Shit Hits The Fan

The tier list

The ranking

1. A73

   Vulnerability · high

   Zyxel GS1900 switch zero-day exploited, patch incomplete

   Who’s exposed: GS1900 switches with reachable web management interfaces

   Tier A because: Core infrastructure or popular tool AND exploited in the wild

   Reach

   Attack

   Damage

   Fix

   Popular tool · Exploited in the wild · Remote, no login · Full takeover · Secrets exposed · No fix yet

   • CVE-2026-107441

   Checklist · 7 of 10 yes

   Yes	Hits tech teams	Judgment: managed network switches are network infrastructure that IT teams build with and run.
   No	Core infrastructure	Judgment: a single vendor's switch line is not software nearly every team runs.
   Yes	Popular tool	Judgment: Zyxel GS1900 is a widely deployed business switch appliance, though not mainstream software.
   Yes	Exploited in the wild	BleepingComputer: Zyxel zero-day exploited to hack nearly 1,000 network switches worldwide.
   No	Public exploit	No source says exploit code or a step-by-step PoC is published.
   Yes	Remote, no login	The Hacker News: anyone who can reach the web management interface can run commands; crafted HTTP requests (SecurityWeek).
   Yes	Full takeover	The Hacker News: the exploit allows root command execution on the switch.
   Yes	Secrets exposed	BleepingComputer: attackers stole configuration files and credentials from compromised switches.
   No	Supply chain	Sources describe a flaw exploited in the device, not malicious code shipped through a trusted channel.
   Yes	No fix yet	The Hacker News: GS1900 switches that received the earlier fix are still open to the exploit; the patch is incomplete.

   The Hacker News · 2d ago · 3 sources · Details & share

   What to do

   • Restrict access to the GS1900 web management interface so it is not reachable from untrusted networks
   • Check GS1900 switches for signs of compromise and review stored configuration files and credentials
2. A69

   Vulnerability · critical

   OpenSSH authentication flaw on musl/Alpine systems without PAM, with 10.6p2 workaround

   Who’s exposed: Alpine and musl systems running openssh-server without PAM

   Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover

   Reach

   Attack

   Damage

   Fix

   Core infrastructure · Popular tool · Remote, no login · Full takeover

   Checklist · 5 of 10 yes

   Yes	Hits tech teams	Judgment: OpenSSH servers on Alpine are run by ops and IT teams, so this affects systems they operate.
   Yes	Core infrastructure	Judgment: OpenSSH is core infrastructure that nearly every team runs for remote access.
   Yes	Popular tool	Judgment: OpenSSH is a widely used, mainstream server package.
   No	Exploited in the wild	No source reports observed attacks using this flaw; sources only describe that it allows login.
   No	Public exploit	No source says exploit code or a step-by-step PoC is published; details are not described as public.
   Yes	Remote, no login	The Hacker News: attackers need only network access, an account name, and an oversized password, no valid credentials.
   Yes	Full takeover	Ars Technica: the vulnerability lets hackers log into devices with no password, an authentication bypass.
   No	Secrets exposed	No source reports stolen credentials, keys, configs, source code or customer data.
   No	Supply chain	No source reports compromised packages, updates, build pipelines or signing keys; it is a normal bug.
   No	No fix yet	The Hacker News: OpenSSH issues emergency fix; LWN: version 10.6p2 released with a workaround.

   Biz & IT - Ars Technica · 1d ago · 7 sources · 💬 193 · Details & share

   What to do

   • Upgrade to OpenSSH 10.6p2 or a later release that includes the workaround
   • If you cannot upgrade yet, set PasswordAuthentication no in sshd configuration and restart sshd, after confirming key-based login works
3. A69

   Supply-chain attack · high

   Russia-linked hackers use watering-hole sites and a hijacked web analytics script to deliver iOS and Android exploit chains

   Who’s exposed: Visitors to compromised sites and Plerdy SEO Tracker users

   Tier A because: Core infrastructure or popular tool AND exploited in the wild

   Reach

   Attack

   Damage

   Fix

   Popular tool · Exploited in the wild · Remote, no login · Supply chain

   Checklist · 5 of 10 yes

   Yes	Hits tech teams	Judgment: iOS and Android are OSes developers and IT teams work on; Plerdy is a SaaS script.
   No	Core infrastructure	Judgment: iOS, Android and a single analytics vendor's script are not core infrastructure like OpenSSH or the Linux kernel.
   Yes	Popular tool	Judgment: iOS and Android are mainstream, widely used platforms affected by the exploit chains.
   Yes	Exploited in the wild	The Record: state-linked hackers targeted users in Ukraine, US and Europe in a campaign.
   No	Public exploit	No source says exploit code or a proof-of-concept was published.
   Yes	Remote, no login	The Record: describes the campaign as a zero-click espionage campaign.
   No	Full takeover	Sources mention exploit chains but do not explicitly state code execution or root/admin access.
   No	Secrets exposed	The Record says the campaign aims to steal sensitive information; no source confirms data was stolen.
   Yes	Supply chain	The Hacker News: supply chain attack hijacked the Ukrainian Plerdy SEO Tracker web analytics script.
   No	No fix yet	No source reports whether a patched version of iOS, Android or Plerdy is available.

