{"category":"all","changes":[{"body":null,"category":"supply-chain","date":"2026-10-30","incident":"malicious-pypi-packages-twitter-request-diagnostics-and-test-01-rafamarrara-learning-dc-backdoor-web-apps","incidentTitle":"Malicious PyPI packages twitter-request-diagnostics and test-01-rafamarrara-learning-dc backdoor web apps","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-w3jr-q4jr-xq95","status":"live","title":"Malicious PyPI packages twitter-request-diagnostics and test-01-rafamarrara-learning-dc backdoor web apps","url":"https://helix.ml/threat-watch/i/malicious-pypi-packages-twitter-request-diagnostics-and-test-01-rafamarrara-learning-dc-backdoor-web-apps"},{"body":null,"category":"patch","date":"2026-10-30","incident":"linux-kernel-tcp-use-after-free-race-mptcp-linked-root-exploit-ubuntu-rhel-unpatched-cve-2026-98432","incidentTitle":"Linux kernel TCP use-after-free race (MPTCP-linked root exploit) — Ubuntu/RHEL unpatched (CVE-2026-98432)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/437","status":"live","title":"Go team issues official guidance on protecting Go programs against CVE-2026-98432","url":"https://helix.ml/threat-watch/i/linux-kernel-tcp-use-after-free-race-mptcp-linked-root-exploit-ubuntu-rhel-unpatched-cve-2026-98432"},{"body":"CrowdStrike says the VAPOR PANDA campaign is separate from Storm-0940's ARTEX activity, which suggests that several China-nexus actors have adopted the framework. See https://helix.ml/threat-watch/i/vapor-panda-china-nexus-used-artex-ai-agents-running-deepseek-to","category":"supply-chain","date":"2026-10-29","incident":"storm-0940-artex-ai-driven-supply-chain-attack-connectwise-cloud-backup-china-aligned-actor-compromised-m365-tenants-via","incidentTitle":"ARTEX AI-driven attacks: ConnectWise Cloud Backup supply-chain compromise and suspected same-actor 123 Reg breach (no CVE)","kind":"other","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/","status":"live","title":"Related: CrowdStrike reports a second China-nexus actor, VAPOR PANDA, using ARTEX against 200+ organizations","url":"https://helix.ml/threat-watch/i/storm-0940-artex-ai-driven-supply-chain-attack-connectwise-cloud-backup-china-aligned-actor-compromised-m365-tenants-via"},{"body":"CrowdStrike says the VAPOR PANDA campaign is separate from Storm-0940's ARTEX activity, which suggests that several China-nexus actors have adopted the framework. See https://helix.ml/threat-watch/i/vapor-panda-china-nexus-used-artex-ai-agents-running-deepseek-to","category":"supply-chain","date":"2026-10-29","incident":"connectwise-cloud-backup-storm-0940-china-linked-used-stolen-app-credentials-and-ai-pentest-tool-artex-to-access-2-250-m","incidentTitle":"ConnectWise Cloud Backup: Storm-0940 (China-linked) used stolen app credentials and AI pentest tool ARTEX to access 2,250+ Microsoft 365 tenants","kind":"other","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/","status":"closed","title":"Related: CrowdStrike reports a second China-nexus actor, VAPOR PANDA, using ARTEX against 200+ organizations","url":"https://helix.ml/threat-watch/i/connectwise-cloud-backup-storm-0940-china-linked-used-stolen-app-credentials-and-ai-pentest-tool-artex-to-access-2-250-m"},{"body":null,"category":"breach","date":"2026-10-29","incident":"vapor-panda-china-nexus-used-artex-ai-agents-running-deepseek-to","incidentTitle":"VAPOR PANDA (China-nexus) used ARTEX AI agents running DeepSeek to target 200+ organizations in 11 days, compromising at least nine (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/","status":"live","title":"CrowdStrike discloses VAPOR PANDA's ARTEX campaign: 200+ organizations targeted, nine compromised","url":"https://helix.ml/threat-watch/i/vapor-panda-china-nexus-used-artex-ai-agents-running-deepseek-to"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"malicious-npm-package-dowload-ebok-lolita-by-vladimir-nabokov-oy1gy-full-system-compromise-on-install","incidentTitle":"Malicious npm package dowload_ebok_lolita_by_vladimir_nabokov_oy1gy — full system compromise on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-cjmr-6xg2-vf8h","status":"live","title":"Malicious npm package dowload_ebok_lolita_by_vladimir_nabokov_oy1gy — full system compromise on install","url":"https://helix.ml/threat-watch/i/malicious-npm-package-dowload-ebok-lolita-by-vladimir-nabokov-oy1gy-full-system-compromise-on-install"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"malicious-npm-package-dowload-ebok-el-piso-mil-el-piso-mil-1-by-katharine-mcgee-h1llc-full-system-compromise","incidentTitle":"Malicious npm package dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc — full system compromise","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-j272-m9j4-g3v9","status":"live","title":"Malicious npm package dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc — full system compromise","url":"https://helix.ml/threat-watch/i/malicious-npm-package-dowload-ebok-el-piso-mil-el-piso-mil-1-by-katharine-mcgee-h1llc-full-system-compromise"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"malicious-npm-package-dowload-ebok-nur-mal-schnell-das-mammut-retten-by-knut-kruger-eva-schoffmann-davidov-ouz6t-fully-c","incidentTitle":"Malicious npm package dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t fully compromises hosts","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-5cmc-vx46-22wx","status":"live","title":"Malicious npm package dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t fully compromises hosts","url":"https://helix.ml/threat-watch/i/malicious-npm-package-dowload-ebok-nur-mal-schnell-das-mammut-retten-by-knut-kruger-eva-schoffmann-davidov-ouz6t-fully-c"},{"body":null,"category":"breach","date":"2026-10-29","incident":"amadeus-it-group-breach-leaks-92-000-japan-airlines-customer-reservation-records","incidentTitle":"Amadeus IT Group breach leaks 92,000 Japan Airlines customer reservation records","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.bleepingcomputer.com/news/security/japan-airlines-suffers-third-party-data-breach-exposing-passenger-info/","status":"live","title":"Japan Airlines confirms ~92,000 passengers' data exposed via breach at Amadeus's Passenger Service System","url":"https://helix.ml/threat-watch/i/amadeus-it-group-breach-leaks-92-000-japan-airlines-customer-reservation-records"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"malicious-npm-package-dowload-ebok-reiki-sviluppa-e-usa-lenergia-reiki-by-matt-harvey-9q55p-full-system-compromise","incidentTitle":"Malicious npm package dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p — full system compromise","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-h86m-7gvf-j79h","status":"live","title":"Malicious npm package dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p — full system compromise","url":"https://helix.ml/threat-watch/i/malicious-npm-package-dowload-ebok-reiki-sviluppa-e-usa-lenergia-reiki-by-matt-harvey-9q55p-full-system-compromise"},{"body":null,"category":"breach","date":"2026-10-29","incident":"suspected-hack-behind-military-base-freezer-failures-us-pentagon-bases-food-spoilage-linked-to-french-supermarket-attack","incidentTitle":"Suspected hack behind military base freezer failures — US Pentagon bases food spoilage, linked to French supermarket attack","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://securityaffairs.com/202073/hacking/us-probes-suspected-hack-behind-military-base-freezer-failures.html","status":"live","title":"Suspected hack behind military base freezer failures — US Pentagon bases food spoilage, linked to French supermarket attack","url":"https://helix.ml/threat-watch/i/suspected-hack-behind-military-base-freezer-failures-us-pentagon-bases-food-spoilage-linked-to-french-supermarket-attack"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"npm-malware-dowload-ebok-armageddon-by-max-hastings-kv3s4-malicious-package-fully-compromises-installed-machines","incidentTitle":"npm