Every AltTabDaily "Am I affected?" guide in one place, newest first: who is hit, how to check, and what to do.
Last updated
Part of Cybersecurity · AltTabDaily Tech News
Railway's Nov 10 incident report: attackers decrypted variables for at most about 100,000 workspaces, mostly hunting AI keys, with about $740,000 in estimated unauthorized charges. How to check and what to rotate.
A researcher found a password in Wyndham's Android app that opened a customer database. Wyndham revoked it and says it has no evidence of unauthorized access. Here's what was exposed and what to do.
SonicWall disclosed an actively exploited SSL-VPN flaw (CVE-2026-19868) that can skip SAML MFA when alternate credentials work. Who's affected, fixed versions, and how to check your logs.
A viral-style X post put an $800K hiring quote on a 55-minute AI workshop. The quote isn't in the video. Here's a five-step check you can run yourself.
A marketing vendor breach exposed Who Gives A Crap customers' names, emails, phone numbers, mailing addresses and total spend in the US, UK and Australia. No payment details or passwords. Here's how to check and what to do.
Zero Day Initiative disclosed three Philips Hue Bridge Pro flaws on Nov 6, including an 8.8-rated login bypass for attackers on your home network. Firmware 6.1.2071524030 (Sept 24) or later fixes them.
Alpine Linux warned Nov 5 that openssh-server built without PAM can accept a very long password for key-only accounts (CVE-2026-123158). Update openssh, restart sshd, or set PasswordAuthentication no.
DreamHost says attackers accessed its web File Manager and took FTP/SFTP passwords for users who logged in from about August through Oct 23, 2026. Here's how to check and what to do.
mSecure says someone took an encrypted copy of a user database. It only involves people who sync with mSecure Cloud. Here's how to check which sync you use and what to change today.
Starlink is testing Residential prices that move about 20% up or down by location, from bills on or after Nov 30. What's changing and how to check yours.
Google says device maker Videostrong built the XCPE backdoor into more than 1.3 million Android TV boxes. Who's affected, how to check your box in a few minutes, and what to do if it matches.
Synology says C3RB3R ransomware is hitting NAS boxes running outdated DSM. Who's affected, how to check your DSM version in a minute, and why the fix is the latest DSM build for your version line.
An upgrade-window race bug in WordPress core (CVE-2026-119977) affects versions 4.7 through 7.1.3 and is drawing attack attempts. It's fixed in WordPress 7.1.4 and backport releases. How to check your version and what to do now.
A remote use-after-free in Linux's IPv4 TCP code (CVE-2026-98432) dates back to kernel 4.4. Debian, SUSE, Oracle and some Amazon Linux kernels are fixed; Ubuntu and RHEL fixes were still in progress on Oct 31, 2026. How to check your kernel and what to do now.
Attackers moved about $6.3 billion out of Binance wallets on 29 Oct 2026. Binance says user funds are safe and it will cover all losses; about $3 billion is frozen. Withdrawals are still paused; Binance is targeting a Sunday, Nov 1 restart.
CISA added the Brotli decoder bug CVE-2026-111497 (Node2Shell / Broccoli2Shell / HTTP2Shell) to its Known Exploited Vulnerabilities catalog on 27 Oct 2026, with a 10 Nov federal due date. Run node --version and upgrade to 22.23.4, 24.22.1 or 26.12.1 or later.
Anthropic's Frontier Red Team says an internal Claude model found and chained critical bugs into five attacks, including one-click Chrome code execution and zero-click Linux root. Google's Chrome 156 (27 Oct 2026) ships 52 security fixes, several credited to Anthropic and Claude.
On 26 Oct 2026 CISA added CVE-2026-109618 and CVE-2026-109619 (php2shell) to the Known Exploited Vulnerabilities Catalog with a 29 Oct due date for FCEB agencies. Honeypot evidence from 24 Oct showed working shells on unpatched PHP 8.4.26 under Apache mod_php.
Attackers breached GMO Internet's Onamae Desktop Cloud, a Windows VPS service used by FX and stock traders. Up to 26,739 servers are affected, logins saved in trading tools were taken, and the attacker demanded about ¥8 billion. On 27 Oct 2026 GMO confirmed a leak, refused to pay and announced a $1 million bounty.
An out-of-bounds write in Google's Brotli decoder (CVE-2026-111497, CVSS 4.0 9.2 from the CNA) can be triggered by crafted compressed data. Fixed Brotli, Node.js, Bun, Envoy, Istio and Python releases shipped 21–23 Oct 2026.
Unauthenticated RCE fixed in PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. CISA urges immediate patching; Cloudflare WAF is mitigation only. Monday checklist for IT/ops.
