Ledger confirmed that devices sold through Southeast Asian reseller CryptoBilis contained a hardware implant hidden behind the display, capturing 24-word recovery phrases during setup and transmitting wallet keys over a mobile network. According to Bitquery, unconfirmed by Ledger, suspected losses reach $93.2 million across 315 wallets on six chains; Tether has frozen roughly $10 million in USDT.
PHP shipped out-of-band releases today for two critical use-after-free bugs enabling unauthenticated remote code execution. Sites running PHP - especially onion services - should update and restart all workers now.
The blockchain-analytics firm says an external actor used AI-driven “offensive agentic techniques” to access its systems and internal tools, exposing user IDs, names, email addresses and role labels. Investigation content and credentials were not accessed, according to the company.
A malicious script injected through a compromised third-party vendor hit Polymarket's front end and drained an estimated $2.7 million from about 700 users, according to Bubblemaps monitoring. Trading has resumed, the company has promised full reimbursement, and it is the platform's second vendor-origin compromise in 2026.
Slovak intelligence dismantled an EU-funded NERO R-ONE camera and found a rebadged Russian CORDON PRO.M with two modems and a hidden SMS-triggered backdoor tied to twelve Russian phone numbers.
A single actor behind the CameraSwarm campaign compromised at least 14,530 Dahua IP cameras across Ukrainian, Russian and CIS networks in 35 days, leaning heavily on the 2021 authentication bypasses CVE-2021-33044 and CVE-2021-33045. The operation only came to light because the attacker left his own toolkit exposed online.
The FortiBleed leak exposed admin credentials for tens of thousands of internet-facing FortiGates across 194 countries. Within days of CISA's emergency advisory, an initial access broker was selling bulk US device accesses on Darkforums with forum escrow.
A seller claims a full extraction of a Korean food-delivery platform's unauthenticated Firebase backend: 47.9 million records including door codes, resident registration numbers, plaintext passwords, and live payment keys. The listing is unverified, but the pattern behind it is the most reliable supply line feeding dark-web data markets.
Connor Riley Moucka pleaded guilty to breaching 165 Snowflake customer accounts and selling the haul on hacking forums - and his own sales threads are now evidence in a case that could put him away for 32 years.
The FBI and IRS Criminal Investigation seized hundreds of NetNut domains on July 2, 2026, exposing a residential proxy network built on two million compromised smart TVs. For Tor users, it is another reminder that anonymization infrastructure keeps collapsing under law-enforcement pressure.
Intelligence firms and US agencies have moved past asking whether criminals use AI. Flashpoint's monthly reporting, a joint NSA and FBI advisory, and two documented intrusion cases show exactly where large language models now sit inside illicit workflows.
A ransomware affiliate posing as a recovery service contacted victims mid-attack, offering decryptors and data deletion for a fee. How the double-dip scam works, the red flags, and what legitimate incident response actually looks like.
