Cybersecurity news: the major attacks, breaches and flaws

On November 9, Google released Chrome 157.0.8103.50/.51, which fixes nine flaws, including one in XML processing (CVE-2026-125350) that attackers are already exploiting. Reported on November 6, it is Chrome's eighth zero-day of 2026, following the one in September.

Crédit Mutuel Arkéa, the parent company of Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and Fortuneo, announced on November 4 a cyberattack that enabled fraudulent transfers from its own accounts to other banks. The press puts the figure at €118 million; the bank acknowledges that order of magnitude without confirming an exact amount. Some transactions were delayed; according to the bank, customer funds are not affected.

Google announced on November 2 that, with partners including the Japanese police, it had disrupted the XCPE botnet, a backdoor installed on more than 1.3 million TV boxes and other Android devices. According to Google, the Chinese manufacturer Videostrong ran it and sold access to criminals for ad fraud and proxy networks; the company is now excluded from certified Android devices. The malware remains on infected boxes.

On October 29, attackers drained wallets at Binance, the largest cryptocurrency exchange, of about $6.3 billion, four times the record Bybit theft of 2025. Binance first pointed to an engineer's compromised laptop, covered the losses from its reserves and reopened deposits and withdrawals on November 1. The FBI attributes the attack to the North Korean group TraderTraitor.

On October 29, the CNIL, France's data protection authority, published two penalties against Fnac: €6 million for Fnac Darty Participations et Services and €1 million for Fnac Direct. The retailer's mobile app placed trackers without user consent to follow their browsing, recommend products and train its recommendation algorithm.

On October 28, WordPress released version 7.1.4, along with patches for every branch back to 4.7. The most serious of the 22 flaws lets an attacker with no account run code on the server during the few seconds of a WordPress core update. Wordfence saw exploitation attempts as soon as the patch came out and warns that installing the update itself opens this window one last time.

Japanese video game publisher Capcom said on October 22 that unauthorized access to its CAPCOM ID account service exposed 11,774,247 records: email addresses, login dates and counts, and IP addresses. Payment cards are not affected; 196 accounts had their passwords changed by the attackers and have been reset.

On October 21, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws, nicknamed “PHP2Shell,” that let an attacker run code on the server without an account. Every installation that serves web pages is affected, which includes WordPress, PrestaShop, Drupal and Magento sites. Several public sites were taken offline as a precaution; as of October 28, Wordfence knew of no WordPress site compromised this way.

Over the weekend of October 17 and 18, the developer of the UpdraftPlus backup plugin, used on more than 4 million sites, discovered that an attacker had accessed its customer database, including the connection keys for the hosted UpdraftCentral service. With these keys, the attacker installs backdoored plugins and administrator accounts on the connected sites. Versions 1.26.13 and 2.26.13 delete the old keys but do not remove what has already been installed.

Overnight from October 11 to 12, attackers took control of the refrigeration control systems of hundreds of stores: at least 300 Intermarché and Netto stores, more than 100 Coopérative U, 80 Carrefour, plus Monoprix and E.Leclerc stores. Some display cases reached 50°C, and fresh and frozen products had to be thrown out; other European countries were also hit. On November 9, France attributed the attack to cyber units of Iran's Islamic Revolutionary Guard Corps.

On October 9, the FBI director announced the arrest of another alleged accomplice of ShinyHunters, the extortion group that in late September claimed the theft of FBI employee data through an Oracle PeopleSoft flaw. In late September, an alleged member known as “Rey” was arrested in Jordan, which confirmed the arrest. ShinyHunters is linked to data thefts from many Salesforce customers and to phone attacks targeting corporate access.

On October 6, customers of the fashion retailer ASOS received an unauthorized in-app notification pointing to a Telegram channel. ASOS confirms that customer names and contact details may have been accessed, but not payment cards or passwords, according to the company. The number of affected customers has not been published; the UK's NCSC and the data protection authority are monitoring the incident.

Denmark's Central Person Register (CPR) announced on October 5 that in September attackers hijacked a private company's legitimate access to extract names, addresses and ID numbers. About 8.8 million people are affected, or 80% of the registry, which includes people who have died or moved abroad. The Danish data protection authority says the numbers were found through automated guessing; the company has been cut off from the registry.

On September 30, police from nine countries, coordinated by Europol and Eurojust, seized the KillSec group's extortion site and five servers holding at least 110 terabytes of stolen data. Three people were arrested and eight searches carried out in Spain, Greece, Romania and the United Kingdom. The alleged main operator is 16 years old; the group is linked to nearly 1,000 attacks worldwide.

On September 27, Citrix released patches for eight flaws in its NetScaler ADC and Gateway remote access appliances, including two critical flaws (CVE-2026-88771 and CVE-2026-88772) already exploited before they were disclosed. CISA added them to its catalog of exploited vulnerabilities the same day, and the UK's NCSC urged organizations to patch without delay. After attack code was published, attempts spread to every exposed device.

On September 25, Patchstack detailed a flaw in versions 4.3.0 and 4.3.1 of Elementor, the WordPress page builder: if a logged-in administrator simply opens a malicious link, an administrator account is created for the attacker. About 2 million sites were running these versions. Elementor released version 4.3.2 on September 24; no attacks had been reported at the time of disclosure.

On September 22, WordPress released version 7.1.2, which fixes a critical flaw (CVE-2026-87902, rated 9.2 out of 10) present in every version since 4.7: with no account, an attacker can make the server read a file and, in some configurations, run code. Patchstack spotted the first attempts the same day, then, starting September 23, attempts to write files to servers, with no published count of compromised sites. Patches are available for every branch back to 4.7.

