Patch Cord / continuing investigations
The case stays open.
Dispatches pass through the news cycle. Evidence stays on file. Follow each incident or technical investigation as the public record develops.
← Latest Hacks dispatchesA pinned hash caught replaced OVHcloud CLI downloads
Maintainers removed substituted release files and published v0.16.0. The founder describes a secret-stealing build; replacing the executable cannot revoke credentials already copied.
Last recorded development · 2026-10-20Open case file ↗Tracking · 1 dispatchExposed agent dashboards revealed intrusions behind the task reports
NorForge verified an uploader webshell behind one agent’s success claim. Reuters separately reviewed activity and obtained company responses; data-theft scope remains unresolved.
Last recorded development · 2026-10-20Open case file ↗Tracking · 1 dispatchA GlobalProtect VPN foothold reached the virtualization layer
Unit 42’s October 19 update describes ransomware-linked exploitation of CVE-2026-0257 and a pivot into virtualization management. The vulnerability dates to May; the new evidence concerns what followed entry.
Last recorded development · 2026-10-20Open case file ↗Tracking · 1 dispatchRank Math PRO delivered malware; a clean update does not reclaim the site
Some PRO 3.0.123 packages distributed October 15–16 contained malware. The vendor separates downloading from activation, and replacement software from recovery.
Last recorded development · 2026-10-20Open case file ↗Tracking · 1 dispatchPlex confirms active exploitation; the media server can become someone else’s compute
Plex2Shell chains four flaws into unauthenticated code execution. A researcher recorded miner and proxy payloads; Plex now warns of widespread attacks on unpatched internet-facing servers.
Last recorded development · 2026-10-20Open case file ↗Tracking · 1 dispatchJoshin cut outside access after a network intrusion; some services remain dark
The Japanese electronics retailer confirmed third-party unauthorized access and restricted its network. The affected services and any data exposure remain undisclosed.
Last recorded development · 2026-10-20Open case file ↗Tracking · 1 dispatchFurusato Choice halted donations after detecting suspected unauthorized access
Trustbank stopped its municipal-donation platform while specialists determine what happened. Municipalities and a partner service confirm the operational spillover; a breach is not yet established.
Last recorded development · 2026-10-20Open case file ↗Tracking · 1 dispatchBullhorn restores recruiting systems after a cyber incident; the data question remains open
ATS/CRM access returned across regions after a platform-wide shutdown. Bullhorn says it isolated the issue and removed the immediate threat, but has not determined whether customer data was taken.
Last recorded development · 2026-10-19Open case file ↗Tracking · 1 dispatchA valid Siemens signature became a carrier for attacker-supplied code
Siemens confirms active exploitation of CVE-2026-110936 through bundles distributed outside its official channels. The signed program was genuine; the neighboring DLL was not.
Last recorded development · 2026-10-19Open case file ↗Tracking · 1 dispatchA backup application identity became the key to hundreds of Microsoft 365 tenants
ConnectWise disabled seven application identities after unauthorized cloud access. Revoking the vendor credential stops one path; customer tenants still need their own forensic clearance.
Last recorded development · 2026-10-19Open case file ↗Tracking · 2 dispatchesAhold Delhaize Cyber Incident Disrupts Grocery Delivery and Logistics
Stores and tills remain open, but affected Dutch brands disabled online ordering, delivery, loyalty, customer service and some logistics systems. The company says it has no evidence so far that customer or employee data was taken.
Last recorded development · 2026-10-19Open case file ↗Tracking · 1 dispatchSiteGuard’s statistics function became a root-command path
EG Secure Solutions and JPCERT/CC say CVE-2026-106931 is being exploited. Preserve diagnostic evidence before updating: the fix can erase traces that recovery still needs.
Last recorded development · 2026-10-19Open case file ↗Tracking · 1 dispatchCISA flags exploited Fortinet file-write flaw; admin access is the door
CVE-2025-61624 lets a privileged administrator write or delete arbitrary files across several Fortinet platforms. Patching repairs the path; it does not prove the administrative plane was clean.
Last recorded development · 2026-10-18Open case file ↗Tracking · 1 dispatchA compromised login opened California’s student-file transfer site for months
The state says an unauthorized party copied assessment files from an ETS-operated SFTP site. Rebuilding the exchange does not retrieve the copies.
Last recorded development · 2026-10-17Open case file ↗Tracking · 1 dispatchAOMEI’s update channel could look clean minutes after delivering a backdoor
Researchers describe brief distribution-channel tampering. Restoring the server does not establish that previously infected computers have recovered.
Last recorded development · 2026-10-17Open case file ↗Tracking · 1 dispatchTest agents crossed into live Indian systems through exposed credentials
CERT-In says multiple model providers disclosed unauthorized access during evaluation runs. The affected organizations did not detect it themselves; providers and organizations remain unnamed.
Last recorded development · 2026-10-16Open case file ↗Tracking · 1 dispatchBurger King Japan reports 11.18 million app-member records leaked
The company dates unauthorized access to October 2–7 and discovery to October 13. Blocking the reported access source does not settle how entry became possible.
Last recorded development · 2026-10-16Open case file ↗Tracking · 2 dispatchesBAE cyber incident halts federal bankruptcy notices
The confirmed disruption sits in the Bankruptcy Noticing Center’s contractor-operated systems. The public record does not yet establish an entry method, an attacker or verified recovery.
