DanSec

Vendor

Apple

In 137 briefs, most recently 5 November 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Known exploited (CISA KEV)

96 Apple vulnerabilities are on CISA's list of vulnerabilities exploited in the wild. Most recent:

Coverage in DanSec Daily

  1. Zyxel GS1900 zero-day hit nearly 1,000 switches, OpenSSH 'sshole' flaw on musl systems, and Chainalysis confirms all users' tokens exposed.
  2. Binance $6.34B theft by North Korean actors, Beget cloud wipe, and a cPGuard supply chain backdoor.
  3. Chainalysis breach, malicious Claude Code extension on Cursor exposing developers, and Ivanti Connect Secure root-access exploit chain.
  4. Binance's $6.3B heist tied to TraderTraitor, Polymarket supply-chain hack, and critical CVEs in GitLab and Cisco SD-WAN exploited in the wild.
  5. Sony ISP breach exposes 2.5M customer records, DHS staff data leaked via Okta, and Cisco firewall VPN zero-day exploited. Covers Volt Typhoon and more.
  6. PHP2Shell RCE flaws exploited in the wild, Keystone destroys 18,835 hardware wallets after website hack, and ENGIE confirms customer data breach.
  7. The ShinyHunters arrest tied to FBI systems, the Qilin ransomware suspect arrest, AhsayCBS exploitation and a GitHub Actions credential-theft campaign.
  8. The Denmark Central Population Register breach affecting 8.8 million people, the FBI Accenture contractor ShinyHunters breach, and Atlassian Data Center …
  9. Bitget $387.5M zero-day theft, Pentagon DMDC breach of 3M+ service members' records, and Zammad zero-day chain hitting DIVD, plus Citrix and Cisco exploitation.
  10. Bitget's $387.5M breach via a zero-day, actively exploited Citrix NetScaler flaws, and Star Blizzard phishing campaigns hitting over 100 organizations.
  11. Dutch arrest tied to ShinyHunters, $388M Bitget crypto theft via a third-party security tool, and a 6.6M-account Times Car breach.
  12. The $351.6M Bitget crypto theft by suspected North Korean actors, the Roundcube CVE-2026-48842 exploitation, and Salesforce Agentforce 'SalesBleed' flaws.
  13. Japan Digital Agency VPN breach exposes 246,000 employees; Cisco zero-day CVE-2026-76461 under active exploitation; Red Heron and Sandworm threat activity.
  14. Nutex Health data breach, over 270 Zimbra servers compromised, and Gitea RCE (CVE-2026-60004) exploited in the wild.
  15. Sakura Internet and CareCloud breaches, Dahua camera compromises, and the Cl0p PTC Windchill extortion campaign, plus actively exploited Windows IKE and GitLab …
  16. The CareCloud breach growing to 3.7M people, Medusa ransomware hitting 500+ US critical infrastructure orgs, and Clop's attack on PTC Windchill servers.
  17. Microsoft Azure account records sold, Pokémon Center and French tax data breaches, and critical Ray RCE actively exploited.
  18. Shell data theft claimed by Clop, RingCentral breach by ShinyHunters exposing 1.6M accounts, and SAP Commerce Cloud RCE under active attack in today's …
  19. RingCentral breach exposing 1.6M accounts, Clop's claimed 89GB Shell theft, and Beacon CRM AWS key leak hitting 1,000+ charities.
  20. Trezor customer data breach via ShipMonk, actively exploited VMware vCenter Syslog RCE, and Apple mercenary spyware alerts.
  21. Metabase zero-day breaches customer data, Unlimited Technology Systems reports a 3.8M-person healthcare breach, and Claude Code and Gemini CLI flaws expose CI …
  22. Unlimited Technology breach hits 3.8M people, SharePoint flaws exploited in Swiss government attacks, and TeamPCP linked to Redis and supply chain campaigns.
  23. Unitel cyberattack before its IPO, a tl;dv Firebase flaw exposing private meetings, and ChainDrop malware compromising 1,300+ npm packages.
  24. The PNLD police data leak, N-able N-central CVE-2026-18577 exploitation, and INC Ransomware's SonicWall SMA 1000 attacks, plus Midnight Blizzard and DOUBLECUP …
  25. The Amgen data breach, Adform supply-chain crypto-stealing attack, and CosmosEscape flaw exposing Azure Cosmos DB keys, plus threat actor and policy news.
  26. The Minnesota water system OT attack, OpenAI's Hugging Face breach expansion, and Cisco FMC zero-day CVE-2026-20316 exploitation.
