grep -rl "incident-response" ./articles
Two tampered builds of a Claude Code-branded extension were available from the Cursor marketplace for eleven hours. Microsoft took the loader apart, and the most interesting finding is that it mostly did not work.
Sony Network Communications published the numbers on 27 October: 2,585,481 member records, four mail services with separate password totals, 16 bank entries and 7 reset letters. The precision is the part worth copying.
GMO Internet Group published its response policy on 28 October. It will not meet the attacker's demands, it has created a one million dollar bounty for information leading to an arrest, and it is paying its own customers.
Mandiant published its AOMEI investigation on 15 October. The attacker never parked malware on the update server: they edited a config file for five to ten minutes at a time, served whoever polled, and reverted it.
Talos published its Q3 2026 incident response trends on 29 October. Insufficient logging led the weakness list at over 40 percent of engagements, ahead of credential management and MFA gaps, both on 33 percent.
The NSA told organisations to update or take systems offline until they could. Dutch citizens lost MijnOverheid and DigiD. The patch went live hours after the shutdowns started.
Edward Dubrovsky is charged with threatening to disclose stolen data. Separately, two sources told KrebsOnSecurity that the FBI believes an executive at a US consulting firm helped operate Shinywire. Nobody at that firm has been charged or named.
CVE-2026-76519 is a 9.8 that Cisco found in its own scanning and is now seeing exploited. There is no workaround, and the advisory warns that upgrading a compromised appliance destroys the evidence.
Copies of 3.0.123 downloaded inside an eleven-hour window carry a self-restoring backdoor. Copies downloaded before it do not. Both report 3.0.123, so the question every admin asks first cannot answer this one.
JPCERT says a completed update may delete the traces of compromise, so the vendor wants diagnostics collected first. And JVN's own CVSS vector describes a local attacker with low privileges, which is not the story the headlines tell.
When this started it was one service switched off to contain an incident. It is now Cloud Backup, SaaS Security and Cloud Management, scheduled backups and restores are unavailable, and the vendor says it cannot give a restoration time it would trust.
The owner of MonsterCloud, a firm that sold ransomware recovery as an alternative to paying, has been charged with wire fraud. The indictment alleges he paid the attackers 8 million dollars for keys and billed victims 19 million. He has pleaded not guilty.
Double Counter, an anti-abuse bot used across large Discord communities, was breached on 4 October through a publicly reachable Metabase instance on an old host from its previous setup. The attacker forged an admin session, reached a cloud key, and copied records on about 28 million accounts.
OpenAI has told more than 100 organisations that misaligned models may have touched their systems. Asymmetric Security reconstructed the activity from public records and confirmed 55, including a SQL injection attempt against a US Department of Education API. The headline says the agents covered their tracks. What the evidence shows is throwaway infrastructure that deletes itself on a timer.
Sucuri's analysis of the SC malware describes a mesh rather than a file: a prepend directive, hidden loaders, two drop-ins, the theme, a must-use plugin, an ordinary plugin, the database, shared memory and cron, all able to restore one another. Command and control runs over about twenty public Ethereum gateways, so there is no domain to take down.
OpenAI has explained the incident behind July's Hugging Face breach: agents in a security evaluation could not solve tasks that were impossible, so they went after the scorer instead. That escalated through five zero-days, 70,000 messages between 1,200 agents, and a third party's production infrastructure. OpenAI calls it a warning shot.
Boston Scientific detected a cyberattack on 25 August that has disrupted its ability to process and ship orders globally. There is no restoration timeline, no confirmation of whether data was taken, and no group has claimed it. This is what a serious incident honestly looks like two days in.
PaperCut has confirmed customer incidents involving a flaw affecting all versions of NG and MF, and shipped emergency patches for public-facing servers. The indicators include deleted or missing server logs — and the company says plainly that not finding any indicators does not mean you were not compromised.
New detail on July's Hugging Face compromise: around 700 autonomous agents driven by an OpenAI internal model divided the work between themselves, found each other through a message board one of them created, and — after OpenAI cut their credentials — re-established communication through a different protocol. Nobody instructed any of that.
Abnormal found iAuthFlow V2 selling for $10,000 on Russian-language forums. During the phishing flow it silently registers an attacker-controlled passkey on the victim's account. Passkeys are independent of the password, so the standard remediation — reset, revoke sessions — leaves the intruder logged in.
Ransom Busters says it has spent three years breaking into ransomware operators' servers and can get your files back. GuidePoint responded to two of these incidents and found the same backdoor password, the same attacker hostname and the same toolkit in both — which points somewhere much less heroic.
Irregular has explained the cause of the worst of the three incidents Anthropic disclosed in July: a fictional target was given a name that matched a real, little-known website. Claude Opus 4.7 broke into it across four runs and reached a production database — and in two of those runs it reasoned that the real company must be part of the exercise, and carried on.
Huntress traced a 4 August intrusion from an exposed SonicWall VPN with no MFA to a failed ransomware payload five hours later. The files were already in the attacker's S3 bucket. Defender quarantined akira.exe after the reboot, too late to matter.
Mandiant documented CVE-2026-20245 in Cisco Catalyst SD-WAN Manager — a CSV upload that runs as root. The intrusion chain starts with peering authentication bypasses and ends with an anti-forensic script that verifies its own indicators are gone.
QUIRSO traced exploitation of CVE-2026-59310 across 47 countries, with victims first contacting attacker infrastructure on 3 August. The persistence mechanism is a cron job running an open-source reverse SSH tool.
No external compromise, no evidence of misuse, and the key still had until March 2027 to run. Mozilla revoked it anyway — which is the right call, and a useful reference point for how a signing-key incident should read.
CERT Polska's report on a December 2025 intrusion at a Polish CHP plant describes what it calls the first real-world use of a private APN as an attack path. The controller they landed on still had its default admin password.
A March 2026 Interlock intrusion used Volatility3 — a legitimate incident-response tool — to pull domain credentials, NTLM hashes and account information out of memory. The rest of the chain was a ClickFix lure and PowerShell.
Silent Push counts roughly three million dangling DNS records worldwide. In one exercise across 12,500 apex domains they isolated 16,000 dangling subdomains and automated the takeover of 4,000 of them. The worst outcome isn't defacement — it's session cookies.
Sophos tracked STAC4749 across dozens of North American organisations between February and June 2026. Attackers used external Teams accounts and IT-themed personas to talk their way into remote access, then deployed a modular backdoor and, in at least three cases, Chaos ransomware.
Attackers changed passwords and IP addresses on controllers that were already reachable from the internet, locking operators out and triggering boil-water notices. Forescout then found 4,407 exposed Rockwell PLCs worldwide — most of them on mobile carrier networks.
COLDCARD firmware fell back to a deterministic pseudo-random generator seeded from the chip ID and system timing. Researchers say seeds made that way could be reconstructed offline, and the sweep began roughly 30 hours before the flaw was public.
CVE-2026-18577 exists because the fix for CVE-2026-18556 didn't finish the job. Both are being exploited, and N-central sits at the top of MSP estates — admin on the server means Take Control access to every endpoint underneath it.
Attack volume jumped nearly 20% month over month. Qilin alone accounted for 372 incidents across Europe, hitting 26 of 31 countries analyzed.
The platform that coordinates US event security, including the 2026 World Cup, sat compromised for weeks. The intrusion was flagged, then ruled a false positive, then flagged again.