Maersk Breached by Ransomware, Microsoft Issues Record Patch for Outlook Zero-Day

Maersk Breach: WhiteArmor Ransomware Claims 100GB Data Theft

Global shipping firm Maersk has confirmed a data breach affecting a legacy IT system from a previous acquisition. The WhiteArmor ransomware group claims to have stolen 100GB of sensitive logistics data, including plaintext passwords and customer records, and is demanding a $5 million ransom. Maersk states the incident is isolated and does not anticipate disruption to customer operations, though the attackers have published detailed lists of allegedly stolen data to apply pressure.

ransomwaredata breachlogisticssupply chainM&A +1 more

Maersk Confirms Breach; WhiteArmor Ransomware Demands $5M Ransom

Massive GitHub Supply Chain Attack Injects 'wfx' Stealer into Repos

CRITICAL

GitHub Supply Chain Attack Steals CI/CD Secrets with 'wfx' Malware

A large-scale software supply chain attack is actively targeting the GitHub ecosystem. Attackers are using compromised developer accounts to inject a sophisticated information stealer, dubbed 'wfx', into tens of thousands of code repositories. The malware is designed to run within GitHub Actions to exfiltrate sensitive CI/CD secrets, including repository secrets, cloud credentials, and API keys, posing a severe threat to software development and deployment pipelines.

supply chainGitHubCI/CDwfxinfostealer +2 more

Massive GitHub Supply Chain Attack Injects 'wfx' Stealer into Repos

Microsoft Reveals 'Lazarus,' a Stealthy AI Supply Chain Attack

Microsoft's 'Lazarus' Attack Can Backdoor AI Models by Editing Neurons

Microsoft researchers have disclosed 'Lazarus,' a novel and highly stealthy AI supply-chain attack technique. The method allows an attacker to surgically backdoor open-weight large language models (LLMs) by modifying fewer than ten dormant neurons. This nearly undetectable edit, which requires no model retraining, can be activated by a secret trigger in a prompt, forcing the AI agent to execute arbitrary commands using its assigned privileges. The research highlights a critical new threat vector for the rapidly growing field of agentic AI.

AILLMsupply chainbackdoorMicrosoft Research +2 more

6 min read

Microsoft Reveals 'Lazarus,' a Stealthy AI Supply Chain Attack

Falcon C2 Framework Compromises Browsers to Target Governments

Falcon C2: Browser-Based Framework Targets Governments

Unit 42 has identified a browser-based command and control (C2) framework named Falcon (also known as XG or Xiàng Gē). The threat actor leverages this framework to compromise government webmail portals and applications by injecting malicious JavaScript. Operating entirely within the browser, Falcon can sideload malicious Chrome extensions and exfiltrate sensitive information. The campaign, observed between March and May 2026, targeted government ministries in the Middle East and Southeast Asia. The framework also serves as a delivery mechanism for a secondary implant called Antino, which uses Microsoft OneDrive for C2 communications. Analysis reveals a high-confidence link between Falcon and the PeckBirdy framework previously reported by Trend Micro.

Falcon C2Browser-based C2JavaScript MalwareGovernment TargetingCyber Espionage +5 more

24 min read

Falcon C2 Framework Compromises Browsers to Target Governments

Updated Articles (5)

Vanderbilt University Hit by BYOD Ransomware; Attackers Claim Massive Data Theft

BYOD Ransomware Gang Claims Attack on Vanderbilt University

New reports clarify Vanderbilt University confirmed the ransomware incident on November 11, 2026, with the attack also stated to have begun on this date, differing from earlier reports of November 9. Additional cyber observables for hunting include `adfind.exe` and `bloodhound.exe` for Active Directory reconnaissance, `*.byod` file extensions, and monitoring for internal RDP connections. The university continues to work on containment and investigation, with D3FEND techniques like Resource Access Pattern Analysis and Data Backup highlighted for detection and mitigation.

November 11, 2026

RansomwareBYODData BreachHigher EducationVanderbilt

Vanderbilt University Hit by BYOD Ransomware; Attackers Claim Massive Data Theft

'Black October' Attacks Steal API Keys from Nine AI Dev Platforms

Black October: Coordinated Attacks on AI Developer Platforms

New details have emerged regarding the breach of the Railway cloud hosting platform, a victim of the 'Black October' campaign. Attackers exploited a chain of two vulnerabilities to access customer environment variables, specifically targeting AI service API keys. This resulted in approximately $740,000 in fraudulent AI service charges, a substantial increase from the previously reported overall campaign impact. Additionally, the breach exposed GitHub OAuth tokens for 1,852 users. Railway has remediated the vulnerabilities and committed to covering the fraudulent costs, highlighting the severe financial liabilities associated with compromised AI API keys.

November 1, 2026

Black OctoberLLMJackingAICloud SecurityAPI Security +3 more

'Black October' Attacks Steal API Keys from Nine AI Dev Platforms

Email Service Breach Leaks 77 Million Addresses, Sparks Phishing Wave

Arara Message Breach Exposes 77 Million Email Addresses

Video game company SEGA announced on November 9, 2026, that 2,196,044 customer email addresses were compromised due to the data breach at its third-party newsletter provider, Arara Co., Ltd. This confirms SEGA as one of the 380 corporate clients affected by the larger Arara incident that exposed 77 million emails. Attackers leveraged Arara's compromised infrastructure to send highly convincing phishing emails, posing a significant risk to SEGA's affected customers. The incident highlights the ongoing impact of the Arara breach on its clients.

November 2, 2026

Data BreachEmailPhishingSupply Chain AttackJapan

4 min read

Email Service Breach Leaks 77 Million Addresses, Sparks Phishing Wave

Ten Philippine Government Agencies Report Data Breaches

Philippines Confirms Data Breaches Across 10 Government Agencies

The National Privacy Commission (NPC) has confirmed that the ongoing data breach investigation now includes several state universities, in addition to the ten government agencies previously reported. This expansion significantly increases the scope of the incident. The compromised data is reported to be extensive, including personally identifiable information (PII), government ID numbers, taxpayer information, HR and payroll records, and student files. The breaches were initially flagged by the cybersecurity monitoring group Deep Web Konek. New technical analysis points to potential exploitation of public-facing applications or large-scale phishing campaigns.

November 10, 2026

data breachphilippinesgovernmentNPCcybersecurity

4 min read

Ten Philippine Government Agencies Report Data Breaches

Microsoft Patches Actively Exploited Outlook Zero-Day in Massive Update

Microsoft Patches Outlook Zero-Day CVE-2026-124194 for NTLM Hash Theft

The November 2026 Patch Tuesday update now includes details on a critical Remote Code Execution (RCE) vulnerability, CVE-2026-116928, in the Windows Search Component. This flaw, rated CVSS 9.8, allows an attacker to achieve code execution on on-premise Microsoft Exchange Servers without any user interaction by sending a specially crafted email. This significantly broadens the impact and severity of the patch cycle beyond the previously reported Outlook zero-day. The update also confirms a total of 1,235 CVEs were patched, including 66 critical vulnerabilities.

November 11, 2026