BTCPay Server Flaw Exploited to Drain Bitcoin and Litecoin Wallets
Attackers are exploiting a vulnerability in BTCPay Server 2.4.1 and earlier to steal funds from hot wallets. Users should migrate to a fresh server immediately.
VPN & PrivacyThreat Intelligence Feed
-
-
Weekly Recap: Crypto Theft Records, Linux DDoS, and Critical CVEs
This week's top threats include a record $6.43B crypto theft, supply chain attacks, spyware, and a covert Chinese hacking network.
Guides -
China's Spy Plot Near Nvidia CEO Left Unaddressed by Trump
Trump was briefed on a Chinese intelligence operation targeting Nvidia's CEO but took no action. Federal data security lapses compound the risk.
Tools -
TeamViewer Flaw Lets Controlled Host Attack the Connecting Viewer
A high-severity flaw in TeamViewer allows a malicious host machine to crash or execute code on the viewer's computer. Update to version 15.83.
Threats -
GMO Internet Offers $1 Million Bounty After Refusing Extortion Demand
Japan's GMO Internet Group is offering up to $1 million for tips leading to the arrest of attackers who breached its Onamae.com Desktop Cloud service.
Threats -
Google Opens One-Tap Android App Install Program to Third-Party Stores
Google's Registered App Stores program lets approved third-party stores install and update Android apps with one tap, launching December 1 outside the US.
Tools
Analysis & Guides
Threats
Malicious AGENTS.md in Downloads Folder Targeted AI Coding Agents
A planted instruction file in a developer's Downloads folder attempted to make an AI coding agent install malware-linked npm packages, researchers found.
Guides
Node2Shell PoC Achieves RCE on Official Node.js via Brotli Bug
Imperva's Node2Shell proof of concept executes attacker code on an official Node.js 24 build via a Brotli decoder flaw. Patches were released October 21.
VPN & Privacy
Microsoft October Windows Server Updates Cause Exchange OWA and Mail Issues
Microsoft confirmed October 2026 Windows Server updates are causing OWA sign-in failures and mail delivery issues on some Exchange Server systems.
Guides
Hackers Abuse Compromised ConnectWise Credential to Access Customer M365 Tenants
A compromised ConnectWise Cloud Backup credential has been used to gain unauthorized access to 173 partner and customer Microsoft 365 tenants.
VPN & Privacy
Email Bombing: What It Is and How to Respond
Email bombing floods your inbox to hide fraud alerts. Here's how to spot it, respond, and protect your accounts.
Threats
PwnEscape: Critical Linux Kernel Flaw Enables VM-to-Host Memory Leak
CVE-2026-99999, dubbed PwnEscape, lets code inside a VM read host memory. Patches are available for all supported Linux stable branches.
Tools
The Blind Spots of Agentic Pentesting and How to Close Them
Agentic pentesting is the sharpest edge of offensive security today, but it leaves critical gaps. Here's where those blind spots are and how to address them.
Tools
What to Do When a Data Breach Notice Tells You Little
Breach notices are revealing less than ever. Here's how to interpret vague notifications and take meaningful action to protect yourself.
Guides
Three Teams Remotely Hack Pixel 10 at Pwn2Own Ireland 2026
Three research teams successfully exploited a fully patched Google Pixel 10 at Pwn2Own Ireland, winning a combined $562,500 in prizes.