The live board

Breaches & attacks · Real loss · since 13 Nov 2026

United States authorities seized hacking infrastructure belonging to APT38 used in cryptocurrency thefts totalling $1.2 billion from Binance. The operation also recovered footage used by attackers to impersonate victims during video calls.

Breaches & attacks · Real loss · since 12 Nov 2026

North Korean state hackers stole over $400 million in cryptocurrency using fake video conferencing calls featuring webcam footage of earlier victims. The FBI seized over 900 recordings and issued a warning to crypto and web3 workers.

Breaches & attacks · Real loss · since 13 Nov 2026

The City of Osaka announced a data breach affecting one million people and warned residents about suspicious phishing emails. Officials are investigating the intrusion and urging vigilance against fraudulent messages.

Do:Warn residents to ignore suspicious emails claiming to be from the local government.

Breaches & attacks · Real loss · since 11 Nov 2026 · updated 13 Nov 2026

Baker Tilly Advisory Group has begun notifying clients that a third-party data breach has exposed personal information regarding clients and their dependents. The organization is responding to the security incident.

Breaches & attacks · Exploited · since 13 Nov 2026

Attackers used a fake Microsoft Teams meeting scheduler to trick an employee into approving a device code sign-in. The attackers obtained a valid session token before the incident was identified.

Patch now · Exploited · ●Patched · since 13 Nov 2026 · CVE-2026-123039

Attackers exploited PHP2Shell for initial compromise alongside CVE-2026-123039 to elevate privileges to root on Check Point Gateways. The targeted attacks resulted in destructive gateway impacts.

Do:Apply the emergency hotfixes provided by the vendor immediately.

Breaches & attacks · Exploited · since 13 Nov 2026

A state-sponsored threat group named SilentAir compromised equipment across Asian mobile operators to intercept calls and text messages. The campaign primarily targeted users in Taiwan across at least six countries.

Breaches & attacks · Exploited · since 13 Nov 2026

Hackers breached ActiveCloud and encrypted parts of its cloud infrastructure, causing multi-day service outages for customers. The company confirmed the intrusion and worked to restore affected systems.

Do:Verify cloud backups and review access controls.

Breaches & attacks · Real loss · since 6 Nov 2026

Federal authorities announced that scammers utilized AI voice spoofing to impersonate executives and steal over $100 million in fraud campaigns. The U.S. is currently seeking extradition of three suspects from Europe.

Breaches & attacks · Real loss · since 5 Nov 2026 · updated 6 Nov 2026

DigiCert disclosed a data breach resulting from a server migration error that exposed an internal business system to the internet. Unauthorized individuals gained access to customer information and identity verification documents.

Do:Review communications from DigiCert if you are an affected customer and monitor for identity theft.

Breaches & attacks · Real loss · since 31 Oct 2026 · updated 6 Nov 2026

Blockchain analysis firm Chainalysis suffered a security incident where an external actor accessed non-sensitive customer data using agentic techniques. The company stated that investigation content, authentication credentials, and session tokens remained secure.

Do:Reset all user credentials, revoke active session tokens, and rotate API keys.

Supply chain · Exploited · —No fix needed · since 6 Nov 2026

Threat actors are hosting malicious security projects on GitHub to target cybersecurity professionals. The fake repositories deliver infostealers and backdoors to unsuspecting users.

Do:Avoid downloading unverified security tools from untrusted GitHub accounts.

Supply chain · Exploited · —No fix needed · since 5 Nov 2026 · updated 6 Nov 2026

Threat actors are distributing a new Linux backdoor named CWPdoor via a trojanized version of the Control Web Panel web server. The malicious binary enables attackers to execute commands silently without generating logs.

Do:Check servers for unauthorized modifications to the cwpsrv binary and remove any instances of CWPdoor.

Patch now · Exploited · ●Patched · since 3 Nov 2026 · updated 6 Nov 2026 · CVE-2026-119977

WordPress core contains a time-of-check time-of-use race condition vulnerability allowing unauthenticated attackers to execute code via predictable staging paths during upgrades. CISA added the flaw to its known exploited vulnerabilities catalog following confirmed in-the-wild exploitation.

Do:Block web access to the staging directory while applying WordPress updates to prevent race condition exploitation during the installation phase.

Breaches & attacks · Real loss · since 5 Nov 2026

Mark Cuban reported that Facebook knowingly runs AI-generated deepfake scam ads featuring his likeness for fake products. Internal documents allegedly point to massive revenue generated from such fraudulent advertising.

Breaches & attacks · Real loss · since 5 Nov 2026

The Brazilian Credit Guarantor Fund (FGC) suffered a data breach resulting in the exposure of personal identifiable information and payout data. The incident impacts customers and highlights security gaps at the institution.