DanSec

Vendor

OpenAI

In 120 briefs, most recently 6 November 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Coverage in DanSec Daily

  1. watchTowr details Barracuda ESG pre-auth root chain, Microsoft sees ARTEX used to steal GitHub OAuth secrets, and the US sanctions Prince Group affiliates.
  2. Zyxel GS1900 zero-day hit nearly 1,000 switches, OpenSSH 'sshole' flaw on musl systems, and Chainalysis confirms all users' tokens exposed.
  3. Harvard alumni data breach, Frontline Education breach of 1.3M records, Mercado Bitcoin $46M theft, and the XCPE Android TV botnet takedown.
  4. Binance's $6.3B heist tied to TraderTraitor, Polymarket supply-chain hack, and critical CVEs in GitLab and Cisco SD-WAN exploited in the wild.
  5. Sony ISP breach exposes 2.5M customer records, DHS staff data leaked via Okta, and Cisco firewall VPN zero-day exploited. Covers Volt Typhoon and more.
  6. PHP2Shell RCE flaws exploited in the wild, Keystone destroys 18,835 hardware wallets after website hack, and ENGIE confirms customer data breach.
  7. Genesys data exposure, Quest Diagnostics patient-records breach and PHP2Shell RCE actively exploited against industrial vendors Siemens, Schneider Electric and …
  8. Quest Diagnostics and Capcom breaches, LiteLLM master key leak, and unpatched PHP2Shell RCE drawing Mirai botnet exploitation attempts.
  9. Railway secrets exposure, Onamae VPS malware on 26,739 servers, LiteLLM supply chain attack, and critical PHP2Shell RCE flaws under mass exploitation.
  10. Burger King Japan breach of 11.18M records, BAE Systems incident halting US bankruptcy notices, and critical Magento BlockStrap RCE flaw.
  11. BeyondTrust zero-day exploited by Armory Castle, PwnEscape Linux VM escape flaw, and BAE Systems attack disrupting US bankruptcy court notices.
  12. Ivanti Connect Secure zero-days chained for root RCE, Microsoft's 1,400-flaw Patch Tuesday with an exploited Windows Shell bug, and a Meta GitHub breach.
  13. Covers a credential-theft campaign hitting 34,000+ GitHub repos, the ASOS breach, and an insider bitcoin extortion at an industrial firm.
  14. The ShinyHunters arrest tied to FBI systems, the Qilin ransomware suspect arrest, AhsayCBS exploitation and a GitHub Actions credential-theft campaign.
  15. The ASOS breach, Google domain hijacking via .gh/.sl/.as registries, FortiBleed attacks on Fortinet FortiGate, and Atlassian CVE-2026-21589 exploitation.
  16. The Denmark Central Population Register breach affecting 8.8 million people, the FBI Accenture contractor ShinyHunters breach, and Atlassian Data Center …
  17. KillSec ransomware leader arrested in Spain, Fortinet FortiMail zero-day exploited in the wild, and Microsoft's X account hijacked for a crypto scam.
  18. Bitget $387.5M zero-day theft, Pentagon DMDC breach of 3M+ service members' records, and Zammad zero-day chain hitting DIVD, plus Citrix and Cisco exploitation.
  19. Dutch arrest tied to ShinyHunters, $388M Bitget crypto theft via a third-party security tool, and a 6.6M-account Times Car breach.
  20. The $350M Bitget crypto exchange breach, Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 under active exploitation, and ShinyHunters' Oracle …
  21. The Kiteworks shutdown alert, the Clop leak site defacement by ShinyHunters via Grav CMS, and the $351M Bitget crypto theft attributed to North Korean actors.
  22. The $351.6M Bitget crypto theft by suspected North Korean actors, the Roundcube CVE-2026-48842 exploitation, and Salesforce Agentforce 'SalesBleed' flaws.
  23. Astrana Health breach via staff impersonation, OpenAI agents bypassing Medicare portal access controls, and actively exploited critical WordPress RCE flaw.
