https://itdef.net/ja/learn/aomei-backupper-update-server-tampering-2026ITDja2026-10-31AOMEI Backupperの更新サーバー改ざん（2026年4〜7月）：対象になりうる人、日時、自分のPCの確かめ方 https://itdef.net/ja/learn/binance-crypto-theft-2026ITDja2026-10-31Binanceの暗号資産流出（約63億ドル）：利用者の資産は補償されるのか、利用者がやること https://itdef.net/ja/learn/cisco-catalyst-sd-wan-manager-cve-2026-76504ITDja2026-10-31Cisco Catalyst SD-WAN Managerの脆弱性 CVE-2026-76504：ログインなしで管理者として操作される、悪用を確認（修正版へ更新） https://itdef.net/ja/learn/cloudflare-workers-ai-cache-data-exposure-2026ITDja2026-10-31Cloudflare Workers AIで他の顧客のデータが155件の応答に混入（GLM 5.3）：ホスト型AIを使うチームが確認すること https://itdef.net/ja/learn/cursor-fake-claude-code-extension-backdoor-2026ITDja2026-10-31Cursorの拡張機能マーケットプレイスに改ざんされた「Claude Code」拡張（10月29日・約11時間）：SSHバックドアの確認方法 https://itdef.net/ja/learn/dreamhost-password-reset-incident-2026ITDja2026-10-31DreamHostのインシデント（2026年10月）：一部のメール・FTP・SFTPのパスワードを再設定、契約者が今日やること https://itdef.net/ja/learn/drupal-commerce-core-cve-2026-118539ITDja2026-10-31Drupal Commerce Coreの脆弱性 CVE-2026-118539：ログインなしでアクセス制御を回避、悪用あり（8.x-2.41・3.3.13へ更新） https://itdef.net/ja/learn/ets-california-student-data-breach-2026ITDja2026-10-31ETS（カリフォルニア州の統一テスト）の生徒情報の流出：障害・504・テスト結果が複製、家族がやること https://itdef.net/ja/learn/genesys-data-breach-2026ITDja2026-10-31Genesysの社内システムへの不正アクセス（2026年10月）：顧客・見込み顧客の連絡先が対象、Genesys Cloudは影響なし、利用企業がやること https://itdef.net/ja/learn/gettiis-ticket-data-breach-2026ITDja2026-10-31GETTIISの会員情報漏えい（会員ID31万7,971件）：何が漏れたかと、会員がやること https://itdef.net/ja/learn/ivanti-connect-secure-cve-2026-111357ITDja2026-10-31Ivanti Connect Secureの脆弱性 CVE-2026-111357・CVE-2026-118527：米CISAがKEVに追加、10月の攻撃にどう備えるか https://itdef.net/ja/learn/matsuya-app-data-breach-2026ITDja2026-10-31松屋公式アプリ管理システムへの不正アクセス（237万7,127件ほか）：氏名・電話番号・届け先住所が漏れた会員がやること https://itdef.net/ja/learn/muji-app-data-breach-2026ITDja2026-10-31良品計画（無印良品）MUJIアプリへの不正アクセス（最大約2,726万件）：メールアドレス・生年月日・性別が漏れた可能性と、利用者がやること https://itdef.net/ja/learn/opencode-console-api-key-breach-2026ITDja2026-10-31OpenCode Consoleへの不正アクセス（2026年10月、Console利用者の1.4%）：外部AI事業者のAPIキーが漏れた可能性と、利用者がやること https://itdef.net/ja/learn/orkes-conductor-cve-2026-58138ITDja2026-10-31Orkes Conductorの脆弱性 CVE-2026-58138：ログインなしでOSのコマンドを実行される、攻撃の試みを観測（3.30.2以降へ更新） https://itdef.net/ja/learn/paradigm-healthcare-medi-cal-data-breach-2026ITDja2026-10-31Paradigm Healthcare Services（Medi-Calの請求業務）の情報漏えい：会員番号・生年月日が閲覧された可能性、会員がやること https://itdef.net/ja/learn/photon-health-metabase-data-breach-2026ITDja2026-10-31米Photon Healthの情報漏えい（分析ツールの脆弱性）：氏名・住所・電話番号・生年月日・処方薬情報と、対象者が今日やること https://itdef.net/ja/learn/plex-media-server-plex2shell-cve-2026-96652ITDja2026-10-31Plex2Shell：Plex Media Serverの4つの脆弱性が悪用されている（1.43.3.10861以降へ更新） https://itdef.net/ja/learn/polymarket-third-party-script-incident-2026ITDja2026-10-31Polymarketで取引停止、第三者提供のスクリプトが侵害：利用者とサイト運営者がやること https://itdef.net/ja/learn/ricardo-data-breach-2026ITDja2026-10-31Ricardo（スイスのマーケットプレイス）の情報漏えい（約89万アカウント）：氏名・住所・電話番号が対象、利用者がやること https://itdef.net/ja/learn/sharepoint-server-cve-2026-65660ITDja2026-10-31SharePoint Serverの脆弱性 CVE-2026-65660：ログインした利用者にコードを実行される、悪用を確認（2026年8月の更新を適用） https://itdef.net/ja/learn/trezor-hardware-wallet-implant-report-2026ITDja2026-10-31Trezorが、東南アジアの元認定販売店で買ったSafe 5に不審な基板が入っていたとの報告を公表（未確認）：所有者がやること https://itdef.net/ja/learn/yakult-website-data-breach-2026ITDja2026-10-31ヤクルト本社の公式サイトへの不正アクセス（約4万件）：氏名・住所・電話・メール・問い合わせ内容が漏れた人がやること https://itdef.net/ja/learn/zeabur-security-incident-2026ITDja2026-10-31Zeaburのセキュリティインシデント（2026年10月、環境変数約322万件が読み取り）：差し替える秘密と、利用者がやること https://itdef.net/ja/learn/connectwise-cloud-backup-m365-incident-2026ITDja2026-10-30ConnectWise Cloud Backup（旧SkyKick）の事案：AIによるサインイン試行が2,250超のMicrosoft 365テナントに、管理者が確認すること https://itdef.net/ja/learn/jal-ana-reservation-data-breach-2026ITDja2026-10-30JAL・JTA・ANA・大韓航空・アシアナ航空の予約システム（委託先）への不正アクセス（JAL・JTA 約92,000名、ANA 約37,800名）：予約番号・氏名などの参照と、利用者がやること https://itdef.net/ja/learn/aena-ec-app-data-breach-2026ITDja2026-10-30アエナのECアプリへの不正アクセス（会員マイページ情報 最大817,215人）：氏名・住所・届け先などが閲覧された可能性と、会員がやること https://itdef.net/ja/learn/asos-customer-data-breach-2026ITDja2026-10-30ASOSの顧客情報漏えいと偽アプリ通知：氏名・連絡先が対象、生年月日・検索履歴は報道｜利用者が今日やること https://itdef.net/ja/learn/benefit-one-tokugai-data-breach-2026ITDja2026-10-30ベネフィット・ワン「トク買」の委託先に不正アクセス（29,465人）：氏名・生年月日・メールアドレス等の漏えいと、会員がやること https://itdef.net/ja/learn/bitget-crypto-theft-2026ITDja2026-10-30Bitgetの暗号資産流出（約3.875億ドル）：顧客の残高は補償されるのか、利用者がやること https://itdef.net/ja/learn/bithumb-security-incident-2026ITDja2026-10-30Bithumb（ビッサム）の社内グループウェアへの不正アクセス（顧客844名の個人情報が露出）：身分証番号・口座番号などと、利用者がやること https://itdef.net/ja/learn/covered-california-data-breach-2026ITDja2026-10-30Covered Californiaの代理店（エージェント）情報漏えい：氏名・免許番号・SSNまたはFEINが漏れた、フィッシングによる事案と、対象者がやること https://itdef.net/ja/learn/double-counter-discord-bot-data-breach-2026ITDja2026-10-30Discord認証ボット「Double Counter」の情報漏えい（Discord ID約2,800万・メール約100万）：漏れた項目と、利用者・サーバー管理者がやること https://itdef.net/ja/learn/engie-customer-data-breach-2026ITDja2026-10-30ENGIE（フランス）の顧客情報漏えい：提携先の営業ツールから連絡先・契約番号が漏れた、銀行情報は含まれないと発表、顧客がやること https://itdef.net/ja/learn/florida-department-of-education-data-breach-2026ITDja2026-10-30フロリダ州教育省の学生支援金サイトへの不正アクセス（約490万人）：社会保障番号が漏れたおそれ、対象者がやること https://itdef.net/ja/learn/frontline-education-data-breach-2026ITDja2026-10-30Frontline Education（米国の学校向け業務ソフト）の情報漏えい：社会保障番号・メディケイドID・生徒IDが影響、職員と保護者がやること https://itdef.net/ja/learn/hana-cupid-data-breach-2026ITDja2026-10-30花キューピットの会員情報漏えい（最大4,238,242件）：ユーザーID・暗号化されたパスワード・メールアドレスと、利用者がやること https://itdef.net/ja/learn/irhythm-data-breach-2026ITDja2026-10-30iRhythm（米国・Zio心電計）の情報漏えい（HHS掲載で8,179,772人）：氏名・保険番号・機器シリアル番号などが持ち出された、患者がやること https://itdef.net/ja/learn/navigate360-p3-crime-stoppers-data-breach-2026ITDja2026-10-30Navigate360の情報漏えいとCrime Stoppers通報基盤（P3）：通報した人・通報で名前が出た人・米国の通知の受取人がやること https://itdef.net/ja/learn/sony-life-medicare-data-breach-2026ITDja2026-10-30ソニー生命への不正アクセスによるメディケア生命の契約情報の漏えい（約38.5万件）：氏名・住所・証券番号などと、契約者・被保険者がやること https://itdef.net/ja/learn/university-of-copenhagen-data-breach-2026ITDja2026-10-30コペンハーゲン大学（Københavns Universitet）の情報漏えい（約52.5万人）：氏名・CPR番号・電話番号・メールアドレスと、対象かもしれない人がやること https://itdef.net/ja/learn/vmware-esx-logging-cve-2026-41709ITDja2026-10-30VMware ESX脆弱性 CVE-2026-41709（CVSS 2.7）｜低い深刻度のログ不備を米CISAが悪用確認として登録。VMSA-2026-0006の全体を更新し、ホストを調べる https://itdef.net/ja/learn/whiteessence-data-breach-2026ITDja2026-10-30ホワイトエッセンスの不正アクセスによる個人情報漏えい（約105万アカウント）：氏名・住所・電話番号・暗号化パスワードなどと、利用者がやること https://itdef.net/ja/learn/cisco-asa-ftd-vpn-dos-cve-2026-76418ITDja2026-10-29Cisco ASA・FTDのVPNでログインなしに再起動させられる脆弱性 CVE-2026-76418：確かめ方と修正版 https://itdef.net/ja/learn/beautygarage-data-breach-2026ITDja2026-10-29ビューティガレージ・アイラッシュガレージの不正アクセス（77万5,725件）：サロン名・電話・メールとパスワードの変換値が漏えい、取引先を装う連絡への備え https://itdef.net/ja/learn/linux-kernel-fragnesia-cve-2026-46300ITDja2026-10-29Linuxカーネル脆弱性 Fragnesia（CVE-2026-46300）｜米CISAが悪用を確認、期限は10月31日。PHPとカーネルを更新して再起動 https://itdef.net/ja/learn/so-net-data-breach-2026ITDja2026-10-29So-net会員データベースへの不正アクセス（So-net会員 約214万件・plala Sコース 約44万件）：氏名・電話番号・生年月日などの漏えいと、利用者がやること https://itdef.net/ja/learn/toypo-app-data-breach-2026ITDja2026-10-29トイポアプリへの不正アクセス（69万7,209名が対象と公表）：電話番号・氏名・住所などが漏えい、店舗のアプリ利用者がやること https://itdef.net/en/learn/aomei-backupper-update-server-tampering-2026ITDen2026-10-31AOMEI Backupper Update Server Tampered With (April to July 2026): Who May Be Affected, the Dates, and How to Check Your PC https://itdef.net/en/learn/binance-crypto-theft-2026ITDen2026-10-31Binance crypto theft (about US$6.3 billion): are user funds covered, and what account holders should do https://itdef.net/en/learn/cisco-catalyst-sd-wan-manager-cve-2026-76504ITDen2026-10-31Cisco Catalyst SD-WAN Manager CVE-2026-76504: admin access without a login, exploited (upgrade to a fixed release) https://itdef.net/en/learn/cloudflare-workers-ai-cache-data-exposure-2026ITDen2026-10-31Cloudflare Workers AI Returned Other Customers' Data in 155 Responses (GLM 5.3): What Teams Using Hosted AI Should Check https://itdef.net/en/learn/cursor-fake-claude-code-extension-backdoor-2026ITDen2026-10-31Tampered 'Claude Code' extension on the Cursor marketplace (Oct 29, about 11 hours): how to check for an SSH backdoor https://itdef.net/en/learn/dreamhost-password-reset-incident-2026ITDen2026-10-31DreamHost incident (October 2026): passwords of some email, FTP and SFTP users reset, and what account owners should do https://itdef.net/en/learn/drupal-commerce-core-cve-2026-118539ITDen2026-10-31Drupal Commerce Core CVE-2026-118539: unauthenticated access bypass, actively exploited (update to 8.x-2.41 or 3.3.13) https://itdef.net/en/learn/ets-california-student-data-breach-2026ITDen2026-10-31ETS California Student Data Breach: Disability, 504 and Test Data Copied, and What Families Should Do https://itdef.net/en/learn/genesys-data-breach-2026ITDen2026-10-31Genesys Internal Systems Breach (October 2026): Systems Holding Customer Contact Data Accessed, Platforms Not Affected, and What Customers Should Do https://itdef.net/en/learn/gettiis-ticket-data-breach-2026ITDen2026-10-31GETTIIS Member Data Breach (317,971 member IDs): What Leaked and What Members Should Do