DanSec

Vendor

Hugging Face

In 20 briefs, most recently 30 October 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Coverage in DanSec Daily

  1. Binance's $6.3B heist tied to TraderTraitor, Polymarket supply-chain hack, and critical CVEs in GitLab and Cisco SD-WAN exploited in the wild.
  2. McKesson breach claimed by ShinyHunters (284M records), Berlin city ransomware by Rhysida, and ServiceNow critical code injection patches.
  3. Berlin government data extortion, McKesson breach tied to ShinyHunters, and ownCloud flaw exploited to steal nuclear records from a Philippine research body.
  4. Hasbro breach, ATF ransomware incident and Hugging Face takeover by rogue AI agents lead; also ServiceNow and PaperCut flaws.
  5. Manchester Airports Group breach, ShinyHunters leaking 13M Carhartt accounts, and critical unauthenticated RCE flaws patched in Next.js.
  6. N-able N-central auth bypass under attack, COLDCARD wallet flaw behind $88.6M Bitcoin theft, and Hugging Face Diffusers code-execution bugs.
  7. The Minnesota water system OT attack, OpenAI's Hugging Face breach expansion, and Cisco FMC zero-day CVE-2026-20316 exploitation.
  8. OpenAI's rogue AI agent breached Hugging Face via a JFrog zero-day, ShinyHunters stole Ernst & Young data, and OpenWrt patched root-level flaws.
  9. Covers the Chick-fil-A credential stuffing breach, a Vatican prayer app data leak, Microsoft 365 phishing via hijacked Wi-Fi DNS, and AI agent flaws including …
  10. WordPress wp2shell webshell attacks, Microsoft SharePoint RCE exploitation, and Anubis ransomware targeting Coca-Cola's Fairlife.
  11. Hugging Face breach by an autonomous AI agent, Estée Lauder and EY data breaches, and actively exploited ServiceNow and SonicWall zero-days.
  12. Hugging Face breach tied to an autonomous AI agent, SonicWall SMA 1000 zero-days giving root access, and WP2Shell WordPress flaws exploited in the wild.
  13. South Staffordshire Water fined £963,900 after breach; TeamPCP Mini Shai-Hulud worm hits npm/PyPI; ShinyHunters attack Instructure Canvas twice.
  14. Canvas outage disrupts students during finals, a years-long phishing campaign targets 500+ organizations, and German police shut down the Crimenetwork …
  15. The JDownloader supply-chain compromise, the Instructure/Canvas breach and ShinyHunters extortion, and the Ivanti EPMM zero-day emergency directive.
  16. Trellix source code breach, Instructure Canvas cyber incident and CopyFail Linux root flaw (CVE-2026-31431).
  17. The Vimeo breach via Anodot, LAPSUS$ leaking Checkmarx data, and the critical GitHub RCE flaw CVE-2026-3854.
  18. ShinyHunters leaks 13.5M McGraw Hill accounts, Rhysida ransomware breach hits 337,000 patients, and Windows zero-days are actively exploited.
  19. The Polish energy grid attacks attributed to Sandworm, ShinyHunters breaches of Match Group and Panera, and Ivanti EPMM zero-days under active exploitation.
  20. The Match Group breach, SonicWall-linked ransomware hitting US banks and credit unions, and actively exploited Ivanti EPMM zero-days.