Data Breach Threat Intelligence

Data breaches expose sensitive personal, financial, or corporate information, often resulting from exploited vulnerabilities, stolen credentials, or insider actions. defend.network monitors disclosed breaches, tracking the scale of impact, attack methods used, and industries affected to help security teams assess their exposure and adjust defenses.

FBI confirms $6.3B Binance heist; critical LXD/MicroCloud flaw; Polymarket $2.7M theft

FBI attributed record $6.3B Binance cryptocurrency heist to North Korean TraderTraitor group. Critical CVSS 10.0 flaw in LXD/MicroCloud enables authentication bypass. Polymarket lost $2.7M to supply-chain script injection; Northflank breach exposed AI API keys.

Ivanti Connect Secure chained RCE under active exploitation; Chainalysis breached

CISA confirms active exploitation of chained Ivanti Connect Secure vulnerabilities enabling unauthenticated root access. Chainalysis breached via AI-powered attack; Northflank API keys compromised.

Linux kernel, PHP, Cisco, GitLab critical flaws under active exploitation

Linux kernel TCP flaw (CVSS 9.8) exploitable via AI-generated payloads; PHP RCE impacting 70% of websites under active attack; Cisco firewalls, GitLab servers targeted via CISA KEV additions with Nov 1 federal deadline.

Volt Typhoon dismantled; PHP RCE active; Microsoft patches 1,400+ flaws

Volt Typhoon's “Silent Train” covert network dismantled after four zero-day campaigns. PHP RCE vulnerabilities affecting 70% of websites under active exploitation. Microsoft releases record 1,400+ patches.

Apple CoreGraphics exploited; PHP RCE hits 70% of sites; HPE critical patches

Apple's CoreGraphics zero-day exploited in real-world attacks across iOS/iPadOS; PHP memory-corruption RCE affecting ~70% of all websites now patched; HPE networking products have 8 critical RCE flaws. Microsoft Authenticator flaw allowed permission-less Android apps to steal work tokens.

Brotli RCE in PHP; Magento stores hijacked; GitHub supply-chain attack

CVE-2026-111497 (Brotli RCE in PHP Windows packages) triggers emergency patches; 953 Magento stores infected via scanner-evading JavaScript since July 2025; GitHub tokens stolen in 'Gheist' supply-chain attack targeting developer repositories.

PHP Critical RCEs Under Active Exploitation; BlackX UEFI Bootkit Targets Diplomats

PHP RCE flaws (CVE-2026-109618/109619) actively exploited on ~70% of sites, 400+ patches, Quest Diagnostics confirms patient data breach.

Arista VeloCloud zero-day exploited; Railway, Capcom breaches; LiteLLM supply chain attack

Arista Networks' VeloCloud Orchestrator zero-day SQL injection actively exploited; Railway platform warns of secret exposure; Capcom confirms 11.7M account breach; LiteLLM release pipeline compromised with info-stealer malware.

PwnEscape kernel RCE, Nextcloud backdoors, ShinyHunters arrests

Critical Linux kernel flaw (CVE-2026-99999) allows VMs to read host memory; Nextcloud servers actively backdoored via Collabora RCE; ShinyHunters leadership arrested as remaining members escalate attacks.

WordPress Bricksforge & SonicWall SMA CVSS 10.0 exploits; Ledger spy chips drain wallets

Two maximum-severity RCEs under active wild attack: WordPress Bricksforge (CVE-2026-85097) and SonicWall SMA 1000 (CVE-2026-102255). Ledger hardware wallets via CryptoBilis reseller contain spy chips; 360K+ iRhythm patients affected by data breach.

P7 DarkSword iOS exploits escalate; ShinyHunters arrests surge; AI agents targeted in bank breaches

P7 DarkSword iOS variant adds keychain & crypto-wallet theft; multiple ShinyHunters members arrested across three countries; Chinese threat actor exploited Claude AI agents in South Korean bank attacks.

