Security incidents
Breach and zero-day write-ups, each mapped to the certifications that cover the skills involved.
All incident articles are published and available to read. Reviewed entries have had their sources, event classification and impact checked. Awaiting-review entries have not been independently reviewed.
311 incidents
Polymarket Prediction Market Script Breach
Polymarket, a prediction market platform, temporarily suspended trading after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, resulting in approximately $2.5 million in assets being traced to a suspected attacker wallet.
Severity: Awaiting reviewIncident type: Supply chainIncident date: Reading time: 6 min readRelated certifications: CISSPCCSPGSECBullhorn Staffing Platform Cyberattack Incident
Bullhorn, a staffing software company, took its platform offline to contain a cyberattack that caused a system-wide outage. The company is working to restore services after a thorough security review with CrowdStrike specialists. It's unclear if customer data was exfiltrated.
Severity: Awaiting reviewIncident type: Infrastructure outageIncident date: Reading time: 5 min readRelated certifications: CISSPCCSPOSCPCAPCOM ID Customer Data Breach
Capcom disclosed unauthorized access to CAPCOM ID customer records, with some accounts also subject to unauthorized password changes.
Severity: HighIncident type: Data breachIncident date: Reading time: 2 min readRelated certifications: CISSPCySA+Candiru Spyware Delivered via Targeted Ads
Researchers at Citizen Lab discovered a zero-click attack that delivered Candiru spyware to devices via targeted online advertisements. The attack, called AdFection, was linked to Israeli firm Discovere-Tech and affected at least 45 devices between 2024 and 2025.
Severity: Awaiting reviewIncident type: Zero day, Security featureIncident date: Reading time: 6 min readRelated certifications: CEHCISSPOSCPand 1 moreeMudhra Intermediate CA Key Compromise
Recoverable eMudhra intermediate CA private keys prompted browser blocking, certificate revocation and a wider TLS certificate transition.
Severity: HighIncident type: Certificate key compromiseIncident date: Reading time: 3 min readRelated certifications: CISSPCSSLPPlex2Shell Exploitation of Unpatched Plex Servers
Plex confirmed exploitation of a patched Media Server vulnerability chain to run miners and proxy software on exposed, outdated servers.
Severity: HighIncident type: Vulnerability exploitationIncident date: Reading time: 3 min readRelated certifications: CISSPCySA+International CSAM Crackdown Operation
Law enforcement authorities from 17 countries in Latin America and Europe arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM) through online messaging groups.
Severity: Awaiting reviewIncident type: Security newsIncident date: Reading time: 7 min readRelated certifications: CEHCISSPOSCPand 1 moreArch Linux AUR Malware Incident
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru, and delivered malware with root privileges.
Severity: Awaiting reviewIncident type: Supply chainIncident date: Reading time: 9 min readRelated certifications: CEHCISSP-ACISSPand 5 moreCritical Magento BlockStrap Flaw
A critical vulnerability (CVE-2026-103849) in Magento and Adobe Commerce allows hackers to execute arbitrary PHP code on store servers. The flaw, dubbed BlockStrap, impacts September versions of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3.
Severity: Awaiting reviewIncident type: Zero dayIncident date: Reading time: 8 min readRelated certifications: CISSPOSCPCISMand 9 moreCriminal IP Introduces AITEM for Attack Surface Management
Criminal IP introduces AITEM (AI-Powered Threat Exposure Management) as the next evolution of Attack Surface Management, expanding visibility beyond external asset inventory and connecting exposure discovery with investigation, threat context, prioritization, and response.
Severity: Awaiting reviewIncident type: Security featureIncident date: Reading time: 8 min readRelated certifications: CISSPCCSPCAPand 14 moreGoogle Ads Abuse for Claude ClickFix Attacks
Hackers are abusing legitimate Bing search-result redirects in Google search ads to direct users to fake Claude installers that deliver ClickFix attacks.
Severity: Awaiting reviewIncident type: Security featureIncident date: Reading time: 7 min readRelated certifications: CEHCISSPCCand 2 moreASOS Data Breach Incident
ASOS, a UK-based online fashion retailer, suffered a data breach due to a social engineering attack, where hackers stole an employee's login credentials and accessed customer information on third-party platforms.
Severity: Awaiting reviewIncident type: Data breachIncident date: Reading time: 7 min readRelated certifications: CEHCISSPOSCPand 1 moreSouth Korea Bank Breaches
South Korea's Financial Services Commission (FSC) is investigating a series of cyberattacks targeting financial institutions, including Shinhan Bank and Kookmin Bank, which affected over 144,000 customers. The breaches are suspected to be AI-powered attacks.