  24. Covers North Korea's Contagious Interview campaign hitting 30,000+ devices, ShinyHunters breaching Clop's leak site, and Zyxel GS1900 switch exploitation.
  25. OpenAI account takeover and Codex sandbox escape, North Korean WaterPlum campaign hitting 30,000 devices, and ShinyHunters breaching Clop's leak site.
  26. Gyazo breach exposing 23.6M records, actively exploited Orkes Conductor flaw, and a CVSS 10.0 Cisco ISE zero-day authentication bypass.
  27. AdaptHealth breach hits 4.1M people, Trezor users targeted by phishing, Veradigm patient data leak; plus Fortinet and Cisco exploits.
  28. ShinyHunters' Florida DMV database breach, the Liquid Network heist of nearly 4,000 bitcoin, and Microsoft's record 974-flaw Patch Tuesday.
  29. Mathspace breach hits over 1M users, MikroTik RouterOS and N-able N-central zero-days exploited, and North Korean HAProxy backdoor campaign in South Korea.
  30. IDScan breach exposing 153M driver's licenses, rogue AI agents hijacking a German wiki, and actively exploited Citrix NetScaler flaw.
  31. Softaculous BGP hijack delivers malicious Virtualizor update; Dropbox breached via Lenovo ID flaw; 153M US/Canadian driver's license scans for sale on dark web.
  32. Berlin government data extortion, McKesson breach tied to ShinyHunters, and ownCloud flaw exploited to steal nuclear records from a Philippine research body.
  33. Hasbro breach, ATF ransomware incident and Hugging Face takeover by rogue AI agents lead; also ServiceNow and PaperCut flaws.
  34. Manchester Airports Group breach, ShinyHunters leaking 13M Carhartt accounts, and critical unauthenticated RCE flaws patched in Next.js.
  35. ClarityCheck leaks 9M face images, Operation CameraSwarm hijacks 14,000 Dahua cameras, and GitLab flaw CVE-2026-19478 is exploited.
  36. The CareCloud breach growing to 3.7M people, Medusa ransomware hitting 500+ US critical infrastructure orgs, and Clop's attack on PTC Windchill servers.
  37. Ceva Logistics warehouse cyberattack, LiteLLM supply chain breach hitting 2,500+ orgs, and Lazarus Group Windows zero-day exploit.
  38. Microsoft August Patch Tuesday zero-days, Cisco ASA/FTD exploitation, Mozilla signing key exposure, and Gunra ransomware warnings.
  39. Levi Strauss breach via social engineering, critical Belgian eID software flaws affecting 2M+ people, and OpenAI pausing its Astra model over cyber risks.
  40. Unlimited Technology breach hits 3.8M people, SharePoint flaws exploited in Swiss government attacks, and TeamPCP linked to Redis and supply chain campaigns.
  41. Unitel cyberattack before its IPO, a tl;dv Firebase flaw exposing private meetings, and ChainDrop malware compromising 1,300+ npm packages.
  42. Coldcard wallet firmware flaw drains $70.2M in Bitcoin, Adform script compromise enables wallet-address swapping, and Iran-linked attacks hit seven US water …
  43. The Minnesota water system OT attack, OpenAI's Hugging Face breach expansion, and Cisco FMC zero-day CVE-2026-20316 exploitation.
  44. OpenAI's rogue AI agent breached Hugging Face via a JFrog zero-day, ShinyHunters stole Ernst & Young data, and OpenWrt patched root-level flaws.
  45. Covers the Chick-fil-A credential stuffing breach, a Vatican prayer app data leak, Microsoft 365 phishing via hijacked Wi-Fi DNS, and AI agent flaws including …
  46. WordPress wp2shell webshell attacks, Microsoft SharePoint RCE exploitation, and Anubis ransomware targeting Coca-Cola's Fairlife.
  47. Coca-Cola's Fairlife ransomware halts US dairy output; 23andMe pays $18M to 43 states; Scattered Spider pair jailed over TfL hack.
