Threat Watch– active
Live incidents
Incident archive
Every exploited vulnerability, breach and supply chain attack Threat Watch has logged, grouped by the day it started. Each date opens that day's log.
2,998 incidents, newest first. Page 1 of 30. 100 incidents from 26 October 2026 to 30 October 2026.
30 October 2026
29 October 2026
- Linux kernel TCP use-after-free race (MPTCP-linked root exploit) — Ubuntu/RHEL unpatched (CVE-2026-98432) Critical · Patch now
- npm malware: dowload_ebok_armageddon_by_max_hastings_kv3s4 — malicious package fully compromises installed machines Critical · Supply chain
- Malicious npm package dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p — full system compromise Critical · Supply chain
- Malicious npm package dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t fully compromises hosts Critical · Supply chain
- Malicious npm package dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc — full system compromise Critical · Supply chain
- Malicious npm package dowload_ebok_lolita_by_vladimir_nabokov_oy1gy — full system compromise on install Critical · Supply chain
- WordPress 7.1.4: unauthenticated race condition in core update process enables RCE; exploitation attempts detected Critical · Patch now
- 2026-10-bq-helix-recon: bq-helix-build-hook-6ade983e / bq-helix-recon-6ade983e PyPI packages — infostealer executes on install and every Python startup, exfiltrating credentials and cloud tokens Critical · Supply chain
- Malicious npm package react-native-drago-callkit — full system compromise on install Critical · Supply chain
- Malware in orderbook-volt-plugin npm package — full machine compromise Critical · Supply chain
- KeyDrift / UAT-11473: Cisco Catalyst SD-WAN — auth-bypass exploited to steal AES traffic keys via Volt Typhoon-linked 'Silent Train' infrastructure (CVE-2026-20127) Critical · Breach
- Malicious npm package @chatunitycenter/baileys — full system compromise on install Critical · Supply chain
- black-spindle-2 (npm): malicious postinstall beacon exfiltrates host data on install (no CVE) Critical · Supply chain
- poc-revshell (PyPI): malicious package ships reverse-shell backdoor triggered on pip install or import (no CVE) Critical · Supply chain
- @dmangal/curse-dependent-ecto (npm): malicious install-time script exfiltrates env secrets and files via webhook.site Critical · Supply chain
- spectral-core (npm) typosquat: install-time script steals env secrets and AWS metadata Critical · Supply chain
- Malicious npm packages m98th, m98bet, 789bet, m98vip — full system compromise on install Critical · Supply chain
- npm typosquat malware: bcxhdh1kjlopsde & cjlowuxbnexkhgpzq — full machine compromise on install Critical · Supply chain
- Dependency-confusion malware: @zmtcdn/components and @zmtcdn/ui npm packages exfiltrate host data via postinstall script Critical · Supply chain
- Dependency-confusion beacon packages: mw-communication-client, mw-test-utils, mui-wrapper-x-date-pickers exfiltrate user/host/cwd on install Critical · Supply chain
- spectral-net-probe (npm): malicious package exfiltrates local file contents via install-time and load-time callbacks Critical · Supply chain
- Dependency-confusion beacon package identity-two-factor targets Coinbase on npm Critical · Supply chain
- VAPOR PANDA (China-nexus) used ARTEX AI agents running DeepSeek to target 200+ organizations in 11 days, compromising at least nine (no CVE) High · Breach
- Icepick: DHS/Okta SSO — hacktivists leak 41,000 DHS employee records incl. undercover ICE agents High · Breach
- Florida Department of Education student financial aid breach — unauthorized access may expose data of ~4.9 million people High · Breach
- Frontline Education breach: Student SSNs, Medicaid IDs and DOBs exposed via Frontline Central and School Health Management High · Breach
- GitHub Actions issue-injection supply chain campaign — 61 public repos (incl. Trivy, MLflow, Brave, LangExtract) hit via hidden HTML-comment payloads in issues/PRs to steal CI/CD credentials High · Supply chain
- Cisco ASA/FTD SSL VPN zero-day exploited for DoS — patches released (CVE-2026-76418) High · Patch now
- iRhythm data breach: 8.2M patients' data stolen from third-party-hosted apps, ransom demanded High · Breach