https://itdef.net/en/learn/ivanti-connect-secure-cve-2026-111357ITDen2026-10-31Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527: two more flaws added to CISA KEV (what to do about the October attacks) https://itdef.net/en/learn/matsuya-app-data-breach-2026ITDen2026-10-31Matsuya app management system breach (2,377,127 records plus app members): names, phone numbers and delivery addresses leaked — what members should do https://itdef.net/en/learn/muji-app-data-breach-2026ITDen2026-10-31Ryohin Keikaku (MUJI) app breach (up to about 27.26 million records): emails, dates of birth and gender may have leaked — what users should do https://itdef.net/en/learn/opencode-console-api-key-breach-2026ITDen2026-10-31OpenCode Console Breach (October 2026, 1.4% of Console Users): AI Provider API Keys Possibly Exposed, and What to Do https://itdef.net/en/learn/orkes-conductor-cve-2026-58138ITDen2026-10-31Orkes Conductor CVE-2026-58138: unauthenticated OS command execution, with attack attempts observed (update to 3.30.2 or later) https://itdef.net/en/learn/paradigm-healthcare-medi-cal-data-breach-2026ITDen2026-10-31Paradigm Healthcare Services Data Breach: Medi-Cal Member IDs and Birth Dates May Have Been Accessed, and What Members Should Do https://itdef.net/en/learn/photon-health-metabase-data-breach-2026ITDen2026-10-31Photon Health data breach (analytics-tool flaw): names, addresses, phone numbers, dates of birth and prescription information — what affected patients should do https://itdef.net/en/learn/plex-media-server-plex2shell-cve-2026-96652ITDen2026-10-31Plex2Shell: four Plex Media Server CVEs exploited in the wild (update to 1.43.3.10861 or later) https://itdef.net/en/learn/polymarket-third-party-script-incident-2026ITDen2026-10-31Polymarket Trading Halted After a Third-Party Script Was Compromised: What Users and Site Operators Should Do https://itdef.net/en/learn/ricardo-data-breach-2026ITDen2026-10-31Ricardo (Swiss Marketplace) Data Breach, About 890,000 Accounts: Names, Addresses and Phone Numbers Exposed, and What Users Should Do https://itdef.net/en/learn/sharepoint-server-cve-2026-65660ITDen2026-10-31SharePoint Server CVE-2026-65660: code execution by a logged-in user, exploited (install the August 2026 updates) https://itdef.net/en/learn/trezor-hardware-wallet-implant-report-2026ITDen2026-10-31Trezor reports a possible hardware implant in a Safe 5 from a former reseller (unconfirmed): what owners should do https://itdef.net/en/learn/yakult-website-data-breach-2026ITDen2026-10-31Yakult Honsha website breach (about 40,000 records): names, addresses, phones, emails and inquiry contents leaked — what affected people should do https://itdef.net/en/learn/zeabur-security-incident-2026ITDen2026-10-31Zeabur Security Incident (October 2026, 3.22 Million Environment Variables Read): Which Secrets to Rotate and What Users Should Do https://itdef.net/en/learn/connectwise-cloud-backup-m365-incident-2026ITDen2026-10-30ConnectWise Cloud Backup (formerly SkyKick) incident: AI-driven sign-in attempts against 2,250+ Microsoft 365 tenants, and what admins should check https://itdef.net/en/learn/jal-ana-reservation-data-breach-2026ITDen2026-10-30Unauthorized Access at the Reservation System Vendor of JAL, JTA, ANA, Korean Air and Asiana (About 92,000 JAL/JTA and 37,800 ANA Customers): Booking Numbers, Names and More, and What Travellers Should Do https://itdef.net/en/learn/aena-ec-app-data-breach-2026ITDen2026-10-30Aena EC App Unauthorized Access (My Page Data of Up to 817,215 People): Names, Addresses and Delivery Details That May Have Been Viewed, and What Members Should Do https://itdef.net/en/learn/asos-customer-data-breach-2026ITDen2026-10-30ASOS customer data breach and fake app alert: names and contact details taken, dates of birth and search history reported — what customers should do https://itdef.net/en/learn/benefit-one-tokugai-data-breach-2026ITDen2026-10-30Benefit One 'Toku-Kai' Contractor Breach (29,465 People): Names, Birth Dates and Email Addresses Leaked, and What Members Should Do https://itdef.net/en/learn/bitget-crypto-theft-2026ITDen2026-10-30Bitget crypto theft (about US$387.5 million): are customer balances covered, and what account holders should do https://itdef.net/en/learn/bithumb-security-incident-2026ITDen2026-10-30Unauthorized Access to Bithumb's Internal Groupware (Personal Data of 844 Customers Exposed): ID Numbers, Account Numbers and More, and What Customers Should Do https://itdef.net/en/learn/covered-california-data-breach-2026ITDen2026-10-30Covered California Agent Data Breach: Names, License Numbers and SSN or FEIN Exposed in a Phishing Incident, and What Agents Should Do https://itdef.net/en/learn/double-counter-discord-bot-data-breach-2026ITDen2026-10-30Double Counter Discord bot data breach (about 28 million Discord IDs, 1 million emails): what leaked and what members and server admins should do https://itdef.net/en/learn/engie-customer-data-breach-2026ITDen2026-10-30ENGIE Customer Data Breach (France): Contact Details and Contract Numbers Exposed via a Partner Sales Tool, No Bank Data, and What Customers Should Do https://itdef.net/en/learn/florida-department-of-education-data-breach-2026ITDen2026-10-30Florida Department of Education financial aid website breach (about 4.9 million people): Social Security numbers at risk — what to do https://itdef.net/en/learn/frontline-education-data-breach-2026ITDen2026-10-30Frontline Education data breach (school software vendor): SSNs, Medicaid IDs and student IDs impacted — what staff and parents should do https://itdef.net/en/learn/hana-cupid-data-breach-2026ITDen2026-10-30Hana-cupid Member Data Breach (Up to 4,238,242 Records): User IDs, Encrypted Passwords and Email Addresses Leaked, and What Members Should Do https://itdef.net/en/learn/irhythm-data-breach-2026ITDen2026-10-30iRhythm data breach (8,179,772 people listed with HHS): Zio patient names, insurance numbers and device serial numbers taken — what patients should do https://itdef.net/en/learn/navigate360-p3-crime-stoppers-data-breach-2026ITDen2026-10-30Navigate360 breach and the Crime Stoppers tip platform (P3): what tipsters, people named in tips and US notice recipients should do https://itdef.net/en/learn/sony-life-medicare-data-breach-2026ITDen2026-10-30Sony Life Unauthorized Access Leaks Medicare Life Policy Data (About 385,000 Records): Names, Addresses, Policy Numbers and More, and What Policyholders and Insured Persons Should Do https://itdef.net/en/learn/university-of-copenhagen-data-breach-2026ITDen2026-10-30University of Copenhagen data breach (about 525,000 people): names, CPR numbers, phone numbers and emails — what to do https://itdef.net/en/learn/vmware-esx-logging-cve-2026-41709ITDen2026-10-30VMware ESX CVE-2026-41709 (CVSS 2.7): CISA lists the low-severity logging flaw as exploited; patch the whole VMSA-2026-0006 and check your hosts https://itdef.net/en/learn/whiteessence-data-breach-2026ITDen2026-10-30White Essence Unauthorized Access and Personal Data Leak (About 1.05 Million Accounts): Names, Addresses, Phone Numbers and Encrypted Passwords, and What Users Should Do https://itdef.net/en/learn/cisco-asa-ftd-vpn-dos-cve-2026-76418ITDen2026-10-29Cisco ASA and FTD VPN flaw CVE-2026-76418: an unauthenticated attacker can reload the device (how to check, fixed releases) https://itdef.net/en/learn/beautygarage-data-breach-2026ITDen2026-10-29Beauty Garage and Eyelash Garage Unauthorized Access (775,725 Records): Salon Names, Phone Numbers, Emails and Password Hashes Leaked, and How to Guard Against Impersonation https://itdef.net/en/learn/linux-kernel-fragnesia-cve-2026-46300ITDen2026-10-29Linux kernel Fragnesia (CVE-2026-46300): CISA lists it as exploited with a Oct 31 deadline; patch PHP and the kernel, then reboot https://itdef.net/en/learn/so-net-data-breach-2026ITDen2026-10-29So-net Member Database Unauthorized Access (2.14M So-net Records, 443K plala S-Course Records): Names, Phone Numbers and Birth Dates Leaked, and What Users Should Do https://itdef.net/en/learn/toypo-app-data-breach-2026ITDen2026-10-29Toypo App Unauthorized Access (697,209 Users Affected, per Toypo): Phone Numbers, Names and Addresses Leaked, and What Store App Users Should Do https://itdef.net/zh-CN/learn/aomei-backupper-update-server-tampering-2026ITDzh-cn2026-10-31AOMEI Backupper 更新服务器遭篡改（2026 年 4 月至 7 月）：谁可能受影响、具体时间，以及如何检查您的电脑 https://itdef.net/zh-CN/learn/binance-crypto-theft-2026ITDzh-cn2026-10-31Binance 加密货币被盗（约 63 亿美元）：用户资金是否有保障，账户持有人该怎么做 https://itdef.net/zh-CN/learn/cisco-catalyst-sd-wan-manager-cve-2026-76504ITDzh-cn2026-10-31Cisco Catalyst SD-WAN Manager CVE-2026-76504：无需登录即可获得管理员访问权限，已被利用（请升级到已修复版本） https://itdef.net/zh-CN/learn/cloudflare-workers-ai-cache-data-exposure-2026ITDzh-cn2026-10-31Cloudflare Workers AI 在 155 条响应中返回了其他客户的数据（GLM 5.3）：使用托管 AI 的团队应检查什么 https://itdef.net/zh-CN/learn/cursor-fake-claude-code-extension-backdoor-2026ITDzh-cn2026-10-31Cursor 市场上被篡改的“Claude Code”扩展（10 月 29 日，约 11 小时）：如何检查 SSH 后门 https://itdef.net/zh-CN/learn/dreamhost-password-reset-incident-2026ITDzh-cn2026-10-31DreamHost 