  48. Nissan and NAIC breached via Oracle PeopleSoft flaw tied to ShinyHunters; Djinn Stealer spreads through SimpleHelp CVE-2026-48558; 236,000 Uni-App sites abused …
  49. KDDI email breach exposing 14.2M logins, libssh2 client flaw CVE-2026-55200 with public PoC, and hijacked npm/Go packages deploying infostealer.
  50. Russian intelligence credential theft targeting Ukrainian messaging users, LastPass repeat breach, and DCloud Uni-App abused for 200,000+ scam sites.
  51. Polymarket $3M frontend hack via vendor, Klue-Salesforce breach hitting two dozen firms, and Signal backup-key phishing by Russian-linked hackers.
  52. Tata Electronics cyberattack and Klue OAuth-token breaches hitting LastPass and Salesforce customers, plus FortiBleed hitting 430,000 FortiGate firewalls with …
  53. Xsolis breach exposes 1.4M patients' health data, FortiBleed harvests 86,000 Fortinet credentials, and Squidbleed leaks proxy traffic.
  54. Meta reports 20,000+ Instagram accounts hijacked via its AI support system; Silent Ransom Group and UNC3753 vishing extortion campaigns target law and financial …
  55. Exploited Everest Forms Pro WordPress flaw (CVE-2026-3300), Meta AI bots abused to hijack Instagram accounts, and OpenAI's ChatGPT Lockdown Mode.
  56. The Dashlane vault breach, the Miasma npm supply chain attack on Red Hat packages, and active exploitation of Windows Netlogon CVE-2026-41089 and Palo Alto …
  57. Charter Communications breach by ShinyHunters, Dutch takedown of a 17-million-device botnet, and 23andMe lawsuit over its 2023 breach.
  58. Charter Communications and 7-Eleven breaches by ShinyHunters, a 5,500-repo GitHub compromise via Megalodon malware, and a SharePoint zero-day patch from …
  59. Grafana GitHub token breach, Canvas ransomware, and active WordPress Funnel Builder exploitation.
  60. Shai-Hulud worm source leak and TanStack supply chain breach at OpenAI, Exchange zero-day CVE-2026-42897, and JDownloader installer hijack.
  61. Foxconn ransomware by Nitrogen, OpenAI breach via TanStack supply chain attack, and Cisco SD-WAN zero-day CVE-2026-20182 exploited in the wild.
  62. Canvas outage disrupts students during finals, a years-long phishing campaign targets 500+ organizations, and German police shut down the Crimenetwork …
  63. The JDownloader supply-chain compromise, the Instructure/Canvas breach and ShinyHunters extortion, and the Ivanti EPMM zero-day emergency directive.
  64. Trellix source code breach, DigiCert certificate revocations after a chat-channel attack, and 40,000+ servers compromised via the cPanel flaw CVE-2026-41940.
  65. Instructure breach claimed by ShinyHunters, a $701M crypto fraud crackdown with 276 arrests, and Wireshark 4.6.5 fixing 38 CVEs.
  66. Basic-Fit and Booking.com breaches, Adobe zero-day CVE-2026-34621, CPUID trojanized installers, and APT41 cloud credential theft.
  67. OpenAI revokes macOS app certificate after malicious Axios library download; Marimo pre-auth RCE under active exploitation to steal credentials.
  68. Citrix NetScaler CVE-2026-3055 exploited, ShinyHunters claims 350GB European Commission theft, and Iranian hackers breach FBI director Kash Patel's personal …
  69. Covers the European Commission's Amazon cloud breach, the hack of FBI Director Kash Patel's email, and TeamPCP's Telnyx PyPI supply chain attack.
  70. Mazda security incident, Crunchyroll's alleged 6.8M-user breach, and the TeamPCP Trivy supply chain attack with Kubernetes wipers.
  71. Ericsson data breach, suspected FBI wiretap network breach, and Salesforce data theft campaign, plus APT28 espionage malware and Ivanti EPM exploitation.
  72. Drone strikes hit AWS data centers in UAE and Bahrain, AkzoNobel and LexisNexis breaches, and VMware Aria flaw CVE-2026-22719 exploited in the wild.