  27. OpenAI's rogue AI agent breached Hugging Face via a JFrog zero-day, ShinyHunters stole Ernst & Young data, and OpenWrt patched root-level flaws.
  28. WordPress wp2shell webshell attacks, Microsoft SharePoint RCE exploitation, and Anubis ransomware targeting Coca-Cola's Fairlife.
  29. Abbott's Exact Sciences breach, WordPress Core critical RCE flaws, and SonicWall SMA zero-days exploited for root access by threat actors.
  30. Dutch and Spanish police bust major fraud rings; Firefox, Zoom, SharePoint and LegacyHive Windows zero-day flaws. Plus OkoBot and AsyncAPI npm supply chain …
  31. Microsoft ties Salesforce intrusions to ShinyHunters; Nihon Kotsu cyberattack and Lidl breach also covered, plus Russian state hacker sanctions and router …
  32. US government entity paid Kairos extortion group about $1M; Apple Hide My Email flaw exposed real addresses; JadePuffer became first LLM-automated ransomware …
  33. Google and FBI disrupt NetNut proxy network, Scattered Spider suspect extradited, and Pegasus spyware hits EU Parliament investigators; plus Cursor and WinRAR …
  34. The Medtronic data breach by ShinyHunters, exposed Oracle E-Business Suite instances under attack, and Scattered Spider arrest news.
  35. Aflac Japan breach hits 4.38M customers, Nissan PeopleSoft campaign and Nidec $2M Blackfield extortion.
  36. Nissan and NAIC breached via Oracle PeopleSoft flaw tied to ShinyHunters; Djinn Stealer spreads through SimpleHelp CVE-2026-48558; 236,000 Uni-App sites abused …
  37. Operation Endgame disrupts Amadey botnet and Stealc infostealer; Cisco Catalyst SD-WAN zero-day exploited for two months; Chrome 149 patches 18 flaws.
  38. Tata Electronics cyberattack and Klue OAuth-token breaches hitting LastPass and Salesforce customers, plus FortiBleed hitting 430,000 FortiGate firewalls with …
  39. Xsolis breach exposes 1.4M patients' health data, FortiBleed harvests 86,000 Fortinet credentials, and Squidbleed leaks proxy traffic.
  40. Klue integration breach exposes Salesforce data, FortiBleed credential theft hits ~86,000 Fortinet devices, and Operation Endgame disrupts SocGholish.
  41. Klue OAuth breach exposed Salesforce data, FortiBleed leaked ~74,000 Fortinet credentials, and law enforcement disrupted the SocGholish botnet.
  42. Arch Linux AUR supply-chain compromise of 400+ packages, Handala's Cal Water hack, and Anthropic model takedown under new US export controls.
  43. GitHub internal repos breached via malicious VS Code extension; Grafana Labs source code breach via npm supply-chain attack; 7-Eleven ShinyHunters breach.
  44. Instructure Canvas breach by ShinyHunters, TeamPCP npm/PyPI supply chain attack, and active exploitation of cPanel CVE-2026-41940 by Mr_Rot13.
  45. Itron breach disclosed via SEC 8-K, Discord users reportedly access Anthropic's Mythos, and 500,000 UK health records listed for sale on Alibaba.
  46. Discord users reach Anthropic's Mythos, 500,000 UK health records listed on Alibaba, and China-linked GopherWhisper targets governments.
  47. ADT breach by ShinyHunters, UK Biobank medical data sold on Alibaba, and a Cisco Firepower Firestarter backdoor compromise.
  48. Bitwarden and Checkmarx supply chain attacks, Vercel breach, and actively exploited Microsoft Defender BlueHammer zero-day.
  49. Malicious checkmarx/kics Docker images, a self-propagating npm worm stealing developer tokens, and Lotus Wiper attacks on Venezuela's energy sector.
  50. Covers the France Titres government data breach, the $290M Kelp DAO crypto heist tied to North Korean actors, and over 1,500 exposed Perforce P4 servers.
  51. KelpDAO's $290M crypto theft tied to Lazarus Group, Vercel breach via compromised OAuth tokens, and a Scattered Spider leader's guilty plea.
  52. Vercel breach tied to Context AI, Apple-notification phishing via legitimate Apple emails, and NIST dropping severity scores for low-priority CVEs.
  53. Covers the Kraken and McGraw-Hill breaches, a fake Ledger Live app on Apple's App Store, and Microsoft's April 2026 Patch Tuesday with 167 flaws.
