Every notable cyber threat for education and government (126 items), including CVE references.
AI-assisted summaries and fixes, sources cited.
High · Security Affairs ·
Unknown attackers used a third-party service provider to conduct fraudulent transactions at Crédit Mutuel Arkéa, forcing system shutdowns and losses that may reach $133 million.
Medium · BleepingComputer ·
Unidentified intruders reached Crédit Mutuel Arkéa through a third-party provider, triggering unauthorized transfers and forcing temporary system shutdowns, with losses estimated as high as $133 million.
High · BleepingComputer ·
Fraudsters are borrowing the names of well-known companies and famous figures to run prize draws that harvest personal details, trigger paid subscriptions, and never pay out.
High · The Record ·
DigiCert says an unidentified intruder reached an internal business system this summer, opened an account without authorization, and accessed commercial customer data.
Medium · BleepingComputer ·
Unknown attackers are using a Plex2Shell exploit to compromise QNAP NAS systems that host Plex Media Server; no CVE has been assigned.
High · The Record ·
An FBI agent admitted taking about $2.4 million in cryptocurrency, using his investigative access, and laundering funds to pay off debts.
Medium · The Record ·
Federal prosecutors in the United States have charged three European suspects in a nine-figure fraud that used executive impersonation and AI assistance, and they are seeking extradition.
High · BleepingComputer ·
Unidentified intruders reached Chainalysis internal tooling, exposing credentials and active tokens for the entire customer base and raising takeover risk.
High · SecurityWeek ·
Unidentified attackers created accounts and reached contact details for DigiCert’s business customers, prompting a high-severity review.
Medium · Dark Reading ·
A compromise affecting freezer controls at European grocery chains has interrupted distribution and highlighted how OT failures can spread across the food retail sector.
Medium · SecurityWeek ·
U.S. agencies say malicious actors are going after internet-exposed refrigeration controllers at European grocery stores and blood-collection facilities.
High · SecurityWeek ·
A patching rush is underway after OpenSSH maintainers and musl libc developers addressed an authentication bypass that can accept arbitrary passwords in certain configurations.
Medium · Security Affairs ·
ENISA and EU authorities say unknown intruders have hit commercial cooling and industrial control systems in multiple member states, with a new wave reported by November 1.
High · Help Net Security ·
Unidentified attackers are manipulating refrigeration control systems at supermarkets and temperature-controlled warehouses, prompting a joint U.S. advisory on Nov. 6, 2026.
Medium · The Hacker News ·
Unknown intruder exposed credentials, hashed passwords, and active tokens across Chainalysis Reactor and Data Solutions, forcing service shutdown and access revocation during investigation.
High · SecurityWeek ·
Prosecutors have charged three people accused of using AI-assisted impersonation to target accounting personnel and steal roughly $129 million.
Medium · BleepingComputer ·
Federal cyber agencies say intruders are going after industrial cooling and temperature-monitoring environments worldwide, with spoiled food, harmed equipment and fire hazards among possible effects.
Medium · Dark Reading ·
A Russian-linked disinformation campaign is reportedly using AI, impersonation, and forged papers to target schools in Peru and Ecuador through a locally presented front group.
Medium · BleepingComputer ·
Attackers are using counterfeit event invitations and two rented phishing kits to capture employee credentials and authentication sessions for Microsoft and Google accounts.
Medium · The Register — Security ·
OpenSSH maintainers have shipped a fix for a ten-year-old bug in musl Linux builds that could let an attacker gain root through extremely long passwords.
Medium · Dark Reading ·
A Russian government-linked intrusion set, APT29, is turning compromised websites into collection points that profile and steal data from several thousand mobile visitors, with no CVE to patch.
High · The Record ·
Russian state-linked intruders are compromising Apple and Google mobile devices without user interaction to steal sensitive data across Ukraine, the U.S., and Europe.
High · The Hacker News ·
An authentication bypass in the openssh-server package distributed by Alpine Linux allowed logins without valid credentials, prompting an out-of-band 10.6p2 fix.
High · The Hacker News ·
A flaw in ChatGPT's Lockdown Mode let researchers quietly pull conversation content without victim action, raising phishing risk; OpenAI fixed it in November 2026.