{ "response": [ { "Event": { "uuid": "33f88102-5701-57d5-ae19-61490a213398", "info": "Safeguarding India's Banking from AI-Powered Cyberattacks", "date": "2026-11-13", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"india\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/safeguarding-indias-banking-from-ai-powered-cyberattacks-20261113/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://ciso.economictimes.indiatimes.com/news/cybercrime-fraud/safeguarding-indias-banking-from-ai-powered-cyberattacks/135787484", "comment": "ETCISO (Economic Times)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (ETCISO (Economic Times)), Nov 13, 2026. Type: other; sectors: financial services. Asia-Pacific countries affected: India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "6eb20c15-2e94-5172-8c2c-bb1d822f59b8", "info": "Mirae Asset says data breaches exposed customer, employee information", "date": "2026-11-06", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"india\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/mirae-asset-says-data-breaches-exposed-customer-employee-information-20261106/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261107000400315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261107000451315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10929242", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://ciso.economictimes.indiatimes.com/news/data-breaches/personal-info-of-39000-persons-leaked-from-mirae-asset-securities/135669047", "comment": "ETCISO (Economic Times)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 4 articles in 3 outlets (ETCISO (Economic Times), The Korea Herald, Yonhap), Nov 6 to Nov 9, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea, India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "f930550a-e9fd-5a9b-b713-a6aecbb01a92", "info": "State Bank of India reports cyberattack involving nearly 3,900 customer records", "date": "2026-10-21", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"india\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/state-bank-of-india-reports-cyberattack-involving-nearly-3900-customer-20261021/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.channelnewsasia.com/business/state-bank-india-reports-cyberattack-involving-nearly-3900-customer-records-6477746", "comment": "Channel News Asia", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Channel News Asia), Oct 21, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "167ea1de-40ba-55d9-81b2-cbf681891ff2", "info": "Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties", "date": "2026-09-18", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"espionage\"" }, { "name": "misp-galaxy:threat-actor=\"WageMole\"" }, { "name": "misp-galaxy:country=\"india\"" }, { "name": "misp-galaxy:sector=\"Cryptocurrency\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-20260918/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/", "comment": "SentinelLabs", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (SentinelLabs), Sep 18, 2026. Type: espionage campaign; sectors: cryptocurrency. Asia-Pacific countries affected: India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "df93c624-4dac-5413-a1f3-71ded88e6b63", "info": "GitLab maximum-severity path traversal exploited within hours of disclosure", "date": "2026-09-11", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"supply_chain\"" }, { "name": "misp-galaxy:country=\"united states\"" }, { "name": "misp-galaxy:country=\"united kingdom\"" }, { "name": "misp-galaxy:country=\"germany\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:country=\"india\"" }, { "name": "misp-galaxy:country=\"singapore\"" }, { "name": "misp-galaxy:sector=\"Technology and Software Supply Chain\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" }, { "name": "misp-galaxy:sector=\"Government\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/gitlab-maximum-severity-path-traversal-exploited-within-hours-of-disclosure/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-one-known-exploited-vulnerability-catalog", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal in the GitLab repository commits API, came under in-the-wild probing from 06:00 UTC on 11 September 2026 according to watchTowr, the same day CISA added it to the KEV catalog. Exploitation requires only that a single public project exists and allows arbitrary file reads of logs, configuration files, credentials and secrets. Successful exploitation creates a direct path to source code theft and CI/CD pipeline compromise. Patches are available in 19.3.2, 19.2.6 and 19.1.8, with a 14 September federal remediation deadline.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "a33a801c-155e-55ff-a042-ba68fbef2d44", "info": "Google Patches Sixth Actively Exploited Chrome Zero-Day of 2026", "date": "2026-09-04", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"united states\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:country=\"australia\"" }, { "name": "misp-galaxy:country=\"india\"" }, { "name": "misp-galaxy:sector=\"Government\"" }, { "name": "misp-galaxy:sector=\"Technology\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" }, { "name": "misp-galaxy:sector=\"Healthcare\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/google-patches-sixth-actively-exploited-chrome-zero-day-of-2026/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://securityaffairs.com/198405/security/google-fixes-the-sixth-actively-exploited-chrome-zero-day-of-2026.html", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Google released an emergency Chrome update addressing CVE-2026-85046, a CVSS 8.8 type confusion vulnerability in the V8 JavaScript and WebAssembly engine that enables arbitrary code execution within the renderer sandbox via a crafted HTML page. The flaw was under active exploitation prior to patching and is the sixth exploited Chrome zero-day of 2026. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 September 2026, requiring Federal Civilian Executive Branch agencies to remediate by 18 September 2026. The fix ships in Chrome 152.0.7977.82.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "82d67df5-545f-59b5-bdad-47706b5845aa", "info": "JFrog Artifactory flaws chained to administrator access and Rust backdoor deployment", "date": "2026-09-01", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"supply_chain\"" }, { "name": "misp-galaxy:country=\"united states\"" }, { "name": "misp-galaxy:country=\"germany\"" }, { "name": "misp-galaxy:country=\"israel\"" }, { "name": "misp-galaxy:country=\"india\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:sector=\"Technology and Software Supply Chain\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" }, { "name": "misp-galaxy:sector=\"Telecommunications\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/jfrog-artifactory-flaws-chained-to-administrator-access-and-rust-backdoor-deployment/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.bleepingcomputer.com/news/security/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware/", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Wiz disclosed coordinated exploitation of CVE-2026-42018, which returns an internal anonymous-user token to an unauthenticated caller, chained with CVE-2026-42016 to escalate that token to administrator scope, taking attackers from first request to new admin account in under five minutes. Separately CVE-2026-82329, a CVSS 9.8 authentication bypass, was exploited between 1 and 8 September with approximately 406,000 attempts detected on 2 September alone. Post-compromise activity included persistent admin account creation, malicious Groovy plugin installation, custom Rust backdoor deployment and extraction of cluster join keys for lateral movement. Cloud instances were unaffected; CISA KEV-listed CVE-2026-42016 and CVE-2026-42018 on 11 September and CVE-2026-82329 on 2 September.", "comment": "summary", "to_ids": false } ] } } ] }