Incident Blog- 2026 2025 2024 2023 2021 2020 2019 2018
AI blog APT blog Attack blog BigBrother blog BotNet blog CyberCrime blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blog
DATE | NAME | Info | CATEG. | WEB |
|
24.10.26 |
8 eMudhra certificates are compromised. Here's what you need to know | On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised. These certificates were widely trusted by browsers, operating systems, and also within Cloudflare. Because the keys themselves are weak, an attacker can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic. | Incident blog | Cloudflare Blog |
|
24.10.26 |
eMudhra CA Compromise: Weak Keys and Forged Certificates | Eight eMudhra intermediate CA keys were compromised, some as weak as 3 bits. Learn the code-signing risk and the steps to hunt for misuse and close the gap from TrendAI™. | Incident blog | TrendAI (US) |
|
24.10.26 |
OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond | OpenCode reported a breach affecting Console users with linked AI providers. Here is what the vendor has said, and how to find OpenCode on your developer machines. | Incident blog | StepSecurity |
|
24.10.26 |
Japan Data Breaches 2026: Inside the October Surge | Japan is facing a dense wave of breach disclosures. Since late September, at least 20 major Japanese companies have reported breaches, including Times Car, Lawson, Yakiniku King, Sourcenext and Burger King Japan, and a ransomware attack on SoftBank’s IDC Frontier cloud took 495 customer organizations offline. | Incident blog | SOCRADAR |
|
24.10.26 |
ConnectWise Cloud Backup Breach | ConnectWise is investigating unauthorized access to application identities associated with Cloud Backup, formerly SkyKick, after researchers detected the applications authenticating into customer Microsoft 365 environments. | Incident blog | SOCRADAR |
|
24.10.26 |
ZoomInfo Sale, TryCircle, Vicente López, HDB, and X Leaks | SOCRadar Dark Web Team identified several underground posts, including an alleged ZoomInfo database sale involving 185 million records, an alleged TryCircle customer data leak, and an alleged Vicente López municipal database exposure. Other posts advertised a previously compromised HDB Financial Services dataset and an unverified X (Twitter) user database leak claim. | Incident blog | SOCRADAR |
|
17.10.26 |
Frostbitten in France: A Danfoss StoreView Internet Exposure Report | Attackers targeted refrigeration units at hundreds of supermarkets across France over the weekend of October 10, resulting in spoiled food and, in some cases, fires. | Incident blog | Censys |
|
17.10.26 |
Navigating the Waves of AI-Powered Identity Attacks | It’s one of the most famous lines in movie history. Chief Brody, chumming the water off the back of the Orca, a battle-hardened fishing boat, gets his first full look at the nemesis in Jaws. He backs slowly into the cabin in shock and says… | Incident blog | Flare |
|
17.10.26 |
Analysis After the Refrigeration System Attack in France | Overnight between October 11-12, 2026, refrigeration systems at several hundred grocery stores in France were driven into forced defrost. Temperatures in some cases reached 50 degrees Celsius, stock was destroyed, and equipment overheated. | Incident blog | Flare |
|
10.10.26 |
One breach, please, and make no mistakes | For some time now, the cybersecurity community has seen examples of autonomous agents, built inside AI labs, attacking public infrastructure (to name a few, Hugging Face, DSEWiki, and RubyGems). Of course, frontier labs have built-in security to prevent these attacks from occurring, but every now and then, the training or prompting appears to be insufficient — especially when the agents themselves attempt to use logic to probe and bypass the restrictions placed on them. | Incident blog | CISCO TALOS |
|
3.10.26 |
ShinyHunters Returns to PeopleSoft With a One-Character WAF Bypass | ShinyHunters is once again exploiting a previously patched vulnerability in PeopleSoft, which we analyzed in June 2026. | Incident blog | Trend Micro |
|
29.9.26 |
Beyond DICOM: 1,057 FHIR & 656 HL7 Systems Exposures | For a decade, everyone hunting exposed healthcare infrastructure has looked at the same protocol: DICOM. Open PACS servers spilling X-rays onto the public internet make for a good headline, and the research has been thorough. | Incident blog | Flare |
|
3.9.26 |
FBI Investigates Nexus Claim of 153M+ ID Records | A Dark Web service called Nexus has claimed to offer access to more than 153 million driver’s license records from the United States and Canada, along with millions of other identity documents. The FBI has reportedly opened an investigation into the exposure. | Incident blog | SOCRADAR |
|
31.8.26 |