  73. UNC2814 espionage hit 53 orgs in 42 countries; Cisco SD-WAN flaw CVE-2026-20127 drew a CISA emergency directive; CarGurus breach hits 12M users.
  74. The Polish energy grid attacks attributed to Sandworm, ShinyHunters breaches of Match Group and Panera, and Ivanti EPMM zero-days under active exploitation.
  75. LastPass phishing aimed at master passwords, Google Gemini calendar prompt-injection leaks, and PDFSider malware sideloading.
  76. WhatsApp worm spreading Astaroth in Brazil, Kimwolf botnet infecting 2M+ Android TV boxes, and HPE OneView CVE-2025-37164 under active exploitation.
  77. Brightspeed customer data claimed stolen by Crimson Collective, fake AITOPIA Chrome extensions harvesting AI chats, and critical n8n 'Ni8mare' RCE (CVSS 10.0).
  78. Coupang breach exposing 33.7M users, Shai-Hulud 2.0 npm attack leaking 400,000 developer secrets, and North Korean threat actors renting engineers' identities …
  79. Coupang breach exposing 33.7M customers, CodeRED alert platform shut down by Inc ransomware, and SmartTube app compromised via stolen signing keys.
  80. OpenAI API customer data exposed via Mixpanel breach, Asahi ransomware hits 2M people, and CodeRED alert system outage; plus Tomiris and Bloody Wolf activity.
  81. The Oracle EBS data theft fallout, Operation Endgame takedowns, and actively exploited Fortinet and WatchGuard flaws in today's cybersecurity news.
  82. GlassWorm returns with malicious VS Code extensions on OpenVSX; Microsoft discloses Whisper Leak AI side-channel attack and reminds Windows 10 users to enroll …
  83. The SonicWall cloud backup breach, Sandworm's wiper attacks on Ukraine, Cisco UCCX patches (CVE-2025-20333), and a $128M Balancer DeFi exploit.
  84. Covers SonicWall firewall config breach by state-sponsored actors, Balancer V2 $128M crypto theft, and actively exploited CentOS Web Panel RCE flaw from CISA.
  85. Miljödata breach affecting 1.5M, Nikkei Slack compromise and actively exploited Post SMTP WordPress flaw.
  86. Balancer DeFi $120M hack, Everest ransomware claims, and XWiki RCE exploitation.
  87. The Ribbon Communications breach, Cisco IOS XE webshell attacks, the Motex Lanscope zero-day exploited by Tick, and Conti extradition news.
  88. Dentsu/Merkle breach, Canadian water and energy hacktivist intrusions, and DELMIA Apriso and XWiki exploitation, plus TEE.fail and PhantomRaven.
  89. Top Secret clearance database exposed, ChatGPT Atlas hidden-command flaw, and Chrome zero-day tied to Memento Labs spyware.
  90. Jaguar Land Rover cyber incident, OpenAI Atlas browser prompt-injection flaw, and CoPhish phishing abusing Microsoft Copilot Studio for OAuth token theft.
  91. Toys R Us Canada data breach, Collins Aerospace airport check-in disruption, and Lazarus Group's Operation DreamJob against European defense firms.
  92. FBI seizes BreachForums amid ShinyHunters Salesforce extortion; Gladinet CentreStack zero-day CVE-2025-11371 and Oracle EBS zero-day attacks actively exploited.
  93. Salesforce customer data theft by ShinyHunters, Clop's Oracle EBS zero-day, and Redis 'RediShell' RCE flaw.
  94. Boyd Gaming breach, GeoServer flaw (CVE-2024-36401) hitting a US federal agency, and RTX ransomware disrupting European airports via Collins Aerospace.
  95. UNC1549 espionage against European telecoms, Turla and Gamaredon teaming up on Ukraine, and a CVSS 10.0 GoAnywhere MFT command injection patch.
  96. Iran-linked UNC1549 breaches European telecoms, Gamaredon and Turla team up on Ukraine, and ShinyHunters tied to healthcare breaches affecting 600K+ people.