- Suspected hack behind military base freezer failures — US Pentagon bases food spoilage, linked to French supermarket attack Medium · Breach
- RIZAP: employee uploaded 726 members' health records to personal generative AI chat Medium · Breach
- Amadey botnet: Australian Signals Directorate severs C2 access to ~180,000 infected computers Medium · Breach
- BAE Systems / US Bankruptcy Noticing Center outage — no data extracted, service restored after 2+ weeks Medium · Breach
- Cyberattack on Belgian FPS Finance takes MyMinfin tax portal offline before filing deadline Medium · Breach
- Searchjacked: 319 malicious Chrome extensions hijack searches of 13.4M users, monetize via Yahoo/Bing referral fraud Medium · Supply chain
28 October 2026
- PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300) Critical · Breach
- Zip Cloaking: Rust zip crate — parser differential bypasses scanners for arbitrary file write/RCE, plus symlink write, alloc-abort and legacy-decoder DoS (CVE-2026-115905, CVE-2026-115908, CVE-2026-115909, CVE-2026-115907) Critical · Patch now
- Oracle EBS SQL injection to RCE now scanned/exploited in the wild (CVE-2026-101767) Critical · Patch now
- Volt Typhoon 'Silent Train': rotating relay chains used to exploit zero-days in SD-WAN and IT-management platforms Critical · Breach
- b20miner npm package: malicious cryptominer backdoor fully compromises installed hosts (no CVE) Critical · Supply chain
- Electrum malicious-server RBF fee-bump theft via unverified mempool tx (CVE-2026-117601) Critical · Patch now
- @zaip-ai/cli npm package is malware — full machine compromise, no patched versions (GHSA-ffq4-h5jm-8pqr) Critical · Supply chain
- itsa-utils / itsa-react-checkbox npm packages trojanized with malware (no CVE) Critical · Supply chain
- Malicious npm package dsh-plugin-blender-3d — full machine compromise for installers (no CVE) Critical · Supply chain
- @walknpm/todo-cli npm package is malware — full machine compromise for installers of v2.0.1 (no CVE) Critical · Supply chain
- my-empty-package (npm): malicious package compromises machines that install it Critical · Supply chain
- Malicious npm package transaction-info-generate-sdk — full system compromise on install (no CVE) Critical · Supply chain
- Malicious npm package mock-transactions-sdk — full system compromise on install Critical · Supply chain
- camelotlabs npm packages (core, config, sdk, worker) published as malware — full machine compromise Critical · Supply chain
- @atlisp/mcp npm package 1.12.14 is malware — full machine compromise, rotate all secrets Critical · Supply chain
- Adobe Campaign Classic: 8 critical flaws enabling RCE and security bypass patched (CVE-2026-104351 et al.) Critical · Patch now
- glyphmatrix-fixture (npm): malicious package versions 1.0.0 and 1.0.1 fully compromise installed machines (no CVE) Critical · Supply chain
- trajmetrics PyPI malware: system-wide file scanning and exfiltration via background job Critical · Supply chain
- Dependency-confusion beacon: @webapp-shared/login-vmok (npm) exfiltrates hostname and paths on install Critical · Supply chain
- csvflow-schema (npm): malicious postinstall beacon package removed from registry Critical · Supply chain
- Shai-Hulud worm wave 2: @testsecuiitytestme/cache-helper npm package — malicious native-addon loader steals credentials (no CVE) Critical · Supply chain
- Three TLS Bugs in GoAhead web server: revoked certs accepted, DH truncation, chain-depth bypass (no CVEs) Critical · Patch now
- VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls High · Patch now
- GhostAction: GitHub supply-chain campaign steals developer secrets and pivots to cloud access High · Supply chain
- Jenkins core: 15 vulnerabilities fixed in 2.588 / LTS 2.580.2. Low-privilege users can get RCE on the controller; an unauthenticated race in the setup wizard can create an admin (CVE-2026-117612–117626) High · Patch now
- Times Car data breach: driver's license data of 1.46 million leaked, ¥5.5 billion loss reported High · Breach
- Royal Darwin Hospital privacy breach — pregnant women's medical records posted to Instagram by 'medical observer' High · Breach