malware: dowload_ebok_armageddon_by_max_hastings_kv3s4 — malicious package fully compromises installed machines","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-p6mc-228w-6q75","status":"live","title":"npm malware: dowload_ebok_armageddon_by_max_hastings_kv3s4 — malicious package fully compromises installed machines","url":"https://helix.ml/threat-watch/i/npm-malware-dowload-ebok-armageddon-by-max-hastings-kv3s4-malicious-package-fully-compromises-installed-machines"},{"body":null,"category":"patch","date":"2026-10-29","incident":"wordpress-7-1-4-unauthenticated-race-condition-in-core-update-process-enables-rce-exploitation-attempts-detected","incidentTitle":"WordPress 7.1.4: unauthenticated race condition in core update process enables RCE; exploitation attempts detected","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","status":"live","title":"WordPress 7.1.4: unauthenticated race condition in core update process enables RCE; exploitation attempts detected","url":"https://helix.ml/threat-watch/i/wordpress-7-1-4-unauthenticated-race-condition-in-core-update-process-enables-rce-exploitation-attempts-detected"},{"body":null,"category":"breach","date":"2026-10-29","incident":"navigate360-school-safety-tipline-data-breach-crime-stoppers-suspend-use-amid-poor-transparency","incidentTitle":"Navigate360 school-safety tipline data breach — Crime Stoppers suspend use amid poor transparency","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/29/extent-of-crime-stoppers-data-breach-unknown-sault-police-chief/","status":"live","title":"Sault Ste. Marie police pause Crime Stoppers ties as breach scope remains unknown","url":"https://helix.ml/threat-watch/i/navigate360-school-safety-tipline-data-breach-crime-stoppers-suspend-use-amid-poor-transparency"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"2026-10-bq-helix-recon-bq-helix-build-hook-6ade983e-bq-helix-recon-6ade983e-pypi-packages-infostealer-executes-on-instal","incidentTitle":"2026-10-bq-helix-recon: bq-helix-build-hook-6ade983e / bq-helix-recon-6ade983e PyPI packages — infostealer executes on install and every Python startup, exfiltrating credentials and cloud tokens","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-526r-6j5j-v9pv","status":"live","title":"2026-10-bq-helix-recon: bq-helix-build-hook-6ade983e / bq-helix-recon-6ade983e PyPI packages — infostealer executes on install and every Python startup, exfiltrating credentials and cloud tokens","url":"https://helix.ml/threat-watch/i/2026-10-bq-helix-recon-bq-helix-build-hook-6ade983e-bq-helix-recon-6ade983e-pypi-packages-infostealer-executes-on-instal"},{"body":null,"category":"breach","date":"2026-10-29","incident":"icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents","incidentTitle":"Icepick: DHS/Okta SSO — hacktivists leak 41,000 DHS employee records incl. undercover ICE agents","kind":"other","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://cyberscoop.com/dhs-employee-breach-icepick-database-takedown/","status":"live","title":"Icepick DHS data archive faces takedown pressure — contractor removal request and hosting blocks, but it finds a new home","url":"https://helix.ml/threat-watch/i/icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents"},{"body":null,"category":"breach","date":"2026-10-29","incident":"florida-department-of-education-student-financial-aid-breach-unauthorized-access-may-expose-data-of-4-9-million-people","incidentTitle":"Florida Department of Education student financial aid breach — unauthorized access may expose data of ~4.9 million people","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/29/florida-education-department-says-data-breach-may-affect-4-9-million-people/","status":"live","title":"Florida Department of Education student financial aid breach — unauthorized access may expose data of ~4.9 million people","url":"https://helix.ml/threat-watch/i/florida-department-of-education-student-financial-aid-breach-unauthorized-access-may-expose-data-of-4-9-million-people"},{"body":null,"category":"breach","date":"2026-10-29","incident":"rizap-employee-uploaded-726-members-health-records-to-personal-generative-ai-chat","incidentTitle":"RIZAP: employee uploaded 726 members' health records to personal generative AI chat","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/10/29/a-rizap-employee-uploaded-726-peoples-health-records-to-a-personal-ai-chat/","status":"live","title":"RIZAP: employee uploaded 726 members' health records to personal generative AI chat","url":"https://helix.ml/threat-watch/i/rizap-employee-uploaded-726-members-health-records-to-personal-generative-ai-chat"},{"body":null,"category":"breach","date":"2026-10-29","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://therecord.media/php2shell-successful-exploitation-reports-emerge","status":"live","title":"Limited real-world exploitation of PHP2Shell bugs confirmed: half-dozen exploitations listed and suspected Chinese campaign breached U.S. government-affiliated servers","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":null,"category":"breach","date":"2026-10-29","incident":"unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data","incidentTitle":"UNM Health Sciences Center cyberattack: extortion group BYOD claims theft of student/employee PII, EHR data","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/29/unm-health-addresses-cyberattack-in-new-mexico-after-ransomware-group-claims-responsibility/","status":"live","title":"UNM Health confirms it is aware of ransomware group's claims of responsibility for the cyberattack","url":"https://helix.ml/threat-watch/i/unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data"},{"body":null,"category":"breach","date":"2026-10-29","incident":"amadey-botnet-australian-signals-directorate-severs-c2-access-to-180-000-infected-computers","incidentTitle":"Amadey botnet: Australian Signals Directorate severs C2 access to ~180,000 infected computers","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/10/29/australia-severs-criminal-access-to-180000-computers-after-breaching-amadey-malware-backend/","status":"live","title":"Amadey botnet: Australian Signals Directorate severs C2 access to ~180,000 infected computers","url":"https://helix.ml/threat-watch/i/amadey-botnet-australian-signals-directorate-severs-c2-access-to-180-000-infected-computers"},{"body":null,"category":"breach","date":"2026-10-29","incident":"frontline-education-breach-student-ssns-medicaid-ids-and-dobs-exposed-via-frontline-central-and-school-health-management","incidentTitle":"Frontline Education breach: Student SSNs, Medicaid IDs and DOBs exposed via Frontline Central and School Health Management","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/29/student-ssns-and-medicaid-ids-exposed-in-frontline-school-software-breach/","status":"live","title":"Frontline Education breach: Student SSNs, Medicaid IDs and DOBs exposed via Frontline Central and School Health Management","url":"https://helix.ml/threat-watch/i/frontline-education-breach-student-ssns-medicaid-ids-and-dobs-exposed-via-frontline-central-and-school-health-management"},{"body":null,"category":"breach","date":"2026-10-29","incident":"icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents","incidentTitle":"Icepick: DHS/Okta SSO — hacktivists leak 41,000 DHS employee records incl. undercover ICE agents","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/10/29/dhs-personnel-leak-exposes-contact-details-and-sensitive-job-information/","status":"live","title":"Leaked DHS records confirmed searchable, exposing contact details and sensitive assignment info of 41,000+ current and former