   The Hacker News · 2d ago · 3 sources · Details & share

4. A69

   Malware · medium

   Exploitation of patched iOS and Android flaws to deliver malware

   Who’s exposed: iOS and Android users visiting compromised or fake sites

   Tier A because: Core infrastructure or popular tool AND exploited in the wild

   Reach

   Attack

   Damage

   Fix

   Popular tool · Exploited in the wild · Remote, no login · Full takeover

   Checklist · 5 of 10 yes

   Yes	Hits tech teams	Judgment: iOS and Android are operating systems developers and IT teams work on and run.
   No	Core infrastructure	Judgment: mobile OS flaws are not in the core infrastructure list like Linux, OpenSSH or OpenSSL.
   Yes	Popular tool	Judgment: iOS and Android are widely used mainstream operating systems.
   Yes	Exploited in the wild	The Hacker News: CISA added the Apple flaw to KEV after reports of active exploitation.
   No	Public exploit	No source says exploit code or a proof-of-concept was published.
   Yes	Remote, no login	BleepingComputer: hackers use n-day exploits in zero-click attacks on iOS and Android devices.
   Yes	Full takeover	Ars Technica: hackers exploited the flaws to infect phones with malware.
   No	Secrets exposed	Sources say info-stealing malware was delivered; none report stolen credentials or data.
   No	Supply chain	Malware was delivered via compromised or fake websites, not a trusted package, update or pipeline.
   No	No fix yet	The Hacker News and Ars Technica describe the flaws as previously patched.

   The Hacker News · 2d ago · 3 sources · Details & share

   What to do

   • Update iOS and Android devices to the patched versions that fix the flaws
5. A66

   Vulnerability · high

   CISA flags WordPress RCE flaw as actively exploited in attacks

   Who’s exposed: WordPress sites running the unpatched vulnerable version

   Tier A because: Core infrastructure or popular tool AND exploited in the wild

   Reach

   Attack

   Damage

   Fix

   Popular tool · Exploited in the wild · Full takeover

   Checklist · 4 of 10 yes

   Yes	Hits tech teams	WordPress is a widely used CMS that developers and ops teams build with and run.
   No	Core infrastructure	A single web framework/CMS, not software nearly every team runs.
   Yes	Popular tool	WordPress is a mainstream platform powering a large share of websites.
   Yes	Exploited in the wild	BleepingComputer: CISA warned attackers have started exploiting the flaw in the wild.
   No	Public exploit	No source says exploit code or a proof-of-concept is published.
   No	Remote, no login	No source says the flaw is exploitable without credentials over the network.
   Yes	Full takeover	BleepingComputer: the flaw is described as a remote code execution (RCE) vulnerability.
   No	Secrets exposed	No source reports credentials, data or configs being stolen or exposed.
   No	Supply chain	No source reports compromised packages, updates or build pipelines; it is a normal vulnerability.
   No	No fix yet	BleepingComputer: the vulnerability was recently patched, so a fixed version exists.

   BleepingComputer · 2d ago · Details & share

   What to do

   • Apply the available WordPress patch for this RCE flaw as soon as possible
6. A65

   Vulnerability · critical · CVSS 9.8

   Langflow's Critical Flaws Show Why Agent Tool Calls Need a Scrub Layer, Not Just a Patch

   Who’s exposed: Langflow deployments reachable by unauthenticated network attackers

   Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover

   Reach

   Attack

   Damage

   Fix

   Popular tool · Remote, no login · Full takeover

   Checklist · 4 of 10 yes

   Yes	Hits tech teams	Langflow is an open-source AI agent and workflow builder that developers build and run.
   No	Core infrastructure	A single AI workflow framework, not software nearly every team runs.
   Yes	Popular tool	Langflow is a widely used open-source AI agent builder with broad developer adoption.
   No	Exploited in the wild	DEV Community source reports no observed attacks using these flaws.
   No	Public exploit	DEV Community source does not say exploit code or a PoC is published.
   Yes	Remote, no login	DEV Community: both critical flaws let an unauthenticated attacker act over the network.
   Yes	Full takeover	DEV Community: flaws let unauthenticated attackers bypass authentication or run arbitrary code.
   No	Secrets exposed	DEV Community source reports no stolen or exposed credentials, tokens or data.
   No	Supply chain	DEV Community source describes vulnerabilities, not compromised packages or updates.
   No	No fix yet	DEV Community source does not say a fix is unavailable; the patch is implied.