- Skyw4lker: device code phishing campaign targeting U.S. organizations via Microsoft 365 token theft High · Breach
- Amadeus IT Group breach leaks 92,000 Japan Airlines customer reservation records Medium · Breach
- AfD email breach: 345,000 addresses leaked via hacked WordPress site Medium · Breach
- Bithumb internal mobile system breach — data leak under investigation Medium · Breach
- Ransomware attack on NZ coronial services delays investigations, grieving families left waiting Medium · Breach
27 October 2026
- dsh-* npm malware campaign: dsh-vm-tester, dsh-redteam-mode and dsh-volcengine-provider fully compromise installed machines; rotate secrets (no CVE) Critical · Supply chain
- EPICS Base: AI agent finds 4 severe bugs incl. critical RCE in industrial control software (CVE-2026-114595) Critical · Patch now
- h13t0ry-hello-demo (PyPI): malicious package spawns reverse shell on import, giving attackers full command execution Critical · Supply chain
- adyen-web-v6 (npm): lookalike of Adyen's checkout SDK ships malware; full machine compromise Critical · Supply chain
- 2026-10-numprint: PyPI package numprint — malicious install-time RAT executing attacker commands via GitHub Gist C2 Critical · Supply chain
- MLflow third-party scorer deserialization RCE — unauthenticated code execution on MLflow servers (CVE-2026-116692) Critical · Supply chain
- agentenact (npm): malicious package 0.2.0 fully compromises machines that install it (no CVE) Critical · Supply chain
- Malicious npm packages csec-form-validator, csec-crypto-toolkit (and ccsec- typosquat variants) — full system compromise Critical · Supply chain
- Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-48356) Critical · Patch now
- pydicom: NaN/inf DICOM values let one upload crash MONAILabel and corrupt inference (CVE-2026-48705) Critical · Patch now
- better-auth: OAuth state accepted as a Magic Link token enables account takeover by email (CVE-2026-114607) Critical · Patch now
- Authlib: unsigned JWS JSON accepted as verified when the signatures array is empty (CVE-2026-96760) Critical · Patch now
- Agno: eval() on FunctionCall field_type runs arbitrary Python code (CVE-2026-35002) Critical · Patch now
- Navigate360 school-safety tipline data breach — Crime Stoppers suspend use amid poor transparency High · Breach
- So-net (Sony Network Communications): member database breach exposes 2.59M customer records and 54k email passwords High · Breach
- UK police: hackers repeatedly breached IT suppliers holding police data since 2021, HMICFRS finds High · Breach
- SafePay ransomware: 600+ victims across US and Europe since August 2024 per FBI advisory High · Breach
- Discover-Tech ad-network spyware: governments deliver zero-click spyware via malicious online ads High · Breach
- iPhone malware drive-by campaign: crypto thieves serve malware via hundreds of infected websites and malicious ads High · Breach
- Conduent $80M settlement — 62.2M-record healthcare data breach class action High · Breach
- Malicious Firefox wallet impersonators (Phantom/Jupiter/Bitget) — steal recovery phrases and private keys via bonto[.]io C2 High · Supply chain
- Bajaj Hospital ransomware attack: all 9 servers encrypted, sensitive patient data stolen High · Breach
- ENGIE: French customer contact and contract data stolen through a partner marketing platform breach Medium · Breach
- Moldova government digital services breach — ~750,000 citizens' personal data possibly stolen; further cyberattacks warned Medium · Breach
- Hive/Nefilim ransomware affiliate Artem Stryzhak sentenced to 70 months Medium · Breach
- SquareML: leaked read-only access key exposed data of 238,083 Denver Health Medical Plan members Medium · Breach
- DMDC data breach — Pentagon sued by Marines over PII leak enabling scams Medium · Breach
- Covered California: agent data exposed via phishing attack on spreadsheets (no CVE) Medium · Breach
- Ohio Auditor web server cyberattack — state server taken down amid possible foreign state actor involvement Medium · Breach
- Cyberattack on Italy's Chamber of Deputies email accounts, including account assigned to PM Meloni Medium · Breach
- FEC electronic filing system outage after hacking attempts ahead of November 3 elections Medium · Breach