An AI model wrote an exploit for a critical Linux kernel flaw, CVE-2026-98432 rated CVSS 9.8, that lets attackers run root commands on Linux servers with a multipath TCP listener. Attackers are actively exploiting a maximum-severity flaw in Siemens SIMATIC IoT2050 Advanced devices running Node-RED to run malicious code. Attackers escalated to root on Ivanti Connect Secure 22.8R2.4, and the October 13 fixes didn't stop it. WorkOS reported unauthorized access to an internal sales app that exposed customer contact info and business conversation records. And the new Volta infostealer uses AI to rank its Windows victims by financial worth, then sends stolen cookies and cards out over Telegram.

The hot sheet: https://blog.thehotdrop.live/blog/the-hot-drop-for-11-03-2026

0:00 Linux kernel use-after-free flaw and patch versions
1:10 Active exploitation of Siemens IoT2050 devices
2:12 Ivanti Connect Secure privilege escalation
3:10 WorkOS investigates access to internal sales app
3:39 Volta infostealer uses AI to assess victims

#Cybersecurity #Linux #Siemens #Ivanti #Infostealer

An attacker abused ConnectWise credentials to access 162 Microsoft 365 tenants, and in one tenant a ConnectWise cloud app added itself to the Global Administrator role. BeyondTrust Remote Support 2.6.2.3 and earlier has a flaw that lets an unauthenticated attacker write files and run code. LiteLLM version 1.107.0 spread credential-stealing malware, and tens of thousands of users lost their API keys. DebugBear code drained 710 Polymarket wallets of $2.7 million in a supply chain attack. A TeamViewer flaw, rated CVSS 8.8, lets a compromised machine hijack the support technician's computer the moment a session opens. And French supermarket refrigeration controllers were compromised overnight, forcing staff to clear damaged stock.

The hot sheet: https://blog.thehotdrop.live/blog/the-hot-drop-for-11-02-2026

0:00 ConnectWise access reaches 162 Microsoft 365 tenants
2:07 BeyondTrust flaw enables unauthenticated code execution
3:13 LiteLLM supply-chain malware steals API credentials
4:08 DebugBear code linked to Polymarket wallet theft
4:47 TeamViewer session flaw threatens support technicians
5:41 Compromised refrigeration controllers affect French stores

#Cybersecurity #ConnectWise #Microsoft365 #SupplyChain #TeamViewer

Anthropic's unreleased Claude model chained zero-days into working exploits, including a CVSS 9.8 Linux kernel flaw that leaves unpatched servers open to root access without any user interaction. A group calling itself the Department of Peace leaked records on more than 41,000 DHS employees, copied from the agency's Okta single sign-on system. Polymarket traders lost funds to malicious code served from Debug Bear. A Volt Typhoon-linked actor has exploited a Cisco SD-WAN zero-day since 2023. The FBI arrested a third ShinyHunters suspect as the group claims more than $70 million in extortion. And Binance lost $6.3 billion to Lazarus subgroup TraderTraitor, the largest crypto heist in history.

The hot sheet: https://blog.thehotdrop.live/blog/the-hot-drop-for-10-30-2026

0:00 Claude Model Chains Zero-Days Into Root Exploits
1:52 41,000 DHS Records Leaked From Okta
4:24 Polymarket Traders Drained by Debug Bear Script
6:01 Volt Typhoon-Linked Cisco SD-WAN Zero-Day
6:32 Third ShinyHunters Arrest, $70M Extortion Claim
7:35 Lazarus Hits Binance for $6.3 Billion

#Cybersecurity #ZeroDay #Anthropic #DataBreach #Binance

Storm-0940 used compromised ConnectWise credentials to attempt sign-ins against more than 2,250 Microsoft 365 tenants, with more than 300 of those sign-ins appearing to succeed. Capcom confirms a breach of 11.7 million Capcom ID records. Volt Typhoon is linked to a CVSS 10 Cisco Catalyst SD-WAN zero-day exploited since 2023. An Anthropic model turned zero-days into working exploits, including a 9.8 zero-click Linux kernel root exploit. Cl0p targets Oracle E-Business Suite with a new CVSS 10 flaw as proof-of-concept exploits circulate. And a third ShinyHunters arrest charges a Canadian ransomware negotiator and former cybersecurity executive.