   DEV Community: ai · 19h ago · Details & share

7. A65

   Vulnerability · critical

   Barracuda Email Security Gateway flaws chained for root access

   Who’s exposed: Organizations running Barracuda Email Security Gateway appliances

   Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover

   Reach

   Attack

   Damage

   Fix

   Popular tool · Remote, no login · Full takeover

   Checklist · 4 of 10 yes

   Yes	Hits tech teams	Judgment: email security gateway appliances are network security devices that IT and ops teams run.
   No	Core infrastructure	Judgment: a single vendor's email gateway appliance, not core software nearly every team runs.
   Yes	Popular tool	Judgment: Barracuda Email Security Gateway is a widely deployed commercial appliance used by many organizations.
   No	Exploited in the wild	SecurityWeek and The Hacker News describe researcher demonstrations only; no observed attacks reported.
   No	Public exploit	The Hacker News: watchTowr detailed the chain; no source says exploit code or a step-by-step PoC was published.
   Yes	Remote, no login	The Hacker News: attack chain runs commands as root over the network with no login required.
   Yes	Full takeover	The Hacker News: flaws can be chained to run commands as root, the highest access level.
   No	Secrets exposed	Neither source reports stolen credentials, data or configs; only demonstrated root access.
   No	Supply chain	Sources describe flaws in the appliance software, not malicious code shipped through a trusted channel.
   No	No fix yet	The Hacker News: the company released patches on Monday, so a fixed version is available.

   The Hacker News · 2d ago · 2 sources · Details & share

   What to do

   • Apply the patches Barracuda released for the Email Security Gateway.
8. B48

   Supply-chain attack · high

   Backdoored ARTEX/CWP-style server images

   Who’s exposed: Servers running trojanized cwpsrv from Control Web Panel

   Tier B because: Exploited in the wild OR public exploit

   Reach

   Attack

   Damage

   Fix

   Exploited in the wild · Full takeover · Supply chain

   Checklist · 4 of 10 yes

   Yes	Hits tech teams	Judgment: CWP is a Linux hosting control panel run by sysadmins and hosting ops teams.
   No	Core infrastructure	Judgment: a single hosting control panel's web server, not core infrastructure like OpenSSH or the kernel.
   No	Popular tool	Judgment: CWP is a niche hosting panel, not a mainstream developer tool or framework.
   Yes	Exploited in the wild	BleepingComputer: CWPdoor malware is being distributed via trojanized cwpsrv, an active campaign.
   No	Public exploit	No source says exploit code or a step-by-step proof-of-concept was published.
   No	Remote, no login	Sources say the backdoor runs commands sent via web requests but do not state that no credentials are needed.
   Yes	Full takeover	The Hacker News headline: backdoored ARTEX exposes 62 consoles to root access.
   No	Secrets exposed	No source reports credentials, keys, configs or customer data being stolen or exposed.
   Yes	Supply chain	The Hacker News: backdoor hidden in CWP's web server; BleepingComputer: distributed through trojanized cwpsrv build of a legitimate project.
   No	No fix yet	No source states whether a patched version of CWP or cwpsrv is available.

   The Hacker News · 1d ago · 3 sources · Details & share

   What to do

   • Check Linux servers running Control Web Panel for a trojanized cwpsrv and the CWPdoor backdoor
9. B46

   Vulnerability · high

   Debian and Ubuntu APT man-in-the-middle code execution flaw

   Who’s exposed: Debian and Ubuntu systems using APT to download packages over HTTP

   Tier B because: Full takeover OR secrets exposed OR supply chain

   Reach

   Attack

   Damage

   Fix

   Core infrastructure · Popular tool · Full takeover

   Checklist · 4 of 10 yes

   Yes	Hits tech teams	APT is the package manager developers and ops teams use on Debian and Ubuntu.
   Yes	Core infrastructure	APT is core package-management infrastructure that nearly every Debian and Ubuntu team runs.
   Yes	Popular tool	APT is a mainstream package manager used across Debian and Ubuntu systems.
   No	Exploited in the wild	Sources report the flaw and advisories only, with no observed attacks.
   No	Public exploit	Sources describe the flaw and advisories; no published exploit or PoC is mentioned.
   No	Remote, no login	Attack requires a man-in-the-middle position to modify package downloads, not unauthenticated network access alone.
   Yes	Full takeover	The Hacker News: attacker's code runs as root after swapping a verified package.
   No	Secrets exposed	Sources report code execution; no stolen credentials, keys or data are mentioned.
   No	Supply chain	Sources describe a MitM package swap in transit, not a compromised legitimate project or build pipeline.
   No	No fix yet	Debian, Ubuntu and APT developers published advisories on November 4, implying fixes; no source says unpatched.

