Threat Pulse
No critical signals in the last 12 hours.
bazsec.news
Home
SOC Threat Dashboard
Subscribe
Personal wireGet dispatches on your cadence — instant, hourly, daily, or weekly.
Telegram LinkedIn ShareToday's briefingArchiveMonthly reportSubscribe
“
Quote of the dayMonday 2 November
“There is no patch for human stupidity.”
— Kevin Mitnick
LeadOT/ICS & Critical National Infrastructure

From Rules to AI and Back

Fraud prevention combines rules, AI and behavioral analytics to stop scams, reduce false declines and keep automated decisions explainable through human review.

HackRead··OT/ICS & Critical National Infrastructure·Notable
Read dispatch →

Top Signals

Live

    CVE watch

    Ranked: known exploited → likely exploited → severe → rest
    • P4CVE-2026-101767

      Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

      The Hacker News
    Build a threat hunt →Full monthly CVE roll-up →

    The Wire

    Chronological · latest dispatches

    From Rules to AI and Back

    Fraud prevention combines rules, AI and behavioral analytics to stop scams, reduce false declines and keep automated decisions explainable through human review.

    HackRead··OT/ICS & Critical National Infrastructure·Notable
    Breaking

    Researchers uncover Volt Typhoon’s covert, ephemeral network

    Volt Typhoon, a China-government backed hacking group that has infiltrated America’s critical infrastructure networks for years, has consistently built and dismantled ephemeral malicious infrastructure to burrow into hundreds of sensitive systems undetected, Lumen Technologies’ Black Lotus Labs said in a Wednesday report. The covert access operation that researchers call “Silent Train” isn’t a standalone network, but rather a series of compromised small office home office (SOHO) routers, internet of things (IoT) devices and enterprise infrastructure that Volt Typhoon has rapidly rotated through since late 2023. The Chinese threat group has used this chain of short-lived compromised infrastructure to exploit additional vulnerabilities, including zero-days, in network edge devices and gain d

    CyberScoop··Vulnerabilities & CVEs·Critical

    European digital rights nonprofit noyb sues Scale AI for ‘invasive’ worker surveillance

    Noyb alleges the platform in some cases records freelancers’ mouse clicks and keystrokes every few seconds and claims the collected information can be used to generate video documenting freelancers’ entire workday.

    The Record··AI & Emerging Tech Security·Notable

    Unwrapping Retail Peak Season Cyber Threats

    Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust. The post Unwrapping Retail Peak Season Cyber Threats appeared first on Unit 42 .

    Palo Alto Unit 42··Ransomware·Notable

    38,628 Crypto Orders. 10,139 IPs. What Wagyu’s Alleged Leak Means for Monero Privacy.

    HR HUDSON ROCK / INFOSTEALERS.COM Threat Intelligence • October 28, 2026 Research / Cryptocurrency privacy 38,628 Crypto Orders. 10,139 IPs. What Wagyu’s Alleged Leak Means for Monero Privacy. Monero’s cryptography was not broken. But newly examined order records show how a privacy-focused swap service can retain the exact connections its customers hoped to conceal. Hudson Rock Research Wagyu.xyz 11-minute read Original dataset analysis Can Monero users be traced through a hacked exchange? Not by magically decrypting Monero’s blockchain. But potentially by reading what a swap service knows before coins ever enter the privacy network — and what it records when those coins leave. That is the central finding of Hudson Rock’s review of purported Wagyu.xyz transaction data supplied alongside a

    Infostealers··Data Breaches·Notable
    Breaking

    GitHub’s npm package firewall can block brand-new versions before they install

    GitHub announced a package firewall that checks npm packages against an enterprise’s policy before they install. It blocks known malware, critical vulnerabilities, and brand-new versions, and any developer can turn it on by pointing npm at the firewall. The checks run before a package reaches a laptop, a build, or a coding agent. GitHub says AI agents are helping developers build more software, faster, and the firewall is one of four security additions aimed at … More → The post GitHub’s npm package firewall can block brand-new versions before they install appeared first on Help Net Security .

    Help Net Security··Vulnerabilities & CVEs·Critical
    Breaking

    OffSec Launches Free PHP2Shell Lab Following Critical Vulnerability Discovery

    New York, United States, 28th October 2026, CyberNewswire

    HackRead··Vulnerabilities & CVEs·Critical

    Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.

    Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores get the features from December 1, but only on

    The Hacker News··Malware & Botnets·Notable

    Moldova investigates possible foreign involvement in major government cyberattack

    Prime Minister Vasile Tofan said the incident may be part of a broader campaign targeting both citizens' personal data and government digital infrastructure, according to local media reports.

    The Record··Threat Intelligence & APTs·Notable

    Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win

    A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. Microsoft fixed the Edge bugs the day after the contest,

    The Hacker News··Cloud & Infrastructure·Notable

    A threat actor on a dark-web source claims to have leaked data from Hauhinco. Unverified.

    Unverified claim. Monitored and summarised without links or data. Source: Dark-web monitoring (link withheld).

    Unverified claimDark-web monitoring (link withheld)··Cybercrime & Dark Web·Notable

    A threat actor on a dark-web source claims to have leaked data from Marbre Design. Unverified.

    Unverified claim. Monitored and summarised without links or data. Source: Dark-web monitoring (link withheld).

    Unverified claimDark-web monitoring (link withheld)··Cybercrime & Dark Web·Notable

    Yet Another ClickFix Campaign, (Wed, Oct 28th)

    Introduction On Wednesday, 2026-10-28, I ran across a ClickFix campaign I haven't seen before. Like several other ClickFix campaigns, this one uses a fake Cloudflare verification page. It targets both macOS and Windows. I don't yet have a name for this specific activity, but this diary shares some screenshots and indicators. Unfortunately, I was unable to get the macOS or Windows malware distributed through this particular ClickFix campaign. Screenshots of the Activity Shown above: Fake verification page with ClickFix instructions when viewed on a Windows host. When I ran the command on a Windows host, the server hosting the malware responded with a 403 Forbidden error, and I was unable to proceed any further. Shown above: Fake verification page with ClickFix instructions when viewed on a

    SANS ISC··Malware & Botnets·Notable

    A threat actor on a dark-web source claims to have leaked data from RTO REVISION TECNICA OBLIGATORIA. Unverified.

    Unverified claim (Argentina). Monitored and summarised without links or data. Source: Dark-web monitoring (link withheld).

    Unverified claimDark-web monitoring (link withheld)··Cybercrime & Dark Web·Notable

    PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

    Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root

    The Hacker News··Data Breaches·Notable

    Attacker Relentlessly Scans for Credentials by Impersonating AI Bots

    The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.

    Dark Reading··Data Breaches·Notable
    Baz Security News

    An editorial aggregator of the world's foremost cybersecurity reporting and research.

    Sources

    News: The Hacker News · BleepingComputer · Krebs · The Record · SecurityWeek · Dark Reading · Help Net Security · Infosecurity · CyberScoop · DataBreaches.net · HackRead · Cybernews. Government: CISA · NCSC UK · SANS ISC. Vendor research: Unit 42 · Project Zero · Talos · Microsoft · SOCRadar. Dark-web monitoring: forum and leak-site claims, summarised only — links withheld.

    Methodology

    Headlines and short summaries from news, government and vendor-research sources are aggregated with attribution and outbound links. No article bodies are republished. Dark-web claims are summarised without links or data and labelled unverified. How we handle dark-web claims

    © 2026 Baz Security News · All source rights reserved to their respective publishers.
    Privacy & cookiesTelegramLinkedIn