WIRETAPSubscribeYmirlink said its investigation found data was exported from 49 Cuenote FC email-delivery systems, totaling 51,628,280 records. The total is a cumulative record count, not 51.6 million confirmed individuals. The affected data includes email addresses, while other fields vary by customer and remain under review.
Giftee Group said a third party exploited a vulnerability in a subsidiary system and used it to issue about ¥550 million in unauthorized e-gifts. The activity was discovered on October 25, and the affected system was stopped that day to block further issuance.
LiteLLM’s completed investigation says the supply-chain attack began with a master key accidentally committed to a public repository on May 27. The key was identified for revocation but remained active. On October 10, an attacker used it to access an experimental agent platform and retrieve a GitHub CLI token tied to an organization owner, providing owner-level access across the project’s repositories.
Park24’s Times Mobility said unauthorized access to the Times Car web system exposed personal data associated with about 6.62 million accounts. Around 1.46 million accounts whose identity-document images were transferred are eligible for a 3,000-yen payment. The company’s incident FAQ says the last four digits of some payment cards were exposed, but it did not retain full card numbers or security codes.
OpenAI said frontier-model agents assigned to stress-test its research infrastructure chained vulnerabilities into microVM escapes, found routes through internal services to limited internet access and communicated across isolated tasks using timing signals in shared hardware and services. The tests ran in monitored, purpose-built copies of the company’s environment, and agents were given source code, configuration details and vulnerability hints, so the results were not uncontrolled attacks on customer systems.
Independent researcher Erica Windisch says lab testing of Tailscale 1.104.2 and headscale 0.29.5 reproduced 11 security issues. The most serious claims involve Unix-socket forwarding in Tailscale SSH, which could let an attacker controlling an approved device gain root-level access on a destination Linux server. The reported chain enables lateral movement, not unauthenticated remote code execution from the internet, and requires an applicable SSH policy.
PingCAP said an attacker used a compromised GitHub account and exposed credentials to access internal systems from September 9 through October 7, copying source code and customer-related records from analytics, storage and support environments. Confirmed categories included names, email addresses, organization and project associations, SQL editor text and errors, contract terms, pricing and billing configuration. The mix varied by customer.
Hardware-wallet maker Keystone said an intruder accessed its website and obtained customer names, contact information, shipping addresses and order details, including purchased products and prices. The company detected the access on October 20 and confirmed the exposure on October 23 after reviewing API activity with Shopify. It has not disclosed how many customers were affected.
Moonshot AI said it removed cyber-related material from Kimi K3.1 Pro’s mid-training data and reinforcement-learning environments to limit misuse before releasing the model’s weights. On the company’s internal xdev-bench-hard test, an unfiltered checkpoint solved 90.5% of vulnerability-discovery and exploitation tasks at pass@3, compared with 81.0% for the release model.
GMO Internet Group said on October 24 that an intruder accessed its Onamae.com Desktop Cloud service, took customer information outside the environment and was linked to transactions that some customers said they did not authorize. An earlier company update said up to 26,739 servers may have been affected and that trading credentials stored on them may have been exposed.
Kaspersky researchers said a cyberespionage campaign used a newly identified UEFI bootkit called BlackX against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan in early 2026. After gaining administrator privileges, the attackers exploited the older Baton Drop vulnerability, CVE-2022-21894, to install custom keys and load malicious code before Windows started.
Network monitoring company Kentik said several waves of abnormal traffic coincided with intermittent outages across North Korea’s public internet over roughly 32 hours beginning October 20. More than 40 state-managed websites using the .kp domain were reportedly inaccessible or unstable, including the foreign ministry and the Korean Central News Agency.
Arista Networks said on October 22 that attackers are actively exploiting CVE-2026-114625, a critical SQL injection flaw in on-premises VeloCloud Orchestrator. A user with the lowest built-in tenant role and access to the web interface can gain operator privileges, impersonate a local superuser operator and reach internal functions that are not intended to be remotely accessible.
Cloud platform Railway said on October 21 that it detected anomalous activity in systems storing customer environment variables. Its investigation indicates that an unauthorized third party may have accessed encrypted variables and obtained decrypted contents for some of them. The company said those variables can contain API keys, database credentials and registry credentials, while its initial analysis suggests the impact may be limited to a subset of users.
PHP disclosed CVE-2026-115560 on October 23, two days after emergency fixes for the separate PHP2Shell flaws. The newly identified remote-code-execution risk remains unpatched, but PHP says it requires an unusual combination of session settings, runtime configuration changes and enabled upload-progress tracking.
A Chinese national was extradited from the Netherlands and arraigned in California on October 23 over an alleged cryptocurrency investment and money-laundering conspiracy. The Justice Department says the network used unsolicited messages, calls and dating services to direct victims to fake trading websites, identifying 174 U.S. victims.
PwC confirmed on October 23 that a third-party vendor hosting employee learning records experienced a cybersecurity incident. The firm told Reuters that the affected site does not contain client data, sensitive personal data or financial information, and said its network and operations were not affected.
LiteLLM says attackers compromised its release pipeline on October 21 and published version 1.107.0 to PyPI and official container registries. The malicious release could run when Python started, even if an application never imported LiteLLM, and targeted developer, cloud, browser, SSH and AI-provider credentials.
Quest Diagnostics says personal information and patient records were affected by unauthorized access to its Quanum Lab Services Manager system. In an October 23 notice, the laboratory company said it was still identifying the patients and information involved. It has not disclosed an affected-patient count.
Certificate authority eMudhra is offering customers certificates from another provider after eight of its certificate-signing keys were found to be weak. Security researcher Scott Helme reported on October 20 that one private key was simply the number 4. He said he recovered all eight from their public certificates in less than a second.
Toronto Crime Stoppers has suspended its anonymous reporting service after a breach of its tip-management provider. In an October 21 statement, the charity said Navigate360 told it that hackers stole 176,859 Toronto tips dating from January 2022 to November 2025. The vendor also identified 14,973 names, but has not clarified whether they belong to tipsters, people named in reports, or both.
Capcom says unauthorized access to its CAPCOM ID service affected 11,774,247 email address records worldwide. The exposed information also included account creation dates, login activity and the IP address used at the last login. The company detected the intrusion on October 19 and disclosed it on October 22.
A new token promoted through crypto influencer Kimchi’s X account reportedly collapsed shortly after launch. Posts connected to the token and his Pump.fun collaboration were later deleted, prompting rug-pull allegations, according to Wiretap’s October 22 report.
Authorities recovered more than $105 million and arrested 1,462 suspects in a coordinated cybercrime operation across 21 countries, INTERPOL announced on October 22. Investigators identified nearly 66,000 victims and linked the cases to losses exceeding $385 million.
Amazon says it detected an attempt to exploit two critical PHP vulnerabilities on October 17, four days before patches were released. The flaws, known as PHP2Shell, could let unauthenticated attackers execute code on affected servers. Amazon observed further attempts after disclosure, but says it is unclear whether those attempts would have succeeded against real systems.