Daily digest,
Critical Vulnerabilities in Progress WS_FTP Server Disclosed (+5 more)
Vulnerabilities
Critical Vulnerabilities in Progress WS_FTP Server Disclosed
On October 29, 2026, Progress Software disclosed two critical vulnerabilities in its WS_FTP Server: CVE-2026-84295 and CVE-2026-90868. CVE-2026-84295, rated CVSS 10.0, allows unauthenticated remote attackers to access sensitive information, including administrative credentials. CVE-2026-90868, rated CVSS 9.9, is an OS command injection flaw that can enable arbitrary command execution under certain configurations. Both vulnerabilities were patched in versions 2024.0.6 and 2025.0.3, released earlier in September and October 2026. As of the disclosure date, there is no evidence of exploitation in the wild, and neither vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog. Organizations using WS_FTP Server are advised to upgrade to the latest versions and review access permissions for administrative accounts.
Vulnerability · 2 sources · score 71 · CVE-2026-84295, CVE-2026-90863, CVE-2026-90864, CVE-2026-90865, CVE-2026-90867
Malware Campaign Exploits Hugging Face for Crypto Mining
A cryptomining and backdoor campaign has resurfaced, exploiting Hugging Face model repositories to hijack GPUs. Researchers at Pluto Security identified 31 malicious repositories across seven accounts, with the most popular model downloaded over 28,000 times. The attack leverages the 'trust_remote_code' option, allowing malicious Python code to execute on user machines upon model loading. This campaign has recorded more than 32,000 downloads collectively, targeting GPU hosts running self-hosted inference servers like Xinference and GPUStack. Despite previous takedowns, new repositories appeared within days, indicating the persistence of the threat. Scanning tools failed to detect the malicious code, as it does not match known malware signatures. The campaign's operator has reportedly earned around $5,000 in cryptocurrency from the mining activities.
Vulnerability · 2 sources · score 70 · CVE-2024-34359, CVE-2026-22807, NetSupport RAT, Peakminer
Breaches
Binance Investigates Major Hack: Up to $5.8 Billion Potentially Stolen
On October 29, 2026, Binance, the world's largest cryptocurrency exchange, reported a potential security breach involving significant outflows from its hot wallets, with estimates suggesting up to $5.8 billion may have been drained. The breach was first flagged by on-chain analysts, revealing that large amounts of Ethereum and stablecoins were transferred to a newly created wallet funded through Tornado Cash, a cryptocurrency mixer. Binance co-founder Changpeng Zhao indicated that the incident appears to be a hack and stated that user funds are expected to be fully covered. In response, Tether and Circle froze approximately $2.4 billion in assets linked to the incident. As of October 30, Binance confirmed that $2.54 billion in assets had been frozen while investigations continue. The hack, if confirmed, would represent the largest theft in cryptocurrency history, surpassing the $1.5 billion Bybit hack in 2025.
APT · 20 sources · score 70 · Lazarus Group, TraderTraitor
Malware Attack Exposes Online Poker Players' Cards
A malware attack targeting online poker players has reportedly stolen millions of dollars. The attack utilized a program called MeshAgent, which was secretly installed on players' computers, allowing the hacker to capture screens and gain unfair access to opponents' cards. Professional player Alex discovered the malware after noticing suspicious activity while using his AI agent. Investigations revealed that hundreds of players were affected, with one player, known as OxOO, suspected of cheating in multiple sessions. The attack has raised concerns about the security of online poker platforms, with varying responses from different sites. Some sites banned the suspected cheater before the malware was publicly uncovered, while others failed to act despite player complaints. The incident highlights ongoing vulnerabilities in online gaming environments.
Malware · 2 sources · score 64 · MeshAgent
Japan Airlines Data Breach Exposes 92,000 Customer Records
Japan Airlines (JAL) reported a data breach at Amadeus’s Passenger Service System, affecting 92,000 customers. The breach, which occurred between August 10, 2023, and September 23, 2026, exposed reservation codes, names, and flight details. For approximately 2,000 customers, sensitive information such as email addresses, phone numbers, passport numbers, and frequent flyer numbers was also compromised. JAL confirmed that credit card numbers and passwords were not affected and stated there is no evidence of misuse of the data. Amadeus, the IT firm responsible for the system, had previously announced a vulnerability in its travel booking display environment on October 1, 2026. Other airlines, including All Nippon Airways, Asiana Airlines, and Korean Air, are also reported to be affected by this incident. JAL is reaching out to affected customers to provide support and guidance. The airline assured that flight operations remain unaffected.
Breach · 2 sources · score 52
42 Million Civic Records Exposed in CitySourced Data Leak
A cybersecurity researcher discovered an unprotected database linked to CitySourced, revealing 42 million documents and 450,000 JSON files containing personally identifiable information (PII) of residents across North America and the Caribbean. The exposed data included names, addresses, email addresses, and phone numbers of individuals who reported civic issues from 2016 to 2026. The database lacked password protection and encryption, raising significant privacy concerns. After the discovery, the database was restricted from public access, and Granicus, the parent company of CitySourced, stated it was investigating the incident. Granicus claimed that the issue had been resolved in August 2026 and that no passwords were stored in the repository. However, it remains unclear how long the database was publicly accessible or if it was accessed by unauthorized parties before being secured.
Breach · 2 sources · score 52
New on leak sites
29 victims listed on ransomware leak sites by 11 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-109618, CVE-2026-101767, CVE-2026-109619, CVE-2026-41709, CVE-2026-46300
- Vulnerabilities: Path Traversal, Fragnesia, XSS, Authenticated Local File Inclusion, Authenticated Privilege Escalation
- Campaigns: 2026 Safe Korea Exercise For The Financial Sector, Anthropic Impersonation Campaign
- Malware: Aisuru, Brickstorm, Coruna
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.