The hot sheet: https://blog.thehotdrop.live/blog/the-hot-drop-for-10-29-2026

0:00 Storm-0940 Breaches M365 via ConnectWise Creds
2:21 Capcom Breach Exposes 11.7M Records
4:09 Volt Typhoon Tied to Cisco SD-WAN Zero-Day
4:57 Anthropic Model Builds Exploit Chains
5:38 Cl0p Targets Oracle EBS With CVSS 10 Flaw
6:12 Third ShinyHunters Arrest

#Cybersecurity #Microsoft365 #VoltTyphoon #Ransomware #ZeroDay

Clop ransomware breached 100 organizations, including Harvard and the Washington Post, through a 9.8 Oracle E-Business Suite zero-day, and a 9.5 TianoCore EDK2 flaw lets attackers run code before the OS or Secure Boot loads on PXE-booting servers. Chrome 156 fixes 62 critical flaws found by Anthropic's Claude model, which also built a 9.8 zero-click Linux root exploit. Plus CISA sets a November 10th deadline for the 9.2 Node-to-Shell flaw, JFrog finds GitHub malware planting hooks in AI coding assistants, and Volt Typhoon rebuilds its covert router networks in under two minutes.

The hot sheet: https://blog.thehotdrop.live/blog/the-hot-drop-for-10-28-2026

0:00 Clop Breaches 100 Orgs via Oracle EBS Zero-Day
1:02 Disable PXE Boot: EDK2 Pre-Boot Flaw
3:29 Chrome 156 Patches 62 AI-Found Flaws
4:42 CISA Sets Node-to-Shell Deadline
5:22 JFrog: AI Tool Malware in GitHub
6:25 Volt Typhoon Rebuilds Covert Networks

#Cybersecurity #Ransomware #Chrome #CISA #VoltTyphoon

Ukraine's CERT-UA warns attackers are remotely hijacking Dahua cameras through the Easy4IP cloud feature using device serial numbers, and Sansec reports 953 Magento stores hit by a long-running skimmer campaign rated 9.1. Microsoft and Cloudflare shipped emergency patches for a 9.2 Brotli decoder flaw, and PHP patched 9.8 remote code execution bugs reaching back to version 5.4. Plus CISA adds a 9.3 cPanel authentication bypass to its KEV catalog, and the FBI arrests a third ShinyHunters member as the group turns to AI to automate attacks.

The hot sheet: https://blog.thehotdrop.live/blog/the-hot-drop-for-10-27-2026

0:00 Dahua Cameras Hijacked via Easy4IP
2:12 953 Magento Stores Skimmed
4:07 Brotli Decoder Flaw: Emergency Patches
6:05 PHP Patches 9.8 RCE Flaws
6:42 cPanel Auth Bypass Hits CISA KEV
7:38 ShinyHunters Turn to AI

#Cybersecurity #Magento #PHP #cPanel #ShinyHunters

Node-to-Shell, a CVSS 9.2 Brotli decoder flaw, lets unauthenticated attackers run code remotely, and Wiz says 91% of cloud environments have vulnerable resources. Microsoft Authenticator for Android could hand a malicious app your work account tokens, and Eye Security disabled the abandoned Time4Popcorn updater on two million devices to close a 9.8 remote code execution flaw. Plus emergency PHP patches reaching back to PHP 5.4, APT41's BlackX bootkit bypassing Secure Boot on diplomatic systems, and a compromised LiteLLM 1.107.0 release that steals cloud credentials.

The hot sheet: https://blog.thehotdrop.live/blog/the-hot-drop-for-10-26-2026

0:00 Brotli Decoder Flaw: Update Now
1:59 Authenticator Hands Out Your Tokens
3:52 Popcorn Updater Gets Sinkholed
5:28 PHP: The Flaw That Keeps on Giving
6:19 APT41's BlackX Bypasses Secure Boot
7:19 LiteLLM Compromised: Rotate Everything

#Cybersecurity #NodeJS #PHP #SupplyChain #ZeroDay

eMudhra revoked eight CA certificates after a key generation flaw dropped entropy to single digits, and Mozilla, Google, Apple and Microsoft blocked them within hours. AI agents breached more than 100 organizations through unprotected panels, and a CVSS 10 Magento flaw puts Adobe Commerce stores at risk of full server compromise. Plus stolen Active Directory databases, the $5,000 BlackLotus bootkit and VoidLink cloud malware, PHP-to-Shell and a Cisco Expressway root bug at CVSS 9.8, and Node-to-Shell, where one compressed packet owns a Node.js server.

The hot sheet: https://blog.thehotdrop.live/blog/the-hot-drop-for-10-23-2026

0:00 Eight Busted CA Certs Get the Boot
2:14 AI Agents Raid Unprotected Panels, Magento Scores a 10
4:22 Black Lotus Rootkit and VoidLink: Stolen AD, $5K Bootkit
6:44 PHP-to-Shell: Pre-Auth RCE Before Your App Wakes Up
7:57 Cisco Expressway: Root Access, No Login Required
8:36 Node-to-Shell: One Compressed Packet, One Owned Server

#Cybersecurity #Magento #PHP #NodeJS #ZeroDay