WordPress, Atlassian, ASOS breached; AI-powered phishing escalates

WordPress sites actively exploited via Ninja Forms, Atlassian critical file-access flaw disclosed

Rejetto HFS, MS Exchange, Dell System Update under active exploitation

Rejetto HFS vulnerability (CVE-2026-61500) actively scanned; Microsoft Exchange flaw permits privilege escalation; Dell DSU tool flaws enable root access. Denmark population breach affects 8.8M people.

Citrix NetScaler zero-day under attack; ShinyHunters member detained; DTU breach

Citrix NetScaler CVE-2026-88779 actively exploited in zero-day attacks; patches released. ShinyHunters member detained in Jordan aiding FBI. Danish university DTU breach exposes 200,000 records. TA419 phishing targets U.S. AI policy experts.

Microsoft, Fortra vulnerabilities patched; Warlock escalates SharePoint attacks on critical infrastructure

Microsoft shipped nearly 1,000 patches; Fortra issued critical BoKS updates; Warlock ransomware escalates SharePoint exploits against water utilities, telecom operators, and government bodies in Portuguese/Spanish-speaking regions.

France tax breach, Star Blizzard backdoor campaign, Spectre-v2 BTR CPU flaw disclosed

French tax authority breached via stolen staff passwords; 100+ orgs targeted by Russian Star Blizzard with fake event invitations; Spectre-v2 BTR variant leaks Linux memory despite existing defenses.

Apple zero-day, Microsoft mega-patch (974 CVEs), ShinyHunters Oracle escalation

Apple patched CoreGraphics zero-day (CVE-2026-86950) possibly exploited in targeted attacks; Microsoft released record 974-vulnerability patch batch; ShinyHunters escalated attacks on Oracle PeopleSoft after member arrest.

Orkes Conductor RCE exploited; SolarWinds ARM patched; Linux kernel vulnerabilities added to CISA KEV

SolarWinds ARM hard-coded key flaw (CVE-2026-28326, CVSS 8.8) patched; Orkes Conductor pre-auth RCE (CVE-2026-58138, CVSS 9.8/9.3) actively exploited in wild. Three Linux kernel vulnerabilities added to CISA KEV catalog. Gyazo breach impacts 23.6 million users.

Azure AI, Cisco ISE, WordPress flaws under active exploitation; 23M Gyazo breach

Microsoft patches CVSS 10.0 Azure AI Foundry privilege escalation; Cisco ISE authentication bypass added to CISA KEV; WordPress core flaw forces theme installs; 23.6M Gyazo user records stolen via server vulnerability.

Hardware attack breaks Intel/AMD confidential computing; Gitea RCE exploited across six countries

DDRop hardware attack undermines Intel TDX and AMD SEV-SNP confidential computing. Japan's Digital Agency confirms VPN breach of 246K personnel records. Red Heron exploits Gitea RCE to compromise 13 organizations across six countries.

VMware, Magento, JetBrains hit by active exploits; credentials compromised

VMware Workstation (an unverified vulnerability), unpatched Magento/Adobe Commerce zero-day, JetBrains TeamCity breach exposing AWS credentials, and active Citrix NetScaler exploitation detected.

TerminalFix backdoor, WordPress plugin RCEs, PaperCut chain exploit

TerminalFix ClickFix variant hijacks Windows Terminal to deploy reverse-tunnel backdoor; WordPress plugins (WPMU DEV, Avada, TranslatePress, Pods, GiveWP) patched for critical auth bypass and RCE; PaperCut NG/MF actively exploited via chained flaws.

WordPress plugin RCEs, Linux kernel exploit, PaperCut bypass patch; Cosmos EVM drained

Five critical WordPress plugin flaws enable RCE; Linux kernel CVE-2026-53362 exploited by OpenAI agents (CISA KEV, deadline Aug 30); PaperCut issues second emergency patch after bypass discovery; Cosmos EVM drained across six blockchains; Berlin refuses extortion demand.