   The Hacker News · 2d ago · 2 sources · 💬 78 · Details & share

   What to do

   • Upgrade the apt package to the fixed version, as the advisories recommend
   • Check whether systems still on older Debian releases such as bookworm have received a fix
10. B46

    Vulnerability · high

    Linux kernel privilege escalation flaws allowing root

    Who’s exposed: Linux systems with unpatched kernels and local user accounts

    Tier B because: Full takeover OR secrets exposed OR supply chain

    Reach

    Attack

    Damage

    Fix

    Core infrastructure · Popular tool · Full takeover

    Checklist · 4 of 10 yes

    Yes	Hits tech teams	Linux kernel is run and administered by developers, ops and IT teams worldwide.
    Yes	Core infrastructure	The Linux kernel is core infrastructure nearly every team runs.
    Yes	Popular tool	Linux is a mainstream OS; core infrastructure implies popular tool.
    No	Exploited in the wild	Sources describe an OpenAI research pipeline and model, not observed real-world attacks.
    No	Public exploit	OpenAI and SecurityWeek report no published exploit code or step-by-step PoC.
    No	Remote, no login	Sources describe local privilege-escalation flaws, not unauthenticated network attacks.
    Yes	Full takeover	SecurityWeek: AI agents got root on Linux via 948 kernel flaws.
    No	Secrets exposed	Sources report no stolen credentials, keys, or data exposure.
    No	Supply chain	No source reports malicious code shipped through a trusted channel.
    No	No fix yet	OpenAI reports its pipeline generated patches for the 948 vulnerabilities.

    SecurityWeek · 2d ago · 3 sources · 💬 353 · Details & share

    What to do

    • Apply Linux kernel updates that include these fixes as your distribution ships them
11. B45

    Breach · high

    DigiCert data breach exposes customer information, identity documents

    Who’s exposed: DigiCert customers whose information and identity documents were accessed

    Tier B because: Exploited in the wild OR public exploit

    Reach

    Attack

    Damage

    Fix

    Exploited in the wild · Secrets exposed

    Checklist · 3 of 10 yes

    Yes	Hits tech teams	Judgment: DigiCert sells SSL/TLS certificates and PKI services that developers and ops teams buy and run.
    No	Core infrastructure	Judgment: Breached internal business system of one CA vendor, not software nearly every team runs.
    No	Popular tool	Judgment: The compromised system was an internal business system, not the widely used certificate product itself.
    Yes	Exploited in the wild	BleepingComputer: Server migration exposure allowed unauthorized access to customer information and identity documents.
    No	Public exploit	BleepingComputer: No exploit code or proof-of-concept is mentioned in the source.
    No	Remote, no login	BleepingComputer: Source says exposed to the internet but does not state that no credentials were needed.
    No	Full takeover	BleepingComputer: Source reports data access, not code execution, root/admin rights or account takeover.
    Yes	Secrets exposed	BleepingComputer: Unauthorized access exposed customer information and identity documents.
    No	Supply chain	BleepingComputer: Source describes a data exposure, not malicious code shipped through a trusted channel.
    No	No fix yet	BleepingComputer: Source does not say whether a fix is available or missing.

    BleepingComputer · 19h ago · Details & share

12. B45

    Breach · high

    Chainalysis breach exposes user data and forces service shutdowns

    Who’s exposed: All Chainalysis users, including law enforcement and national security sectors

    Tier B because: Exploited in the wild OR public exploit

    Reach

    Attack

    Damage

    Fix

    Exploited in the wild · Secrets exposed

    Checklist · 3 of 10 yes

    Yes	Hits tech teams	Judgment: Chainalysis sells enterprise SaaS and APIs that compliance and engineering teams run and integrate.
    No	Core infrastructure	Judgment: a single blockchain analytics vendor, not software nearly every team runs.
    No	Popular tool	Judgment: a niche specialist analytics platform, not mainstream developer tooling.
    Yes	Exploited in the wild	The Record: Chainalysis said some user information was exposed in a cyberattack.
    No	Public exploit	No source says exploit code or a proof-of-concept was published.
    No	Remote, no login	No source describes the attack vector or whether credentials were needed.
    No	Full takeover	Sources mention exposed live tokens but do not state code execution, admin rights or account takeover.
    Yes	Secrets exposed	The Hacker News: names, usernames, password hashes and live tokens exposed for all users.
    No	Supply chain	No source reports a compromised package, update, build pipeline or signing key.
    No	No fix yet	No source states whether the underlying flaw has been patched or remains unfixed.

