Sun 1 Nov · updated 09:20 UTC
Today in security
Today’s briefing
07:00 UTC edition
Ivanti flaws remain part of an exploited access chain
New details on the Ivanti Connect Secure exploit chain follow the previous edition’s notice that CISA had listed two of its flaws: reporting describes unauthenticated root access and patches for the listed vulnerabilities. The chain also includes CVE-2026-104935, while the attacker’s identity and the full scope of activity remain unclear in the latest accounts. Separately, Coinspect said attackers still hold valid certificates for 13 domains involved in the Name.com redirection incident, although all 15 affected domains have been restored.
Known exploited9
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
Cisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareCVE-2026-76418
Federal deadline 1 Nov · In CISA KEV since 29 Oct
8.6High0.8% EPSS6 articles
- In CISA KEV
GitLabCVE-2026-97229
Federal deadline 1 Nov · In CISA KEV since 29 Oct
10.0Critical27% EPSS14 articles
- In CISA KEV
Ivanti Connect SecureCVE-2026-111357
Federal deadline 2 Nov · In CISA KEV since 30 Oct
7.0High0.5% EPSS4 articles
- In CISA KEV
Ivanti Connect SecureCVE-2026-118527
Federal deadline 13 Nov · In CISA KEV since 30 Oct
Not scored4 articles
Show 5 more · federal deadlines passed
- In CISA KEV
LinuxCVE-2026-46300
Federal deadline passed 31 Oct · In CISA KEV since 28 Oct
7.8High16% EPSS12 articles
- In CISA KEV
PHPCVE-2026-109618
Federal deadline passed 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS55 articles
- In CISA KEV
PHPCVE-2026-109619
Federal deadline passed 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS54 articles
- In CISA KEV
Ivanti Connect SecureCVE-2026-104935
Federal deadline passed 16 Oct · In CISA KEV since 13 Oct
8.6High87% EPSS18 articles
- In CISA KEV
Drupal CoreCVE-2026-9082
Federal deadline passed 27 May · In CISA KEV since 22 May
9.8Critical89% EPSS9 articles
Latest news11
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 09:20 UTC. Red diamonds mark the story about exploited CVEs.
- 09:20 UTC. Four threat actors used the ARTEX AI hacking tool in October, two of them linked to the Chinese state. 1 outlet.
- 07:48 UTC. Trezor warns of tampered wallets sold through CryptoBilis. 1 outlet.
- 07:31 UTC. Android flaw lets attackers trigger repeated remote phone crashes. 1 outlet.
- 07:25 UTC. Polymarket Traders Lose $2.7 Million in Script Hijack. 1 outlet.
- 07:02 UTC. Kaspersky details NetamLoader attack on Asian government systems. 1 outlet.
- 06:44 UTC. FBI blames North Korea group for $6.43 billion Binance heist. 1 outlet.
- 19:33 UTC. CISA adds two Ivanti VPN flaws to its exploited list. 1 outlet. About an exploited CVE.
- 18:25 UTC. Northflank tells customers to assume every stored secret was decrypted. 1 outlet.
- 17:02 UTC. Attackers behind the Name.com DeFi hijack still hold valid certificates for 13 domains. 1 outlet.
- 12:01 UTC. Chainalysis Says Intruder Accessed Internal Tools and Customer Data. 1 outlet.
- 11:00 UTC. Syrian Hacker Sentenced to 42 Months for Decade of Intrusions. 1 outlet.
- 10:48 UTC. YARA-X 1.22.1 Ships Two Bug Fixes in Maintenance Update. 1 outlet.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 09:20 | Four threat actors used the ARTEX AI hacking tool in October, two of them linked to the Chinese state | 1 | Other |
| 07:48 | Trezor warns of tampered wallets sold through CryptoBilis | 1 | Other |
| 07:31 | Android flaw lets attackers trigger repeated remote phone crashes | 1 | Other |
| 07:25 | Polymarket Traders Lose $2.7 Million in Script Hijack | 1 | Other |
| 07:02 | Kaspersky details NetamLoader attack on Asian government systems | 1 | Other |
| 06:44 | FBI blames North Korea group for $6.43 billion Binance heist | 1 | Other |
| 19:33 | CISA adds two Ivanti VPN flaws to its exploited list | 1 | Known exploited |
| 18:25 | Northflank tells customers to assume every stored secret was decrypted | 1 | Other |
| 17:02 | Attackers behind the Name.com DeFi hijack still hold valid certificates for 13 domains | 1 | Other |
| 12:01 | Chainalysis Says Intruder Accessed Internal Tools and Customer Data | 1 | Other |
| 11:00 | Syrian Hacker Sentenced to 42 Months for Decade of Intrusions | 1 | Other |
| 10:48 | YARA-X 1.22.1 Ships Two Bug Fixes in Maintenance Update | 1 | Other |
- Four threat actors used the ARTEX AI hacking tool in October, two of them linked to the Chinese state
Microsoft, CrowdStrike and Profero have each documented ARTEX in real intrusions, by four different threat actors. Several claims in wider coverage go beyond what the reports show.
cybersixt.com
- Trezor warns of tampered wallets sold through CryptoBilis
Trezor has issued an urgent security alert after investigators found a hardware tamper implant inside an altered Safe 5 unit sold through Southeast Asian distributor CryptoBilis. A buyer in Indonesia reportedly…
SecurityOnline
- Android flaw lets attackers trigger repeated remote phone crashes
A zero‑click Android flaw dubbed the SMS of Death affects millions of handsets by forcing telephony services into endless termination and recovery loops. Security researcher Mark Blah disclosed that malformed cellular…
SecurityOnline
- Polymarket Traders Lose $2.7 Million in Script Hijack
Malicious code on Polymarket’s site substituted a page-speed script loaded from DebugBear, a real-user monitoring tool, and enabled unauthorised access to users’ open trading sessions on 29 October 2026. Hudson Rock’s…
The Hacker News
- Kaspersky details NetamLoader attack on Asian government systems
Cybersecurity researchers have disclosed a highly sophisticated infection chain targeting government Windows 10 systems in Asia, described by Kaspersky as involving a custom government-edition build and a previously…
The Hacker News
- FBI blames North Korea group for $6.43 billion Binance heist
The FBI has attributed the theft of more than $6 billion in virtual assets to TraderTraitor, a North Korea-aligned elite hacking group also known as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899. In…
The Hacker News
- Northflank tells customers to assume every stored secret was decrypted
Users of the deployment platform report stolen AI API keys already in use. Wiz counts Northflank as the ninth AI developer platform to disclose an incident in October.
cybersixt.com
- Attackers behind the Name.com DeFi hijack still hold valid certificates for 13 domains
Coinspect found the attacker switched nameservers at the registrar and obtained TLS certificates that last until January. How the attacker got access to Name.com is still unknown.
cybersixt.com
- Chainalysis Says Intruder Accessed Internal Tools and Customer Data
Chainalysis has disclosed that it was the target of a cybersecurity incident in which an external actor accessed internal systems and tools. The company said the breach did not grant access to its investigation…
The Hacker News
- Syrian Hacker Sentenced to 42 Months for Decade of Intrusions
A US federal court in the Eastern District of Virginia sentenced Ahmad Umar Agha, a Syrian national linked to the Syrian Electronic Army, to 42 months in prison. The Justice Department says Agha evaded authorities for…
SecurityWeek
- YARA-X 1.22.1 Ships Two Bug Fixes in Maintenance Update
YARA-X has released version 1.22.1, described as a bugfix update that brings two fixes. The update is positioned as a maintenance release to address issues in the prior build, with the release notes linked to the…
SANS ISC