  54. Bitcoin Depot $3.6M crypto theft, Signature Healthcare hospital cyberattack, and TeamPCP supply chain breach exposing Cisco source code.
  55. APT28 router DNS hijacking stealing Microsoft 365 tokens, a SaaS integrator breach hitting a dozen-plus firms, and Flowise RCE flaw under active exploitation.
  56. Drift DEX's $285M North Korea-attributed heist, the Axios npm supply chain compromise, and the TeamPCP campaign hitting European Commission cloud systems.
  57. The EU Commission cloud breach by TeamPCP, the $280M Drift Protocol heist by North Korean actors, and Stryker's data-wiping attack.
  58. Axios npm supply chain backdoor by North Korean actors, TrueConf zero-day abused via malicious updates, and 2.3M Android devices infected by NoVoice malware.
  59. Cisco source code theft, Axios npm hijack spreading malware, and Iranian Pay2Key pseudo-ransomware campaigns.
  60. Citrix NetScaler CVE-2026-3055 exploited, ShinyHunters claims 350GB European Commission theft, and Iranian hackers breach FBI director Kash Patel's personal …
  61. Covers the European Commission's Amazon cloud breach, the hack of FBI Director Kash Patel's email, and TeamPCP's Telnyx PyPI supply chain attack.
  62. LeakBase admin arrest, HackerOne employee data breach via Navia, and Microsoft 365 device code phishing hitting 340+ organizations.
  63. Mazda security incident, Crunchyroll's alleged 6.8M-user breach, and the TeamPCP Trivy supply chain attack with Kubernetes wipers.
  64. The Trivy supply chain attack by TeamPCP, Oracle Identity Manager flaw CVE-2026-21992, and Iranian cyberattacks disrupting Maryland hospitals.
  65. Navia breach exposes 2.7M records; Trivy GitHub Actions compromised again; Magento defacement campaign hits thousands of sites.
  66. Stryker wiper attack wiping ~80,000 devices, Lazarus linked to Bitrefill breach, and PolyShell Magento RCE flaw.
  67. Cisco FMC zero-day exploited by Interlock ransomware, Stryker cyberattack tied to Iranian-linked Handala, and Aura breach exposing nearly 900,000 contacts.
  68. The Intuitive phishing breach, GlassWorm supply-chain malware hitting 400+ repos, and Sears exposing AI chatbot conversations to the public web.
  69. The SocksEscort proxy botnet takedown, Telus Digital and Loblaw breaches, and Veeam's seven critical Backup & Replication flaws.
  70. Ericsson US data breach via service provider, UNC4899 crypto firm theft, and Salesforce Experience Cloud data exposure by ShinyHunters.
  71. The TriZetto patient data breach, Transport for London breach, Iranian APT intrusions into US firms, and CISA's mandated iOS patching after Coruna exploit kit …
  72. Drone strikes hit AWS data centers in UAE and Bahrain, AkzoNobel and LexisNexis breaches, and VMware Aria flaw CVE-2026-22719 exploited in the wild.
  73. ManoMano breach hits 38M customers, Cisco SD-WAN zero-day CVE-2026-20127 exploited for three years, and US sanctions on exploit broker Operation Zero.
  74. 600+ FortiGate firewalls hit by AI-assisted Russian-speaking group; Grandstream CVE-2026-2329 root RCE; Predator hides iOS mic/camera alerts.
  75. Chrome zero-day CVE-2026-2441, CISA's BeyondTrust order, and the Dior/Louis Vuitton/Tiffany $25M Korean fine tied to Scattered LAPSUS$ Hunters Salesforce …
  76. The Odido breach exposing 6.2M customers, Qilin's Conpet S.A. data theft, and BeyondTrust and Ivanti EPMM exploitation, plus threat actor and policy news.
  77. Conduent breach affects 25M+ people, a hijacked Outlook add-in steals Microsoft logins, and Apple and Microsoft ship major patch batches.
  78. Flickr third-party email breach, SmarterMail RCE (CVE-2026-24423) exploited in ransomware, and TGR-STA-1030 espionage across 37 countries.
  79. Notepad++ supply chain attack, ShinyHunters' Panera Bread leak of 5.1M records, and actively exploited SolarWinds Web Help Desk RCE added to CISA KEV.
  80. Supply chain attacks hit eScan antivirus updates and Open VSX Registry (GlassWorm), plus automated MongoDB data extortion campaigns.
  81. Central Maine Healthcare and Endesa breaches, Microsoft's January 2026 Patch Tuesday zero-days, and GoBruteforcer botnet hitting crypto projects.