    The Hacker News · 1d ago · 2 sources · Details & share

    What to do

    • Reset Chainalysis account passwords and revoke any live tokens tied to your account
13. B45

    Breach · high

    DreamHost data breach exposing FTP logins and webmail sessions

    Who’s exposed: DreamHost customers using FTP/SFTP and webmail

    Tier B because: Exploited in the wild OR public exploit

    Reach

    Attack

    Damage

    Fix

    Exploited in the wild · Secrets exposed

    Checklist · 3 of 10 yes

    Yes	Hits tech teams	Web hosting service whose File Manager and FTP/SFTP access developers and ops teams use.
    No	Core infrastructure	Single hosting company's platform, not software nearly every team runs.
    No	Popular tool	Hosting vendor's internal platform, not a widely used framework, tool or package.
    Yes	Exploited in the wild	BleepingComputer: attackers gained access to File Manager platform for two months.
    No	Public exploit	Neither source mentions published exploit code or proof-of-concept.
    No	Remote, no login	Neither source states the initial access method or that no credentials were needed.
    No	Full takeover	Sources report stolen credentials and sessions, not stated RCE, root or admin takeover.
    Yes	Secrets exposed	BleepingComputer: attackers stole customers' FTP/SFTP usernames and passwords.
    No	Supply chain	No source reports malicious code shipped through a trusted package or update channel.
    No	No fix yet	Neither source says a fix is missing or incomplete.

    The Hacker News · 2d ago · 2 sources · Details & share

    What to do

    • Change FTP/SFTP passwords for DreamHost accounts
14. B45

    Breach · high

    Amadeus breach affecting Asian airlines

    Who’s exposed: Passengers and staff data at airlines using Amadeus reservation platforms

    Tier B because: Exploited in the wild OR public exploit

    Reach

    Attack

    Damage

    Fix

    Exploited in the wild · Secrets exposed

    Checklist · 3 of 10 yes

    Yes	Hits tech teams	Amadeus builds and runs flight reservation and ticketing platforms used by airlines and travel IT teams.
    No	Core infrastructure	A single vendor's enterprise travel platform, not software nearly every engineering team runs.
    No	Popular tool	Major travel-industry vendor, but not mainstream developer tech used by many teams.
    Yes	Exploited in the wild	The Record: Japan Airlines, Cathay Pacific, Korean Air and others report data breaches traced to Amadeus.
    No	Public exploit	No source says exploit code or a proof-of-concept was published.
    No	Remote, no login	No source describes the initial access method or whether it needed credentials.
    No	Full takeover	Sources report data breaches; none mention code execution, root access or account takeover.
    Yes	Secrets exposed	The Record: multiple Asian airlines report data breaches traced back to the Amadeus attack.
    No	Supply chain	No source says malicious code was shipped through a package, update or build pipeline.
    No	No fix yet	No source says a fix is missing or that the vulnerability remains unpatched.

    The Record from Recorded Future News · 2d ago · 2 sources · Details & share

15. B43

    Vulnerability · high

    MS Paint Remote Code Execution Vulnerability Disclosed

    Who’s exposed: Paint 11.0.0.0 up to but excluding 11.2605.91.0

    Tier B because: Full takeover OR secrets exposed OR supply chain

    Reach

    Attack

    Damage

    Fix

    Full takeover

    • CVE-2026-83844

    Checklist · 2 of 10 yes

    Yes	Hits tech teams	Bundled in Windows, an OS that developers and IT teams run and manage
    No	Core infrastructure	A single bundled image editor, not software nearly every team runs
    No	Popular tool	Bundled consumer image editor, not a framework or developer tool
    No	Exploited in the wild	Hacker News title reports only a disclosed vulnerability, no observed attacks
    No	Public exploit	Hacker News lists no summary or exploit details, only a CVE link
    No	Remote, no login	Hacker News does not state that no credentials or interaction are needed
    Yes	Full takeover	Hacker News: title describes a Remote Code Execution vulnerability
    No	Secrets exposed	No source reports credentials, data or secrets being stolen or exposed
    No	Supply chain	No source reports malicious code shipped through a trusted channel
    No	No fix yet	No source states whether a patched version is available or missing

    Hacker News: Front Page · 15h ago · 💬 57 · Details & share

    What to do

    • Update Microsoft Paint to version 11.2609.401.0 or later
    • If Windows Update does not offer the fix, check the Microsoft Store, as one commenter reported
16. B43

    Vulnerability · critical

    Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads

    Who’s exposed: Rails apps processing user uploads with ImageMagick

    Tier B because: Core infrastructure or popular tool AND remote, no login

    Reach

    Attack

    Damage

    Fix

    Popular tool · Remote, no login

    Checklist · 3 of 10 yes

    Yes	Hits tech teams	Ruby on Rails is a web framework that developers build and run apps with.
    No	Core infrastructure	A single web framework flaw, not software nearly every team runs.
    Yes	Popular tool	Rails is a widely used mainstream web framework.
    No	Exploited in the wild	The Hacker News reports the flaw and fix only; no observed attacks mentioned.
    No	Public exploit	The Hacker News describes the flaw via the advisory; no public exploit mentioned.
    Yes	Remote, no login	The Hacker News: flaw lets an unauthenticated attacker write files by uploading a crafted file.
    No	Full takeover	The Hacker News says arbitrary file write only; code execution or root access is not stated.
    No	Secrets exposed	The Hacker News reports arbitrary file writes; no data theft or exposure mentioned.
    No	Supply chain	The Hacker News describes a flaw in Rails, not malicious code shipped through a trusted channel.
    No	No fix yet	The Hacker News: the Rails project fixed the flaw in versions 8.1.4.1 and later.

