TheHotDrop (@thedailyhotdrop)

.NET 10 on Linux Flaw Lets Attackers Escalate Privileges Hot Drop for 11/12/2026: Incorrect authorization in .NET Core lets an authorized attacker elevate privileges over a network. Microsoft released the advisory on the 10th, and the CVE record lists Microsoft .NET 10.0 installed on Linux before…

Hackers Use AntiFox AI Agents to Raid AWS Accounts Hot Drop for 11/12/2026: Arctic Wolf says attackers are hosting self-managed instances of AntiFox, an open-source agentic pen-testing platform, on Alibaba Cloud to target web services and AWS environments. In one intrusion the IIS worker process…

Hackers Hijacked 4,800 GitHub Accounts to Steal Your Secrets Hot Drop for 11/12/2026: Attackers stole secrets from 61,000 repositories using credentials from more than 4,800 compromised GitHub accounts. StepSecurity says the attack relies on valid tokens belonging to developers and bot accounts…

Exploited Outlook Zero-Day Leaks Your NTLM Hash Hot Drop for 11/12/2026: Microsoft patched an actively exploited spoofing zero-day in Outlook, CVE-2026-124194. It hits Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, and CISA added it to the KEV catalog with a November 24…

Critical MongoDB Flaw Could Let Attackers Run Code on Your Database Hot Drop for 11/12/2026: MongoDB rated CVE-2026-118383 a 9.5 out of 10 on CVSS 4. It's a use-after-free in the replication component of MongoDB Server that hits replica set members, including shards and config servers; standalone…

Chrome Zero-Day Under Attack: Update to 157.0.8103.50 Hot Drop for 11/12/2026: Attackers are already exploiting a zero-day in Google Chrome, and CISA has added it to the KEV catalog. Google says an unnamed third party told it about CVE-2026-125350 on November 6, and it shipped the patch on…

Chrome Zero-Day Exploited, MongoDB Critical Patch, Microsoft Outlook Under Attack Attackers are already exploiting a Chrome zero-day, CVE-2026-125350, and Google's fix is Chrome 157.0.8103.50. MongoDB patched a critical use-after-free in its replication component, rated 9.5, that could let…

Iran Accused of Hacking Supermarket Freezers That Caught Fire Hot Drop for 11/11/2026: On October 10, cyberattacks meddled with French supermarket freezers, causing some to catch fire, and France has officially accused Iran and is seeking international arrest warrants. The Paris prosecutor's…

Vanderbilt Ransomware Attack Exposes Student and Staff Data Hot Drop for 11/11/2026: A ransomware attack at Vanderbilt University appears to have compromised vast amounts of student and employee personal data. The university took several digital services intermittently offline and warned community…

Railway Hack: 1,852 Tokens Stolen, $740K in Unauthorized Charges Hot Drop for 11/11/2026: Hackers exploited Railway's build infrastructure, exposing linked-account tokens belonging to 1,852 users and generating more than $740,000 in unauthorized charges. The attack started October 20 with a…

Fireworks AI Breached Through a Third-Party Cloud Provider Hot Drop for 11/11/2026: Fireworks AI suspects financially motivated criminals involved in LLMjacking, selling unauthorized access to AI models, stole account data, secrets and incomplete models from a limited set of accounts. The incident…

Critical Xen Orchestra Flaw Lets Attackers Hijack VM Servers Hot Drop for 11/11/2026: A critical authentication bypass in Xen Orchestra and the Xen Orchestra Appliance is being actively exploited to hijack virtual machine servers. Remote attackers with network access send a specially crafted…

Outlook Zero-Day Leaks NTLM Hashes, 1,094 Flaws Patched Hot Drop for 11/11/2026: Microsoft's November 2026 Patch Tuesday fixed 1,094 vulnerabilities, including a zero-day attackers are already using to steal hashed Outlook NTLM credentials. CVE-2026-124194 is a spoofing flaw where Outlook fails to…

Outlook Zero-Day Under Attack, Xen Orchestra VMs Hijacked, Iran Blamed for Supermarket Freezer Fires Attackers are already exploiting an Outlook zero-day to steal hashed NTLM credentials, one of 1,094 flaws in Microsoft's November Patch Tuesday. A critical Xen Orchestra authentication bypass is…

Turla's New Cereal Malware Spies on Government Exchange Servers Hot Drop for 11/10/2026: Turla is spying on government Exchange servers with a previously undocumented .NET malware toolkit called Cereal. It turns compromised Microsoft Exchange servers into surveillance platforms and command…

