A suspected China-nexus actor chained the PHP2Shell flaws (CVE-2026-109618/109619, CVSS 9.2) with the Fragnesia kernel bug (CVE-2026-46300, CISA KEV deadline Oct 31) on exposed Palo Alto management interfaces. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and lock down management access. CISA guidance: cisa.gov.
Talos says attackers abused CVE-2026-20127 to install KeyDrift, which steals the encryption keys protecting traffic between sites. Upgrade SD-WAN controllers and restrict access to ports 22 and 830.
The Oct 19 breach, spotted Oct 23, exposed names, birth dates, phone numbers and emails, plus about 54K email passwords and 16 bank records. So-net is forcing password resets; customers should watch for phishing.
CVE-2026-111497 (CVSS 9.2) also affects the Prisma Cloud AST client. Workarounds are available and Palo Alto reports no known exploitation of its products yet.
A public relayer plus an Arbitrator hash that was never cleared let the attacker post a fake root to the L1 escrow and withdraw funds.
A settlement flaw at the daily rollover, combined with a flash loan, allowed a double withdrawal from the Fence Finance / Valinor Digital / Oatfi pool. Nothing has been recovered.
A Tornado-funded attacker pushed Proposal 21 through with late votes, upgraded the BalanceSheet contract, minted 25M HIFI and drained about $1M in collateral. It follows a similar governance takeover at X100.
Counterfeit devices could now pass as genuine, and 25,964 customer records were exposed. Buy hardware wallets only direct from the maker and verify them before use.
Emails and internal IDs leaked through third-party mailer YmirLink. No passwords or payment data were involved, but expect GUNDAM-themed phishing.
Gitleaks · MIT license
Gitleaks scans git repositories, files and CI pipelines for hardcoded secrets like API keys, passwords and private keys before they leak. It's for developers and DevOps teams who want a fast, free pre-commit or CI check, the kind of hygiene that keeps a stolen key from becoming this week's headline.