Keystone wallet breach exposes buyers' home addresses

If you've ever bought a Keystone hardware wallet, someone else may now have your name, your phone number and the address it was posted to. The company says a third party pulled customer shipping records out of its online store.

Continue the story · 4 min read+ Follow Hacking

1. Hacking·24 Oct·5 min read

   PHP flags new flaw CVE-2026-115560 after PHP2Shell

   PHP says set session.upload_progress.enabled=0 to block CVE-2026-115560, a new and unlikely RCE path. It follows the PHP2Shell fixes of 21 October.
2. Hacking·23 Oct·4 min read

   Capcom ID breach exposes 11.8 million email records

   Capcom says a hacker got into CAPCOM ID and reached 11,774,247 email and login records worldwide. Passwords were changed on 196 accounts.
3. Hacking·19 Oct·5 min read

   OpenCode breach exposes saved AI keys for 1.4% of users

   OpenCode says a breach hit 1.4% of its Console users and may have exposed saved OpenAI and Anthropic keys. Users are told to revoke and replace them.
5. Hacking·18 Oct·6 min read

   ConnectWise backup app hijacked to break into Microsoft 365

   Hackers used a stolen ConnectWise Cloud Backup credential to sign in to at least 162 Microsoft 365 tenants. ConnectWise shut the service on 17 October.
6. Hacking·17 Oct·5 min read

   Victoria Police warn of AI fake-doctor gift card scam

   Victoria Police say scammers clone doctors' voices with AI to push Mandarin speakers into buying gift cards. One victim lost $50,000.
7. Hacking·17 Oct·5 min read

   Ransomware negotiator charged, ShinyHunters link reported

   Edward Dubrovsky was arrested in Pennsylvania on 8 October on extortion charges. Sources link the case to the FBI's ShinyHunters probe.
8. Hacking·17 Oct·4 min read

   Scamwatch warns of investment scams in WhatsApp groups

   Scamwatch's 28 September alert says investment scams are spreading through hobby WhatsApp groups, trusted referrals and fake news pages.
9. Hacking·17 Oct·5 min read

   Poole Group probes LockBit listing and data threat

   Sunshine Coast firm Poole Group told Cyber Daily it's investigating a cyber incident after LockBit claimed an attack and set a 25 October countdown.
10. Hacking·17 Oct·4 min read

    NZ warns firms about North Korean IT freelancers

    New Zealand's NCSC and Police warned on 1 October that North Korean IT workers are using false identities to land remote jobs.
11. Hacking·17 Oct·6 min read

    Napoleon Perdis says 340,000 records hit in supplier hack

    Napoleon Perdis told customers almost 340,000 records were exposed when supplier Retail Express was hacked, the ABC reports.
12. Hacking·17 Oct·5 min read

    Microsoft's record Patch Tuesday fixes exploited zero-day

    Microsoft's October update covers about 1,413 flaws, including a Windows Shell Mark of the Web bypass already under attack.
13. Hacking·17 Oct·5 min read

    IDC Frontier finds no data leak after cloud ransomware

    IDC Frontier says it found no sign of data theft after the 7 October ransomware attack on IDCF Cloud, and 194 of 495 customers can recover backups.
14. Hacking·17 Oct·5 min read

    Hunter Neurology probes n0n ransomware patient-data claim

    Hunter Neurology is investigating a claim by the n0n ransomware group, reported on 15 October, that it stole tens of thousands of patient files.
15. Hacking·17 Oct·6 min read

    GitLab fixes 10 out of 10 flaw letting attackers run code

    GitLab bug CVE-2026-97229 lets a booby-trapped pattern in a build file run code on self-hosted servers. Fixed in 19.4.2, 19.3.5 and 19.2.8.
16. Hacking·17 Oct·5 min read

    North Korea's fake job interviews infect 30,000 devices

    A joint advisory says North Korea's WaterPlum group used fake job interviews to infect 30,000 devices and drain more than 7,000 crypto wallets.
17. Hacking·17 Oct·4 min read

    Collabora Nextcloud app flaw CVE-2026-110447 exploited

    Attackers exploited CVE-2026-110447 in Nextcloud's Built-in CODE app from 10 September. Version 26.4.303 fixes it. Here's what to check.
18. Hacking·17 Oct·5 min read

    CISA adds five old bugs, one from 2015, to KEV list

    CISA added flaws in ProFTPD, BIND, Struts, ONLYOFFICE and Strapi to its KEV list on 8 October, with an 11 October federal deadline.
19. Hacking·17 Oct·5 min read

    Zammad helpdesk bugs land on CISA KEV list

    CISA added Zammad CVE-2026-102489 and CVE-2026-102490 to KEV after DIVD reported session and privilege-escalation flaws under attack.
20. Hacking·17 Oct·5 min read

    Qilin claims Chadwick Switchboards data leak

    Qilin says it stole and published data from NSW maker Chadwick Switchboards, Cyber Daily reported on 16 October. Chadwick hasn't confirmed a breach.

Say hello in our guest book