employees/contractors","url":"https://helix.ml/threat-watch/i/icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"malware-in-orderbook-volt-plugin-npm-package-full-machine-compromise","incidentTitle":"Malware in orderbook-volt-plugin npm package — full machine compromise","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-w9pq-6r9f-pj96","status":"live","title":"Malware in orderbook-volt-plugin npm package — full machine compromise","url":"https://helix.ml/threat-watch/i/malware-in-orderbook-volt-plugin-npm-package-full-machine-compromise"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"malicious-npm-package-react-native-drago-callkit-full-system-compromise-on-install","incidentTitle":"Malicious npm package react-native-drago-callkit — full system compromise on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-jp74-4rg3-7ppj","status":"live","title":"Malicious npm package react-native-drago-callkit — full system compromise on install","url":"https://helix.ml/threat-watch/i/malicious-npm-package-react-native-drago-callkit-full-system-compromise-on-install"},{"body":null,"category":"breach","date":"2026-10-29","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456","status":"live","title":"China-linked actors used a custom PHP2Shell exploit to root 25 servers and likely retain access to a US government-affiliated network","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":null,"category":"breach","date":"2026-10-29","incident":"keydrift-uat-11473-cisco-catalyst-sd-wan-attackers-exploited-auth-bypass-flaw-to-steal-aes-traffic-keys-cve-2026-20127","incidentTitle":"KeyDrift / UAT-11473: Cisco Catalyst SD-WAN — auth-bypass exploited to steal AES traffic keys via Volt Typhoon-linked 'Silent Train' infrastructure (CVE-2026-20127)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/","status":"live","title":"UAT-11473 observed deploying custom KeyDrift malware framework via Cisco SD-WAN CVE-2026-20127 exploitation","url":"https://helix.ml/threat-watch/i/keydrift-uat-11473-cisco-catalyst-sd-wan-attackers-exploited-auth-bypass-flaw-to-steal-aes-traffic-keys-cve-2026-20127"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"malicious-npm-package-chatunitycenter-baileys-full-system-compromise-on-install","incidentTitle":"Malicious npm package @chatunitycenter/baileys — full system compromise on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-g6j7-j669-23g6","status":"live","title":"Malicious npm package @chatunitycenter/baileys — full system compromise on install","url":"https://helix.ml/threat-watch/i/malicious-npm-package-chatunitycenter-baileys-full-system-compromise-on-install"},{"body":null,"category":"patch","date":"2026-10-29","incident":"linux-kernel-tcp-use-after-free-race-mptcp-linked-root-exploit-ubuntu-rhel-unpatched-cve-2026-98432","incidentTitle":"Linux kernel TCP use-after-free race (MPTCP-linked root exploit) — Ubuntu/RHEL unpatched (CVE-2026-98432)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html","status":"live","title":"Linux kernel TCP use-after-free race (MPTCP-linked root exploit) — Ubuntu/RHEL unpatched (CVE-2026-98432)","url":"https://helix.ml/threat-watch/i/linux-kernel-tcp-use-after-free-race-mptcp-linked-root-exploit-ubuntu-rhel-unpatched-cve-2026-98432"},{"body":null,"category":"patch","date":"2026-10-29","incident":"zip-cloaking-rust-zip-crate-parser-differential-lets-crafted-zips-bypass-security-scanners-and-overwrite-arbitrary-files","incidentTitle":"Zip Cloaking: Rust zip crate — parser differential bypasses scanners for arbitrary file write/RCE, plus symlink write, alloc-abort and legacy-decoder DoS (CVE-2026-115905, CVE-2026-115908, CVE-2026-115909, CVE-2026-115907)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-hjqx-j4rw-g7xv","status":"live","title":"Rust zip crate hit with three more high-severity advisories: lexical symlink validation enabling arbitrary file write (CVE-2026-115908), unbounded symlink-target allocation abort (CVE-2026-115909), and legacy Shrink decoder DoS (CVE-2026-115907)","url":"https://helix.ml/threat-watch/i/zip-cloaking-rust-zip-crate-parser-differential-lets-crafted-zips-bypass-security-scanners-and-overwrite-arbitrary-files"},{"body":null,"category":"patch","date":"2026-10-29","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"advisory","patchStatus":"patched","severity":"high","sourceUrl":"https://securityaffairs.com/202050/hacking/u-s-cisa-adds-linux-kernel-and-broadcom-vmware-esx-flaws-to-its-known-exploited-vulnerabilities-catalog.html","status":"live","title":"CISA adds Broadcom VMware ESX flaw (alongside Linux Kernel bugs) to its Known Exploited Vulnerabilities catalog","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":null,"category":"breach","date":"2026-10-29","incident":"bae-systems-us-bankruptcy-noticing-center-outage-no-data-extracted-service-restored-after-2-weeks","incidentTitle":"BAE Systems / US Bankruptcy Noticing Center outage — no data extracted, service restored after 2+ weeks","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/us-bankruptcy-courts-it-contractor-says-no-data-stolen-cyberattack","status":"live","title":"BAE Systems confirms no data was extracted in the bankruptcy courts cyberattack","url":"https://helix.ml/threat-watch/i/bae-systems-us-bankruptcy-noticing-center-outage-no-data-extracted-service-restored-after-2-weeks"},{"body":null,"category":"patch","date":"2026-10-29","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://www.helpnetsecurity.com/2026/10/29/php2shell-fragnesia-vmware-esx-zero-day/","status":"live","title":"China-nexus actors used the VMware ESX zero-day to hide their tracks and chained PHP2Shell/Fragnesia to root firewalls","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"malicious-npm-packages-m98th-m98bet-789bet-m98vip-full-system-compromise-on-install","incidentTitle":"Malicious npm packages m98th, m98bet, 789bet, m98vip — full system compromise on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-x82c-crm3-jcwv","status":"live","title":"Malicious npm packages m98th, m98bet, 789bet, m98vip — full system compromise on install","url":"https://helix.ml/threat-watch/i/malicious-npm-packages-m98th-m98bet-789bet-m98vip-full-system-compromise-on-install"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"spectral-core-npm-typosquat-install-time-script-steals-env-secrets-and-aws-metadata","incidentTitle":"spectral-core (npm) typosquat: install-time script steals env secrets and AWS metadata","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-jpgq-34qx-jwwc","status":"live","title":"spectral-core (npm) typosquat: install-time script steals env secrets and AWS metadata","url":"https://helix.ml/threat-watch/i/spectral-core-npm-typosquat-install-time-script-steals-env-secrets-and-aws-metadata"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"dmangal-curse-dependent-ecto-npm-malicious-install-time-script-exfiltrates-env-secrets-and-files-via-webhook-site","incidentTitle":"@dmangal/curse-dependent-ecto (npm): malicious install-time script exfiltrates env secrets and files via webhook.site","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-prqg-vvv3-2xf8","status":"live","title":"@dmangal/curse-dependent-ecto (npm): malicious install-time script exfiltrates env secrets and files via webhook.site","url":"https://helix.ml/threat-watch/i/dmangal-curse-dependent-ecto-npm-malicious-install-time-script-exfiltrates-env-secrets-and-files-via-webhook-site"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"poc-revshell-pypi-malicious-package-ships-reverse-shell-backdoor-triggered-on-pip-install-or-import-no-cve","incidentTitle":"poc-revshell (PyPI): malicious package ships reverse-shell backdoor triggered on pip install or import (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-h7h9-fmhv-56wh","status":"live","title":"poc-revshell (PyPI): malicious