45% of American Research Universities Expose Computing Infrastructure | The standard story about higher education cybersecurity is that it’s target-rich and cyber-poor: a sprawling, underfunded sector where the weakest links are the community colleges and cash-strapped campuses without the budget for a real security program. This study finds the opposite pattern. | Incident blog | FLARE.IO |
|
29.8.26 |
GTA VI has been slipping out from behind Rockstar’s usually airtight walls in daily doses. An anonymous figure calling itself CyberLeek has been releasing gameplay clips, map images, and increasingly bold demands, turning what should have been a tightly controlled marketing rollout into one of the messiest leak sagas gaming has seen in years. |
|||
|
29.8.26 |
The Qilin Ransomware group listed the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) on its Dark Web leak site on August 26, 2026, the same day the agency publicly confirmed a cybersecurity “major incident” affecting a standalone system. |
|||
|
8.8.26 |
[Webinar] Tales from the Frontlines: An exclusive briefing on Q2 incidents | Register for an exclusive, unrecorded 30-minute webinar to review the most high-impact incidents Talos IR faced in Q2. | Incident blog | CISCO TALOS |
|
25.7.26 |
The guardrails problem just played out on both sides of the same incident | No hacker. No threat actor. No crime. Just an AI model, an authorized test, and a guardrails problem playing out on both sides of the same incident. | Incident blog | THREATDOWN |
| 25.4.26 | Trigona Affiliates Deploy Custom Exfiltration Tool to Streamline Data Theft | While many ransomware groups rely on off-the-shelf utilities such as Rclone or MegaSync to steal victim data, recent attacks involving the Trigona ransomware used a custom-developed tool designed to provide attackers with granular control over the data theft process. | Incident blog | SECURITY.COM |
| 18.4.26 | That data breach alert might be a trap | Ignoring a real breach notification invites risk, but falling for a bogus one could be even worse. Stop reacting on autopilot | Incident blog | Eset |
| 11.4.26 | Axios npm package compromised to deploy malware | On March 30, 2026, a supply chain security attack targeted Axios, a widely used JavaScript HTTP client for web and Node.js applications. Third-party researchers identified that Axios versions 1.14.1 and 0.30.4 published to the npm registry were compromised following the apparent takeover of a legitimate maintainer account. An attacker published unauthorized package updates that appeared legitimate. | Incident blog | SOPHOS |
| 11.4.26 | From the field to the report and back again: How incident responders can use the Year in Review | The Year in Review distills Talos IR's observations into structured intelligence, but defenders should also be feeding this report back into their own preparation cycles. Here's how. | Incident blog | CISCO TALOS |
| 11.4.26 | Axios NPM supply chain incident | Overview of the recent Axios NPM supply chain incident including details of the payloads delivered from actor-controlled infrastructure. | Incident blog | CISCO TALOS |
| 4.4.26 | Mitigating the Axios npm supply chain compromise | On March 31, 2026, the popular HTTP client Axios experienced a supply chain attack, causing two newly published npm packages for version updates to download from command and control (C2) that Microsoft Threat Intelligence has attributed to the North Korean state actor Sapphire Sleet. | Incident blog | Microsoft blog |
| 4.4.26 | Axios NPM Package Compromised: Supply Chain Attack Hits JavaScript HTTP Client with 100M+ Weekly Downloads | A supply chain attack hit Axios when attackers used stolen npm credentials to publish malicious versions containing a phantom dependency. This triggered a cross-platform RAT during installation and replaced its files with clean decoys, making detection challenging. | Incident blog | Trend Micro |
| 4.4.26 | Axios NPM supply chain incident | Overview of the recent Axios NPM supply chain incident including details of the payloads delivered from actor-controlled infrastructure. | Incident blog | CISCO TALOS |
| 1.2.26 | Identity & Beyond: 2026 Incident Response Predictions | DFIR expert Jamie Mamroe shares 2026 Incident Response Predictions around Identity and Cloud attacks | Incident blog | Cybereason |
| 17.1.26 | Brushstrokes and breaches with Terryn Valikodath | Terryn’s path to cybersecurity started with a fascination for criminal forensics and a knack for jailbreaking his family's tech — interests that eventually steered him toward the fast-paced world of digital investigations. | Incident blog | |
| 10.1.26 | Credential stuffing: What it is and how to protect yourself | Reusing passwords may feel like a harmless shortcut – until a single breach opens the door to multiple accounts | Incident blog | Eset |