Threat actors are running self-hosted copies of AntiFox, an open-source agentic penetration testing platform, on Alibaba Cloud servers to attack web services and AWS environments. Arctic Wolf Labs tracked the activity across several recent intrusions and linked the AntiFox interfaces to confirmed ma
French cooperative banking group Crédit Mutuel Arkéa has confirmed that attackers breached its systems and carried out fraudulent transactions worth tens of millions of euros. Blockchain investigator ZachXBT estimates the total theft at roughly 118 million EUR, or about $133 million USD, which the a
The US Cybersecurity and Infrastructure Security Agency (CISA) has added a WordPress Core vulnerability to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. Security researchers track the flaw as CVE-2026-119977, which carries a CVSS score of 8.1 and affects WordPr
Chinese threat actors have adopted ARTEX, an AI-driven penetration testing framework, to automate intrusions against government agencies, banks, and private companies across multiple continents. CrowdStrike now links the espionage group VAPOR PANDA to a campaign that used the tool against more than
Prediction market platform Polymarket temporarily suspended trading on Thursday, October 29, after attackers compromised a third-party monitoring service to push cryptocurrency-draining JavaScript to users. BleepingComputer traced approximately 2.5 million USD in assets to a suspected attacker walle
The University of New Mexico Health Sciences Center (HSC) disclosed a cyberattack that disrupted patient care, diverted ambulances, and canceled classes across its campus. The incident began on Monday, October 26, 2026, when information technology security teams identified a threat and launched cont
The PHP security team released emergency updates on October 21, 2026, to fix two critical flaws that let unauthenticated attackers execute remote code. Researchers now refer to the pair collectively as PHP2Shell, and the bugs carry the official identifiers CVE-2026-109618 and CVE-2026-109619, respec
Attackers turned trusted Shopify apps into phishing funnels this month, sending shoppers who pressed Checkout to a lookalike payment page that harvested their card details. Researchers at client-side security firm cside traced the campaign to configuration data that app vendors served from their own
Security researchers at ThreatFabric have uncovered a new Android banking trojan called Hirudo, which replaces legitimate banking apps with tampered copies that blind built-in protections. The firm's Mobile Threat Intelligence team published its findings on October 14, 2026, describing a remote acce
Federal agents have arrested Edward Dubrovsky, a Canadian cybersecurity executive, in a case that multiple reports link to the FBI's crackdown on ShinyHunters. Dubrovsky, 54, has held senior roles at firms that help data breach and ransomware victims negotiate extortion payments with cybercriminals.