package ships reverse-shell backdoor triggered on pip install or import (no CVE)","url":"https://helix.ml/threat-watch/i/poc-revshell-pypi-malicious-package-ships-reverse-shell-backdoor-triggered-on-pip-install-or-import-no-cve"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"black-spindle-2-npm-malicious-postinstall-beacon-exfiltrates-host-data-on-install-no-cve","incidentTitle":"black-spindle-2 (npm): malicious postinstall beacon exfiltrates host data on install (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-qcg8-4xw5-5ccq","status":"live","title":"black-spindle-2 (npm): malicious postinstall beacon exfiltrates host data on install (no CVE)","url":"https://helix.ml/threat-watch/i/black-spindle-2-npm-malicious-postinstall-beacon-exfiltrates-host-data-on-install-no-cve"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"io-compress-brotli-perl-bundled-brotli-decoder-out-of-bounds-write-allows-memory-disclosure-crashes-or-potential-rce-whe","incidentTitle":"Node2Shell: Brotli decoder OOB write across Node.js, Python, Bun, .NET, Java, Envoy/Istio and Perl IO::Compress::Brotli enables RCE, memory disclosure or CPU pinning via crafted compressed streams (CVE-2026-111497)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://securitylabs.datadoghq.com/articles/node2shell-cve-2026-111497-nodejs-brotli-decoder/","status":"live","title":"Node2Shell: CVE-2026-111497 Brotli OOB write reproduced in Node.js's bundled decoder, expanding affected products beyond Perl's IO::Compress::Brotli","url":"https://helix.ml/threat-watch/i/io-compress-brotli-perl-bundled-brotli-decoder-out-of-bounds-write-allows-memory-disclosure-crashes-or-potential-rce-whe"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"npm-typosquat-malware-bcxhdh1kjlopsde-cjlowuxbnexkhgpzq-full-machine-compromise-on-install","incidentTitle":"npm typosquat malware: bcxhdh1kjlopsde \u0026 cjlowuxbnexkhgpzq — full machine compromise on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v78q-7787-v9rq","status":"live","title":"npm typosquat malware: bcxhdh1kjlopsde \u0026 cjlowuxbnexkhgpzq — full machine compromise on install","url":"https://helix.ml/threat-watch/i/npm-typosquat-malware-bcxhdh1kjlopsde-cjlowuxbnexkhgpzq-full-machine-compromise-on-install"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"npm-malware-wave-tailwindcss-theme-kit-noelc-css-blender-tailwind-base-buttons-malicious-packages-fully-compromise-insta","incidentTitle":"Tailwind npm malware wave: seven more malicious Tailwind/PostCSS animation packages fully compromise installed machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-282x-w96h-wv7f","status":"live","title":"Tailwind npm malware wave expands: seven more malicious Tailwind/PostCSS animation packages (tailwindcss-keyframe-kit, tailwindcss-animate-catalog, tailwind-animationlab, tailwind-keyframes, tailwind-animate-kit, tailwind-kinetic, @jasperquinn/postcss-motion-helpers) fully compromise installed machines","url":"https://helix.ml/threat-watch/i/npm-malware-wave-tailwindcss-theme-kit-noelc-css-blender-tailwind-base-buttons-malicious-packages-fully-compromise-insta"},{"body":null,"category":"breach","date":"2026-10-29","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"other","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/php2shell-day-after-tomorrow","status":"live","title":"Aikido warns PHP2Shell-style chained firewall RCEs will multiply (Brocolli2Shell), with defenders expected to catch up","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":null,"category":"breach","date":"2026-10-29","incident":"cyberattack-on-belgian-fps-finance-takes-myminfin-tax-portal-offline-before-filing-deadline","incidentTitle":"Cyberattack on Belgian FPS Finance takes MyMinfin tax portal offline before filing deadline","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.theregister.com/security/2026/10/29/belgiums-tax-agency-confirms-cyberattack-pulls-services-offline/5306409","status":"live","title":"Belgian tax agency confirms the cyberattack and extends tax deadlines to November as services remain offline","url":"https://helix.ml/threat-watch/i/cyberattack-on-belgian-fps-finance-takes-myminfin-tax-portal-offline-before-filing-deadline"},{"body":null,"category":"breach","date":"2026-10-29","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks/","status":"live","title":"CISA warns of the chained Linux kernel privesc as PHP2Shell attacks root 25 servers, including US government systems","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":null,"category":"breach","date":"2026-10-29","incident":"bae-systems-us-bankruptcy-noticing-center-outage-no-data-extracted-service-restored-after-2-weeks","incidentTitle":"BAE Systems / US Bankruptcy Noticing Center outage — no data extracted, service restored after 2+ weeks","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.securityweek.com/bae-says-no-data-extracted-in-incident-hitting-bankruptcy-courts/","status":"live","title":"BAE Systems / US Bankruptcy Noticing Center outage — no data extracted, service restored after 2+ weeks","url":"https://helix.ml/threat-watch/i/bae-systems-us-bankruptcy-noticing-center-outage-no-data-extracted-service-restored-after-2-weeks"},{"body":null,"category":"breach","date":"2026-10-29","incident":"cyberattack-on-belgian-fps-finance-takes-myminfin-tax-portal-offline-before-filing-deadline","incidentTitle":"Cyberattack on Belgian FPS Finance takes MyMinfin tax portal offline before filing deadline","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/cyberattack-disrupts-belgian-tax-services-before-deadline","status":"live","title":"Cyberattack on Belgian FPS Finance takes MyMinfin tax portal offline before filing deadline","url":"https://helix.ml/threat-watch/i/cyberattack-on-belgian-fps-finance-takes-myminfin-tax-portal-offline-before-filing-deadline"},{"body":null,"category":"breach","date":"2026-10-29","incident":"unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data","incidentTitle":"UNM Health Sciences Center cyberattack: extortion group BYOD claims theft of student/employee PII, EHR data","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://therecord.media/new-mexico-cyberattack-hospital","status":"live","title":"University of New Mexico restores hospital systems and urges no contact with hackers","url":"https://helix.ml/threat-watch/i/unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data"},{"body":null,"category":"breach","date":"2026-10-29","incident":"silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure","incidentTitle":"Volt Typhoon 'Silent Train': rotating relay chains used to exploit zero-days in SD-WAN and IT-management platforms","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.helpnetsecurity.com/2026/10/29/volt-typhoon-silent-train-relay-network/","status":"live","title":"Lumen Black Lotus Labs details Volt Typhoon's 'Silent Train' rotating relay network used to hide intrusions into enterprise control planes","url":"https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure"},{"body":null,"category":"patch","date":"2026-10-29","incident":"oracle-ebs-sql-injection-to-rce-now-scanned-exploited-in-the-wild-cve-2026-101767","incidentTitle":"Oracle EBS SQL injection to RCE now scanned/exploited in the wild (CVE-2026-101767)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.helpnetsecurity.com/2026/10/29/oracle-e-business-suite-cve-2026-101767-exploitation/","status":"live","title":"Active exploitation confirmed: Oracle EBS decoys recorded exploratory exploits of CVE-2026-101767 on Oct 27","url":"https://helix.ml/threat-watch/i/oracle-ebs-sql-injection-to-rce-now-scanned-exploited-in-the-wild-cve-2026-101767"},{"body":null,"category":"breach","date":"2026-10-29","incident":"icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents","incidentTitle":"Icepick: