🚨 ACTIVE EXPLOITATION
- Over 60,000 Attack Attempts Hit WordPress Upgrade-Window RCE Within 24 Hours
Wordfence blocked over 60,000 attack attempts in 24 hours against an unauthenticated WordPress Core remote code execution flaw exposed during software updates.- All WordPress site owners are exposed; the flaw affects the upgrade process, not a third-party plugin, and WordPress 7.1.4 released October 28, 2026 patches it along with 21 other vulnerabilities.
- During a core upgrade, update files are extracted into a predictable, publicly accessible temporary staging directory, briefly exposing the WordPress installer.
- An unauthenticated attacker who reaches the installer at the right moment can connect it to a database they control, creating a path to executing code on the server; the window lasts only seconds, so attackers flood repeated requests.
- The patch adds 16 random characters to temporary folder names, restores index.php handling, and prevents wp-config.php from being copied; older branches including 7.0.8, 6.9.11, and backports through 4.7.39 also received fixes.
- Wordfence issued a firewall rule to Premium, Care, and Response customers on October 28, with Free users receiving it November 27 after the standard 30-day delay; blocked requests number 60,471 but no confirmed compromises are established.
💥 BREACHES & INCIDENTS
Chainalysis discloses breach of internal tools via 'offensive agentic techniques', exposing customer identity data
Chainalysis disclosed that an external actor used AI-driven 'offensive agentic techniques' to access internal systems, exposing non-sensitive customer identity data.- Affects Chainalysis platform customers, including law enforcement, government agencies, crypto exchanges, and financial institutions
- Accessed data includes user IDs, full names, email addresses, and organization role labels; no evidence investigation content, credentials, MFA secrets, or session tokens were accessed
- An external actor used 'offensive agentic techniques' — AI-powered tools capable of multi-step autonomous actions — to gain unauthorized access to systems and internal tools in October 2026
- Chainalysis has not disclosed which vulnerabilities were exploited, which tools were accessed, or how long the attacker had access; the incident is unrelated to the Binance theft
Sources 📄 Source: chainalysis.com · 📎 Coverage: bleepingcomputer.com · 👁 via The Hacker News, BleepingComputer (+1)Chainalysis discloses breach using 'offensive agentic techniques' exposing customer identity data
Chainalysis disclosed that an external attacker used AI-powered 'offensive agentic techniques' to access its systems and expose non-sensitive customer data.- Chainalysis customers: user IDs, full names, email addresses, and organization role labels for platform users were accessed.
- No evidence that investigation content, cases, query results, credentials, MFA secrets, or session tokens were accessed.
- The attacker used 'offensive agentic techniques,' indicating an AI-powered tool executed the intrusion; no specific methods, entry point, or vulnerabilities were disclosed.
- Chainalysis detected the external actor during October 2026, notified all customers, brought in outside experts, and is patching vulnerabilities and hardening systems.
- The company said the incident is unrelated to the recent Binance crypto theft.
Nvidia notifying Brev.dev AI platform users of a breach
Nvidia is notifying developers who use its Brev.dev AI platform that the platform has been breached.- Affects developers using Brev.dev, the AI/ML development platform Nvidia acquired in 2024 for building, training and deploying models on GPU cloud instances
- Nvidia has begun sending breach notifications to Brev.dev platform users
- Details of the breach, including what data was accessed and how attackers got in, have not been disclosed
NVIDIA's Brev AI developer cloud reportedly suffers a security breach
NVIDIA's Brev developer cloud platform has reportedly been breached, according to a widely shared X post.- NVIDIA's Brev, the AI developer cloud for prototyping and shipping AI workloads on GPUs across 20+ clouds, is reportedly affected
- The claim, posted by AI architect Shivay Lamba, references CVEs, stolen keys/APIs, and exposed user credentials amid a wave of tech company breaches
- The report spread via Reddit's r/cybersecurity and r/nvidia communities; NVIDIA has not been detailed in any confirmed advisory in this material
🔓 CVEs & KEV
CVE-2026-119271 — Google Chrome — CVSS 8.8 — Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remo...
CVE-2026-119270 — Google Chrome — CVSS 8.8 — Improper input validation in CacheStorage in Google Chrome prior to 156.0.807...
CVE-2026-119269 — Google Chrome — CVSS 8.8 — Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a rem...
CVE-2026-119268 — Google Chrome — CVSS 8.8 — Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a...
CVE-2026-119267 — Google Chrome — CVSS 8.8 — Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a re...
CVE-2026-119266 — Google Chrome — CVSS 8.8 — Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a rem...
CVE-2026-119265 — Google Chrome — CVSS 8.8 — Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a ...
CVE-2026-116964 — redhat konflux-ci — CVSS 8.4 — Konflux-ci: remote code execution via eval() in manifest scriptsA flaw was fo...
CVE-2026-117681 — redhat konflux-ci — CVSS 8.0 — Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters...
CVE-2026-109197 — wpdirectorykit WP Directory Kit — CVSS 7.5 — WP Directory Kit through 1.6.0 - Unauthenticated SQL Injection via 'idfield' Param...
CVE-2026-15272 — Shamalli Web 2.0 Directory plugin for WordPress — CVSS 6.5 — Web 2.0 Directory through 2.10.12 - Unauthenticated SQL Injection via 'w2dc_level_...
🕵️ RESEARCH & DEEP DIVES
ChatGPT Shared Link Flaw Let Attackers Run Code in Victim's Session, Read Private Chats
Researchers at Parameter found a now-fixed ChatGPT shared-link flaw that let attacker code execute in a victim's signed-in session and access private conversations.- Affected ChatGPT users who opened a maliciously crafted shared conversation link; reported to OpenAI on October 18, rated P1, fixed by October 26 across two versions of ChatGPT's web frontend
- The exploit chained ChatGPT's Preview sandbox feature with the MathLive math library loaded in the main page, whose message listener accepted unvalidated messages containing raw HTML
- The HTML created a non-sandboxed frame inheriting the chatgpt.com identity, and a script loaded from YouTube (allowed by ChatGPT's CSP) executed inside it
- Once running in the victim's session, the code called ChatGPT's signed-in APIs to list recent conversations, read an unshared private chat, and exfiltrate its contents to an attacker-controlled server
- No real-world abuse was observed; OpenAI paid a $5,000 bounty
VOLTA-AUTODOXER infostealer uses LLMs to profile victims and rank stolen assets
Cisco Talos uncovered the VOLTA-AUTODOXER infostealer, which uses LLMs to profile victims and rank their most monetizable stolen data.- Affects Windows users; the self-deleting VOLTA stealer harvests browser passwords, cookies, payment cards, crypto wallet seed phrases, Discord/Telegram/Steam/Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi passwords, and screenshots.
- After theft, it enriches the haul using stolen sessions — searching Gmail for receipts, pulling UberEats and DoorDash order history, and valuing Roblox accounts — then builds an 'Identity_Report.txt' dossier.
- The bundle is POSTed to OpenRouter with a prompt instructing the model to act as a 'forensic intelligence analyst' producing a 'WHAT THEY'RE WORTH' ranking and an 'THEIR OPSEC' assessment.
- Default model is anthropic/claude-opus-4.6, with a fallback chain to moonshotai/kimi-k2 then google/gemini-2.5-flash if refusals are detected; temperature is hardcoded at 0.2.
- The malware is self-deleting with no attacker-owned infrastructure, and Talos has not tracked whether it has been used in the wild.