Original reporting
CyberSIXT reporting
Breaking security incidents, written from the affected company’s statement, the vendor’s advisory, a government agency or an identifiable researcher.
mSecure data breach: encrypted cloud vault database stolen
· The password manager's maker, mSeven Software, told customers an attacker took an encrypted copy of a database of current and former users who synced through mSecure Cloud. It asks them to change their master password and stored secrets.
Bristol schools cyberattack: 320,000 stolen files leaked online
· More than 320,000 files from 39 schools on Bristol City Council's Trading with Schools platform are online, a month after the council said it had found no evidence that data had been stolen.
CVE-2026-109518: Debian APT flaw lets attackers run root code
· CVE-2026-109518 lets a man-in-the-middle replace a package after APT has verified it, when an HTTP download is retried. Debian and Ubuntu have fixed it; HTTPS sources or turning off retries block it until then.
Crédit Mutuel Arkéa cyberattack: $133M traced to crypto
· The Brittany-based bank says an attack allowed fraudulent transactions and its customers will lose nothing. Investigator ZachXBT traced more than $133 million moved out through crypto exchanges since 1 November.
MUJI data breach may have exposed 1.09 million card numbers
· Ryohin Keikaku, which runs MUJI, says full card numbers of 1.09 million MUJI Card members were exposed, on top of 27.26 million customer records it disclosed on 30 October. About 345,000 cards are still valid.
Nikke PC launcher compromised to install a remote-access tool
· The team behind Goddess of Victory: Nikke says the PC launcher's script files may have been tampered with. Researchers say files on the publisher's CDN installed a remote-access agent for weeks.
Zyxel GS1900 exploit worked on firmware patched in June
· An exploit used against Zyxel GS1900 switches works on firmware patched for the flaw CISA listed in September. Binarly found a second bug, CVE-2026-107441; switches need the newer firmware.
GitBook says AI-driven cyberattack exposed customer API tokens
· The documentation platform says attackers using AI agents reached infrastructure credentials on 2 November, putting integration tokens, Git Sync secrets and API tokens at risk. Customers must rotate them.
WorkOS says hackers used AI tool ARTEX to reach its sales records
· The identity provider says attackers got into an internal sales tool holding customer contacts, account histories and excerpts of calls and Slack conversations. Its production systems were not touched, and it has not said how the attackers got in.
Apple warns German MPs and ministers of mercenary spyware attacks
· Germany's cyber agency has told Bundestag members and government officials who got Apple threat notifications to treat their iPhones as compromised. Nobody has said who sent the spyware or how many people were targeted.
Brazil's Mercado Bitcoin halts withdrawals after $40 million drain
· Brazil's largest crypto exchange puts the assets involved at about $38 million and says $11 million is already blocked. Customers will not lose money, it says; how the transfers were signed is unknown.
Hackers slip seed phrase stealer into Solana Mobile app store
· A fake "SKR Claim" app that asked for wallet seed phrases sat in the Solana dApp Store's spotlight for an hour after someone broke into the store's publishing portal. Solana Mobile patched a bug that let the store link to unpublished apps.
Fridge cyberattack hits 13 countries and France's blood service
· Attackers changed the settings of cold rooms used by France's blood service the same night supermarket fridges were tampered with across Europe. France's health ministry says the incident was caught in time.
Russian emergency app hit with fake nuclear alert after Ukraine hack
· Russia's Emergency Situations Ministry says hackers took over its mobile app and sent fake alerts, hours after Ukraine's Air Alert app was hijacked the same way. Both governments say their sirens kept working.
Hackers hijack Ukraine's Air Alert app to send fake nuclear alerts
· Ukraine's Air Alert app sent false radiation, chemical and street-fighting warnings to phones on Sunday night. Officials say the state siren network kept working, and the app has been taken offline.
Hackers drain BTCPay hot wallets on servers left unpatched since July
· BTCPay Server says the hot wallet thefts hit instances running version 2.4.1 or older, released in July, and that it has no credible reports of drains on the current 2.4.7. Hosting providers shut older servers down.
CVSS 9.8 Linux flaw lets attackers take root on Go servers by default
· Red Hat and Ubuntu have fixed kernels out or in testing, and Marcus Hutchins says threat actors appear to be scanning for the up to 2.1 million exposed servers.
Binance cyberattack: how North Korea launders the stolen $6.4B
· Binance says the theft followed a months-long campaign: a trojanised Homebrew installer in June, a fake job interview in September and abuse of an internal AI tool. Analysts say software is laundering the funds around stablecoin freezes.
AI hacking tool ARTEX used by four threat actors, two tied to China
· Microsoft, CrowdStrike and Profero have each documented ARTEX in real intrusions, by four different threat actors. Two are tied to the Chinese state, and none of the reports links the four to each other.
Northflank tells customers to assume every stored secret was decrypted
· Users of the deployment platform report stolen AI API keys already in use. Wiz counts Northflank as the ninth AI developer platform to disclose an incident in October.
Name.com hijackers still hold valid TLS certificates for 13 domains
· Coinspect found the attacker switched nameservers at the registrar and obtained TLS certificates that last until January. How the attacker got access to Name.com is still unknown.
Also as a feed. How we report: the editorial policy.