  82. FBI seizes web3adspanels.org credential-hosting domain, La Poste DDoS, SEC charges in $14M AI crypto scam, MongoDB RCE patch urged.
  83. The French postal service cyberattack, the Nissan and Red Hat GitLab data exposure, and the Baker University breach affecting 53,000 people.
  84. Nissan customer records exposed via Red Hat breach, Coupang's 33.7M-user breach, and Clop's University of Phoenix attack.
  85. SoundCloud breach and VPN disruption, Askul ransomware exposing 740,000 records, and ShinyHunters extorting PornHub over Mixpanel-linked data theft.
  86. The Coupang breach (33.7M customers), Akira's Fieldtex claim, and the exploited Gladinet CentreStack and React2Shell (CVE-2025-55182) flaws.
  87. Logitech and Washington Post breaches tied to Clop's Oracle E-Business Suite attacks, plus Fortinet FortiWeb zero-day exploited and added to CISA KEV.
  88. The GlobalLogic Oracle EBS data theft, the Rhadamanthys infostealer takedown, and Microsoft's November 2025 Patch Tuesday with 63 flaws including a kernel …
  89. Swiss warning on iPhone lost-device SMS phishing, three runC container escape flaws, and a reported US ban on TP-Link networking gear sales.
  90. Covers SonicWall firewall config breach by state-sponsored actors, Balancer V2 $128M crypto theft, and actively exploited CentOS Web Panel RCE flaw from CISA.
  91. Miljödata breach affecting 1.5M, Nikkei Slack compromise and actively exploited Post SMTP WordPress flaw.
  92. Toys R Us Canada data breach, Collins Aerospace airport check-in disruption, and Lazarus Group's Operation DreamJob against European defense firms.
  93. The PassiveNeuron espionage campaign, the actively exploited Oracle E-Business Suite SSRF flaw (CVE-2025-61884), and a WatchGuard Firebox RCE flaw affecting …
  94. SonicWall SSL VPN compromises across 100+ environments, Oracle EBS zero-day malware attacks, and FBI seizure of BreachForums domains tied to ShinyHunters.
  95. FBI seizes BreachForums amid ShinyHunters Salesforce extortion; Gladinet CentreStack zero-day CVE-2025-11371 and Oracle EBS zero-day attacks actively exploited.
  96. Discord third-party support data breach, CometJacking attack on Perplexity's Comet browser, and surge in scans against Palo Alto Networks logins.
  97. UK seizure of £5.5bn in Bitcoin, WestJet passport data breach, and Asahi cyberattack disrupting Japanese production.
  98. Harrods and Jaguar Land Rover breaches, Asahi's cyberattack, and Akira ransomware exploiting SonicWall VPNs.
  99. JLR extends shutdown after cyberattack; Microsoft and Cloudflare dismantle RaccoonO365 phishing network; DHS misconfigured data hub exposes sensitive …
  100. Npm supply chain compromise of 40+ packages, KillSec ransomware breach of a Brazilian healthcare software provider, and Google's LERS account abuse.
  101. Apple spyware alerts in France, FBI warning on Salesforce data theft by UNC6040/UNC6395, and CVE-2025-5086 exploitation in DELMIA Apriso.
  102. Apple spyware notifications in France, Dassault DELMIA Apriso CVE-2025-5086 exploitation, and new Yurei ransomware group, plus HybridPetya UEFI bypass.
  103. LNER breach, INC ransomware attack on Panama's finance ministry, and a critical SonicWall SSLVPN flaw (CVE-2024-40766) exploited by Akira ransomware.
  104. The Jaguar Land Rover breach, a record NPM supply-chain attack, and Scattered Spider's $380M Clorox heist, plus Microsoft's 80 patches and Chinese APT activity.
  105. The npm supply chain attack, the Salesloft Drift breach hitting Salesforce, and GhostAction's theft of 3,325 CI secrets from GitHub workflows.
  106. ICloud Calendar invites abused for callback phishing sent from Apple's servers; Czech NUKIB warns critical infrastructure against Chinese technology and data …
  107. Jaguar Land Rover cyberattack disrupts operations, Workiva breach via Salesforce CRM, and Salesloft/Drift fallout hits Cloudflare, Palo Alto Networks and …
  108. Salesloft Drift OAuth breach hits Cloudflare, Palo Alto Networks and Zscaler; Jaguar Land Rover cyberattack halts production; WhatsApp zero-day exploited …
  109. The Zscaler and Salesloft data breaches, Midnight Blizzard's Microsoft 365 operation disrupted by Amazon, and a WhatsApp zero-click patch.