N-able Takes N-central Offline After 33 Zero-Days Published Hot Drop for 11/10/2026: N-able took its cloud platform offline after 33 alleged zero-days were published. According to Field Effect, an independent researcher found authenticated and unauthenticated flaws in N-central, including…

Fake Ruby Gem Steals Secrets and Backdoors AI Coding Tools Hot Drop for 11/10/2026: A fake Ruby gem steals developer secrets and poisons AI coding tools. Installing the package triggers a hidden credential-stealing worm that reads credential stores including cloud, CI and AI coding tool settings…

AI Agent Steals OpenAI and DeepSeek API Keys From Exposed Servers Hot Drop for 11/10/2026: An AI agent is stealing OpenAI and DeepSeek API keys from exposed servers. The operation uses 1,438 fake FOFA accounts to find keys on misconfigured servers, extracts them with regular expressions and, for…

GhostAction Attack Hijacks GitHub Repos to Steal Secrets Hot Drop for 11/10/2026: A new wave of the GhostAction supply chain attack pushed a credential-stealing GitHub Actions workflow into tens of thousands of GitHub repositories. Once active, the malicious workflow collects secrets from the…

2.2 Million Sega Customer Emails Leaked in Vendor Breach Hot Drop for 11/10/2026: 2.2 million Sega customers' email addresses were exposed when attackers breached its newsletter provider Arara, affecting 11 newsletters for Sega and group company Sega Fave. The attacker exploited web server…

Millions of Sega Emails Leaked, GitHub Repos Hijacked, AI Agents Stealing API Keys 2.2 million Sega customers' email addresses were exposed when attackers breached its newsletter provider Arara, then used its systems to send over seven million emails impersonating credit card companies. A new wave…

Hackers Used ARTEX AI to Breach WorkOS Customer Data Hot Drop for 11/09/2026: WorkOS customer contact records and conversation data were exposed in a breach on October 30, 2026. The attacker used the ARTEX AI offensive security framework to automate reconnaissance and exploit attempts against…

Hijacked npm Packages Hide Malware Behind the Ethereum Blockchain Hot Drop for 11/09/2026: Attackers hijacked 10 npm packages and slipped hidden code into 12 releases. The loaders query public Ethereum RPC endpoints, falling back to Blockscout, to find transactions from a specific wallet, then…

WordPress Upgrade Race Condition Opens the Door to RCE Hot Drop for 11/09/2026: WordPress versions 4.7 through 7.1.3 are exposed to remote code execution during upgrades, and attackers have launched more than 240,000 exploit attempts. The root cause is a time-of-check, time-of-use race condition…

Fake GitHub Security Tools Infected 2,000 Machines Hot Drop for 11/09/2026: More than 2,000 computers have been infected by fake security tools on GitHub. The campaign began about two years ago targeting crypto wallet users and has shifted to hit security professionals and blockchain game…

Hackers Hijack Plex Servers on QNAP NAS to Mine Monero Hot Drop for 11/09/2026: Hackers are exploiting a chain of four Plex Media Server flaws that lets a remote attacker run arbitrary code with the privileges of the Plex service without any login. The flaws live in the Plex application itself…

A Long Password Bypasses OpenSSH Login on musl Linux Hot Drop for 11/09/2026: An attacker can bypass password authentication on vulnerable OpenSSH servers. The flaw, tracked as CVE-2026-123158, has existed for over 10 years and affects OpenSSH servers on Linux distributions using musl libc with…

Fake GitHub Tools Infect 2,000 PCs, npm Packages Hijacked, OpenSSH Auth Bypass Under Attack Fake security tools on GitHub have infected more than 2,000 machines with backdoors and information stealers, and the campaign now targets security professionals. Attackers hijacked 10 npm packages and hid…

Microsoft Exposes Needy Mantis, a Malware Framework Built for Long-Term Access Hot Drop for 11/06/2026: Microsoft Threat Intelligence identified Needy Mantis, a modular post-compromise malware framework used in targeted intrusions. The framework combines custom loaders, encrypted archives and…

One Hacker's AI Agents Stole 190,000 Gaming Logins Hot Drop for 11/06/2026: AI agents stole 190,000 gaming credentials and 300 Apple certificates from 10 shops. One operator ran two consoles from October 14 through October 29, targeting 10 certificate signing shops. Check Point Research found…