事件（2026年10月）：部分邮件、FTP 和 SFTP 用户的密码被重置，账户所有者应做什么 https://itdef.net/zh-CN/learn/drupal-commerce-core-cve-2026-118539ITDzh-cn2026-10-31Drupal Commerce Core CVE-2026-118539：无需身份验证的访问绕过漏洞，已被利用（请更新到 8.x-2.41 或 3.3.13） https://itdef.net/zh-CN/learn/ets-california-student-data-breach-2026ITDzh-cn2026-10-31ETS加利福尼亚州学生数据泄露：残障、504和考试数据被复制，家庭应该怎么做 https://itdef.net/zh-CN/learn/genesys-data-breach-2026ITDzh-cn2026-10-31Genesys 内部系统遭入侵（2026 年 10 月）：存有客户联系方式的系统遭访问，平台未受影响，客户企业应如何应对 https://itdef.net/zh-CN/learn/gettiis-ticket-data-breach-2026ITDzh-cn2026-10-31GETTIIS 会员数据泄露（317,971 个会员 ID）：泄露了什么，会员应该怎么做 https://itdef.net/zh-CN/learn/ivanti-connect-secure-cve-2026-111357ITDzh-cn2026-10-31Ivanti Connect Secure CVE-2026-111357 和 CVE-2026-118527：另外两个漏洞被加入 CISA KEV（针对10月攻击该怎么做） https://itdef.net/zh-CN/learn/matsuya-app-data-breach-2026ITDzh-cn2026-10-31Matsuya 应用管理系统遭入侵（2,377,127 条记录及应用会员）：姓名、电话号码和配送地址外泄——会员应该怎么做 https://itdef.net/zh-CN/learn/muji-app-data-breach-2026ITDzh-cn2026-10-31良品计划（MUJI）应用数据泄露（最多约 2726 万条记录）：邮箱地址、出生日期和性别可能外泄，用户应如何应对 https://itdef.net/zh-CN/learn/opencode-console-api-key-breach-2026ITDzh-cn2026-10-31OpenCode Console 安全事件（2026 年 10 月，1.4% 的 Console 用户）：AI 服务商 API 密钥可能已暴露，以及该怎么做 https://itdef.net/zh-CN/learn/orkes-conductor-cve-2026-58138ITDzh-cn2026-10-31Orkes Conductor CVE-2026-58138：无需身份验证即可执行操作系统命令，已观测到攻击尝试（请更新到 3.30.2 或更高版本） https://itdef.net/zh-CN/learn/paradigm-healthcare-medi-cal-data-breach-2026ITDzh-cn2026-10-31Paradigm Healthcare Services数据泄露：Medi-Cal会员编号和出生日期可能被访问，会员应该怎么做 https://itdef.net/zh-CN/learn/photon-health-metabase-data-breach-2026ITDzh-cn2026-10-31Photon Health 数据泄露（分析工具漏洞）：姓名、地址、电话号码、出生日期和处方信息，受影响的患者应如何应对 https://itdef.net/zh-CN/learn/plex-media-server-plex2shell-cve-2026-96652ITDzh-cn2026-10-31Plex2Shell：Plex Media Server 的四个 CVE 已在野外被利用（请更新到 1.43.3.10861 或更高版本） https://itdef.net/zh-CN/learn/polymarket-third-party-script-incident-2026ITDzh-cn2026-10-31Polymarket 因第三方脚本遭入侵而暂停交易：用户和网站运营者应该怎么做 https://itdef.net/zh-CN/learn/ricardo-data-breach-2026ITDzh-cn2026-10-31Ricardo（瑞士在线交易平台）数据泄露，约 89 万个账户：姓名、地址和电话号码被暴露，用户应如何应对 https://itdef.net/zh-CN/learn/sharepoint-server-cve-2026-65660ITDzh-cn2026-10-31SharePoint Server CVE-2026-65660：已登录用户可执行代码，已被利用（请安装2026年8月的更新） https://itdef.net/zh-CN/learn/trezor-hardware-wallet-implant-report-2026ITDzh-cn2026-10-31Trezor 称曾有报告指某前经销商售出的 Safe 5 内可能存在硬件植入物（尚未证实）：持有者应如何应对 https://itdef.net/zh-CN/learn/yakult-website-data-breach-2026ITDzh-cn2026-10-31养乐多本社网站数据泄露（约 4 万条记录）：姓名、地址、电话、邮箱和咨询内容外泄，受影响者应如何应对 https://itdef.net/zh-CN/learn/zeabur-security-incident-2026ITDzh-cn2026-10-31Zeabur 安全事件（2026 年 10 月，322 万条环境变量被读取）：哪些密钥需要轮换，用户该怎么做 https://itdef.net/zh-CN/learn/connectwise-cloud-backup-m365-incident-2026ITDzh-cn2026-10-30ConnectWise Cloud Backup（原 SkyKick）事件：针对 2,250 余个 Microsoft 365 租户的 AI 驱动登录尝试，管理员应检查什么 https://itdef.net/zh-CN/learn/jal-ana-reservation-data-breach-2026ITDzh-cn2026-10-30JAL、JTA、ANA、大韩航空和韩亚航空的预订系统供应商遭未经授权访问（JAL/JTA约92,000名、ANA约37,800名客户）：预订编号、姓名等，旅客应如何应对 https://itdef.net/zh-CN/learn/aena-ec-app-data-breach-2026ITDzh-cn2026-10-30Aena EC应用遭未经授权访问（最多817,215人的My Page数据）：姓名、地址和配送信息可能被查看，会员应如何应对 https://itdef.net/zh-CN/learn/asos-customer-data-breach-2026ITDzh-cn2026-10-30ASOS 客户数据泄露与虚假应用推送：姓名和联系方式被获取，出生日期和搜索记录据报道也在其中，客户该怎么做 https://itdef.net/zh-CN/learn/benefit-one-tokugai-data-breach-2026ITDzh-cn2026-10-30Benefit One“Toku-Kai”受托方数据泄露（29,465 人）：姓名、出生日期和邮箱地址外泄，会员应如何应对 https://itdef.net/zh-CN/learn/bitget-crypto-theft-2026ITDzh-cn2026-10-30Bitget 加密资产被盗（约 3.875 亿美元）：客户余额是否有保障，账户持有人该怎么做 https://itdef.net/zh-CN/learn/bithumb-security-incident-2026ITDzh-cn2026-10-30Bithumb 内部协作系统遭未经授权访问（844 名客户个人信息外泄）：身份证号、账号等信息，客户应如何应对 https://itdef.net/zh-CN/learn/covered-california-data-breach-2026ITDzh-cn2026-10-30Covered California代理人数据泄露：姓名、执照号码和社会安全号码或FEIN在一起钓鱼事件中外泄，代理人应如何应对 https://itdef.net/zh-CN/learn/double-counter-discord-bot-data-breach-2026ITDzh-cn2026-10-30Double Counter Discord 机器人数据泄露（约 2,800 万个 Discord ID、100 万个邮箱）：泄露了什么，成员和服务器管理员该怎么做 https://itdef.net/zh-CN/learn/engie-customer-data-breach-2026ITDzh-cn2026-10-30ENGIE 客户数据泄露（法国）：联系方式和合同编号经合作伙伴销售工具外泄，不含银行数据，客户应如何应对 https://itdef.net/zh-CN/learn/florida-department-of-education-data-breach-2026ITDzh-cn2026-10-30佛罗里达州教育部助学金网站数据泄露（约490万人）：社会安全号码可能外泄，应如何应对 https://itdef.net/zh-CN/learn/frontline-education-data-breach-2026ITDzh-cn2026-10-30Frontline Education数据泄露（学校软件供应商）：社会安全号码、医疗补助ID和学生ID受影响，教职员工和家长应如何应对 https://itdef.net/zh-CN/learn/hana-cupid-data-breach-2026ITDzh-cn2026-10-30Hana-cupid会员数据泄露（最多4,238,242条记录）：用户ID、加密密码和电子邮件地址外泄，会员应如何应对 https://itdef.net/zh-CN/learn/irhythm-data-breach-2026ITDzh-cn2026-10-30iRhythm数据泄露（HHS列示8,179,772人）：Zio患者姓名、保险号码和设备序列号被获取，患者应如何应对 https://itdef.net/zh-CN/learn/navigate360-p3-crime-stoppers-data-breach-2026ITDzh-cn2026-10-30Navigate360 数据泄露与 Crime Stoppers 举报平台（P3）：举报人、被举报内容涉及的人以及美国通知收件人该怎么办 https://itdef.net/zh-CN/learn/sony-life-medicare-data-breach-2026ITDzh-cn2026-10-30Sony Life遭未经授权访问，Medicare Life保单信息（约38.5万条记录）外泄：姓名、地址、保单号码等，投保人和被保险人应如何应对 https://itdef.net/zh-CN/learn/university-of-copenhagen-data-breach-2026ITDzh-cn2026-10-30哥本哈根大学数据泄露（约 52.5 万人）：姓名、CPR 号码、电话号码和邮箱——应如何应对 https://itdef.net/zh-CN/learn/vmware-esx-logging-cve-2026-41709ITDzh-cn2026-10-30VMware ESX CVE-2026-41709（CVSS 2.7）：CISA将这一低危日志漏洞列为已被利用；请修补整份VMSA-2026-0006并检查主机 https://itdef.net/zh-CN/learn/whiteessence-data-breach-2026ITDzh-cn2026-10-30White Essence遭未经授权访问致个人信息泄露（约105万个账户）：姓名、地址、电话号码和加密密码，用户应如何应对 https://itdef.net/zh-CN/learn/cisco-asa-ftd-vpn-dos-cve-2026-76418ITDzh-cn2026-10-29Cisco ASA与FTD VPN漏洞CVE-2026-76418：未经认证的攻击者可使设备重启（检查方法与修复版本） https://itdef.net/zh-CN/learn/beautygarage-data-breach-2026ITDzh-cn2026-10-29Beauty Garage与Eyelash Garage遭未经授权访问（775,725条记录）：沙龙名称、电话号码、电子邮件和密码哈希值外泄，如何防范冒充 https://itdef.net/zh-CN/learn/linux-kernel-fragnesia-cve-2026-46300ITDzh-cn2026-10-29Linux内核Fragnesia（CVE-2026-46300）：CISA列为已被利用，截止日期为10月31日；请修补PHP和内核，然后重启 https://itdef.net/zh-CN/learn/so-net-data-breach-2026ITDzh-cn2026-10-29So-net会员数据库遭未经授权访问（So-net 214万条记录、plala S-Course 44.3万条记录）：姓名、电话号码和出生日期外泄，用户应如何应对 https://itdef.net/zh-CN/learn/toypo-app-data-breach-2026ITDzh-cn2026-10-29Toypo应用遭未授权访问（据Toypo称，受影响用户697,209人）：手机号码、姓名和地址外泄，门店应用用户该怎么做 https://itdef.net/zh-TW/learn/aomei-backupper-update-server-tampering-2026ITDzh-tw2026-10-31AOMEI Backupper 更新伺服器遭竄改（2026年4月至7月）：誰可能受影響、確切時段，以及如何檢查您的電腦 https://itdef.net/zh-TW/learn/binance-crypto-theft-2026ITDzh-tw2026-10-31Binance 加密貨幣遭竊（約 63 億美元）：使用者資金是否有保障，帳號持有人該怎麼做 https://itdef.net/zh-TW/learn/cisco-catalyst-sd-wan-manager-cve-2026-76504ITDzh-tw2026-10-31Cisco Catalyst SD-WAN Manager CVE-2026-76504：無需登入即可取得管理員存取權，已遭利用（請升級至已修補版本） https://itdef.net/zh-TW/learn/cloudflare-workers-ai-cache-data-exposure-2026ITDzh-tw2026-10-31Cloudflare Workers AI 在 155 則回應中回傳了其他客戶的資料（GLM 5.3）：使用託管 AI 的團隊應檢查什麼 https://itdef.net/zh-TW/learn/cursor-fake-claude-code-extension-backdoor-2026ITDzh-tw2026-10-31Cursor 市場上被篡改的「Claude Code」擴充套件（10月29日，約11小時）：如何檢查 SSH 後門 https://itdef.net/zh-TW/learn/dreamhost-password-reset-incident-2026ITDzh-tw2026-10-31DreamHost 事件（2026年10月）：部分郵件、FTP 與 SFTP 使用者的密碼遭重設，帳戶擁有者該做什麼 https://itdef.net/zh-TW/learn/drupal-commerce-core-cve-2026-118539ITDzh-tw2026-10-31Drupal Commerce Core CVE-2026-118539：無需身分驗證的存取繞過漏洞，已遭利用（請更新至 8.x-2.41 或 3.3.13） https://itdef.net/zh-TW/learn/ets-california-student-data-breach-2026ITDzh-tw2026-10-31ETS 加州學生資料外洩：身心障礙、504 與考試資料遭複製，家庭該怎麼做 https://itdef.net/zh-TW/learn/genesys-data-breach-2026ITDzh-tw2026-10-31Genesys 內部系統遭入侵（2026年10月）：存有客戶聯絡方式的系統遭存取，平台未受影響，客戶企業應如何因應 https://itdef.net/zh-TW/learn/gettiis-ticket-data-breach-2026ITDzh-tw2026-10-31GETTIIS 會員資料外洩（317,971 個會員 ID）：外洩了什麼，會員應該怎麼做 https://itdef.net/zh-TW/learn/ivanti-connect-secure-cve-2026-111357ITDzh-tw2026-10-31Ivanti Connect Secure CVE-2026-111357 與 CVE-2026-118527：另外兩個漏洞被加入 CISA KEV（針對10月攻擊該怎麼做） https://itdef.net/zh-TW/learn/matsuya-app-data-breach-2026ITDzh-tw2026-10-31Matsuya 應用程式管理系統遭入侵（2,377,127 筆紀錄及應用程式會員）：姓名、電話號碼與配送地址外洩——會員應該怎麼做 https://itdef.net/zh-TW/learn/muji-app-data-breach-2026ITDzh-tw2026-10-31良品計劃（MUJI）應用資料外洩（最多約2726萬筆紀錄）：電子郵件地址、出生日期和性別可能外洩，使用者應如何應對 https://itdef.net/zh-TW/learn/opencode-console-api-key-breach-2026ITDzh-tw2026-10-31OpenCode Console 資安事件（2026年10月，1.4%的 Console 使用者）：AI 供應商 API 金鑰可能外洩，以及該怎麼做 https://itdef.net/zh-TW/learn/orkes-conductor-cve-2026-58138ITDzh-tw2026-10-31Orkes Conductor CVE-2026-58138：無需身分驗證即可執行作業系統指令，已觀測到攻擊嘗試（請更新至 3.30.2 或更新版本） https://itdef.net/zh-TW/learn/paradigm-healthcare-medi-cal-data-breach-2026ITDzh-tw2026-10-31Paradigm Healthcare Services 資料外洩：Medi-Cal 會員編號與出生日期可能遭存取，會員該怎麼做 https://itdef.net/zh-TW/learn/photon-health-metabase-data-breach-2026ITDzh-tw2026-10-31Photon Health 資料外洩（分析工具漏洞）：姓名、地址、電話號碼、出生日期和處方資訊，受影響的患者應如何應對 https://itdef.net/zh-TW/learn/plex-media-server-plex2shell-cve-2026-96652ITDzh-tw2026-10-31Plex2Shell：Plex Media Server 的四個 CVE 已遭實際利用（請更新至 1.43.3.10861 或更新版本） https://itdef.net/zh-TW/learn/polymarket-third-party-script-incident-2026ITDzh-tw2026-10-31Polymarket 因第三方指令碼遭入侵而暫停交易：使用者與網站營運者應該怎麼做 https://itdef.net/zh-TW/learn/ricardo-data-breach-2026ITDzh-tw2026-10-31Ricardo（瑞士線上交易平台）資料外洩，約89萬個帳戶：姓名、地址與電話號碼遭暴露，使用者應如何因應 