    The Hacker News · 2d ago · Details & share

    What to do

    • Upgrade Ruby on Rails to a fixed version, starting with 8.1.4.1, per the Rails advisory
17. B42

    Security · checklist estimated

    Wednesday, November 11, 2026 Security Releases

    The Node.js project announced security releases scheduled for Wednesday, November 11, 2026.

    Tier B because: Full takeover OR secrets exposed OR supply chain

    Reach

    Attack

    Damage

    Fix

    Full takeover

    Checklist · 2 of 10 yes · estimated from older data, not yet checked against the sources

    Yes	Hits tech teams	Does it affect software, devices or services that developers, ops or IT teams build with, run or are responsible for?
    No	Core infrastructure	Is the flaw in, or the compromise of, software that nearly every team runs?
    No	Popular tool	Is the flaw in, or the compromise of, a widely used framework, tool, platform, OS or package?
    No	Exploited in the wild	Do sources report real attacks using it?
    No	Public exploit	Is a working exploit or detailed proof-of-concept public?
    No	Remote, no login	Can an attacker use it over the network without credentials or user interaction?
    Yes	Full takeover	Does it lead to code execution, root/admin rights or full account takeover?
    No	Secrets exposed	Were credentials, tokens, keys, configs, source code or customer data stolen or exposed?
    No	Supply chain	Was malicious code shipped through a channel developers trust?
    No	No fix yet	Is there no patched version yet?

    Node.js Blog · 3d ago · Details & share

18. C22

    Vulnerability · high

    SonicWall warns of unpatched flaws in end-of-life GMS software

    Who’s exposed: Customers running end-of-life SonicWall GMS

    Tier C because: Hits tech teams

    Reach

    Attack

    Damage

    Fix

    No fix yet

    Checklist · 2 of 10 yes

    Yes	Hits tech teams	SonicWall GMS is enterprise firewall management software that IT teams run and are responsible for.
    No	Core infrastructure	Single vendor's management product, not software nearly every team runs.
    No	Popular tool	Niche enterprise management product tied to one vendor's appliances, not mainstream developer tech.
    No	Exploited in the wild	BleepingComputer: the excerpt reports no observed attacks using these flaws.
    No	Public exploit	BleepingComputer: the excerpt mentions only a warning, with no published exploit code.
    No	Remote, no login	BleepingComputer: the excerpt does not state the flaws can be exploited without credentials.
    No	Full takeover	BleepingComputer: the excerpt does not describe code execution or admin takeover.
    No	Secrets exposed	BleepingComputer: the excerpt reports no stolen or exposed credentials, keys or data.
    No	Supply chain	BleepingComputer: the excerpt describes flaws, not compromised packages or updates.
    Yes	No fix yet	BleepingComputer: SonicWall warned that the flaws in end-of-life GMS will not be patched.

    BleepingComputer · 2d ago · Details & share

19. C21

    Vulnerability · high

    Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats

    Who’s exposed: ChatGPT users who enabled Lockdown Mode

    Tier C because: Hits tech teams

    Reach

    Attack

    Damage

    Fix

    Popular tool

    Checklist · 2 of 10 yes

    Yes	Hits tech teams	ChatGPT is a widely used SaaS service that developers and IT teams use daily.
    No	Core infrastructure	ChatGPT is a single vendor's AI product, not foundational software nearly every team runs.
    Yes	Popular tool	ChatGPT is a mainstream, widely adopted AI tool used by many teams.
    No	Exploited in the wild	The Hacker News reports researcher disclosure only; no observed attacks are mentioned.
    No	Public exploit	The Hacker News reports researcher disclosure; no published exploit code or PoC is mentioned.
    No	Remote, no login	The Hacker News says no user interaction is needed, but does not state unauthenticated network access.
    No	Full takeover	The Hacker News describes chat exfiltration, not code execution, admin rights or account takeover.
    No	Secrets exposed	The Hacker News describes researchers demonstrating chat exfiltration; no stolen data is reported.
    No	Supply chain	The Hacker News describes a vulnerability in ChatGPT; no compromised package, update or pipeline is mentioned.
    No	No fix yet	The Hacker News says the vulnerability is now patched.