Severity: Awaiting reviewIncident type: Data breachIncident date: Reading time: 5 min readRelated certifications: CEHCISSPOSCPand 5 moreMetaMask Infrastructure Security Incident
MetaMask disclosed an ongoing infrastructure security incident affecting some of its infrastructure, with no immediate threat to MetaMask wallets. The company is working to address the issue internally, with help from external partners and security advisors.
Severity: Awaiting reviewIncident type: Infrastructure outageIncident date: Reading time: 9 min readRelated certifications: CEHCISSPOSCPand 13 moreMikroTik RouterOS Pre-Authentication RCE Flaw
CISA warns of a critical pre-authentication remote code execution (RCE) flaw in MikroTik RouterOS that could lead to code execution with root privileges or denial of service.
Severity: Awaiting reviewIncident type: Zero dayIncident date: Reading time: 8 min readRelated certifications: CEHCISSPCCSPand 18 moreCitrix NetScaler Zero-Day Exploitation
The Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. government agencies to patch exploited Citrix NetScaler vulnerabilities. Citrix confirmed two NetScaler RCE zero-days exploited in attacks.
Severity: Awaiting reviewIncident type: Zero dayIncident date: Reading time: 8 min readRelated certifications: CISSPCCSPCAPand 6 moreSupabase Database Misconfiguration Exposures
Researchers found over 16,000 misconfigured Supabase databases exposing personally identifiable information, passwords, and authentication tokens.
Severity: Awaiting reviewIncident type: Data breachIncident date: Reading time: 8 min readRelated certifications: CEHCISSPOSCPand 12 moreRogue External MFA Provider Credential Theft
Security researchers discovered a technique called TrustSink that allows hackers with privileged access to register a rogue external MFA provider, stealing users' passwords during legitimate login attempts. The attack relies on Microsoft Entra's external authentication model and requires an attacker to control a highly privileged Entra account.
Severity: Awaiting reviewIncident type: Security featureIncident date: Reading time: 6 min readRelated certifications: CISSPCCOSCPand 1 moreRapuncel Infostealer Malware Campaign
An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms and push a previously undocumented information stealer called Rapuncel, which steals data from infected devices and disables antivirus software.
Severity: Awaiting reviewIncident type: Supply chain, Zero dayIncident date: Reading time: 8 min readRelated certifications: CEHCISSPCCSPand 9 moreBigCommerce Data Breach via Ribon Apps
BigCommerce has alerted multiple merchants to data breaches after attackers compromised credentials for third-party Ribon applications and used them to inject malicious scripts into online stores.
Severity: Awaiting reviewIncident type: Data breachIncident date: Reading time: 7 min readRelated certifications: CEHCISSP-ACISSPand 27 moreCenterPoint Energy Data Breach
CenterPoint Energy confirmed a data breach where an attacker stole 7.49 million customer records containing personal information. The breach occurred through CenterPoint's public API, which lacked security measures. The company is investigating and notifying affected customers.
Severity: Awaiting reviewIncident type: Data breachIncident date: Reading time: 8 min readRelated certifications: CISSP-ACISSPCCSPand 6 moreShinyHunters Hacker Detained in Jordan
A suspected ShinyHunters hacking group member, known online as 'Rey', has been detained in Jordan and is cooperating with the FBI to help locate other members of the extortion group.
Severity: Awaiting reviewIncident type: Data breachIncident date: Reading time: 5 min readRelated certifications: CEHCISSPOSCPand 2 moreGitLab Path Traversal Vulnerability Exploitation
Hackers are exploiting a maximum-severity GitLab vulnerability to read credentials, secrets, and other sensitive information from vulnerable servers. The vulnerability, tracked as CVE-2026-85706, was patched by GitLab in versions 19.3.2, 19.2.6, and 19.1.
Severity: Awaiting reviewIncident type: Zero dayIncident date: Reading time: 8 min readRelated certifications: CEHCISSPCCand 14 moreN-able N-central Remote Code Execution Vulnerability
N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw affecting its N-central remote monitoring and management (RMM) platform. The vulnerability allows threat actors to execute malicious code on unpatched N-central instances exposed online.
Severity: Awaiting reviewIncident type: Zero dayIncident date: Reading time: 6 min readRelated certifications: CISSPOSCPCISM