DHS/Okta SSO — hacktivists leak 41,000 DHS employee records incl. undercover ICE agents","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.securityweek.com/over-41000-dhs-employee-records-leaked-online/","status":"live","title":"DHS/Okta SSO breach: 41,000+ employee records now leaked online by hacktivists","url":"https://helix.ml/threat-watch/i/icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"github-actions-issue-injection-supply-chain-campaign-61-public-repos-incl-trivy-mlflow-brave-langextract-hit-via-hidden","incidentTitle":"GitHub Actions issue-injection supply chain campaign — 61 public repos (incl. Trivy, MLflow, Brave, LangExtract) hit via hidden HTML-comment payloads in issues/PRs to steal CI/CD credentials","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.theregister.com/security/2026/10/29/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour/5306153","status":"live","title":"GitHub Actions issue-injection supply chain campaign — 61 public repos (incl. Trivy, MLflow, Brave, LangExtract) hit via hidden HTML-comment payloads in issues/PRs to steal CI/CD credentials","url":"https://helix.ml/threat-watch/i/github-actions-issue-injection-supply-chain-campaign-61-public-repos-incl-trivy-mlflow-brave-langextract-hit-via-hidden"},{"body":null,"category":"patch","date":"2026-10-29","incident":"cisco-asa-ftd-ssl-vpn-zero-day-exploited-for-dos-patches-released-cve-2026-76418","incidentTitle":"Cisco ASA/FTD SSL VPN zero-day exploited for DoS — patches released (CVE-2026-76418)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/","status":"live","title":"Cisco confirms active exploitation of the ASA/FTD SSL VPN DoS zero-day and releases patches","url":"https://helix.ml/threat-watch/i/cisco-asa-ftd-ssl-vpn-zero-day-exploited-for-dos-patches-released-cve-2026-76418"},{"body":null,"category":"breach","date":"2026-10-29","incident":"silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure","incidentTitle":"Volt Typhoon 'Silent Train': rotating relay chains used to exploit zero-days in SD-WAN and IT-management platforms","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://securityaffairs.com/202023/intelligence/volt-typhoon-used-silent-train-to-hide-zero-day-attacks.html","status":"live","title":"Lumen Black Lotus Labs details three-year Silent Train tracking: disposable relay chains hid at least four Volt Typhoon zero-day attacks","url":"https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure"},{"body":null,"category":"patch","date":"2026-10-29","incident":"cisco-asa-ftd-ssl-vpn-zero-day-exploited-for-dos-patches-released-cve-2026-76418","incidentTitle":"Cisco ASA/FTD SSL VPN zero-day exploited for DoS — patches released (CVE-2026-76418)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html","status":"live","title":"Cisco confirms CVE-2026-76418 (CVSS 8.6) ASA/FTD VPN flaw is actively exploited; patches released","url":"https://helix.ml/threat-watch/i/cisco-asa-ftd-ssl-vpn-zero-day-exploited-for-dos-patches-released-cve-2026-76418"},{"body":null,"category":"breach","date":"2026-10-29","incident":"keydrift-uat-11473-cisco-catalyst-sd-wan-attackers-exploited-auth-bypass-flaw-to-steal-aes-traffic-keys-cve-2026-20127","incidentTitle":"KeyDrift / UAT-11473: Cisco Catalyst SD-WAN — auth-bypass exploited to steal AES traffic keys via Volt Typhoon-linked 'Silent Train' infrastructure (CVE-2026-20127)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/","status":"live","title":"Cisco Talos links the SD-WAN key-stealing exploitation to infrastructure overlapping Volt Typhoon's 'Silent Train' network","url":"https://helix.ml/threat-watch/i/keydrift-uat-11473-cisco-catalyst-sd-wan-attackers-exploited-auth-bypass-flaw-to-steal-aes-traffic-keys-cve-2026-20127"},{"body":null,"category":"breach","date":"2026-10-29","incident":"icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents","incidentTitle":"Icepick: DHS/Okta SSO — hacktivists leak 41,000 DHS employee records incl. undercover ICE agents","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.helpnetsecurity.com/2026/10/29/icepick-dhs-leak-ice-undercover-agents/","status":"live","title":"Icepick: DHS/Okta SSO — hacktivists leak 41,000 DHS employee records incl. undercover ICE agents","url":"https://helix.ml/threat-watch/i/icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents"},{"body":null,"category":"patch","date":"2026-10-29","incident":"cisco-asa-ftd-ssl-vpn-zero-day-exploited-for-dos-patches-released-cve-2026-76418","incidentTitle":"Cisco ASA/FTD SSL VPN zero-day exploited for DoS — patches released (CVE-2026-76418)","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://www.securityweek.com/attackers-exploit-second-cisco-firewall-vpn-zero-day-since-august/","status":"live","title":"Cisco ASA/FTD SSL VPN zero-day exploited for DoS — patches released (CVE-2026-76418)","url":"https://helix.ml/threat-watch/i/cisco-asa-ftd-ssl-vpn-zero-day-exploited-for-dos-patches-released-cve-2026-76418"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"dependency-confusion-beacon-package-identity-two-factor-targets-coinbase-on-npm","incidentTitle":"Dependency-confusion beacon package identity-two-factor targets Coinbase on npm","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-2hrq-h3vj-5wxm","status":"live","title":"Dependency-confusion beacon package identity-two-factor targets Coinbase on npm","url":"https://helix.ml/threat-watch/i/dependency-confusion-beacon-package-identity-two-factor-targets-coinbase-on-npm"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"spectral-net-probe-npm-malicious-package-exfiltrates-local-file-contents-via-install-time-and-load-time-callbacks","incidentTitle":"spectral-net-probe (npm): malicious package exfiltrates local file contents via install-time and load-time callbacks","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-48mf-mvf8-x4v3","status":"live","title":"spectral-net-probe (npm): malicious package exfiltrates local file contents via install-time and load-time callbacks","url":"https://helix.ml/threat-watch/i/spectral-net-probe-npm-malicious-package-exfiltrates-local-file-contents-via-install-time-and-load-time-callbacks"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"dependency-confusion-beacon-packages-mw-communication-client-mw-test-utils-mui-wrapper-x-date-pickers-exfiltrate-user-ho","incidentTitle":"Dependency-confusion beacon packages: mw-communication-client, mw-test-utils, mui-wrapper-x-date-pickers exfiltrate user/host/cwd on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-4h9g-fh86-j87q","status":"live","title":"Dependency-confusion beacon packages: mw-communication-client, mw-test-utils, mui-wrapper-x-date-pickers exfiltrate user/host/cwd on install","url":"https://helix.ml/threat-watch/i/dependency-confusion-beacon-packages-mw-communication-client-mw-test-utils-mui-wrapper-x-date-pickers-exfiltrate-user-ho"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"dependency-confusion-malware-zmtcdn-components-and-zmtcdn-ui-npm-packages-exfiltrate-host-data-via-postinstall-script","incidentTitle":"Dependency-confusion malware: @zmtcdn/components and @zmtcdn/ui npm packages exfiltrate host data via postinstall script","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-2pph-m662-c8hg","status":"live","title":"Dependency-confusion malware: @zmtcdn/components and @zmtcdn/ui npm packages exfiltrate host data via postinstall script","url":"https://helix.ml/threat-watch/i/dependency-confusion-malware-zmtcdn-components-and-zmtcdn-ui-npm-packages-exfiltrate-host-data-via-postinstall-script"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"malware-in-dsh-vm-tester-npm-package-full-machine-compromise-rotate-secrets-no-cve","incidentTitle":"dsh-* npm malware campaign: dsh-vm-tester, dsh-redteam-mode and dsh-volcengine-provider fully compromise