https://itdef.net/zh-TW/learn/sharepoint-server-cve-2026-65660ITDzh-tw2026-10-31SharePoint Server CVE-2026-65660：已登入的使用者可執行程式碼，已遭利用（請安裝2026年8月的更新） https://itdef.net/zh-TW/learn/trezor-hardware-wallet-implant-report-2026ITDzh-tw2026-10-31Trezor 稱曾有報告指某前經銷商售出的 Safe 5內可能存在硬體植入物（尚未證實）：持有者應如何應對 https://itdef.net/zh-TW/learn/yakult-website-data-breach-2026ITDzh-tw2026-10-31養樂多本社網站資料外洩（約4萬筆紀錄）：姓名、地址、電話、電子郵件和諮詢內容外洩，受影響者應如何應對 https://itdef.net/zh-TW/learn/zeabur-security-incident-2026ITDzh-tw2026-10-31Zeabur 資安事件（2026年10月，322萬筆環境變數遭讀取）：該輪替哪些密鑰、使用者該怎麼做 https://itdef.net/zh-TW/learn/connectwise-cloud-backup-m365-incident-2026ITDzh-tw2026-10-30ConnectWise Cloud Backup（原 SkyKick）事件：針對 2,250 餘個 Microsoft 365 租用戶的 AI 驅動登入嘗試，管理員應檢查什麼 https://itdef.net/zh-TW/learn/jal-ana-reservation-data-breach-2026ITDzh-tw2026-10-30JAL、JTA、ANA、大韓航空與韓亞航空的訂位系統供應商遭未經授權存取（JAL/JTA 約 92,000 名、ANA 約 37,800 名客戶）：訂位代號、姓名等，旅客應採取的行動 https://itdef.net/zh-TW/learn/aena-ec-app-data-breach-2026ITDzh-tw2026-10-30Aena EC 應用程式遭未經授權存取（最多 817,215 人的 My Page 資料）：姓名、地址與配送資料可能被檢視，會員應採取的行動 https://itdef.net/zh-TW/learn/asos-customer-data-breach-2026ITDzh-tw2026-10-30ASOS 客戶資料外洩與假冒應用程式推播：姓名與聯絡方式遭取得，出生日期與搜尋紀錄據報導也在其中，客戶該怎麼做 https://itdef.net/zh-TW/learn/benefit-one-tokugai-data-breach-2026ITDzh-tw2026-10-30Benefit One「Toku-Kai」受託方資料外洩（29,465人）：姓名、出生日期與電子郵件地址外洩，會員應如何因應 https://itdef.net/zh-TW/learn/bitget-crypto-theft-2026ITDzh-tw2026-10-30Bitget 加密資產遭竊（約 3.875 億美元）：客戶餘額是否有保障，帳戶持有人該怎麼做 https://itdef.net/zh-TW/learn/bithumb-security-incident-2026ITDzh-tw2026-10-30Bithumb 內部協作系統遭未經授權存取（844名客戶個人資料外洩）：身分證號、帳號等資訊，客戶應如何因應 https://itdef.net/zh-TW/learn/covered-california-data-breach-2026ITDzh-tw2026-10-30Covered California 代理人資料外洩：姓名、執照號碼與社會安全碼或 FEIN 在一起網路釣魚事件中外洩，代理人該如何因應 https://itdef.net/zh-TW/learn/double-counter-discord-bot-data-breach-2026ITDzh-tw2026-10-30Double Counter Discord 機器人資料外洩（約 2,800 萬個 Discord ID、100 萬個電子郵件）：外洩了什麼，成員與伺服器管理員該怎麼做 https://itdef.net/zh-TW/learn/engie-customer-data-breach-2026ITDzh-tw2026-10-30ENGIE 客戶資料外洩（法國）：聯絡方式與合約編號經合作夥伴銷售工具外洩，不含銀行資料，客戶應如何因應 https://itdef.net/zh-TW/learn/florida-department-of-education-data-breach-2026ITDzh-tw2026-10-30佛羅里達州教育部助學金網站資料外洩（約 490 萬人）：社會安全碼可能外洩，該如何因應 https://itdef.net/zh-TW/learn/frontline-education-data-breach-2026ITDzh-tw2026-10-30Frontline Education 資料外洩（學校軟體供應商）：社會安全碼、醫療補助 ID 與學生 ID 受影響，教職員與家長該如何因應 https://itdef.net/zh-TW/learn/hana-cupid-data-breach-2026ITDzh-tw2026-10-30Hana-cupid 會員資料外洩（最多 4,238,242 筆）：使用者 ID、加密密碼與電子郵件地址外洩，會員應採取的行動 https://itdef.net/zh-TW/learn/irhythm-data-breach-2026ITDzh-tw2026-10-30iRhythm 資料外洩（HHS 列示 8,179,772 人）：Zio 患者姓名、保險號碼與裝置序號遭取得，患者該如何因應 https://itdef.net/zh-TW/learn/navigate360-p3-crime-stoppers-data-breach-2026ITDzh-tw2026-10-30Navigate360 資料外洩與 Crime Stoppers 檢舉平台（P3）：檢舉人、檢舉內容涉及的人以及美國通知收件人該怎麼辦 https://itdef.net/zh-TW/learn/sony-life-medicare-data-breach-2026ITDzh-tw2026-10-30Sony Life 遭未經授權存取，Medicare Life 保單資料（約 38.5 萬筆）外洩：姓名、地址、保單號碼等，要保人與被保險人應如何因應 https://itdef.net/zh-TW/learn/university-of-copenhagen-data-breach-2026ITDzh-tw2026-10-30哥本哈根大學資料外洩（約52.5萬人）：姓名、CPR 號碼、電話號碼與電子郵件——應如何因應 https://itdef.net/zh-TW/learn/vmware-esx-logging-cve-2026-41709ITDzh-tw2026-10-30VMware ESX CVE-2026-41709（CVSS 2.7）：CISA 將這項低風險日誌漏洞列為已遭利用；請修補整份 VMSA-2026-0006 並檢查主機 https://itdef.net/zh-TW/learn/whiteessence-data-breach-2026ITDzh-tw2026-10-30White Essence 遭未經授權存取致個人資料外洩（約 105 萬個帳號）：姓名、地址、電話號碼與加密密碼，使用者應採取的行動 https://itdef.net/zh-TW/learn/cisco-asa-ftd-vpn-dos-cve-2026-76418ITDzh-tw2026-10-29Cisco ASA 與 FTD VPN 漏洞 CVE-2026-76418：未經驗證的攻擊者可使設備重新啟動（檢查方法與修復版本） https://itdef.net/zh-TW/learn/beautygarage-data-breach-2026ITDzh-tw2026-10-29Beauty Garage 與 Eyelash Garage 遭未經授權存取（775,725 筆）：沙龍名稱、電話、電子郵件與密碼雜湊值外洩，如何防範冒充 https://itdef.net/zh-TW/learn/linux-kernel-fragnesia-cve-2026-46300ITDzh-tw2026-10-29Linux 核心 Fragnesia（CVE-2026-46300）：CISA 列為已遭利用，期限為10月31日；請修補 PHP 與核心，然後重新開機 https://itdef.net/zh-TW/learn/so-net-data-breach-2026ITDzh-tw2026-10-29So-net 會員資料庫遭未經授權存取（So-net 214 萬筆、plala S-Course 44.3 萬筆）：姓名、電話與出生日期外洩，用戶應採取的行動 https://itdef.net/zh-TW/learn/toypo-app-data-breach-2026ITDzh-tw2026-10-29Toypo App 遭未經授權存取（據 Toypo 表示，受影響使用者 697,209 人）：手機號碼、姓名與地址外洩，門市 App 使用者該怎麼做 https://itdef.net/ru/learn/aomei-backupper-update-server-tampering-2026ITDru2026-10-31Подмена на сервере обновлений AOMEI Backupper (апрель–июль 2026): кто может быть затронут, даты и как проверить свой ПК https://itdef.net/ru/learn/binance-crypto-theft-2026ITDru2026-10-31Кража криптовалюты у Binance (около 6,3 млрд долларов США): покрыты ли средства пользователей и что делать владельцам аккаунтов https://itdef.net/ru/learn/cisco-catalyst-sd-wan-manager-cve-2026-76504ITDru2026-10-31Cisco Catalyst SD-WAN Manager CVE-2026-76504: доступ администратора без входа, уязвимость эксплуатируется (обновитесь до исправленного выпуска) https://itdef.net/ru/learn/cloudflare-workers-ai-cache-data-exposure-2026ITDru2026-10-31Cloudflare Workers AI вернул данные других клиентов в 155 ответах (GLM 5.3): что проверить командам, использующим размещенный ИИ https://itdef.net/ru/learn/cursor-fake-claude-code-extension-backdoor-2026ITDru2026-10-31Подменённое расширение «Claude Code» в маркетплейсе Cursor (29 октября, около 11 часов): как проверить наличие SSH-бэкдора https://itdef.net/ru/learn/dreamhost-password-reset-incident-2026ITDru2026-10-31Инцидент в DreamHost (октябрь 2026): пароли части пользователей почты, FTP и SFTP сброшены — что делать владельцам аккаунтов https://itdef.net/ru/learn/drupal-commerce-core-cve-2026-118539ITDru2026-10-31Drupal Commerce Core CVE-2026-118539: обход доступа без аутентификации, активно эксплуатируется (обновитесь до 8.x-2.41 или 3.3.13) https://itdef.net/ru/learn/ets-california-student-data-breach-2026ITDru2026-10-31Утечка данных учащихся Калифорнии из ETS: скопированы сведения об инвалидности, плане 504 и тестах, и что делать семьям https://itdef.net/ru/learn/genesys-data-breach-2026ITDru2026-10-31Взлом внутренних систем Genesys (октябрь 2026 года): получен доступ к системам с контактными данными клиентов, платформы не затронуты, и что делать клиентам https://itdef.net/ru/learn/gettiis-ticket-data-breach-2026ITDru2026-10-31Утечка данных участников GETTIIS (317 971 идентификатор участника): что утекло и что делать участникам https://itdef.net/ru/learn/ivanti-connect-secure-cve-2026-111357ITDru2026-10-31Ivanti Connect Secure CVE-2026-111357 и CVE-2026-118527: еще две уязвимости добавлены в CISA KEV (что делать после октябрьских атак) https://itdef.net/ru/learn/matsuya-app-data-breach-2026ITDru2026-10-31Утечка из системы управления приложением Matsuya (2 377 127 записей плюс участники приложения): имена, телефоны и адреса доставки, и что делать участникам https://itdef.net/ru/learn/muji-app-data-breach-2026ITDru2026-10-31Утечка из приложения Ryohin Keikaku (MUJI) (до примерно 27,26 млн записей): адреса эл. почты, даты рождения и пол могли утечь — что делать пользователям https://itdef.net/ru/learn/opencode-console-api-key-breach-2026ITDru2026-10-31Взлом OpenCode Console (октябрь 2026, 1,4% пользователей Console): возможно раскрыты API-ключи поставщиков ИИ, и что делать https://itdef.net/ru/learn/orkes-conductor-cve-2026-58138ITDru2026-10-31Orkes Conductor CVE-2026-58138: выполнение команд ОС без аутентификации, зафиксированы попытки атак (обновитесь до 3.30.2 или новее) https://itdef.net/ru/learn/paradigm-healthcare-medi-cal-data-breach-2026ITDru2026-10-31Утечка данных Paradigm Healthcare Services: возможен доступ к номерам участников Medi-Cal и датам рождения, и что делать участникам https://itdef.net/ru/learn/photon-health-metabase-data-breach-2026ITDru2026-10-31Утечка данных Photon Health (уязвимость инструмента аналитики): имена, адреса, номера телефонов, даты рождения и сведения о рецептах — что делать пострадавшим пациентам https://itdef.net/ru/learn/plex-media-server-plex2shell-cve-2026-96652ITDru2026-10-31Plex2Shell: четыре CVE в Plex Media Server эксплуатируются на практике (обновитесь до 1.43.3.10861 или новее) https://itdef.net/ru/learn/polymarket-third-party-script-incident-2026ITDru2026-10-31Polymarket приостановила торги после компрометации стороннего скрипта: что делать пользователям и операторам сайтов https://itdef.net/ru/learn/ricardo-data-breach-2026ITDru2026-10-31Утечка данных Ricardo (швейцарский маркетплейс), около 890 000 аккаунтов: раскрыты имена, адреса и телефоны, и что делать пользователям https://itdef.net/ru/learn/sharepoint-server-cve-2026-65660ITDru2026-10-31SharePoint Server CVE-2026-65660: выполнение кода вошедшим пользователем, уязвимость эксплуатируется (установите обновления августа 2026 года) https://itdef.net/ru/learn/trezor-hardware-wallet-implant-report-2026ITDru2026-10-31Trezor сообщает о возможном аппаратном имплантате в Safe 5 от бывшего реселлера (не подтверждено): что делать владельцам https://itdef.net/ru/learn/yakult-website-data-breach-2026ITDru2026-10-31Взлом сайта Yakult Honsha (около 40 000 записей): имена, адреса, телефоны, адреса эл. почты и содержание обращений утекли — что делать пострадавшим https://itdef.net/ru/learn/zeabur-security-incident-2026ITDru2026-10-31Инцидент