    The Hacker News · 19h ago · Details & share

20. C21

    Malware · medium

    Residential proxy SDKs found on White House network devices

    Who’s exposed: Several White House staffers' devices using residential proxy services

    Tier C because: Hits tech teams

    Reach

    Attack

    Damage

    Fix

    Checklist · 1 of 10 yes

    Yes	Hits tech teams	Judgment: proxy SDKs on staff computers and phones, which IT teams manage and developers integrate.
    No	Core infrastructure	Judgment: residential proxy SDKs are not core infrastructure like OpenSSH, the Linux kernel or GitHub.
    No	Popular tool	Judgment: niche residential proxy services, not a widely used framework, tool or platform.
    No	Exploited in the wild	Krebs on Security: staffers' devices are equipped with proxy services; no observed attack using a flaw is reported.
    No	Public exploit	Krebs on Security: no exploit code or proof-of-concept is mentioned in the sources.
    No	Remote, no login	Krebs on Security: no unauthenticated remote attack vector is described.
    No	Full takeover	Krebs on Security: no code execution, root access or account takeover is reported.
    No	Secrets exposed	Krebs on Security: the sources report address rental, not stolen credentials, keys or data.
    No	Supply chain	Krebs on Security: no compromised package, update or build pipeline is reported.
    No	No fix yet	Krebs on Security and Hacker News: the sources do not state whether a fix exists.

    Krebs on Security · 2d ago · 2 sources · 💬 388 · Details & share

21. C20

    Vulnerability · medium

    SourceHut Registration Bypass Disclosed as CVE-2026-121728

    Who’s exposed: SourceHut instances with registration disabled

    Tier C because: Hits tech teams

    Reach

    Attack

    Damage

    Fix

    • CVE-2026-121728

    Checklist · 1 of 10 yes

    Yes	Hits tech teams	SourceHut is a developer code hosting and CI service used by software teams.
    No	Core infrastructure	A single niche hosting service, not software nearly every team runs.
    No	Popular tool	SourceHut is a niche forge compared with mainstream platforms like GitHub or GitLab.
    No	Exploited in the wild	Lobsters source gives no summary and reports no observed attacks.
    No	Public exploit	Lobsters source gives no summary and does not say exploit code is published.
    No	Remote, no login	Lobsters source gives no summary and does not say unauthenticated network access works.
    No	Full takeover	Lobsters source gives no summary and does not report code execution or account takeover.
    No	Secrets exposed	Lobsters source gives no summary and reports no stolen or exposed data.
    No	Supply chain	Lobsters source gives no summary and reports no compromised packages, updates or pipelines.
    No	No fix yet	Lobsters source gives no summary and does not say whether a fix exists.

    Lobsters · 17h ago · Details & share

22. C20

    Malware · medium

    Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit

    Who’s exposed: Developers who installed the trojanized Codex jailbreak bundle

    Tier C because: Hits tech teams

    Reach

    Attack

    Damage

    Fix

    Checklist · 1 of 10 yes

    Yes	Hits tech teams	OpenAI Codex is a developer coding agent that developers run, so the injected ads affect dev workflows.
    No	Core infrastructure	The compromise is a malicious jailbreak bundle for one AI agent, not core infrastructure like OpenSSH or npm.
    No	Popular tool	Codex is widely used, but the malicious element is an unofficial jailbreak toolkit, not Codex itself.
    No	Exploited in the wild	The Hacker News reports researchers disclosed the bundle; it does not report observed attacks using it.
    No	Public exploit	The Hacker News does not say exploit code or a step-by-step proof-of-concept was published.
    No	Remote, no login	The Hacker News does not say the bundle can be used over the network without credentials or user action.
    No	Full takeover	The Hacker News describes modifying agent instructions to insert ads; it does not report code execution or admin takeover.
    No	Secrets exposed	The Hacker News does not report credentials, tokens, or data being stolen or exposed.
    No	Supply chain	The Hacker News describes malware in an unofficial jailbreak toolkit, not a compromise of an official Codex package or update.
    No	No fix yet	The Hacker News does not say whether a fix exists or is missing for the affected software.

    The Hacker News · 2d ago · Details & share

    What to do

    • Avoid installing unverified Codex jailbreak bundles
23. D9

    Supply-chain attack · high

    NIKKE PC game launcher hacked to spread remote access, data-stealing malware

    Who’s exposed: PC players who ran the NIKKE game launcher during the compromise

    Tier D because: Does not hit tech teams

    Reach

    Attack

    Damage

    Fix

    Exploited in the wild · Full takeover · Secrets exposed · Supply chain

    Checklist · 4 of 10 yes

    No	Hits tech teams	Consumer PC game launcher for a mobile-origin game; not developer or ops tooling.
    No	Core infrastructure	A single game's launcher, not software nearly every engineering team runs.
    No	Popular tool	Popular with gamers, but not a developer framework, tool, platform, OS or package.
    Yes	Exploited in the wild	BleepingComputer: hackers tampered with launcher scripts and distributed the malware.
    No	Public exploit	BleepingComputer reports no published exploit code or proof-of-concept.
    No	Remote, no login	BleepingComputer describes a supply-chain tampering attack; no unauthenticated network exploit is reported.
    Yes	Full takeover	BleepingComputer: the malware spreads remote access, giving attackers control of victim PCs.
    Yes	Secrets exposed	BleepingComputer: the malware steals credentials and cryptocurrency wallet data.
    Yes	Supply chain	BleepingComputer: hackers tampered with launcher scripts in a supply-chain attack.
    No	No fix yet	BleepingComputer does not say whether a fixed launcher version is available.