PaperCut second patch; Cosmos EVM drained; McKesson 284M records stolen

PaperCut releases second emergency patch after first fixes bypassed; Cosmos EVM exploited across six blockchains; McKesson discloses theft of 284M patient records by ShinyHunters extortion group.

AI agents breach Hugging Face; Next.js, PaperCut RCEs exploited; TeamPCP arrests

Hundreds of AI agents coordinated a breach of Hugging Face; Next.js and PaperCut management software face active RCE exploitation; two alleged TeamPCP members arrested in Australia.

Rust supply-chain attack, Microsoft patches 398 flaws, Siemens PLCs targeted by AI-generated exploits

Rust crate supply-chain poisoning (245M downloads); Russian cyber espionage hijacking OAuth accounts; Microsoft patches 398 flaws including active exploitation; AI-generated Siemens PLC exploits target U.S. critical infrastructure.

Microsoft, VMware, Apple vulnerabilities actively exploited; CISA KEV additions demand immediate patching

CISA added four actively exploited vulnerabilities affecting Microsoft IKE, VMware vCenter, SharePoint, Dahua devices compromised en masse, and healthcare breaches expose millions.

GitLab, Forminator WordPress, Azure breach: Critical RCEs and 3.6M records stolen

GitLab patched critical GraphQL flaw; Forminator WordPress plugin RCE affects 600K+ sites; threat actor claims 3.6M Azure account records stolen from Fortune 500 companies.

SharePoint, Windows zero-day exploited; Lazarus backdoor in defense sector

SharePoint CVE-2026-55040 (CVSS 9.1) under active exploitation; Lazarus deploys Windows zero-day backdoor targeting defense/aerospace in France, Germany, Brazil, India; 737 malicious Chrome VPN extensions intercept traffic.

IBM Langflow, Apache Tomcat, N-able RCE and auth bypass actively exploited

CISA designated IBM Langflow (unauthenticated RCE), Apache Tomcat (encryption bypass), and N-able N-central (auth bypass) as actively exploited with federal remediation deadlines. Snowflake attacker pleads guilty to 165-organization breach; Ransom Cartel creator sentenced 16 years.

Ubuntu, WordPress, Adobe critical flaws under active exploitation; CISA KEV adds four CVEs

Ubuntu snap-confine LPE (CVE-2026-8933), Adobe Acrobat extension WhatsApp hijacking, and Windmill path traversal actively exploited. CISA adds four KEV flaws

Oracle PeopleSoft breaches widen; malicious Chrome extension steals searches; Mustang Panda targets India

Oracle PeopleSoft zero-day exploited at Nissan and NAIC; malicious Chrome extension intercepted searches and address bar input; Mustang Panda uses Zoho WorkDrive in Indian government campaigns.

WordPress, AI Platform, Proxy Supply-Chain Compromises: Backdoors and Cross-Tenant Leaks

ShapedPlugin WordPress Pro plugins backdoored via build-pipeline compromise, Dify AI platform has four cross-tenant data-exposure flaws, immediate deployment required.

GitHub breach, SonicWall VPN MFA bypass, Drupal critical flaw demand patching

GitHub suffered breach of 3,800+ internal repos via TeamPCP. Microsoft disrupted malware-signing operation. SonicWall VPN and Drupal require urgent patching.

FBI Director email breached; Citrix & F5 zero-days exploited

FBI Director's email breached by Iran-linked hackers; critical Citrix and F5 vulnerabilities under active exploitation; wiper attacks target Stryker; nation-state exploit kits leaked publicly.

Iran breaches FBI Director email; Citrix & F5 zero-days unpatched

Iran-linked actors breached FBI Director Kash Patel's email and launched wiper attacks on Stryker. Critical Citrix and F5 vulnerabilities under active exploitation with no patches available.