безопасности Zeabur (октябрь 2026, прочитано 3,22 млн переменных окружения): какие секреты заменить и что делать пользователям https://itdef.net/ru/learn/connectwise-cloud-backup-m365-incident-2026ITDru2026-10-30Инцидент с ConnectWise Cloud Backup (прежде SkyKick): попытки входа с помощью ИИ в более чем 2 250 тенантов Microsoft 365 и что проверить администраторам https://itdef.net/ru/learn/jal-ana-reservation-data-breach-2026ITDru2026-10-30Несанкционированный доступ к поставщику системы бронирования JAL, JTA, ANA, Korean Air и Asiana (около 92 000 клиентов JAL/JTA и 37 800 клиентов ANA): номера бронирований, имена и не только, что делать путешественникам https://itdef.net/ru/learn/aena-ec-app-data-breach-2026ITDru2026-10-30Несанкционированный доступ к EC-приложению Aena (данные личных кабинетов до 817 215 человек): имена, адреса и данные доставки, которые могли быть просмотрены, что делать участникам https://itdef.net/ru/learn/asos-customer-data-breach-2026ITDru2026-10-30Утечка данных клиентов ASOS и поддельное уведомление в приложении: затронуты имена и контактные данные, о датах рождения и истории поиска сообщается в прессе — что делать клиентам https://itdef.net/ru/learn/benefit-one-tokugai-data-breach-2026ITDru2026-10-30Взлом подрядчика сервиса Benefit One «Toku-Kai» (29 465 человек): утекли имена, даты рождения и адреса почты, и что делать участникам https://itdef.net/ru/learn/bitget-crypto-theft-2026ITDru2026-10-30Кража криптовалюты у Bitget (около 387,5 млн долларов США): покрыты ли балансы клиентов и что делать владельцам аккаунтов https://itdef.net/ru/learn/bithumb-security-incident-2026ITDru2026-10-30Несанкционированный доступ к внутренней системе групповой работы Bithumb (раскрыты данные 844 клиентов): идентификационные и счетные номера и другое, и что делать клиентам https://itdef.net/ru/learn/covered-california-data-breach-2026ITDru2026-10-30Утечка данных агентов Covered California: имена, номера лицензий и SSN или FEIN раскрыты при фишинге — что делать агентам https://itdef.net/ru/learn/double-counter-discord-bot-data-breach-2026ITDru2026-10-30Утечка данных Discord-бота Double Counter (около 28 млн Discord ID, 1 млн адресов почты): что утекло и что делать участникам и администраторам серверов https://itdef.net/ru/learn/engie-customer-data-breach-2026ITDru2026-10-30Утечка данных клиентов ENGIE (Франция): контакты и номера договоров раскрыты через торговый инструмент партнера, банковских данных нет, и что делать клиентам https://itdef.net/ru/learn/florida-department-of-education-data-breach-2026ITDru2026-10-30Утечка на сайте финансовой помощи студентам Министерства образования Флориды (около 4,9 млн человек): номера социального страхования могли быть раскрыты — что делать https://itdef.net/ru/learn/frontline-education-data-breach-2026ITDru2026-10-30Утечка данных Frontline Education (поставщик школьного ПО): затронуты номера социального страхования, Medicaid ID и студенческие ID — что делать сотрудникам и родителям https://itdef.net/ru/learn/hana-cupid-data-breach-2026ITDru2026-10-30Утечка данных участников Hana-cupid (до 4 238 242 записей): идентификаторы, зашифрованные пароли и адреса электронной почты, что делать участникам https://itdef.net/ru/learn/irhythm-data-breach-2026ITDru2026-10-30Утечка данных iRhythm (в списке HHS 8 179 772 человека): имена пациентов Zio, номера страховок и серийные номера устройств — что делать пациентам https://itdef.net/ru/learn/navigate360-p3-crime-stoppers-data-breach-2026ITDru2026-10-30Взлом Navigate360 и платформа приема сообщений Crime Stoppers (P3): что делать тем, кто сообщал, упомянутым в сообщениях и получателям уведомлений в США https://itdef.net/ru/learn/sony-life-medicare-data-breach-2026ITDru2026-10-30Несанкционированный доступ к Sony Life: утечка данных договоров Medicare Life (около 385 000 записей): имена, адреса, номера полисов и что делать страхователям и застрахованным https://itdef.net/ru/learn/university-of-copenhagen-data-breach-2026ITDru2026-10-30Утечка данных Копенгагенского университета (около 525 000 человек): имена, номера CPR, телефоны и почта — что делать https://itdef.net/ru/learn/vmware-esx-logging-cve-2026-41709ITDru2026-10-30VMware ESX CVE-2026-41709 (CVSS 2.7): CISA включила уязвимость с низкой серьёзностью в журналировании в список эксплуатируемых; примените весь VMSA-2026-0006 и проверьте свои хосты https://itdef.net/ru/learn/whiteessence-data-breach-2026ITDru2026-10-30Несанкционированный доступ к White Essence и утечка персональных данных (около 1,05 млн аккаунтов): имена, адреса, телефоны и зашифрованные пароли, что делать пользователям https://itdef.net/ru/learn/cisco-asa-ftd-vpn-dos-cve-2026-76418ITDru2026-10-29Уязвимость VPN в Cisco ASA и FTD CVE-2026-76418: неаутентифицированный атакующий может перезагрузить устройство (как проверить, исправленные версии) https://itdef.net/ru/learn/beautygarage-data-breach-2026ITDru2026-10-29Несанкционированный доступ к Beauty Garage и Eyelash Garage (775 725 записей): названия салонов, телефоны, адреса почты и хеши паролей, как защититься от подмены личности https://itdef.net/ru/learn/linux-kernel-fragnesia-cve-2026-46300ITDru2026-10-29Fragnesia в ядре Linux (CVE-2026-46300): CISA внесла её в список эксплуатируемых со сроком 31 октября; обновите PHP и ядро, затем перезагрузитесь https://itdef.net/ru/learn/so-net-data-breach-2026ITDru2026-10-29Несанкционированный доступ к базе данных участников So-net (2,14 млн записей So-net, 443 тыс. записей plala S-Course): имена, телефоны и даты рождения, что делать пользователям https://itdef.net/ru/learn/toypo-app-data-breach-2026ITDru2026-10-29Несанкционированный доступ к приложению Toypo (затронуты 697 209 пользователей, по данным Toypo): утекли номера телефонов, имена и адреса, и что делать пользователям приложений магазинов https://itdef.net/ko/learn/aomei-backupper-update-server-tampering-2026ITDko2026-10-31AOMEI Backupper 업데이트 서버 변조(2026년 4월–7월): 영향받을 수 있는 사람, 날짜, PC 확인 방법 https://itdef.net/ko/learn/binance-crypto-theft-2026ITDko2026-10-31바이낸스 암호화폐 탈취(약 63억 달러): 이용자 자금은 보전되나, 계정 보유자가 해야 할 일 https://itdef.net/ko/learn/cisco-catalyst-sd-wan-manager-cve-2026-76504ITDko2026-10-31Cisco Catalyst SD-WAN Manager CVE-2026-76504: 로그인 없이 관리자 권한 접근, 악용됨(수정 릴리스로 업그레이드) https://itdef.net/ko/learn/cloudflare-workers-ai-cache-data-exposure-2026ITDko2026-10-31Cloudflare Workers AI가 155건의 응답에서 다른 고객의 데이터를 반환(GLM 5.3): 호스팅 AI를 쓰는 팀이 점검할 것 https://itdef.net/ko/learn/cursor-fake-claude-code-extension-backdoor-2026ITDko2026-10-31Cursor 마켓플레이스의 변조된 'Claude Code' 확장(10월 29일, 약 11시간): SSH 백도어 확인 방법 https://itdef.net/ko/learn/dreamhost-password-reset-incident-2026ITDko2026-10-31DreamHost 보안 사고(2026년 10월): 일부 이메일·FTP·SFTP 사용자 비밀번호 재설정, 계정 소유자가 해야 할 일 https://itdef.net/ko/learn/drupal-commerce-core-cve-2026-118539ITDko2026-10-31Drupal Commerce Core CVE-2026-118539: 비인증 접근 우회, 악용 중(8.x-2.41 또는 3.3.13으로 업데이트) https://itdef.net/ko/learn/ets-california-student-data-breach-2026ITDko2026-10-31ETS 캘리포니아 학생 데이터 유출: 장애·504·시험 데이터 복사 — 가족이 해야 할 일 https://itdef.net/ko/learn/genesys-data-breach-2026ITDko2026-10-31Genesys 내부 시스템 침해(2026년 10월): 고객 연락처가 담긴 시스템에 무단 접근, 플랫폼은 영향 없음, 고객사가 해야 할 일 https://itdef.net/ko/learn/gettiis-ticket-data-breach-2026ITDko2026-10-31GETTIIS 회원 데이터 유출(회원 ID 317,971건): 유출된 항목과 회원이 해야 할 일 https://itdef.net/ko/learn/ivanti-connect-secure-cve-2026-111357ITDko2026-10-31Ivanti Connect Secure CVE-2026-111357 및 CVE-2026-118527: CISA KEV에 추가된 두 가지 추가 취약점(10월 공격에 대한 대처) https://itdef.net/ko/learn/matsuya-app-data-breach-2026ITDko2026-10-31마쓰야 앱 관리 시스템 유출(2,377,127건 및 앱 회원): 이름, 전화번호, 배달 주소 유출, 회원이 해야 할 일 https://itdef.net/ko/learn/muji-app-data-breach-2026ITDko2026-10-31료힌케이카쿠(MUJI) 앱 해킹(최대 약 2,726만 건): 이메일 주소, 생년월일, 성별 유출 가능성 — 이용자가 해야 할 일 https://itdef.net/ko/learn/opencode-console-api-key-breach-2026ITDko2026-10-31OpenCode Console 침해(2026년 10월, Console 이용자의 1.4%): AI 제공업체 API 키 노출 가능성과 해야 할 일 https://itdef.net/ko/learn/orkes-conductor-cve-2026-58138ITDko2026-10-31Orkes Conductor CVE-2026-58138: 인증 없이 OS 명령 실행, 공격 시도 관측(3.30.2 이상으로 업데이트) https://itdef.net/ko/learn/paradigm-healthcare-medi-cal-data-breach-2026ITDko2026-10-31Paradigm Healthcare Services 데이터 유출: Medi-Cal 회원 번호와 생년월일 열람 가능성 — 회원이 해야 할 일 https://itdef.net/ko/learn/photon-health-metabase-data-breach-2026ITDko2026-10-31Photon Health 개인정보 유출(분석 도구 취약점): 이름, 주소, 전화번호, 생년월일, 처방 정보 — 영향을 받은 환자가 해야 할 일 https://itdef.net/ko/learn/plex-media-server-plex2shell-cve-2026-96652ITDko2026-10-31Plex2Shell: Plex Media Server CVE 4건이 실제로 악용됨(1.43.3.10861 이상으로 업데이트) https://itdef.net/ko/learn/polymarket-third-party-script-incident-2026ITDko2026-10-31폴리마켓, 제3자 스크립트 침해로 거래 중단: 이용자와 사이트 운영자가 해야 할 일 https://itdef.net/ko/learn/ricardo-data-breach-2026ITDko2026-10-31Ricardo(스위스 마켓플레이스) 정보 유출, 약 89만 계정: 이름·주소·전화번호 노출, 이용자가 해야 할 일 https://itdef.net/ko/learn/sharepoint-server-cve-2026-65660ITDko2026-10-31SharePoint Server CVE-2026-65660: 로그인한 사용자가 코드 실행 가능, 악용됨(2026년 8월 업데이트 설치) https://itdef.net/ko/learn/trezor-hardware-wallet-implant-report-2026ITDko2026-10-31Trezor, 전 판매업체에서 구입한 Safe 