installed machines; rotate secrets (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-8hr2-m7vq-fhpg","status":"live","title":"dsh-* npm malware campaign expands: dsh-volcengine-provider (~1,860 downloads/month) fully compromises installed machines","url":"https://helix.ml/threat-watch/i/malware-in-dsh-vm-tester-npm-package-full-machine-compromise-rotate-secrets-no-cve"},{"body":null,"category":"breach","date":"2026-10-29","incident":"engie-data-breach-customer-data-stolen-via-compromised-partner-marketing-platform-france","incidentTitle":"ENGIE: French customer contact and contract data stolen through a partner marketing platform breach","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://securityaffairs.com/201985/data-breach/engie-data-breach-exposes-customer-details-and-energy-contracts.html","status":"live","title":"ENGIE confirms attackers accessed French customers' contact and energy contract data via a partner sales tool; banking data unaffected","url":"https://helix.ml/threat-watch/i/engie-data-breach-customer-data-stolen-via-compromised-partner-marketing-platform-france"},{"body":null,"category":"breach","date":"2026-10-29","incident":"keydrift-uat-11473-cisco-catalyst-sd-wan-attackers-exploited-auth-bypass-flaw-to-steal-aes-traffic-keys-cve-2026-20127","incidentTitle":"KeyDrift / UAT-11473: Cisco Catalyst SD-WAN — auth-bypass exploited to steal AES traffic keys via Volt Typhoon-linked 'Silent Train' infrastructure (CVE-2026-20127)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html","status":"live","title":"KeyDrift / UAT-11473: Cisco Catalyst SD-WAN — attackers exploited auth-bypass flaw to steal AES traffic keys (CVE-2026-20127)","url":"https://helix.ml/threat-watch/i/keydrift-uat-11473-cisco-catalyst-sd-wan-attackers-exploited-auth-bypass-flaw-to-steal-aes-traffic-keys-cve-2026-20127"},{"body":null,"category":"breach","date":"2026-10-29","incident":"irhythm-data-breach-8-2m-patients-data-stolen-from-third-party-hosted-apps-ransom-demanded","incidentTitle":"iRhythm data breach: 8.2M patients' data stolen from third-party-hosted apps, ransom demanded","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.securityweek.com/hhs-filing-puts-irhythm-data-breach-toll-at-8-2-million/","status":"live","title":"iRhythm data breach: 8.2M patients' data stolen from third-party-hosted apps, ransom demanded","url":"https://helix.ml/threat-watch/i/irhythm-data-breach-8-2m-patients-data-stolen-from-third-party-hosted-apps-ransom-demanded"},{"body":null,"category":"patch","date":"2026-10-29","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://www.securityweek.com/chinese-hackers-quietly-used-low-severity-esxi-logging-flaw-as-zero-day/","status":"live","title":"SecurityWeek confirms Chinese hackers used the low-severity ESXi logging flaw CVE-2026-41709 as a zero-day","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":null,"category":"breach","date":"2026-10-29","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html","status":"live","title":"Palo Alto Networks warns of active PHP2Shell exploitation against internet-exposed management interfaces","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":null,"category":"patch","date":"2026-10-29","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html","status":"live","title":"CVE-2026-41709 added to CISA KEV after CrowdStrike tied it to China-nexus Warp Panda attacks on the U.S. legal sector","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"malware-in-dsh-vm-tester-npm-package-full-machine-compromise-rotate-secrets-no-cve","incidentTitle":"dsh-* npm malware campaign: dsh-vm-tester, dsh-redteam-mode and dsh-volcengine-provider fully compromise installed machines; rotate secrets (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-r4m9-8735-g966","status":"live","title":"Second malicious dsh-* package: dsh-redteam-mode (npm) fully compromises installed machines; rotate all secrets","url":"https://helix.ml/threat-watch/i/malware-in-dsh-vm-tester-npm-package-full-machine-compromise-rotate-secrets-no-cve"},{"body":"As of 12:40 JST GMO says its white-hat team has obtained information that may help identify the attacker and will submit it to the police and other agencies that day. The bounty site had received 270 tips by 11:30 JST. GMO asks the public not to track down or contact suspects themselves and to report new leak sites through onamae.com/abuse/. The entry vector and the number of affected customers are still undisclosed.","category":"breach","date":"2026-10-29","incident":"onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand","incidentTitle":"Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand","kind":"status","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://internet.gmo/news/article/261/","status":"live","title":"GMO 15th report: white-hat team hands possible attacker leads to police; 270 bounty tips","url":"https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand"},{"body":null,"category":"supply-chain","date":"2026-10-29","incident":"searchjacked-319-malicious-chrome-extensions-hijack-searches-of-13-4m-users-monetize-via-yahoo-bing-referral-fraud","incidentTitle":"Searchjacked: 319 malicious Chrome extensions hijack searches of 13.4M users, monetize via Yahoo/Bing referral fraud","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://socket.dev/blog/searchjacked?utm_medium=feed","status":"live","title":"Searchjacked: 319 malicious Chrome extensions hijack searches of 13.4M users, monetize via Yahoo/Bing referral fraud","url":"https://helix.ml/threat-watch/i/searchjacked-319-malicious-chrome-extensions-hijack-searches-of-13-4m-users-monetize-via-yahoo-bing-referral-fraud"},{"body":null,"category":"breach","date":"2026-10-29","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/ghost-php2shell-coordinated-disclosure-faster","status":"live","title":"Commentary on PHP2Shell coordinated disclosure: AI-accelerated exploit development sparks debate over disclosure speed","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":"AI editor revision: China-nexus actors used the VMware ESX zero-day to hide their tracks and chained PHP2Shell/Fragnesia to root firewalls","category":"patch","date":"2026-10-28","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"correction","patchStatus":"patched","severity":"high","sourceUrl":null,"status":"live","title":"Severity changed from medium to high","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":"AI editor revision: Palo Alto Networks warns of active PHP2Shell exploitation against internet-exposed management interfaces","category":"breach","date":"2026-10-28","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"status","patchStatus":"partial","severity":"critical","sourceUrl":null,"status":"live","title":"Patch status changed from unknown to partial","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":"AI editor revision: CVE-2026-41709 added to CISA KEV after CrowdStrike tied it to China-nexus Warp Panda attacks on the U.S. legal sector","category":"patch","date":"2026-10-28","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"status","patchStatus":"patched","severity":"high","sourceUrl":null,"status":"live","title":"Patch status changed from unknown to patched","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":"AI editor revision: CVE-2026-41709 added to CISA KEV after CrowdStrike tied it to China-nexus Warp Panda attacks on the U.S. legal sector","category":"patch","date":"2026-10-28","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"correction","patchStatus":"patched","severity":"high","sourceUrl":null,"status":"live","title":"Severity changed from low to medium","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":"GMO Internet's filing to the Tokyo Stock Exchange lists the incident costs it bears: the ¥5,000 goodwill