Breaches Breaches
Incident reporting: who got in, how long they stayed, and what it cost.
Breaches 
Breaches
Railway urges credential rotation after unauthorized access to environment variables
The cloud deployment platform detected suspicious activity affecting systems storing customer secrets and confirmed that some decrypted environment variables may have been accessed by an unauthorized party.
Breaches
LiteLLM supply-chain attack distributes credential-stealing malware across PyPI and Docker
Attackers compromised the LiteLLM release pipeline to push a malicious version that harvests cloud credentials, AI secrets, and developer keys from affected systems across Windows, Linux, and macOS.
Breaches
Interpol-led Operation Serengeti III dismantles nearly 11,000 African cybercrime networks, recovers $105 million
A coordinated law enforcement action across 21 countries has shut down thousands of malicious networks and arrested over 1,400 suspects in a sweeping crackdown on business email compromise, ransomware and fraud schemes across Africa.
Breaches
Onamae Desktop Cloud breach affects 26,739 Japanese VPS customers; servers taken offline
GMO Internet's Onamae.com confirmed unauthorized access to its Desktop Cloud infrastructure and installation of malware across thousands of customer environments, prompting a service shutdown beginning October 21.
Breaches
Lazarus Group Deploys Post-Quantum Cryptography in South Korean Malware Campaign
North Korean-linked attackers are leveraging ML-KEM, a NIST-standardized post-quantum algorithm, to encrypt malware payloads in a sophisticated operation targeting South Korean firms. The campaign, dubbed FlashHole by Kaspersky researchers, chains together multiple custom tools to evade detection.
Breaches
SafePay ransomware has targeted over 600 critical infrastructure organizations globally, CISA warns
A joint advisory from CISA, FBI, and international law enforcement details how the SafePay ransomware gang has breached more than 600 critical infrastructure entities worldwide since August 2024, exploiting VPN access and credential theft.
Breaches
TeamUpdraft breach exposes UpdraftCentral keys; attackers backdoor WordPress sites at scale
A compromised TeamUpdraft infrastructure led to theft of UpdraftCentral connection keys, which attackers are now using to inject malicious plugins and administrator accounts into hundreds of thousands of WordPress sites.