    BleepingComputer · 2d ago · Details & share

24. D7

    Incident · medium

    Fake OpenAI and SpaceX Event Invitations Used in Phishing Campaigns

    Who’s exposed: Employees targeted by fake OpenAI, SpaceX and Anthropic event invitations

    Tier D because: Does not hit tech teams

    Reach

    Attack

    Damage

    Fix

    Exploited in the wild · Full takeover · Secrets exposed

    Checklist · 3 of 10 yes

    No	Hits tech teams	Phishing campaign impersonating OpenAI, SpaceX and Anthropic; no developer platform breached.
    No	Core infrastructure	Impersonated brands only; no core infrastructure software is compromised.
    No	Popular tool	Popular brands are impersonated in lures; no tool or package is flawed or compromised.
    Yes	Exploited in the wild	BleepingComputer: hackers use fake event invitations in phishing attacks stealing account credentials.
    No	Public exploit	BleepingComputer reports phishing-as-a-service lures; no exploit code or PoC mentioned.
    No	Remote, no login	Victims must be lured into clicking invitations; no unauthenticated access is described.
    Yes	Full takeover	BleepingComputer: attackers steal Microsoft and Google account credentials and authentication sessions.
    Yes	Secrets exposed	BleepingComputer: attackers stole Microsoft and Google account credentials and authentication sessions.
    No	Supply chain	No legitimate package, update, build pipeline or signing key is reported compromised.
    No	No fix yet	This is a phishing campaign, not a vulnerability, so no patch applies.

    BleepingComputer · 14h ago · Details & share

25. D5

    Malware · high

    Backdoor Found in Firmware Partition of 1.3 Million Set-Top Boxes

    Who’s exposed: About 1.3 million set-top boxes with the backdoored firmware partition

    Tier D because: Does not hit tech teams

    Reach

    Attack

    Damage

    Fix

    Exploited in the wild · Full takeover

    Checklist · 2 of 10 yes

    No	Hits tech teams	Judgment: set-top boxes are consumer home devices, not software developers, ops or IT teams run or build with.
    No	Core infrastructure	Judgment: a consumer set-top box firmware backdoor is not core infrastructure nearly every team runs.
    No	Popular tool	Judgment: set-top box firmware is not a widely used developer framework, tool, platform, OS or package.
    Yes	Exploited in the wild	DEV Community: Google Threat Intelligence Group disclosed a botnet backdoor (XCPE) and dismantled it with partners.
    No	Public exploit	DEV Community summary does not say exploit code or a proof-of-concept was published.
    No	Remote, no login	DEV Community summary does not state how the devices were reached or whether authentication was needed.
    Yes	Full takeover	DEV Community: a backdoor let a remote operator control the compromised devices in a botnet.
    No	Secrets exposed	DEV Community summary does not report credentials, tokens, keys or customer data being stolen or exposed.
    No	Supply chain	DEV Community summary does not say the backdoor was shipped through an official update or build channel.
    No	No fix yet	DEV Community summary does not say whether a patch or fixed firmware is available.

    DEV Community: ai · 2h ago · Details & share

26. D4

    Incident · high

    US government warns of attacks on refrigeration and cooling systems

    Who’s exposed: Industrial refrigeration and cold-chain monitoring systems worldwide, across food, transport and healthcare

    Tier D because: Does not hit tech teams

    Reach

    Attack

    Damage

    Fix

    Exploited in the wild

    Checklist · 1 of 10 yes

    No	Hits tech teams	Judgment: industrial refrigeration and cold-chain OT equipment, not software developers or IT teams run.
    No	Core infrastructure	Judgment: refrigeration control systems are not core infrastructure like OpenSSH or GitHub.
    No	Popular tool	Judgment: industrial freezers and cooling systems are not a widely used developer framework, tool or platform.
    Yes	Exploited in the wild	BleepingComputer: FBI and CISA warn hackers are actively targeting refrigeration systems worldwide.
    No	Public exploit	No source mentions published exploit code or a proof-of-concept.
    No	Remote, no login	No source states the attack vector or whether unauthenticated network access is possible.
    No	Full takeover	No source reports code execution, root access or account takeover; sources cite spoilage and equipment damage risks.
    No	Secrets exposed	No source reports stolen credentials, configs, source code or customer data.
    No	Supply chain	No source reports compromised packages, updates, build pipelines or signing keys.
    No	No fix yet	No source states whether patches or fixes are available for affected systems.

    The Record from Recorded Future News · 17h ago · 3 sources · Details & share

    What to do

    • Harden industrial cooling and refrigeration systems now, as urged by US government agencies