Talk to an expert
PricingNewsTalk to an expert
Newsroom

Security news, straight from the field.

Threat intelligence, breach breakdowns and the latest from 4Tify — written by the engineers who do the work.

Threat IntelFEATURED

AI-Driven Espionage at Scale: Vapor Panda Turns the ARTEX Framework on 200+ Organizations

A China-linked espionage group used the LLM-driven intrusion framework ARTEX against more than 200 government, telecom and industrial targets in two weeks, with one human operator steering swarms of AI agents.

Oct 30, 2026·5 min readRead article
Threat Intel

WordPress Core Upgrade Flaw Under Attack: Nearly 63,000 Exploit Attempts in 24 Hours

A high-severity remote code execution flaw in WordPress Core 4.7 through 7.1.3 is being probed at scale just days after the 7.1.4 fix shipped. The bug hides in the temporary staging folder used during full core upgrades. Here is who is exposed and what to do now.

Oct 30, 2026·5 min read
Threat Intel

Trezor Wallet Bought From Reseller CryptoBilis Allegedly Hid a Cellular Implant Leaking Recovery Phrases

A customer in Indonesia found an extra circuit board inside a Trezor Safe 5 bought through reseller CryptoBilis. Trezor says the board appears to capture the recovery phrase and transmit it over a mobile network, and is telling every CryptoBilis buyer since March 2026 to move their funds now.

Oct 30, 2026·5 min read
Threat Intel

Critical Fixes Stuck in Detect Mode? A Four-Step Loop Gets Them Enforced

Security fixes stall when operations teams lack proof a change is safe. The Observe, Prove, Act, Confirm loop turns the protections you already own from detect-only into enforced, with evidence at every step.

Oct 30, 2026·6 min read
Threat Intel

Syrian Electronic Army Hacker Sentenced to 42 Months for the Fake AP Tweet That Rattled Markets

Ahmad Umar Agha, the Syrian Electronic Army operator known as Th3Pr0, has been sentenced to 42 months in a U.S. prison for a years-long phishing and account-hijacking campaign against Western media, businesses and government bodies, including the 2013 fake Associated Press tweet that briefly erased about $136 billion in stock-market value.

Oct 30, 2026·6 min read
Threat Intel

Trojanized Claude Code Extension Hit Cursor Users With an SSH Backdoor

A tampered build of Anthropic's official Claude Code extension was served through the Cursor marketplace under the legitimate publisher identity. Version 2.1.313 planted an attacker SSH key, set up persistence and beaconed host details. Up to 5,000 users were exposed.

Oct 30, 2026·6 min read
Threat Intel

Drupal Commerce Core Access Bypass Is Being Exploited in the Wild: Patch Now

A missing-authorization flaw in Drupal's Commerce Core module (CVE-2026-118539) is under active exploitation, exposing routes and entity fields that can cost merchants money. Fixed in 3.3.13 and 8.x-2.41. Here is what to check.

Oct 30, 2026·5 min read
Threat Intel

CISA Flags Actively Exploited GitLab RCE and Cisco Firewall DoS Bugs

A CVSS 10 unauthenticated RCE in GitLab and a crash bug in Cisco ASA/FTD firewalls joined the KEV catalog after real-world attacks, including a near-miss against Alpine Linux's own GitLab server. Patch deadline: 1 November.

Oct 30, 2026·5 min read
Breach

Binance Hit by the Largest Crypto Heist on Record: $6.3 Billion Exposed, Nearly Half Frozen

A compromised DevOps laptop opened a path to Binance's withdrawal infrastructure. Roughly $6.3 billion was affected, about $3 billion has been frozen on-chain, and the trail points to North Korea's TraderTraitor.

Oct 30, 2026·6 min read
Threat Intel

GitLab CVSS 10 RCE and Cisco Firewall DoS Land on CISA's Exploited-Vulnerabilities List

CISA has added a maximum-severity GitLab remote code execution flaw and a Cisco Secure Firewall denial-of-service bug to its KEV catalog after confirmed exploitation. The GitLab bug has already been tried against Alpine Linux's own infrastructure. Patch deadline: 1 November 2026.

Oct 30, 2026·5 min read
Threat Intel

Drupal Commerce Core Authorization Bypass Is Being Exploited in the Wild

Drupal has confirmed that CVE-2026-118539, a highly critical missing-authorization flaw in the Commerce Core module, is under active exploitation. Shops on the 2.x and 3.x branches need to move to 8.x-2.41 or 3.3.13 now and check their logs.

Oct 30, 2026·5 min read
Threat Intel

Trojanized Claude Code Extension Planted an SSH Backdoor on Developer Machines

A tampered build of the Claude Code VS Code extension was served from Cursor's marketplace for about eleven hours on 29 October 2026, planting an SSH key, cross-platform persistence and an HTTP beacon on up to 5,000 developer machines. Here is what it does and how to clean it up.

Oct 30, 2026·7 min read
Threat Intel

FreePBX Malware Now Steals SIP Trunk Credentials So Phone Fraud Survives a Rebuild

The INJ3CTOR3 campaign against FreePBX and Asterisk servers has added a credential-theft stage: trunk passwords, database logins and mail secrets are uploaded every minute, so attackers can keep billing calls to a victim long after the server is wiped.

Oct 29, 2026·6 min read
Threat Intel

Cisco ASA and FTD VPN Flaw Under Active Attack Can Knock Firewalls Offline

Cisco has fixed CVE-2026-76418, a high-severity bug in the SSL remote-access VPN of ASA and FTD firewalls that lets an unauthenticated attacker force a device reload. Exploitation is already underway, so patch and check your tunnel-group settings now.

Oct 29, 2026·5 min read
Threat Intel

GitHub's New npm Firewall Blocks Risky Packages Before They Install

GitHub has opened a public preview of a package firewall that sits between developer machines, CI runners, AI coding agents and the npm registry. It refuses known malware, attestation downgrades, freshly added install scripts and brand-new versions before they ever land on a system.

Oct 29, 2026·5 min read