On September 8, Google released Chrome 153, which fixes a flaw in the V8 JavaScript engine (CVE-2026-87491) already exploited by attackers. Five days earlier, a first update had closed another exploited flaw (CVE-2026-85046). It is Chrome's seventh zero-day of the year; the US agency CISA added it to its catalog of exploited vulnerabilities the same day.

IDScan, a US identity verification company used by car rental agencies and retailers, acknowledged on September 4 that a third party may have copied data from its online platform: names, driver's license numbers and other ID document numbers. On a criminal forum, a seller is offering more than 153 million scanned licenses from the United States and Canada; IDScan has not confirmed that total. The FBI is investigating.

Manchester Airports Group, which runs Manchester, London Stansted and East Midlands, announced the theft of data on 8.7 million customers of its parking, lounges, fast track lanes and Wi-Fi: emails, phone numbers, license plates and postcodes. No payment data was affected, and flights are operating normally.

The US medical device maker reported a cyberattack detected on August 25: a network outage is blocking access to several applications, including those used to process and ship orders. The company has activated its incident response plan with outside experts, with no date for a return to normal.

After a ransom demand was refused, the ShinyHunters group published data it says it stole from the workwear brand Carhartt. Have I Been Pwned counts 12.9 million real accounts in it (emails, names, phone numbers, mailing addresses), half the number claimed, the rest being test data. Carhartt has not confirmed publicly.

The DGFiP, France's tax authority, acknowledged unauthorized access to its information system in June and July using an employee's stolen credentials. Tax data on 678,000 individuals and businesses was extracted, including reference taxable income and household tax shares. Passwords and taxpayers' online accounts are not affected; the people concerned will be notified starting August 17.

Poland's data protection authority announced an inspection of MyDr, a medical practice management software used by more than 12,000 facilities, after a data theft reported to affect 19 million Poles, half the country. ID numbers, prescriptions and doctors' notes are among the stolen data.

Malicious versions of keyv, flat-cache, file-entry-cache and other widely used JavaScript packages were published on npm on August 4. Once installed, they steal AWS keys and GitHub and npm tokens, then spread to other developers' packages. Endor Labs counts at least 1,136 malicious versions across 384 packages.

Have I Been Pwned added 55.3 million email addresses from Suno, an AI music creation service, taken in a November 2025 intrusion revealed in July. The file also contains phone numbers and, for a few tens of thousands of purchases, names, addresses and the last digits of payment card numbers. Suno confirms the incident without disputing the figure.

Have I Been Pwned added 23.3 million Paidwork accounts, from a platform for paid microtasks, after the release of 11 GB of data put up for sale in March. The file contains names, addresses, dates of birth, bank details, payment histories and encrypted passwords. Paidwork says it has no evidence of an intrusion.

Coca-Cola announced that ransomware had hit Fairlife, including its production systems: its four US plants were shut down, while the Canadian ones kept running. On July 27, the company said most production had resumed, that data had been stolen and that the attack would not have a material impact on its results.

SOCRadar analyzed a server left open for three weeks by the WP-SHELLSTORM group, which hacks sites at scale to resell access. The group exploited 27 known flaws in WordPress and Joomla extensions, including one in the Breeze caching plugin (more than 17,000 sites compromised). About 25,000 compromised sites were identified out of 1.4 million targeted.

KDDI detailed the intrusion into the email service it provides to several Japanese internet providers, first disclosed on June 23: 12.2 million email addresses and 7.6 million passwords were leaked. The attackers had been exploiting an unknown flaw in third-party software since mid-May. The affected providers are requiring a password change.

The US Department of Justice announced the extradition of Peter Stokes, 19, arrested in Finland and charged with conspiracy, computer intrusion and fraud. The Scattered Spider group, which specializes in scam calls to help desks, is linked to more than 100 intrusions and more than $100 million in ransom payments.

Europol and Eurojust announced a new phase of Operation Endgame, carried out June 15 to 19 with France, Germany, the Netherlands, the United Kingdom, the United States and Microsoft. In all, 326 servers and 142 domains used by the StealC, Amadey and SocGholish malware were taken offline, and 27 million stolen credentials were recovered.

Attackers stole the access tokens that the competitive intelligence tool Klue held to connect to its customers' Salesforce accounts. LastPass confirms the leak of customer contact details and support requests; Recorded Future, Jamf and Tanium are among the other victims named. LastPass password vaults are not affected.

CISA is warning about “FortiBleed”: a database of credentials tied to about 74,000 Fortinet firewalls and VPN gateways, obtained through password reuse and brute-force attacks, is being used to break into corporate and government networks. Fortinet says this is not a new flaw but poorly protected accounts, often without two-factor authentication.

The Danish drugmaker announced unauthorized access to part of its internal IT systems, some of which were shut down during the investigation. Nonpublic data, including personal data and patient data from some clinical trials, was copied out. Its core operations continue to run.

Oracle issued an out-of-band alert for a critical flaw in PeopleSoft PeopleTools (versions 8.61 and 8.62) that can be exploited remotely without a password. According to Mandiant, the extortion group ShinyHunters had been exploiting it since late May, mostly against universities, to steal data and then publish it. CISA added it to its catalog of exploited vulnerabilities on June 12.

Google rushed out Chrome 149.0.7827.102/.103 to fix a flaw in the V8 JavaScript engine (CVE-2026-11645) and says attack code is already circulating. A single malicious web page is enough to trigger it. It is the fifth Chrome flaw exploited before a patch since the start of 2026, and Chromium-based browsers (Edge, Brave, Opera) are affected.

DINUM, the French government's digital agency, confirmed an intrusion into Tchap, the instant messaging app for public servants, detected by the national cybersecurity agency ANSSI on June 7. The attacker used a legitimate hijacked account, with no technical flaw involved: only public rooms, open to all users, are said to have been accessed. The attacker claims to have collected several hundred thousand messages, a figure the government has not confirmed.