payment, compensation for realized losses on trades GMO recognises as unauthorized, a replacement PC for any customer hit by ransomware (none confirmed as of the 10th report), the special payments for published data, and support for affected customers. The parent, GMO Internet Group, funds the US$1M bounty. It says no total can be calculated yet because the number of affected customers, the extent of the published data and the review of compensable trades are not settled. GMO Internet Group says its checks so far have found no unauthorized access or data leak from this incident in any group service other than Onamae.com Desktop Cloud.","category":"breach","date":"2026-10-28","incident":"onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand","incidentTitle":"Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://internet.gmo/ir/pdf/irlibrary/gmointernet_j_disclose_20261028.pdf","status":"live","title":"Exchange filing: financial impact not yet calculable; no other GMO group service affected","url":"https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand"},{"body":"GMO's 13th report (11:00 JST) says the domain of the site publishing customer information, mirrors included, was suspended at about 04:00 JST, working with the operators involved. GMO says it will take down any new copy, is logging posts that spread the URLs and reporting them to X and the police, and may pursue sender disclosure and damages.","category":"breach","date":"2026-10-28","incident":"onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand","incidentTitle":"Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand","kind":"status","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://internet.gmo/news/article/259/","status":"live","title":"Leak site and its mirrors taken down (~04:00 JST)","url":"https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand"},{"body":null,"category":"supply-chain","date":"2026-10-28","incident":"b20miner-npm-package-malicious-cryptominer-backdoor-fully-compromises-installed-hosts-no-cve","incidentTitle":"b20miner npm package: malicious cryptominer backdoor fully compromises installed hosts (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fw7x-6chc-4244","status":"live","title":"b20miner npm package: malicious cryptominer backdoor fully compromises installed hosts (no CVE)","url":"https://helix.ml/threat-watch/i/b20miner-npm-package-malicious-cryptominer-backdoor-fully-compromises-installed-hosts-no-cve"},{"body":null,"category":"patch","date":"2026-10-28","incident":"broadcom-vmware-esx-cve-2026-41709","incidentTitle":"VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-41709","status":"live","title":"CISA added CVE-2026-41709 to the Known Exploited Vulnerabilities catalog (federal remediation due Nov 11, 2026)","url":"https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709"},{"body":null,"category":"breach","date":"2026-10-28","incident":"amadeus-it-group-breach-leaks-92-000-japan-airlines-customer-reservation-records","incidentTitle":"Amadeus IT Group breach leaks 92,000 Japan Airlines customer reservation records","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/japan-airlines-warns-of-breach-country-grapples-with-incidents","status":"live","title":"Amadeus IT Group breach leaks 92,000 Japan Airlines customer reservation records","url":"https://helix.ml/threat-watch/i/amadeus-it-group-breach-leaks-92-000-japan-airlines-customer-reservation-records"},{"body":null,"category":"supply-chain","date":"2026-10-28","incident":"ghostaction-github-supply-chain-campaign-steals-developer-secrets-and-pivots-to-cloud-access","incidentTitle":"GhostAction: GitHub supply-chain campaign steals developer secrets and pivots to cloud access","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.darkreading.com/application-security/ghostaction-hacking-wave-fizzles-attackers-github","status":"live","title":"GhostAction: GitHub supply-chain campaign steals developer secrets and pivots to cloud access","url":"https://helix.ml/threat-watch/i/ghostaction-github-supply-chain-campaign-steals-developer-secrets-and-pivots-to-cloud-access"},{"body":null,"category":"patch","date":"2026-10-28","incident":"oracle-ebs-sql-injection-to-rce-now-scanned-exploited-in-the-wild-cve-2026-101767","incidentTitle":"Oracle EBS SQL injection to RCE now scanned/exploited in the wild (CVE-2026-101767)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://www.theregister.com/security/2026/10/28/oracle-celebrates-end-of-cybersecurity-awareness-month-with-quadruple-trouble/5306121","status":"live","title":"Attackers probe another Oracle EBS bug and ShinyHunters' PeopleSoft 0-day is revealed to involve three vulnerabilities","url":"https://helix.ml/threat-watch/i/oracle-ebs-sql-injection-to-rce-now-scanned-exploited-in-the-wild-cve-2026-101767"},{"body":null,"category":"patch","date":"2026-10-28","incident":"electrum-malicious-server-rbf-fee-bump-theft-via-unverified-mempool-tx-cve-2026-117601","incidentTitle":"Electrum malicious-server RBF fee-bump theft via unverified mempool tx (CVE-2026-117601)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-6jp4-8v48-cc5v","status":"live","title":"Electrum malicious-server RBF fee-bump theft via unverified mempool tx (CVE-2026-117601)","url":"https://helix.ml/threat-watch/i/electrum-malicious-server-rbf-fee-bump-theft-via-unverified-mempool-tx-cve-2026-117601"},{"body":null,"category":"supply-chain","date":"2026-10-28","incident":"zaip-ai-cli-npm-package-is-malware-full-machine-compromise-no-patched-versions-ghsa-ffq4-h5jm-8pqr","incidentTitle":"@zaip-ai/cli npm package is malware — full machine compromise, no patched versions (GHSA-ffq4-h5jm-8pqr)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-ffq4-h5jm-8pqr","status":"live","title":"@zaip-ai/cli npm package is malware — full machine compromise, no patched versions (GHSA-ffq4-h5jm-8pqr)","url":"https://helix.ml/threat-watch/i/zaip-ai-cli-npm-package-is-malware-full-machine-compromise-no-patched-versions-ghsa-ffq4-h5jm-8pqr"},{"body":null,"category":"patch","date":"2026-10-28","incident":"zip-cloaking-rust-zip-crate-parser-differential-lets-crafted-zips-bypass-security-scanners-and-overwrite-arbitrary-files","incidentTitle":"Zip Cloaking: Rust zip crate — parser differential bypasses scanners for arbitrary file write/RCE, plus symlink write, alloc-abort and legacy-decoder DoS (CVE-2026-115905, CVE-2026-115908, CVE-2026-115909, CVE-2026-115907)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-m665-v7pm-7grj","status":"live","title":"Zip Cloaking: Rust zip crate — parser differential lets crafted ZIPs bypass security scanners and overwrite arbitrary files (CVE-2026-115905)","url":"https://helix.ml/threat-watch/i/zip-cloaking-rust-zip-crate-parser-differential-lets-crafted-zips-bypass-security-scanners-and-overwrite-arbitrary-files"},{"body":null,"category":"supply-chain","date":"2026-10-28","incident":"walknpm-todo-cli-npm-package-is-malware-full-machine-compromise-for-installers-of-v2-0-1-no-cve","incidentTitle":"@walknpm/todo-cli npm package is malware — full machine compromise for installers of v2.0.1 (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-p6gj-69gx-r376","status":"live","title":"@walknpm/todo-cli npm package is malware — full machine compromise for installers of v2.0.1 (no CVE)","url":"https://helix.ml/threat-watch/i/walknpm-todo-cli-npm-package-is-malware-full-machine-compromise-for-installers-of-v2-0-1-no-cve"},{"body":null,"category":"supply-chain","date":"2026-10-28","incident":"malicious-npm-package-dsh-plugin-blender-3d-full-machine-compromise-for-installers-no-cve","incidentTitle":"Malicious npm package dsh-plugin-blender-3d — full machine compromise for installers (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-hw9g-f63g-4c8x","status":"live","title":"Malicious npm