  97. SonicWall cloud backup breach, Tiffany & Co. data theft and BianLian-linked Medical Associates of Brevard breach affecting nearly 250,000 people.
  98. JLR extends shutdown after cyberattack; Microsoft and Cloudflare dismantle RaccoonO365 phishing network; DHS misconfigured data hub exposes sensitive …
  99. Wireshark 4.4.9 fixes five bugs; pdf-parser dump-stream error reported; OpenAI tests a ChatGPT "Thinking effort" picker.
  100. Miljödata breach disrupts 200+ Swedish municipalities; Citrix NetScaler flaw CVE-2025-7775 exploited; Salesforce data theft via Salesloft Drift OAuth tokens.
  101. Colt Technology breach by Warlock ransomware, Apple zero-day patch, and Scattered Spider member sentenced to 10 years.
  102. Google Salesforce CRM breach, US federal court records cyberattack, and 60 malicious Ruby gems stealing developer credentials, plus Lenovo webcam flaws.
  103. Columbia University breach hits 870,000, Bouygues discloses 6.4M-customer breach, and Royal/BlackSuit ransomware dismantled after 450+ U.S. victims.
  104. Google Salesforce data breach by ShinyHunters, DaVita ransomware notice to over 1 million people, and WhatsApp removing 6.8 million scam-centre accounts.
  105. NNSA breach via Microsoft SharePoint zero-days, Clorox's $380M suit against Cognizant, and a backdoored npm 'is' package.
  106. Ingram Micro SafePay ransomware outage, exposed JDWP interfaces hijacked for crypto mining, and Taiwan's warning on Chinese apps like RedNote and TikTok.
  107. Spanish police bust a €10M investment fraud ring, IdeaLab ransomware data theft, and Ivanti CSA zero-days exploited by Chinese actors against French sectors.
  108. The McLaren Health Care breach (743,000 patients), Citrix NetScaler patches, and Salt Typhoon's breach of Canadian telecoms via a Cisco flaw.
  109. Episource breach hits 5.4M US patients, Predatory Sparrow drains $90M from Iran's Nobitex, and Water Curse hijacks 76 GitHub accounts.
  110. The Zoomcar breach affecting 8M+ users, Veeam's critical CVE-2025-23121 backup RCE, and the Langflow flaw exploited to deploy the Flodrix botnet.
  111. Erie Insurance cyberattack, INTERPOL's Operation Secure takedown of infostealer infrastructure, and a Microsoft WebDAV zero-day exploited by Stealth Falcon.
  112. The TxDOT crash-records data breach, Microsoft's June 2025 Patch Tuesday zero-days, and the six-hour Heroku outage.
  113. Sensata and UNFI breaches, critical Roundcube RCE CVE-2025-49113 actively exploited, and a Wazuh flaw exploited by Mirai botnets.
  114. 70+ malicious npm and VS Code packages exfiltrating data via Discord, ChatGPT Deep Research adding Dropbox and Box integration, and OpenAI's o3 altering a …
  115. Procolored printer drivers spread malware for six months, Coinbase offers $20M bounty after extortion, and Intel CPUs face new Spectre-style flaws.
  116. Coinbase breach via bribed support agents, Nucor halted by a cyber incident, and APT28 exploiting webmail zero-days in the RoundPress campaign.
  117. DOGE's alleged NLRB data exfiltration, a Microsoft Entra lockout mishap, and the 'Fog' ransomware campaign hitting over 100 victims since January.
  118. The DaVita ransomware attack, Chinese transformer backdoor fears, and Pakistan-linked actors using Xeno RAT and Spark RAT against India.
  119. Langflow CVE-2025-3248 exploitation, the Tycoon2FA phishing kit targeting Microsoft 365, and 'slopsquatting' supply chain risks from AI-hallucinated packages.
  120. North Korean IT worker schemes, AkiraBot's AI-generated spam campaign against 420,000 sites, and a Lovable AI jailbreak flaw.