Hackers Drain Bitcoin Hot Wallets on BTCPay Servers as Project Urges Immediate Shutdown
BTCPay Server has issued an urgent warning after…
Updated 4 minutes ago
Tech news, decoded.
AI, security, automation, cloud and self-hosting — explained without the noise.
Trending now
Latest articles
Fresh from the blog: news, security alerts and hands-on how-tos. Keep scrolling for more.
Critical CVE-2026-112816: LXD and MicroCloud Permit Trusted Client Impersonation (CVSS 10.0)
A newly disclosed critical vulnerability affecting Canonical's LXD and MicroCloud allows an attacker to authenticate as a trusted client without possessing that client's private key. Because the flaw undermines the server's certificate checks during mutual TLS authentication, an attacker with network access to the HTTPS API and a trusted client's public certificate can present a crafted certificate chain and be accepted as the trusted identity. Canonical has released patched snap…
NetamLoader: .NET Injection Attack Hits Government Windows 10 Build in Asia
Cybersecurity researchers have disclosed a sophisticated multi-stage intrusion that targeted a government-only Windows 10 build in Asia using a previously undocumented .NET assembly-loading framework dubbed NetamLoader. Kaspersky researchers who investigated the artifact say the sample was discovered in the first half of 2026 and was packaged inside a Windows cabinet (CAB) archive placed in a directory normally used for Windows update packages. The operation appears to have used AppDomainManager injection…
How TraderTraitor Pulled Off a $6.43B Heist and Where the Stolen Crypto Went
The U.S. Federal Bureau of Investigation (FBI) has publicly attributed the theft of $6.43 billion in virtual assets to TraderTraitor, a North Korea–linked hacking cluster. Working with the U.S. Secret Service and the IRS Criminal Investigation unit, investigators say the group converted a large share of the stolen funds into Ethereum and began moving assets through decentralized finance (DeFi) and instant-swap services as part of a multi-stage laundering effort. The…
Supply-chain Compromise Drains $2.7M from Polymarket After DebugBear Script Hijack
A malicious change to a third-party page-speed script on Polymarket’s site allowed attackers to use signed-in traders’ browser sessions to sell positions and siphon funds on October 29. The injected code targeted only Polymarket’s copy of a DebugBear real user monitoring (RUM) script and moved crypto to an attacker-controlled wallet in under an hour. Polymarket says it will refund roughly $2.7 million to affected wallets and is returning a total…
OpenAI Cuts Fundraising Target to $20 Billion as Investor Interest Wanes
OpenAI has reportedly lowered the target for its latest private fundraising round, a move that signals softer demand for one of the most closely watched companies in AI. Previously reported targets ranged as high as $30 billion at valuations around $1.4 trillion and $1.25 trillion; according to multiple reports, the company has now set a $20 billion goal with an initial close expected to be smaller. What changed in the…
Ivanti Connect Secure Exploit Chain Achieves Unauthenticated Root Access
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two Ivanti Connect Secure (ICS) vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation. Security researchers documented an exploit chain that combined multiple flaws to yield unauthenticated root-level code execution, and Ivanti has released updates to address the issues across affected releases. The flaws involved CVE-2026-111357 — A high-severity (CVSS 8.8) missing-authentication-for-a-critical-function vulnerability that could allow…
Chainalysis Confirms Customer Data Exposure After Attackers Used “Offensive Agentic Techniques”
Blockchain analytics firm Chainalysis has disclosed a security incident after attackers used what the company described as "offensive agentic techniques" to gain unauthorized access to internal systems and tools. The company says some customer information—names, email addresses, user IDs, and organizational role labels—was accessed, but it has found no evidence that sensitive investigation data, authentication credentials, or session tokens were exposed. Chainalysis is still determining the full scope of accessed…
Reddit’s move to make full content available only to logged-in users
For two decades, Reddit allowed most of its content to be browsed without an account. That era is changing: co‑founder Steve Huffman announced the company will gradually shift toward a “logged‑in service,” limiting some content for visitors who aren’t signed in. The stated goals are straightforward—deliver better personalization for members and reduce unauthorized data harvesting that has become a persistent problem for the platform. Why Reddit is changing access Huffman…
Cursor: Malicious Claude Code Extension in VS Code Marketplace Carried SSH Backdoor for 11 Hours
Cursor confirmed that weaponized builds of the Claude Code extension briefly appeared in its Visual Studio Code extension marketplace on October 29, 2026. For roughly eleven hours those tampered packages attempted to harvest host details and install an SSH backdoor intended to provide persistent remote access. Cursor says the compromised builds were not produced by Anthropic and that distribution was limited to specific versions of the extension. Timeline and affected…
Chainalysis Confirms Agentic Cyberattack That Exposed Customer Account Details
Chainalysis has confirmed a cyberattack that used what the company described as “offensive agentic techniques” to access internal systems and tools, exposing customer account information. The firm says the incident was detected in October and that it has notified affected customers while engaging outside cybersecurity experts to investigate and harden its platform. What Chainalysis says about the incident Chainalysis reported that an external attacker accessed user IDs, full names, email…
TeamViewer Bug Lets Remote Hosts Crash or Run Code Against Technicians
A recently disclosed vulnerability in TeamViewer can turn an ordinary remote support session into a serious risk for the technician on the other end. Tracked as CVE-2026-111585 and rated High with a CVSS score of 8.8, the flaw lets a malicious host crash the viewer application and, in some cases, execute code on the technician’s machine after a connection has been established. How the flaw works TeamViewer separates sessions into…
Inside the 60,471 Attempts: What the WordPress 7.1.4 Patch Actually Stopped
Hackers flooded WordPress sites with tens of thousands of requests targeting a Core remote code execution (RCE) weakness in the hours after a security patch was released. Wordfence’s threat intelligence recorded 60,471 blocked attempts in a 24‑hour window — a clear signal that attackers were actively probing the update process, even though the majority of those requests were firewall‑blocked and not confirmed compromises. What attackers were trying to exploit The…