The Florida Department of Education (FLDOE) says hackers breached its student financial aid website, potentially exposing the personal information of roughly 4.9 million people. The department discovered the intrusion on October 19. It says it launched its incident response procedures after detecting the threat and has since contained the breach. "At this time, we believe the incident was limited to the Florida Student Financial Aid website." the department said. READ MORE...
Online fashion retailer Revolve is notifying at least 180,000 individuals that their personal and payment card information was stolen in a data breach. The incident occurred on September 11 and involved unauthorized access to certain systems, including the company's online shopping platform. Immediately after learning of the cyberattack, Revolve initiated incident response and contained and remediated the unauthorized activity. READ MORE...
Three weeks after the attack that turned refrigeration units in French supermarkets into ovens overnight, similar cyberattacks have hit shops in other European countries and again caused refrigerated food to be spoiled. "[In Belgium,] fridges and freezers have been affected at Delhaize, Carrefour and Spar, among others. The attackers remotely switched the units' evaporators to defrost mode, causing the fridges to warm up," Belgian news agency Belga reported today. READ MORE...
A Trezor Safe 5 sold by CryptoBilis, the reseller linked to the recent Ledger wallet drains, may contain a hidden implant that steals the owner's recovery phrase, Trezor has warned. Trezor is a Czech company and part of SatoshiLabs Group. It has made hardware wallets since 2014. "If you bought a Trezor from CryptoBilis from March 2026 onwards and are using it to store funds, please move your funds to a newly created wallet as soon as possible," the company advised. READ MORE...
Anthropic's official Claude Code extension for the Cursor VS Code Marketplace was hijacked and swapped out for a malicious version with a persistent backdoor. The SolarWinds-style attack in miniature lasted only 11 hours, from 9:27 a.m. GMT to 8:35 p.m. GMT, on Oct. 29, according to Cursor's disclosure. Any software developers who downloaded or updated Claude Code in their Cursor integrated development environment (IDE) during that time would have received a malicious version 2.1.313. READ MORE...
The US has charged five individuals as part of the first broad federal crackdown on "ghost students"-fraudsters who steal the identities of hundreds of Americans to pose as fake college students and steal student loans. In a press release Thursday, the Department of Justice said it had uncovered a large-scale scheme relying partly on AI. The DOJ seized more than $750,000 in cryptocurrency from "a network associated with Kenyan nationals" after data analysis helped flag likely fraudsters. READ MORE...
Taiwanese network-attached storage (NAS) appliance maker Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks. The company urged users to enable automatic updates and upgrade the DiskStation Manager (DSM) software running on their NAS devices to the latest version to protect their data. "Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. READ MORE...
A suspected China-nexus actor chained flaws in PHP2Shell with a privilege escalation bug in the Linux kernel to gain root access to Palo Alto Networks firewalls, according to researchers at Dream and PAN Unit 42. The attacks reached more than two dozen targets, including multiple servers linked to the U.S. government. The chained critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109169, along with a high-severity flaw in Fragnesia, tracked as CVE-2026-46300. READ MORE...
Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks. Tracked as CVE-2026-97229, this vulnerability stems from an integer overflow weakness and was discovered in the CI/CD Regular Expression Compiler, which parses and evaluates regular expressions in pipeline configuration files. On Friday, the US CISA confirmed that attackers have begun exploiting the flaw in the wild. READ MORE...