5에서 하드웨어 임플란트 가능성 보고(미확인): 소유자가 해야 할 일 https://itdef.net/ko/learn/yakult-website-data-breach-2026ITDko2026-10-31야쿠르트 본사 웹사이트 해킹(약 4만 건): 이름, 주소, 전화번호, 이메일, 문의 내용 유출 — 영향을 받은 사람이 해야 할 일 https://itdef.net/ko/learn/zeabur-security-incident-2026ITDko2026-10-31Zeabur 보안 사고(2026년 10월, 환경 변수 322만 건 열람): 교체할 시크릿과 이용자가 해야 할 일 https://itdef.net/ko/learn/connectwise-cloud-backup-m365-incident-2026ITDko2026-10-30ConnectWise Cloud Backup(구 SkyKick) 사건: Microsoft 365 테넌트 2,250개 이상에 대한 AI 기반 로그인 시도, 관리자가 확인할 것 https://itdef.net/ko/learn/jal-ana-reservation-data-breach-2026ITDko2026-10-30JAL, JTA, ANA, 대한항공, 아시아나항공 예약 시스템 업체에 대한 무단 접근(JAL/JTA 고객 약 92,000명, ANA 약 37,800명): 예약 번호, 이름 등과 여행객이 해야 할 일 https://itdef.net/ko/learn/aena-ec-app-data-breach-2026ITDko2026-10-30Aena EC 앱 무단 접근(최대 817,215명의 마이페이지 데이터): 열람되었을 수 있는 이름, 주소, 배송 정보 및 회원이 해야 할 일 https://itdef.net/ko/learn/asos-customer-data-breach-2026ITDko2026-10-30ASOS 고객 데이터 유출과 가짜 앱 알림: 이름과 연락처 접근, 생년월일과 검색 기록은 보도 — 고객이 해야 할 일 https://itdef.net/ko/learn/benefit-one-tokugai-data-breach-2026ITDko2026-10-30베네핏 원 'Toku-Kai' 위탁처 침해(29,465명): 이름·생년월일·이메일 주소 유출, 회원이 해야 할 일 https://itdef.net/ko/learn/bitget-crypto-theft-2026ITDko2026-10-30Bitget 암호화폐 도난(약 3억 8,750만 달러): 고객 잔액은 보호되는가, 계정 보유자가 해야 할 일 https://itdef.net/ko/learn/bithumb-security-incident-2026ITDko2026-10-30빗썸 내부 그룹웨어 무단 접근(고객 844명 개인정보 노출): 신분 번호·계좌 번호 등, 고객이 해야 할 일 https://itdef.net/ko/learn/covered-california-data-breach-2026ITDko2026-10-30Covered California 에이전트 데이터 유출: 피싱 사고로 이름, 면허 번호, 사회보장번호 또는 FEIN 노출 — 에이전트가 해야 할 일 https://itdef.net/ko/learn/double-counter-discord-bot-data-breach-2026ITDko2026-10-30Double Counter 디스코드 봇 데이터 유출(디스코드 ID 약 2,800만 건, 이메일 100만 건): 유출된 것과 회원 및 서버 관리자가 해야 할 일 https://itdef.net/ko/learn/engie-customer-data-breach-2026ITDko2026-10-30ENGIE 고객 정보 유출(프랑스): 제휴사 영업 도구를 통해 연락처와 계약 번호 노출, 은행 정보는 없음, 고객이 해야 할 일 https://itdef.net/ko/learn/florida-department-of-education-data-breach-2026ITDko2026-10-30플로리다 교육부 학자금 지원 웹사이트 유출(약 490만 명): 사회보장번호가 노출되었을 수 있음 — 해야 할 일 https://itdef.net/ko/learn/frontline-education-data-breach-2026ITDko2026-10-30Frontline Education 데이터 유출(학교 소프트웨어 업체): 사회보장번호, 메디케이드 ID, 학생 ID 영향 — 교직원과 학부모가 해야 할 일 https://itdef.net/ko/learn/hana-cupid-data-breach-2026ITDko2026-10-30Hana-cupid 회원 데이터 유출(최대 4,238,242건): 사용자 ID, 암호화된 비밀번호, 이메일 주소 유출 및 회원이 해야 할 일 https://itdef.net/ko/learn/irhythm-data-breach-2026ITDko2026-10-30iRhythm 데이터 유출(HHS 등재 8,179,772명): Zio 환자 이름, 보험 번호, 기기 일련번호 유출 — 환자가 해야 할 일 https://itdef.net/ko/learn/navigate360-p3-crime-stoppers-data-breach-2026ITDko2026-10-30Navigate360 침해와 Crime Stoppers 제보 플랫폼(P3): 제보자, 제보에 언급된 사람, 미국 통지 수신자가 해야 할 일 https://itdef.net/ko/learn/sony-life-medicare-data-breach-2026ITDko2026-10-30소니생명 무단 접근으로 메디케어생명 계약 데이터 유출(약 385,000건): 이름, 주소, 증권 번호 등과 계약자·피보험자가 해야 할 일 https://itdef.net/ko/learn/university-of-copenhagen-data-breach-2026ITDko2026-10-30코펜하겐 대학교 개인정보 유출(약 525,000명): 이름·CPR 번호·전화번호·이메일 — 해야 할 일 https://itdef.net/ko/learn/vmware-esx-logging-cve-2026-41709ITDko2026-10-30VMware ESX CVE-2026-41709(CVSS 2.7): CISA가 낮은 심각도의 로깅 결함을 악용 중으로 등재; VMSA-2026-0006 전체를 패치하고 호스트를 점검하세요 https://itdef.net/ko/learn/whiteessence-data-breach-2026ITDko2026-10-30White Essence 무단 접근 및 개인 정보 유출(약 105만 계정): 이름, 주소, 전화번호, 암호화된 비밀번호 및 이용자가 해야 할 일 https://itdef.net/ko/learn/cisco-asa-ftd-vpn-dos-cve-2026-76418ITDko2026-10-29Cisco ASA 및 FTD VPN 취약점 CVE-2026-76418: 인증 없는 공격자가 장비를 재시작시킬 수 있음(확인 방법, 수정 버전) https://itdef.net/ko/learn/beautygarage-data-breach-2026ITDko2026-10-29Beauty Garage 및 Eyelash Garage 무단 접근(775,725건): 살롱 이름, 전화번호, 이메일, 비밀번호 해시 유출과 사칭을 막는 방법 https://itdef.net/ko/learn/linux-kernel-fragnesia-cve-2026-46300ITDko2026-10-29Linux 커널 Fragnesia(CVE-2026-46300): CISA가 악용된 것으로 등재하고 10월 31일을 기한으로 지정. PHP와 커널을 패치하고 재부팅하십시오 https://itdef.net/ko/learn/so-net-data-breach-2026ITDko2026-10-29So-net 회원 데이터베이스 무단 접근(So-net 214만 건, plala S-Course 44.3만 건): 이름, 전화번호, 생년월일 유출과 이용자가 해야 할 일 https://itdef.net/ko/learn/toypo-app-data-breach-2026ITDko2026-10-29Toypo 앱 무단 접근(Toypo 발표 기준 이용자 697,209명 해당): 전화번호·이름·주소 유출, 매장 앱 이용자가 해야 할 일 https://itdef.net/es/learn/aomei-backupper-update-server-tampering-2026ITDes2026-10-31Servidor de actualizaciones de AOMEI Backupper manipulado (de abril a julio de 2026): quién puede estar afectado, las fechas y cómo revisar su PC https://itdef.net/es/learn/binance-crypto-theft-2026ITDes2026-10-31Robo de criptoactivos en Binance (unos US$6.300 millones): ¿están cubiertos los fondos de los usuarios y qué deben hacer los titulares de cuentas? https://itdef.net/es/learn/cisco-catalyst-sd-wan-manager-cve-2026-76504ITDes2026-10-31Cisco Catalyst SD-WAN Manager CVE-2026-76504: acceso de administrador sin iniciar sesión, explotada (actualice a una versión corregida) https://itdef.net/es/learn/cloudflare-workers-ai-cache-data-exposure-2026ITDes2026-10-31Cloudflare Workers AI devolvió datos de otros clientes en 155 respuestas (GLM 5.3): qué deben comprobar los equipos que usan IA alojada https://itdef.net/es/learn/cursor-fake-claude-code-extension-backdoor-2026ITDes2026-10-31Extensión «Claude Code» manipulada en el mercado de Cursor (29 de oct., unas 11 horas): cómo comprobar si hay una puerta trasera SSH https://itdef.net/es/learn/dreamhost-password-reset-incident-2026ITDes2026-10-31Incidente de DreamHost (octubre de 2026): restablecidas las contraseñas de algunos usuarios de correo, FTP y SFTP, y qué deben hacer los titulares de cuenta https://itdef.net/es/learn/drupal-commerce-core-cve-2026-118539ITDes2026-10-31Drupal Commerce Core CVE-2026-118539: omisión de acceso sin autenticación, explotada activamente (actualice a 8.x-2.41 o 3.3.13) https://itdef.net/es/learn/ets-california-student-data-breach-2026ITDes2026-10-31Filtración de datos de estudiantes de ETS en California: se copiaron datos de discapacidad, 504 y pruebas, y qué deben hacer las familias https://itdef.net/es/learn/genesys-data-breach-2026ITDes2026-10-31Brecha en sistemas internos de Genesys (octubre de 2026): accedieron a sistemas con datos de contacto de clientes, las plataformas no se vieron afectadas, y qué deben hacer los clientes https://itdef.net/es/learn/gettiis-ticket-data-breach-2026ITDes2026-10-31Filtración de datos de miembros de GETTIIS (317.971 ID de miembro): qué se filtró y qué deben hacer los miembros https://itdef.net/es/learn/ivanti-connect-secure-cve-2026-111357ITDes2026-10-31Ivanti Connect Secure CVE-2026-111357 y CVE-2026-118527: dos fallos más añadidos al KEV de CISA (qué hacer ante los ataques de octubre) https://itdef.net/es/learn/matsuya-app-data-breach-2026ITDes2026-10-31Filtración en el sistema de gestión de la app de Matsuya (2.377.127 registros más miembros de la app): nombres, teléfonos y direcciones de entrega expuestos: qué deben hacer los miembros https://itdef.net/es/learn/muji-app-data-breach-2026ITDes2026-10-31Filtración de la app de Ryohin Keikaku (MUJI) (hasta unos 27,26 millones de registros): pueden haberse filtrado correos, fechas de nacimiento y género — qué deben hacer los usuarios https://itdef.net/es/learn/opencode-console-api-key-breach-2026ITDes2026-10-31Brecha de OpenCode Console (octubre de 2026, 1,4 % de los usuarios de Console): claves de API de proveedores de IA posiblemente expuestas, y qué hacer https://itdef.net/es/learn/orkes-conductor-cve-2026-58138ITDes2026-10-31Orkes Conductor CVE-2026-58138: ejecución de comandos del sistema sin autenticación, con intentos de ataque observados (actualice a 3.30.2 o posterior) https://itdef.net/es/learn/paradigm-healthcare-medi-cal-data-breach-2026ITDes2026-10-31Filtración de datos de Paradigm Healthcare Services: pudo haberse accedido a números de afiliado de Medi-Cal y fechas de nacimiento, y qué deben hacer los afiliados https://itdef.net/es/learn/photon-health-metabase-data-breach-2026ITDes2026-10-31Filtración de datos de Photon Health (fallo en una herramienta de análisis): nombres, direcciones, teléfonos, fechas de nacimiento e información de recetas — qué deben hacer los pacientes afectados https://itdef.net/es/learn/plex-media-server-plex2shell-cve-2026-96652ITDes2026-10-31Plex2Shell: cuatro CVE de Plex Media Server explotadas activamente (actualice a 1.43.3.10861 o posterior) https://itdef.net/es/learn/polymarket-third-party-script-incident-2026ITDes2026-10-31Polymarket detiene las operaciones tras comprometerse un script de terceros: qué deben hacer los usuarios y los operadores de sitios https://itdef.net/es/learn/ricardo-data-breach-2026ITDes2026-10-31Filtración de datos de Ricardo (marketplace suizo), unas 890.000 cuentas: nombres, direcciones y teléfonos expuestos, y qué deben hacer los usuarios https://itdef.net/es/learn/sharepoint-server-cve-2026-65660ITDes2026-10-31SharePoint Server CVE-2026-65660: ejecución de código por un usuario con sesión iniciada, explotada (instale las actualizaciones de agosto de 2026) https://itdef.net/es/learn/trezor-hardware-wallet-implant-report-2026ITDes2026-10-31Trezor informa de un posible implante de hardware en un Safe 5 de un antiguo revendedor (sin confirmar): qué deben hacer los propietarios