System intrusion

Attacker exploits SGLang flaw to breach NEAR AI inference server, takes data on about 100 users and 18 AI agents

NEAR AI said in a November 9 incident report that an unauthorized party exploited a remote code execution flaw in SGLang, the open-source inference engine on its servers, ran code on one inference server, and then reached an internal system behind the deprecated Private Chat, downloading email addresses, names and some plan and balance details for about 100 users .

Vanderbilt University said on Nov 9 it is responding to an active cybersecurity incident that may impact university devices, systems and cloud-based services, and that its IT team is investigating and working to contain it .

The Record reports that German web hosting provider Mittwald CM Service disclosed in a Saturday blog post that hackers compromised 56 customer projects after going undetected on its systems for eight days .

Emerging-market company Flashaim (7551) said in a November 5 evening material announcement on MOPS that its GMB system was hit by a cyberattack, and that it activated its incident response mechanism and began investigation and maintenance after discovering it .

According to iThome, on the evening of November 3, OTC-listed Microbio Co.

According to iThome, listed household cleaning products manufacturer Mao Bao Inc.

According to iThome, on November 4, restaurant group Wowprime (2727) issued a material announcement on the Market Observation Post System (MOPS), stating that the outsourced shopping website vendor for its subsidiary Wan Hsien experienced an information security incident .

Security firm Todyl says that since Nov 1 an attacker has been using stolen, still-valid credentials to sign in to MSPs' Microsoft 365 and Azure environments as their own applications, targeting about 45 app registrations at roughly 18 organizations with more than 33 authenticating successfully .

Acronis TRU disclosed on Nov 4 an attack framework called BOSSAI that combined 12 AI agents, targeted organizations in 11 countries over 12 observed days, and was assessed to be run by an individual in Hualien City, Taiwan .

According to Security NEXT, Japan's Ministry of Economy, Trade and Industry (METI) announced that the Dentrinet website associated with the Electricity and Gas Market Surveillance Commission suffered a cyberattack in the early hours of October 27, 2026 .

According to iThome, apparel and textile distributor Collins Co.

According to iThome, on October 21, Gourmet Master Co.

Railway said the attack ran from October 20 to 22 and aimed to obtain AI provider API keys for distillation attacks, interrupting builds and deployments .

GMO Internet said that on October 20 it confirmed a third party had planted a malicious program on some customer servers of its Onamae.

On October 21, Gourmet Master Co.

Vulone disclosed on Oct 18 that a China-linked, financially motivated operator built an AI-agent intrusion platform on the open-source Cairn framework and ran 66 operations between Sep 24 and Oct 14, 48 of which reached at least session-level access .

According to iThome, on October 16, e-commerce technology service provider 91APP (6741) issued a material announcement on the Market Observation Post System (MOPS), stating that its Commerce Cloud database was found two days earlier (October 14) to have suffered an automated attack in which attackers unlawfully scraped partial information; 91APP commissioned an independent third-party cybersecurity organization to assist with the investigation, filed a police report, implemented necessary protective measures to mitigate impact, and notified relevant regulatory authorities in accordance with the law, bringing the attack under control .

Dutch retail group Ahold Delhaize announced on October 12, 2026, that it had detected a security issue within its network and taken precautionary measures, including taking certain systems offline to protect its infrastructure, while noting that physical stores remained open .

According to iThome, General Plastic Industrial (GPI) announced on October 7 that its subsidiary Katun Corporation experienced a cybersecurity incident involving anomalous access to some information systems .

According to iThome, on the evening of October 6, online job bank operator 104 Corporation (3130) issued a material announcement on the Market Observation Post System (MOPS), stating that it detected abnormal data read activity on its app system and immediately implemented protective and blocking measures, notified relevant regulatory authorities, and filed a report with the Taipei Field Office of the Investigation Bureau .