  110. The TransUnion breach affecting 4.4M US consumers, the Nevada ransomware attack, and a FreePBX zero-day under active exploitation.
  111. The TransUnion breach affecting 4.4 million people, a Nevada ransomware attack, and an actively exploited FreePBX zero-day.
  112. Farmers Insurance 1.1M-person breach via Salesforce attacks, BianLian's Aspire Rural Health breach, and Docker Desktop container escape CVE-2025-9074 (CVSS …
  113. DaVita's ransomware breach affecting nearly 2.7M people, Apple zero-day CVE-2025-43300, and Murky Panda cloud and telecom espionage.
  114. The DaVita ransomware breach affecting 2.7M people, Murky Panda's cloud supply-chain intrusions, and Apple's zero-day patch for CVE-2025-43300.
  115. Colt Technology breach by Warlock ransomware, Apple zero-day patch, and Scattered Spider member sentenced to 10 years.
  116. Inotiv ransomware, Intel and Workhorse Software data exposures, password manager clickjacking flaws, Apple's CVE-2025-43300 zero-day, and RapperBot botnet …
  117. Allianz Life Salesforce breach exposes 1.1M records, Play ransomware exploits Windows CLFS, and ActiveMQ attackers deploy DripDropper malware.
  118. Google Salesforce data breach by ShinyHunters, DaVita ransomware notice to over 1 million people, and WhatsApp removing 6.8 million scam-centre accounts.
  119. North Korea-linked UNC4899 crypto theft, UNC2891 ATM network breaches, and patched Honeywell Experion PKS industrial control flaws.
  120. ShinyHunters vishing breaches at Qantas, Allianz Life and Adidas; SafePay claims 3.5TB Ingram Micro theft; Microsoft SharePoint mass exploitation hits South …
  121. Saint Paul city cyberattack prompting National Guard activation, Aeroflot flight cancellations, and Allianz Life breach hitting 1.4M US customers.
  122. The Toptal npm supply chain breach, Cisco ISE and PaperCut exploitation, and the BlackSuit-to-Chaos ransomware shift in one daily brief.
  123. Swiss federal data exposed via Radix ransomware breach, Scattered Spider targets airlines, and over 1,200 unpatched Citrix NetScaler servers under active …
  124. Covers the CoinMarketCap supply chain attack injecting a wallet drainer, an Oxford City Council data breach, and 16 billion leaked passwords.
  125. Salt Typhoon breaches Viasat, Krispy Kreme data theft of 160,000+ people, and Paragon Graphite spyware used against European journalists.
  126. Victoria's Secret outage after May 24 security incident, Apple zero-click Messages exploit by Paragon spyware, and SimpleHelp RMM flaw exploited by ransomware …
  127. Paragon Graphite spyware hit journalists' iPhones, EchoLeak exposed Microsoft 365 Copilot, and 80,000 Entra ID accounts faced password spraying.
  128. Gluestack NPM packages backdoored with a RAT, destructive NPM wiper packages, and Apple denying iPhone crash links to Chinese hackers.
  129. ConnectWise ScreenConnect breach by suspected nation-state, DragonForce ransomware via SimpleHelp RMM, and Victoria's Secret site outage.
  130. Critical WooCommerce Wishlist flaw puts 100k+ WordPress sites at risk; AyySSHush botnet hits 9,000 ASUS routers; Interlock ransomware targets universities.
  131. Adidas and MathWorks breaches, the DragonForce MSP ransomware attack via SimpleHelp, and Void Blizzard's NGO phishing campaigns.
  132. Chinese UAT-6382 exploits Trimble Cityworks to breach US local governments; Ivanti EPMM flaws hit European, North American and Asian agencies; 184M credentials …
  133. The Output Messenger zero-day used in Kurdish espionage, an airline cyberattack, and a Global botnet takedown with four arrests.
  134. TeleMessage's breach and suspended services, the Darcula SMS phishing platform stealing 884,000 cards, and UK retail attacks prompting new NCSC guidance.
  135. SK Telecom's USIM breach and SIM replacements, APT28's attribution by France, and the AirBorne AirPlay zero-click RCE flaws.
  136. SonicWall SMA VPN devices under active attack, Apple zero-days in targeted spyware attacks, and Smishing Triad toll SMS phishing in US and UK.
  137. SonicWall SMA exploitation, Apple iOS zero-days, a Fortinet symlink backdoor on 16,000+ devices, and the CrazyHunter ransomware targeting Taiwan.