debts. His actions harmed several investigations, and he could face up to 40 years in prison.

💻 Hackers used a flaw in a ScreenConnect extension to attack 288 devices across 48 organizations. They installed malware that can maintain access, steal session cookies, and spread to other systems. ConnectWise disabled affected extensions, and organizations are urged to disable them too.

🇷🇺 🇰🇿 🇷🇴 Russia-linked Turla used a new stealthy toolset to hack government email servers in Kazakhstan and Romania. The malware hid inside Microsoft Exchange and used the hacked servers to receive commands and collect emails. Its quiet design makes it difficult for defenders to detect.

🔙 🚪 Bitter hackers are targeting South Asian organizations with a new backdoor called PapRAT. The malware can control infected computers, steal files and information, and take screenshots. The attackers use deceptive shortcuts and installers, so organizations should treat unexpected files with caution.

🍎 💸 A newly disclosed iPhone flaw may let malicious apps access data from other apps, including crypto wallet keys and passwords. Apple released an update, but it did not mention the flaw. Binance urged anyone who suspects a breach to move funds to a new wallet on a clean device and reset login sessions.

🆕 OpenAI launched two AI tools to find web application vulnerabilities and help fix them. Daybreak Red Team tests for weaknesses, while Defense Factory investigates findings and suggests patches for engineers to review. The tools can connect with security products and GitHub, but patches are not deployed automatically.

🆕 Anthropic released new Claude models with improved coding, reasoning, and vision. Claude Fable 5.2 scored higher than GPT-6 Cyber on a test of multi-step cyberattacks and performed well at finding software vulnerabilities. Anthropic also updated Claude Security to scan code continuously and track fixes.

🇺🇸 🚫 The US Treasury has barred crypto exchange MEXC from the US financial system. It says MEXC processed billions of dollars in transactions tied to cybercrime and sanctions evasion. MEXC says it is reviewing its controls and will work with regulators.

🇺🇸 ⚖ Former OpenAI engineer Abdulrahman Alfozan has pleaded not guilty to charges of secretly recording conversations in an executive meeting room. Prosecutors say he planted a hidden device to capture sensitive discussions. He remains in custody, and his next hearing is scheduled for November 17, 2026.

🇺🇦 🇩🇪 Ukrainian police arrested four people accused of running cryptocurrency investment scams. The group reportedly stole more than €4.3 million from 135 victims in Germany. The suspects face up to 12 years in prison if convicted.

➝ From the Patching Department:

⚠ 💥 Hackers are exploiting a new N-able N-central flaw to gain full control of servers. At least 21 servers were compromised, mostly to run cryptocurrency miners. N-able advises customers to disable Legacy API access and check systems for signs of attack.

🐛 🚢 A critical flaw in Red Hat Quay could let attackers access private container images and replace repository content. Attackers may create lasting signing keys that bypass access controls and disrupt normal registry use. Red Hat advises restricting access to the key-management service, checking logs, and removing unauthorized keys while applying a fix.

🩹 Git released security updates that fix six vulnerabilities, including risks of code execution, file damage, and crashes. Users should install Git 2.56.1 or another patched version and update apps that include Git. Until then, avoid processing untrusted repositories and files.

⚠ 💥 Hackers are exploiting the *sshole flaw in OpenSSH that can let them bypass password checks on some accounts. The bug mainly affects certain Linux systems, and attackers have so far used it in botnets and crypto-mining operations. Update to OpenSSH 10.6p2, or disable password-based SSH login, and check logs for suspicious activity.

⚠ 💥 Attackers are exploiting patched Plex Media Server flaws to hack QNAP NAS devices. QNAP says its operating systems are not affected and reports no data loss. Update Plex, change passwords, and disable remote access or use a VPN.

⚠ ☁ 🔑 Hackers used Qubole’s AWS access to break into customer accounts and steal secrets and data. They searched for credentials and copied files from S3 buckets. Customers should check their logs, rotate exposed secrets, and remove or restrict unused Qubole access.

🔌 N-able took its hosted N-central platform offline after a researcher publicly disclosed 33 security flaws. The company urged customers with on-premises systems to take them offline, too, while it prepares a fix. N-able says it has seen no active exploitation so far.

🚗 Two researchers found a way around ForgeRock’s security protections at two automakers. They used the flaw to run code on the companies’ identity systems. They also demonstrated remote control of vehicles in the US.

🔓 AI agents helped researchers find cheaper ways to attack outdated 1024-bit RSA systems. The attacks target certain signatures or repeated key factoring, but have important limits. Modern RSA keys of 2048 bits or more remain secure.

🩹 ICS Patch Tuesday — Siemens and other industrial technology companies disclosed vulnerabilities that could allow code execution, data theft, or system compromise. Some flaws involve widely used components, including Node2Shell and PHP2Shell. Patches are unavailable for some products, so customers should follow vendor-recommended mitigations.

🩹 Chipmaker Patch Tuesday — Intel and AMD disclosed more than 200 security flaws across their products. Most have fixes or mitigations, but some are still pending or unavailable. The flaws include serious risks such as privilege escalation, remote code execution, and denial-of-service attacks.

Follow me on Mastodon for quick daily updates and bite-sized content.

Prefer using an RSS feed? Add Infosec MASHUP to your feed here.

Enjoying our newsletter? Forward it to a colleague—
it’s one of the best ways to support us.

Thanks for reading today’s newsletter, and if you're enjoying it and want to support my work, you can buy me a coffee ☕ over at https://www.buymeacoffee.com/0x58

See you next time!

-X.