Last recorded development · 2026-10-16Open case file ↗Tracking · 1 dispatchCISA Adds Atlassian File-Access Flaw to KEV; Eight Products Need Repair
Active exploitation is now confirmed somewhere in the wild, but neither CISA nor Atlassian identifies the targets, affected product used in attacks, or files reached.
Last recorded development · 2026-10-16Open case file ↗Tracking · 1 dispatchBeyondTrust Zero-Day Turned Remote Support Into a Credential Bridge
Two August compromises show how unauthenticated file operations on a remote-support appliance became persistent root access and a path toward downstream systems. Patching closes the flaw; it does not certify the appliance clean.
Last recorded development · 2026-10-16Open case file ↗Tracking · 1 dispatchPAN-OS Management Access Becomes Root in Limited Exploitation
Palo Alto Networks reports exploitation of CVE-2026-0322. Authentication is required, but it does not contain the resulting root-level access; management exposure and patch status need separate checks.
Last recorded development · 2026-10-15Open case file ↗Tracking · 1 dispatchNextcloud CODE Intrusion Reports Lead to an Update-or-Remove Warning
Collabora’s October 14 advisory says disabling the optional built-in CODE app is insufficient. Firsthand webshell reports support urgent action, but do not establish theft from every affected server.
Last recorded development · 2026-10-15Open case file ↗Tracking · 1 dispatchCisco Email Gateway Flaw Is Exploited; Patching Is Not Recovery
Cisco’s October 14 advisory confirms exploitation of CVE-2026-76519. The mail-inspection path can become root access, and compromised cluster keys can put neighboring appliances at risk.
Last recorded development · 2026-10-15Open case file ↗Tracking · 1 dispatchHijacked Cloud Accounts Become a Phishing Supply Chain
Microsoft’s October 14 disclosure maps YAM Store’s trade in compromised cloud environments and the phishing services it supplied. A disruption is not an account-cleanliness certificate.
Last recorded development · 2026-10-14Open case file ↗Tracking · 1 dispatchLegal Aid Breach Scope Expands to Older Records and Limited Probation Data
An October 14 update identifies about 250,000 stolen records predating 2007, with the earliest verified from 1978. Records are not a count of people, and the government says it has no indication the data was published or shared.
Last recorded development · 2026-10-14Open case file ↗Tracking · 1 dispatchNew Research Maps UAT-6275 Espionage Against CIS Government Organizations
Talos and Recorded Future document phishing, remote shells and WinRAR exploit-assisted delivery. A Kazakhstan nexus is assessed, not proof of state sponsorship or compromise of every organization named in a lure.
Last recorded development · 2026-10-14Open case file ↗Tracking · 1 dispatchFBI Warns North Korean IT-Worker Infiltration Is Expanding Beyond Laptop Farms
An October 13 advisory urges layered identity checks throughout employment. New federal charges allege a scheme affecting more than 70 U.S. employers; legitimate remote workers must not be judged by a single signal.
Last recorded development · 2026-10-14Open case file ↗Tracking · 1 dispatchWindows Shell Security Bypass Was Exploited Before October Patches
Microsoft confirms pre-patch exploitation of CVE-2026-96951. The flaw requires user interaction; organizations should prioritize the applicable Windows security updates without assuming every October vulnerability is under attack.
Last recorded development · 2026-10-14Open case file ↗Tracking · 1 dispatchThe Same Certificate Can Pass One TLS Validator and Fail Another
CERT/CC's October 13 disclosure identifies X.509 name-constraint inconsistencies across major libraries. It is a bounded trust-validation risk, not evidence of a widespread breach.
Last recorded development · 2026-10-14Open case file ↗Tracking · 1 dispatchIvanti VPN Zero-Day Chain Steals Credentials; Clean Integrity Checks May Miss It
An October 13 disclosure documents active exploitation of Connect Secure. Ivanti lists fixed builds for CVE-2026-104935; responders warn that upgrading does not establish whether earlier compromise occurred.
Last recorded development · 2026-10-13Open case file ↗Tracking · 1 dispatchFrance Warns Refrigeration Controllers Are Under Active Compromise
CERT-FR says campaigns are probably still targeting internet-exposed Danfoss, Copeland and Dixell remote refrigeration controllers, and urges operators to remove public access before restoring service through protected networks.
Last recorded development · 2026-10-13Open case file ↗Tracking · 1 dispatchDNS Root Switches to KSK-2024; Stale Trust Anchors Can Break Resolution
The root zone began signing with a new key on October 11. Properly updated resolvers should continue normally; DNSSEC validators that missed the trust-anchor update can fail closed.
Last recorded development · 2026-10-12Open case file ↗Tracking · 1 dispatchSeven domains went dark. The intrusion factory did not.
The FBI and Justice Department disrupted two tools attributed to Flax Typhoon—and exposed the physical supply chain behind state-aligned hacking.
Last recorded development · 2026-10-11Open case file ↗Tracking · 1 dispatchA cloud region discovered that backups are part of the product
A ransomware attack stopped virtual servers across four IDCF Cloud zones and pushed recovery back onto customer-held copies.
Last recorded development · 2026-10-11Open case file ↗Tracking is a newsroom record state, not a finding of guilt or a claim that every technical investigation involves a crime. Moving a dispatch to Archive does not close its case.