Cybersecurity News

Mittwald: German web host breached through its AI assistant connector (MCP server)

German hosting provider Mittwald disclosed on 7 November 2026 that an attacker got into its platform through the MCP server it offers so customers can connect AI assistants to its…

HostingMCPAI

Crédit Mutuel Arkéa confirms an attack that enabled fraudulent transfers, reportedly through a service provider

French banking group Crédit Mutuel Arkéa says an attack allowed fraudulent transactions before it suspended some flows and brought the incident under control. Customers’ assets ar…

Supply chainBanking

cPGuard: a hijacked update channel pushed a root backdoor to about 2,950 Linux servers

OPSSHIELD, the vendor of the cPGuard server security suite, says an attacker broke into its billing server and used a stolen key to publish a fake update on 2 November 2026. For a…

LinuxcPGuardSupply chain

Polymarket: a hijacked third-party monitoring script drained traders’ wallets, $3.9 million refunded

On 29 October 2026, a performance-monitoring script supplied by a service provider and loaded on polymarket.com was replaced with malicious code. It used the sessions of users who…

Supply chainJavaScriptWeb

Binance: $6.3 billion stolen from its hot wallets, a DevOps laptop as the first lead, and the FBI points to North Korea

Binance confirms that its hot wallets were compromised on 29 October, with losses of about $6.3 billion, and first traced the intrusion to a DevOps engineer’s laptop before findin…

CloudDevOps

Chainalysis confirms intrusion into its internal tools: customer user names and e-mail addresses accessed

Blockchain analysis firm Chainalysis says an external actor reached its systems and internal tools in October, using what it calls offensive agentic techniques. Customer user iden…

CloudSaaS

Northflank security incident: customers told to treat every stored secret as stolen after AI keys are abused

Cloud platform Northflank disclosed a security incident on 30 October and told all customers to assume their environment variables were decrypted. Users have since reported unauth…

CloudDatabases

OVHcloud CLI: official binaries replaced with a secret-stealing malware on GitHub for 1 h 33

On 19 October 2026, a compromised OVHcloud developer account was used to replace the GitHub release files of ovhcloud-cli v0.11.0 to v0.15.0 with a trojanised build that steals SS…

OVHSupply chainCloud

ConnectWise Cloud Backup: attackers hijacked the service’s Microsoft 365 identities, MSPs must audit every customer tenant

ConnectWise has confirmed unauthorised access to the application identities of its Cloud Backup service, formerly SkyKick, which connect to the Microsoft 365 tenants of managed se…

Microsoft 365Supply chainCloud

US federal bankruptcy courts stop sending notices after a cyberattack at their contractor

The US judiciary says a cybersecurity incident at BAE Systems, which runs the Bankruptcy Noticing Center for the courts, has taken its websites offline and halted the production o…

Supply chainGovernment

Vacaf, France's family holiday-aid platform, hit by a data breach claimed by a hacker

Vacaf, the holiday-aid service of France's family-benefit funds, was hit by a cyberattack. The attacker claims about 1.2 million files — names, children, benefit details — a figur…

Vacafdata breachphishing

Hundreds of French supermarkets hit as attackers hijack Danfoss refrigeration controllers

During the night of 11 to 12 October 2026, attackers took control of Danfoss refrigeration supervisors in French supermarkets and forced fridges and freezers to heat up. CERT-FR i…

DanfossOT

FBI breach: attackers got in through a PeopleSoft patch a contractor never installed

The FBI says the theft of personal data on thousands of its staff happened because a contractor did not apply a security patch to a platform it managed. According to Reuters, that…

OraclePeopleSoft

France’s cybersecurity agency hit through Metabase: the “harmless” internal tools nobody watches

ANSSI, the French national cybersecurity agency, has confirmed that 118 accounts of its innovation lab were compromised through a critical zero-day in Metabase, a self-hosted dash…

Metabase

Denmark: 8.8 million people exposed after attackers used a contractor’s access to the national population register

Attackers reached Denmark’s CPR, the central population register, through the legitimate access of a private company allowed to query it. Names, addresses and personal ID numbers …

Tax data stolen from France’s DGFiP: what ANSSI’s incident report teaches every company

ANSSI has published its investigation into this summer’s data thefts at the French tax administration. Its conclusion: no sophisticated attack, but stolen passwords, missing multi…