Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
2 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
Network data confirm the restriction of social media and messaging platforms Facebook, WhatsApp, Instagram and Messenger in Suriname from Friday evening 17 February 2023 local time. The incident came amid ... The post Social media restricted in Suriname amid cost of living protests appeared first on NetBlocks.
First reported Feb 18, 2023 01:09 UTCCatalog metadata updated Oct 13, 2026 10:41 UTCOpen evidence recordNetwork data confirm the restriction of messaging platform Telegram across most of Iraq as of Sunday 6 August 2023, excluding the autonomous Iraqi Kurdistan region. The measure comes as the ... The post Telegram restricted in Iraq over personal data leaks appeared first on NetBlocks.
First reported Aug 06, 2023 14:18 UTCCatalog metadata updated Oct 13, 2026 10:41 UTCOpen evidence recordNetwork data confirm the restriction of Facebook, Telegram and TikTok in Ethiopia on Thursday 9 February 2023, with YouTube subsequently restricted on Friday. The incident comes amid anti-government protests sparked ... The post Social media and messaging apps restricted in Ethiopia amid religious tensions appeared first on NetBlocks.
First reported Feb 09, 2023 19:40 UTCCatalog metadata updated Oct 13, 2026 10:41 UTCOpen evidence recordLinux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection. Threat actors are known to name their malicious software after a legitimate operating system component or a process as a defense evasion measure. By borrowing the name of a real binary, it may
First reported Oct 06, 2026 18:24 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordCitrix has released patches for yet another critical security flaw impacting NetScaler ADC and NetScaler Gateway that could result in remote code execution or denial-of-service (DoS) under certain conditions. "CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial-of-service under specific configuration conditions," Citrix said. The vulnerability
First reported Oct 09, 2026 08:11 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordThree research teams broke into Google's Pixel 10 on October 8 at Pwn2Own Ireland, a hacking contest in Cork whose rules require every target to be fully patched. The contest pays researchers to show working exploits and passes the flaws to the vendors. One of the three Pixel exploits earned Ikotas Labs $300,000, the contest's top prize, and made the team the overall winner. Trend Micro's Zero
First reported Oct 09, 2026 08:26 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordCybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure," iVerify said in a new report published Thursday. The name
First reported Oct 11, 2026 04:24 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordCybersecurity researchers are calling attention to a new malware family that has been observed targeting exposed artificial intelligence (AI) and large language model (LLM) infrastructure with an aim to deploy cryptocurrency miners and further expand the scale of the botnet. The financially motivated campaign, dubbed Canto Incognito, has been found to install cryptocurrency miners, including
First reported Oct 07, 2026 15:33 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordCybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have
First reported Oct 07, 2026 17:43 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordThe npm package known as "tensorlake," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious version 0.5.144 "contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code," Socket said
First reported Oct 08, 2026 05:46 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordA malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows before it runs a macro. The attack works only when the program's Java support is enabled. So far, it has only been shown as a proof of concept, and there are no reports of its use in
First reported Oct 06, 2026 11:57 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordA maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The
First reported Oct 12, 2026 09:02 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordCybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks. The activity, per CrowdStrike Intelligence, was active from late September to early October 2026, and resulted in data exfiltration from various South Korea-based financial firms,
First reported Oct 08, 2026 14:12 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordSecurity researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root access before anyone approves the connection. AnyDesk patched the flaw in version 8.0.3 in June, but its changelog described the fix only as "fixed a bug that could lead to a crash," with no CVE assigned and no security
First reported Oct 09, 2026 12:59 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordThe crooks have trust problems of their own. One ransomware affiliate decided to keep the profits for himself. Elsewhere, an attacker left a server exposed, complete with tools and traces of an intrusion. Apparently, keeping things secure is a problem on both sides of the fence. The rest of the week isn't much more reassuring. Malicious code turned up in developer packages and extensions that
First reported Oct 08, 2026 17:58 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordAttackers compromised three country-code top-level domains (ccTLDs) and obtained unauthorized HTTPS certificates for several Google domains, Google said on October 6. Google's own systems were not breached, but any domain ending in .gh (Ghana), .sl (Sierra Leone) or .as (American Samoa) was put at risk. With such a certificate, an attacker could pose as the real site over an encrypted
First reported Oct 07, 2026 18:48 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordLow-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies. The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa. The preinstalled
First reported Oct 13, 2026 06:00 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordAttackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaws, the JPCERT Coordination Center (JPCERT/CC) said. The Tokyo-based center, which takes incident reports, based its October 8, 2026 alert on those reports and other information. The alert names no attacker and no affected organization. JPCERT/
First reported Oct 08, 2026 15:45 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordA critical vulnerability in LMCache, open-source software that speeds up large language model (LLM) servers such as vLLM, lets an attacker run code on the cache server without logging in, and no fixed version is available. The flaw is in LMCache's multiprocess mode, where the cache runs as a standalone server that LLM workers reach over the ZeroMQ messaging library. A single network
First reported Oct 07, 2026 15:34 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordA bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's .onion address using only public information, and then take that address over. Searchlight Cyber, which disclosed the flaw on October 8, says an attacker who recovers the key can redirect the site's visitors to a copy of the site they control.
First reported Oct 09, 2026 09:03 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordThreat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker "to direct the appliance to issue requests on their
First reported Oct 12, 2026 10:36 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordThe FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X. ShinyHunters is the extortion group that said in September it had breached the FBI's jobs portal and stolen sensitive data on almost all FBI agents and job applicants. The FBI has not named the suspect, and no charges have been made public. The
First reported Oct 09, 2026 17:45 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordSome meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves.
First reported Oct 12, 2026 15:16 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordThe personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up. Regardless, the tech world is mesmerized by the capabilities and potential of these services. Less than a year
First reported Oct 12, 2026 11:55 UTCCatalog metadata updated Oct 13, 2026 10:39 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.