Active incidents
Events still developing. We update the timeline as vendors, CERTs and researchers publish more.
43 active incidents
QiAnXin XLab says it captured a suspicious script, cwpsrv_update.
On November 4, 2026, TWCERT/CC disclosed three high-severity vulnerabilities in Abouttime Tech's Herowatch series, including an insecure direct object reference flaw in Herowatch Go Server (CVE-2026-121817), firmware signed with publicly known test keys in Herowatch Mini (CVE-2026-121818), and missing authentication in the Herowatch Mini ADB service (CVE-2026-121816) .
Security firm Todyl says that since Nov 1 an attacker has been using stolen, still-valid credentials to sign in to MSPs' Microsoft 365 and Azure environments as their own applications, targeting about 45 app registrations at roughly 18 organizations with more than 33 authenticating successfully .
Kyocera Communication Systems (KCCS) issued a second update on November 6 stating that a web server operated by its subsidiary MOTEX suffered unauthorized access, potentially exposing customer information including company names, personal names, email addresses, and phone numbers .
Following Google's disclosure of the XCPE botnet, cybersecurity vendor TrendAI published observations from June 3 to October 1 showing approximately 1.
ESET researchers exposed a Russia-aligned threat actor they named Gorbag, active since at least February 2025 and focused exclusively on Ukrainian targets, especially law enforcement and justice entities, local administrations near the front line, the defense sector and a major transportation hub for foreign military aid .
BleepingComputer reports that Russian cloud and hosting provider Beget said an attacker gained access to the management systems of its entire architecture on the night of Nov 1 and deployed malware that erased server data, after which Beget disconnected all servers .
Fortinet FortiGuard Labs published research on Nov 2 saying it has tracked, over several months, a campaign targeting South Asian organizations that uses PowerShell scripts and a custom remote access trojan it calls PapRAT for persistent access, attributing it to BITTER with high confidence .
According to iThome, e-commerce cloud ERP provider Mallbic stated that routine daily security checks on October 31 uncovered host anomalies and confirmed that unauthorized malicious commands had been executed on certain hosts; attackers entered through a brand website service portal, potentially affecting consumer and transaction data imported by merchants from other e-commerce platforms .
According to ITmedia, Iris Plaza announced on November 5 that following unauthorized access to an external cloud service used by the company, personal data of approximately 7.
In FreeSWITCH 1.
PayCloud Holdings subsidiary Arara said its email delivery service Arara Message suffered unauthorized access; it first disclosed the incident on Oct 29, and its Nov 6 third report put the deduplicated number of taken (or possibly taken) email addresses at 81,329,467 .
Korean enterprise software vendor Douzone Bizon said on October 23, 2026 that attackers used a flaw in the backup solution behind its APO backup service to exfiltrate some encrypted data from backup servers, adding that it has found no sign the encryption keys leaked and has not yet identified affected customers or individuals .
GMO Internet said that on October 20 it confirmed a third party had planted a malicious program on some customer servers of its Onamae.
According to reports by the United Daily News and China Times, a written operational report submitted by the National Security Bureau (NSB) to the Legislative Yuan on October 20 stated that through September, Taiwan's Government Service Network (GSN) experienced an average of over 2.
On October 21, PHP released security updates patching CVE-2026-109618 and CVE-2026-109619, two vulnerabilities with CVSS v4.
Taiwanese cloud deployment platform Zeabur published its preliminary investigation report: between October 14 and 15 (UTC), attackers used leaked internal credentials to access shared clusters, certain dedicated servers, and internal systems, ultimately reading the platform database and exposing 3,218,965 service environment variables and 321,810 user account records .
An alert from France's CERT-FR warned of widespread compromises affecting Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration remote controllers, with attackers primarily exploiting internet-exposed management interfaces .
Openwave Messaging says Webtop Media Transcoder before 1.
According to The Record, the Danish government said on October 5 that someone exploited an unnamed Danish company's legitimate access to the Central Person Register (CPR) to obtain the names, addresses and CPR numbers of about 8.