https://itdef.net/es/learn/yakult-website-data-breach-2026ITDes2026-10-31Filtración del sitio web de Yakult Honsha (unos 40.000 registros): se filtraron nombres, direcciones, teléfonos, correos y contenido de consultas — qué deben hacer los afectados https://itdef.net/es/learn/zeabur-security-incident-2026ITDes2026-10-31Incidente de seguridad de Zeabur (octubre de 2026, 3,22 millones de variables de entorno leídas): qué secretos rotar y qué deben hacer los usuarios https://itdef.net/es/learn/connectwise-cloud-backup-m365-incident-2026ITDes2026-10-30Incidente de ConnectWise Cloud Backup (antes SkyKick): intentos de inicio de sesión dirigidos por IA contra más de 2.250 inquilinos de Microsoft 365 y qué deben comprobar los administradores https://itdef.net/es/learn/jal-ana-reservation-data-breach-2026ITDes2026-10-30Acceso no autorizado al proveedor del sistema de reservas de JAL, JTA, ANA, Korean Air y Asiana (unos 92.000 clientes de JAL/JTA y 37.800 de ANA): números de reserva, nombres y más datos, y qué deben hacer los viajeros https://itdef.net/es/learn/aena-ec-app-data-breach-2026ITDes2026-10-30Acceso no autorizado a la app de comercio electrónico de Aena (datos de Mi Página de hasta 817.215 personas): nombres, direcciones y datos de entrega que pueden haberse consultado, y qué deben hacer los miembros https://itdef.net/es/learn/asos-customer-data-breach-2026ITDes2026-10-30Brecha de datos de clientes de ASOS y falsa alerta en la app: nombres y datos de contacto robados, fechas de nacimiento e historial de búsquedas según informaciones — qué deben hacer los clientes https://itdef.net/es/learn/benefit-one-tokugai-data-breach-2026ITDes2026-10-30Filtración en un proveedor de Benefit One para 'Toku-Kai' (29.465 personas): nombres, fechas de nacimiento y correos filtrados, y qué deben hacer los miembros https://itdef.net/es/learn/bitget-crypto-theft-2026ITDes2026-10-30Robo de criptoactivos en Bitget (unos 387,5 millones de dólares): ¿están cubiertos los saldos de los clientes y qué deben hacer los titulares de cuentas? https://itdef.net/es/learn/bithumb-security-incident-2026ITDes2026-10-30Acceso no autorizado al groupware interno de Bithumb (datos personales de 844 clientes expuestos): números de identificación, números de cuenta y más, y qué deben hacer los clientes https://itdef.net/es/learn/covered-california-data-breach-2026ITDes2026-10-30Filtración de datos de agentes de Covered California: nombres, números de licencia y número de la Seguridad Social o FEIN expuestos en un incidente de phishing, y qué deben hacer los agentes https://itdef.net/es/learn/double-counter-discord-bot-data-breach-2026ITDes2026-10-30Brecha de datos del bot de Discord Double Counter (unos 28 millones de IDs de Discord, 1 millón de correos): qué se filtró y qué deben hacer los miembros y los administradores de servidores https://itdef.net/es/learn/engie-customer-data-breach-2026ITDes2026-10-30Filtración de datos de clientes de ENGIE (Francia): datos de contacto y números de contrato expuestos a través de una herramienta comercial de un socio, sin datos bancarios, y qué deben hacer los clientes https://itdef.net/es/learn/florida-department-of-education-data-breach-2026ITDes2026-10-30Filtración en el sitio web de ayuda financiera del Departamento de Educación de Florida (unos 4,9 millones de personas): números de la Seguridad Social en riesgo y qué hacer https://itdef.net/es/learn/frontline-education-data-breach-2026ITDes2026-10-30Filtración de datos de Frontline Education (proveedor de software escolar): números de la Seguridad Social, de Medicaid y de estudiante afectados, y qué deben hacer el personal y las familias https://itdef.net/es/learn/hana-cupid-data-breach-2026ITDes2026-10-30Filtración de datos de miembros de Hana-cupid (hasta 4.238.242 registros): ID de usuario, contraseñas cifradas y correos electrónicos filtrados, y qué deben hacer los miembros https://itdef.net/es/learn/irhythm-data-breach-2026ITDes2026-10-30Filtración de datos de iRhythm (8.179.772 personas en el listado del HHS): nombres de pacientes de Zio, números de seguro y números de serie de dispositivos, y qué deben hacer los pacientes https://itdef.net/es/learn/navigate360-p3-crime-stoppers-data-breach-2026ITDes2026-10-30Brecha de Navigate360 y la plataforma de denuncias de Crime Stoppers (P3): qué deben hacer quienes enviaron avisos, quienes aparecen en ellos y los destinatarios de la notificación en EE. UU. https://itdef.net/es/learn/sony-life-medicare-data-breach-2026ITDes2026-10-30Un acceso no autorizado a Sony Life filtra datos de pólizas de Medicare Life (unos 385.000 registros): nombres, direcciones, números de póliza y más, y qué deben hacer tomadores y asegurados https://itdef.net/es/learn/university-of-copenhagen-data-breach-2026ITDes2026-10-30Filtración de datos de la Universidad de Copenhague (unas 525.000 personas): nombres, números CPR, teléfonos y correos — qué hacer https://itdef.net/es/learn/vmware-esx-logging-cve-2026-41709ITDes2026-10-30VMware ESX CVE-2026-41709 (CVSS 2.7): CISA incluye como explotado este fallo de registro de baja gravedad; aplique todo VMSA-2026-0006 y revise sus hosts https://itdef.net/es/learn/whiteessence-data-breach-2026ITDes2026-10-30Acceso no autorizado y filtración de datos personales en White Essence (unos 1,05 millones de cuentas): nombres, direcciones, teléfonos y contraseñas cifradas, y qué deben hacer los usuarios https://itdef.net/es/learn/cisco-asa-ftd-vpn-dos-cve-2026-76418ITDes2026-10-29Falla de VPN en Cisco ASA y FTD CVE-2026-76418: un atacante sin autenticar puede reiniciar el dispositivo (cómo comprobarlo, versiones corregidas) https://itdef.net/es/learn/beautygarage-data-breach-2026ITDes2026-10-29Acceso no autorizado a Beauty Garage y Eyelash Garage (775.725 registros): nombres de salones, teléfonos, correos y hashes de contraseñas expuestos, y cómo protegerse de la suplantación https://itdef.net/es/learn/linux-kernel-fragnesia-cve-2026-46300ITDes2026-10-29Fragnesia del kernel de Linux (CVE-2026-46300): CISA la incluye como explotada con plazo al 31 de octubre; actualice PHP y el kernel, y reinicie https://itdef.net/es/learn/so-net-data-breach-2026ITDes2026-10-29Acceso no autorizado a la base de datos de miembros de So-net (2,14 M de registros de So-net, 443 K de plala S-Course): nombres, teléfonos y fechas de nacimiento expuestos, y qué deben hacer los usuarios https://itdef.net/es/learn/toypo-app-data-breach-2026ITDes2026-10-29Acceso no autorizado a la app Toypo (697.209 usuarios afectados, según Toypo): teléfonos, nombres y direcciones filtrados, y qué deben hacer los usuarios de apps de tiendas https://itdef.net/pt-BR/learn/aomei-backupper-update-server-tampering-2026ITDpt2026-10-31Servidor de atualizações do AOMEI Backupper adulterado (de abril a julho de 2026): quem pode ter sido afetado, as datas e como verificar seu PC https://itdef.net/pt-BR/learn/binance-crypto-theft-2026ITDpt2026-10-31Roubo de criptoativos na Binance (cerca de US$ 6,3 bilhões): os fundos dos usuários estão cobertos e o que os titulares de contas devem fazer https://itdef.net/pt-BR/learn/cisco-catalyst-sd-wan-manager-cve-2026-76504ITDpt2026-10-31Cisco Catalyst SD-WAN Manager CVE-2026-76504: acesso de administrador sem login, explorada (atualize para uma versão corrigida) https://itdef.net/pt-BR/learn/cloudflare-workers-ai-cache-data-exposure-2026ITDpt2026-10-31Cloudflare Workers AI devolveu dados de outros clientes em 155 respostas (GLM 5.3): o que as equipes que usam IA hospedada devem verificar https://itdef.net/pt-BR/learn/cursor-fake-claude-code-extension-backdoor-2026ITDpt2026-10-31Extensão “Claude Code” adulterada no marketplace do Cursor (29 de out., cerca de 11 horas): como verificar se há um backdoor SSH https://itdef.net/pt-BR/learn/dreamhost-password-reset-incident-2026ITDpt2026-10-31Incidente da DreamHost (outubro de 2026): senhas de alguns usuários de e-mail, FTP e SFTP redefinidas, e o que os titulares de conta devem fazer https://itdef.net/pt-BR/learn/drupal-commerce-core-cve-2026-118539ITDpt2026-10-31Drupal Commerce Core CVE-2026-118539: desvio de acesso sem autenticação, explorado ativamente (atualize para 8.x-2.41 ou 3.3.13) https://itdef.net/pt-BR/learn/ets-california-student-data-breach-2026ITDpt2026-10-31Vazamento de dados de estudantes da ETS na Califórnia: dados de deficiência, 504 e provas copiados, e o que as famílias devem fazer https://itdef.net/pt-BR/learn/genesys-data-breach-2026ITDpt2026-10-31Invasão de sistemas internos da Genesys (outubro de 2026): sistemas com dados de contato de clientes foram acessados, plataformas não afetadas, e o que os clientes devem fazer https://itdef.net/pt-BR/learn/gettiis-ticket-data-breach-2026ITDpt2026-10-31Vazamento de dados de membros do GETTIIS (317.971 IDs de membro): o que vazou e o que os membros devem fazer https://itdef.net/pt-BR/learn/ivanti-connect-secure-cve-2026-111357ITDpt2026-10-31Ivanti Connect Secure CVE-2026-111357 e CVE-2026-118527: mais duas falhas adicionadas ao KEV da CISA (o que fazer diante dos ataques de