package dsh-plugin-blender-3d — full machine compromise for installers (no CVE)","url":"https://helix.ml/threat-watch/i/malicious-npm-package-dsh-plugin-blender-3d-full-machine-compromise-for-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-10-28","incident":"itsa-utils-itsa-react-checkbox-npm-packages-trojanized-with-malware-no-cve","incidentTitle":"itsa-utils / itsa-react-checkbox npm packages trojanized with malware (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-x788-rmcm-4x49","status":"live","title":"itsa-utils / itsa-react-checkbox npm packages trojanized with malware (no CVE)","url":"https://helix.ml/threat-watch/i/itsa-utils-itsa-react-checkbox-npm-packages-trojanized-with-malware-no-cve"},{"body":null,"category":"breach","date":"2026-10-28","incident":"silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure","incidentTitle":"Volt Typhoon 'Silent Train': rotating relay chains used to exploit zero-days in SD-WAN and IT-management platforms","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html","status":"live","title":"Lumen attributes Volt Typhoon's Silent Train covert relay network to four zero-day exploitation campaigns; network now disrupted","url":"https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure"},{"body":null,"category":"breach","date":"2026-10-28","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"advisory","patchStatus":"partial","severity":"critical","sourceUrl":"https://www.wordfence.com/blog/2026/10/php2shell-update-still-no-confirmed-wordpress-compromises-and-answers-to-the-questions-were-hearing-most/","status":"live","title":"Wordfence reports no confirmed WordPress compromises via PHP2Shell as of Oct 28; urges updating PHP itself, not just WordPress","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":null,"category":"patch","date":"2026-10-28","incident":"n-able-n-central-cve-2025-8876","incidentTitle":"N-able N-Central Command Injection Vulnerability (CVE-2025-8876)","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure","status":"closed","title":"Black Lotus Labs ties the N-central zero-day chain (CVE-2025-8875/8876) to Volt Typhoon's 'Silent Train' campaign","url":"https://helix.ml/threat-watch/i/n-able-n-central-cve-2025-8876"},{"body":null,"category":"patch","date":"2026-10-28","incident":"n-able-n-central-cve-2025-8875","incidentTitle":"N-able N-Central Insecure Deserialization Vulnerability (CVE-2025-8875)","kind":"exploitation","patchStatus":"patched","severity":"high","sourceUrl":"https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure","status":"closed","title":"Black Lotus Labs ties the N-central zero-day chain (CVE-2025-8875/8876) to Volt Typhoon's 'Silent Train' campaign","url":"https://helix.ml/threat-watch/i/n-able-n-central-cve-2025-8875"},{"body":"See the Silent Train incident for the full campaign.","category":"patch","date":"2026-10-28","incident":"cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127","incidentTitle":"Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability (CVE-2026-20127)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure","status":"closed","title":"Black Lotus Labs ties exploitation to Volt Typhoon's 'Silent Train' campaign, active by late 2025 and continuing after the fix","url":"https://helix.ml/threat-watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127"},{"body":"This is the third SD-WAN platform the group has exploited, after Versa Director and Cisco Catalyst SD-WAN. See the Silent Train incident for the full campaign.","category":"patch","date":"2026-10-28","incident":"arista-velocloud-orchestrator-cve-2026-16812","incidentTitle":"Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability (CVE-2026-16812)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure","status":"closed","title":"Black Lotus Labs attributes zero-day exploitation to Volt Typhoon's 'Silent Train' campaign","url":"https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-16812"},{"body":"Headscale memory exhaustion and Funnel entitlement gating remain open, according to the researcher. Conn25 is unreleased and will be fixed before it ships.","category":"patch","date":"2026-10-28","incident":"tailworm-tailscale-ssh-socket-forwarding-flaws-let-trusted-device-attackers-reach-root-only-sockets-no-cve","incidentTitle":"Tailworm: Tailscale SSH unix-socket forwarding gives policy-permitted peers root-only sockets; fixed in 1.104.4 (TS-2026-014)","kind":"patch","patchStatus":"partial","severity":"high","sourceUrl":"https://github.com/tailscale/tailscale/releases/tag/v1.104.4","status":"live","title":"Tailscale 1.104.4 released, fixing TS-2026-014 to 017; Tailscale publishes \"Findings and fixes\"","url":"https://helix.ml/threat-watch/i/tailworm-tailscale-ssh-socket-forwarding-flaws-let-trusted-device-attackers-reach-root-only-sockets-no-cve"},{"body":null,"category":"breach","date":"2026-10-28","incident":"php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew","incidentTitle":"PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)","kind":"exploitation","patchStatus":"partial","severity":"critical","sourceUrl":"https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html","status":"live","title":"PHP2Shell attack rooted 25 servers including a U.S. government-affiliated network, described as AI-assisted","url":"https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew"},{"body":null,"category":"supply-chain","date":"2026-10-28","incident":"malicious-npm-package-mock-transactions-sdk-full-system-compromise-on-install","incidentTitle":"Malicious npm package mock-transactions-sdk — full system compromise on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-357r-x5jp-3p8f","status":"live","title":"Malicious npm package mock-transactions-sdk — full system compromise on install","url":"https://helix.ml/threat-watch/i/malicious-npm-package-mock-transactions-sdk-full-system-compromise-on-install"},{"body":"13 of the 15 are rated High and 2 Medium. They include XStream deserialization RCE, agent-launch and agent-config RCE, symlink file read/write, a setup-wizard admin-creation race, and stored XSS.","category":"patch","date":"2026-10-28","incident":"jenkins-multiple-vulnerabilities-fixed-in-2-588-lts-2-580-2-rce-arbitrary-file-read-write-xss-cve-2026-117612-et-al","incidentTitle":"Jenkins core: 15 vulnerabilities fixed in 2.588 / LTS 2.580.2. Low-privilege users can get RCE on the controller; an unauthenticated race in the setup wizard can create an admin (CVE-2026-117612–117626)","kind":"patch","patchStatus":"patched","severity":"high","sourceUrl":"https://www.jenkins.io/security/advisory/2026-10-28/","status":"live","title":"Jenkins advisory 2026-10-28 published; weekly 2.588 and LTS 2.580.2 fix 15 core vulnerabilities","url":"https://helix.ml/threat-watch/i/jenkins-multiple-vulnerabilities-fixed-in-2-588-lts-2-580-2-rce-arbitrary-file-read-write-xss-cve-2026-117612-et-al"},{"body":null,"category":"supply-chain","date":"2026-10-28","incident":"malicious-npm-package-transaction-info-generate-sdk-full-system-compromise-on-install-no-cve","incidentTitle":"Malicious npm package transaction-info-generate-sdk — full system compromise on install (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-23j5-jj88-v9f3","status":"live","title":"Malicious npm package transaction-info-generate-sdk — full system compromise on install (no CVE)","url":"https://helix.ml/threat-watch/i/malicious-npm-package-transaction-info-generate-sdk-full-system-compromise-on-install-no-cve"}],"feeds":{"changes":"https://helix.ml/threat-watch/changes.json","json":"https://helix.ml/threat-watch/feed.json","llms":"https://helix.ml/threat-watch/llms.txt","page":"https://helix.ml/threat-watch","rss":"https://helix.ml/threat-watch/feed.xml"},"generatedAt":"2026-10-30T05:14:48Z","site":"https://helix.ml/threat-watch"}