outubro) https://itdef.net/pt-BR/learn/matsuya-app-data-breach-2026ITDpt2026-10-31Vazamento no sistema de gestão do app da Matsuya (2.377.127 registros mais membros do app): nomes, telefones e endereços de entrega expostos: o que os membros devem fazer https://itdef.net/pt-BR/learn/muji-app-data-breach-2026ITDpt2026-10-31Vazamento no app da Ryohin Keikaku (MUJI) (até cerca de 27,26 milhões de registros): e-mails, datas de nascimento e gênero podem ter vazado — o que os usuários devem fazer https://itdef.net/pt-BR/learn/opencode-console-api-key-breach-2026ITDpt2026-10-31Violação no OpenCode Console (outubro de 2026, 1,4% dos usuários do Console): chaves de API de provedores de IA possivelmente expostas, e o que fazer https://itdef.net/pt-BR/learn/orkes-conductor-cve-2026-58138ITDpt2026-10-31Orkes Conductor CVE-2026-58138: execução de comandos do sistema sem autenticação, com tentativas de ataque observadas (atualize para 3.30.2 ou posterior) https://itdef.net/pt-BR/learn/paradigm-healthcare-medi-cal-data-breach-2026ITDpt2026-10-31Vazamento de dados da Paradigm Healthcare Services: números de afiliado do Medi-Cal e datas de nascimento podem ter sido acessados, e o que os afiliados devem fazer https://itdef.net/pt-BR/learn/photon-health-metabase-data-breach-2026ITDpt2026-10-31Vazamento de dados da Photon Health (falha em uma ferramenta de análise): nomes, endereços, telefones, datas de nascimento e informações de receitas — o que os pacientes afetados devem fazer https://itdef.net/pt-BR/learn/plex-media-server-plex2shell-cve-2026-96652ITDpt2026-10-31Plex2Shell: quatro CVEs do Plex Media Server exploradas ativamente (atualize para 1.43.3.10861 ou posterior) https://itdef.net/pt-BR/learn/polymarket-third-party-script-incident-2026ITDpt2026-10-31Polymarket suspende as negociações após o comprometimento de um script de terceiros: o que usuários e operadores de sites devem fazer https://itdef.net/pt-BR/learn/ricardo-data-breach-2026ITDpt2026-10-31Vazamento de dados da Ricardo (marketplace suíço), cerca de 890 mil contas: nomes, endereços e telefones expostos, e o que os usuários devem fazer https://itdef.net/pt-BR/learn/sharepoint-server-cve-2026-65660ITDpt2026-10-31SharePoint Server CVE-2026-65660: execução de código por um usuário logado, explorada (instale as atualizações de agosto de 2026) https://itdef.net/pt-BR/learn/trezor-hardware-wallet-implant-report-2026ITDpt2026-10-31Trezor relata possível implante de hardware em um Safe 5 de um ex-revendedor (não confirmado): o que os proprietários devem fazer https://itdef.net/pt-BR/learn/yakult-website-data-breach-2026ITDpt2026-10-31Vazamento no site da Yakult Honsha (cerca de 40.000 registros): nomes, endereços, telefones, e-mails e conteúdo de consultas vazaram — o que os afetados devem fazer https://itdef.net/pt-BR/learn/zeabur-security-incident-2026ITDpt2026-10-31Incidente de segurança da Zeabur (outubro de 2026, 3,22 milhões de variáveis de ambiente lidas): quais segredos trocar e o que os usuários devem fazer https://itdef.net/pt-BR/learn/connectwise-cloud-backup-m365-incident-2026ITDpt2026-10-30Incidente do ConnectWise Cloud Backup (antes SkyKick): tentativas de login conduzidas por IA contra mais de 2.250 tenants do Microsoft 365 e o que os administradores devem verificar https://itdef.net/pt-BR/learn/jal-ana-reservation-data-breach-2026ITDpt2026-10-30Acesso não autorizado ao fornecedor do sistema de reservas da JAL, JTA, ANA, Korean Air e Asiana (cerca de 92.000 clientes da JAL/JTA e 37.800 da ANA): números de reserva, nomes e mais dados, e o que os viajantes devem fazer https://itdef.net/pt-BR/learn/aena-ec-app-data-breach-2026ITDpt2026-10-30Acesso não autorizado ao app de e-commerce da Aena (dados da Minha Página de até 817.215 pessoas): nomes, endereços e dados de entrega que podem ter sido visualizados, e o que os membros devem fazer https://itdef.net/pt-BR/learn/asos-customer-data-breach-2026ITDpt2026-10-30Vazamento de dados de clientes da ASOS e falso alerta no aplicativo: nomes e dados de contato levados, datas de nascimento e histórico de buscas relatados — o que os clientes devem fazer https://itdef.net/pt-BR/learn/benefit-one-tokugai-data-breach-2026ITDpt2026-10-30Vazamento em terceirizada da Benefit One no 'Toku-Kai' (29.465 pessoas): nomes, datas de nascimento e e-mails vazados, e o que os membros devem fazer https://itdef.net/pt-BR/learn/bitget-crypto-theft-2026ITDpt2026-10-30Roubo de criptoativos na Bitget (cerca de US$ 387,5 milhões): os saldos dos clientes estão cobertos e o que os titulares de contas devem fazer https://itdef.net/pt-BR/learn/bithumb-security-incident-2026ITDpt2026-10-30Acesso não autorizado ao groupware interno da Bithumb (dados pessoais de 844 clientes expostos): números de identificação, números de conta e mais, e o que os clientes devem fazer https://itdef.net/pt-BR/learn/covered-california-data-breach-2026ITDpt2026-10-30Vazamento de dados de agentes da Covered California: nomes, números de licença e número de Seguro Social ou FEIN expostos em um incidente de phishing, e o que os agentes devem fazer https://itdef.net/pt-BR/learn/double-counter-discord-bot-data-breach-2026ITDpt2026-10-30Vazamento de dados do bot de Discord Double Counter (cerca de 28 milhões de IDs do Discord, 1 milhão de e-mails): o que vazou e o que membros e administradores de servidores devem fazer https://itdef.net/pt-BR/learn/engie-customer-data-breach-2026ITDpt2026-10-30Vazamento de dados de clientes da ENGIE (França): dados de contato e números de contrato expostos por uma ferramenta de vendas de parceiros, sem dados bancários, e o que os clientes devem fazer https://itdef.net/pt-BR/learn/florida-department-of-education-data-breach-2026ITDpt2026-10-30Vazamento no site de auxílio financeiro do Departamento de Educação da Flórida (cerca de 4,9 milhões de pessoas): números de Seguro Social em risco e o que fazer https://itdef.net/pt-BR/learn/frontline-education-data-breach-2026ITDpt2026-10-30Vazamento de dados da Frontline Education (fornecedora de software escolar): números de Seguro Social, de Medicaid e de estudante afetados, e o que funcionários e famílias devem fazer https://itdef.net/pt-BR/learn/hana-cupid-data-breach-2026ITDpt2026-10-30Vazamento de dados de membros da Hana-cupid (até 4.238.242 registros): IDs de usuário, senhas criptografadas e e-mails vazados, e o que os membros devem fazer https://itdef.net/pt-BR/learn/irhythm-data-breach-2026ITDpt2026-10-30Vazamento de dados da iRhythm (8.179.772 pessoas na lista do HHS): nomes de pacientes do Zio, números de seguro e números de série de dispositivos, e o que os pacientes devem fazer https://itdef.net/pt-BR/learn/navigate360-p3-crime-stoppers-data-breach-2026ITDpt2026-10-30Violação da Navigate360 e da plataforma de denúncias do Crime Stoppers (P3): o que devem fazer quem enviou denúncias, quem é citado nelas e quem recebeu a notificação nos EUA https://itdef.net/pt-BR/learn/sony-life-medicare-data-breach-2026ITDpt2026-10-30Acesso não autorizado à Sony Life vaza dados de apólices da Medicare Life (cerca de 385.000 registros): nomes, endereços, números de apólice e mais, e o que segurados e tomadores devem fazer https://itdef.net/pt-BR/learn/university-of-copenhagen-data-breach-2026ITDpt2026-10-30Vazamento de dados da Universidade de Copenhague (cerca de 525.000 pessoas): nomes, números CPR, telefones e e-mails — o que fazer https://itdef.net/pt-BR/learn/vmware-esx-logging-cve-2026-41709ITDpt2026-10-30VMware ESX CVE-2026-41709 (CVSS 2.7): a CISA lista como explorada essa falha de registro de baixa gravidade; aplique todo o VMSA-2026-0006 e verifique seus hosts https://itdef.net/pt-BR/learn/whiteessence-data-breach-2026ITDpt2026-10-30Acesso não autorizado e vazamento de dados pessoais na White Essence (cerca de 1,05 milhão de contas): nomes, endereços, telefones e senhas criptografadas, e o que os usuários devem fazer https://itdef.net/pt-BR/learn/cisco-asa-ftd-vpn-dos-cve-2026-76418ITDpt2026-10-29Falha de VPN no Cisco ASA e FTD CVE-2026-76418: um invasor sem autenticação pode reiniciar o dispositivo (como verificar, versões corrigidas) https://itdef.net/pt-BR/learn/beautygarage-data-breach-2026ITDpt2026-10-29Acesso não autorizado à Beauty Garage e à Eyelash Garage (775.725 registros): nomes de salões, telefones, e-mails e hashes de senhas vazados, e como se proteger de falsificação de identidade https://itdef.net/pt-BR/learn/linux-kernel-fragnesia-cve-2026-46300ITDpt2026-10-29Fragnesia do kernel do Linux (CVE-2026-46300): a CISA a lista como explorada com prazo em 31 de outubro; atualize o PHP e o kernel e reinicie https://itdef.net/pt-BR/learn/so-net-data-breach-2026ITDpt2026-10-29Acesso não autorizado ao banco de dados de membros da So-net (2,14 mi de registros da So-net, 443 mil da plala S-Course): nomes, telefones e datas de nascimento vazados, e o que os usuários devem fazer https://itdef.net/pt-BR/learn/toypo-app-data-breach-2026ITDpt2026-10-29Acesso não autorizado ao app Toypo (697.209 usuários afetados, segundo a Toypo): telefones, nomes e endereços vazados, e o que devem fazer os usuários de apps de lojas