Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications. According to the company, the attacker used an AI offensive security framework to automate reconnaissance and exploitation attempts. Based on evidence from the investigation, no WorkOS app data or production services were accessed or affected. WorkOS is a developer infrastructure company that provides APIs, SDKs, and tools for integrating services such as enterprise authentication, single sign-on (SSO), user management, and identity management into applications. According to its website, at least 3,000 companies use its services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify. “On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team,” the company says in an incident alert.
Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day. Companies can record costs as high as $1 million due to fraudulent calls using stolen API keys, researchers at Google's Threat Intelligence Group (GTIG) and Mandiant in analyzed incidents. Based on their observations, there are "two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure." The researchers identified two categories of threat actors: those who scan for publicly exposed LLM endpoints and those who steal valid API keys from unprotected machines. After gaining initial access, the attackers sell it to services known as LLM mixers, which provide their subscribers with unauthorized access to LLMs.
Synology warns of ransomware attacks exploiting a 2024 flaw in outdated NAS devices, urging users to update DSM immediately. A security fix released in 2024 is now at the centre of ransomware attacks against Synology NAS devices. The company has found attackers targeting systems that still run outdated versions of DiskStation Manager (DSM), putting files stored on these network storage devices at risk of encryption and extortion. Synology disclosed the attacks on October 29, 2026. Its investigation found that threat actors are taking advantage of a vulnerability that the vendor had already addressed in December 2024. “These attacks aim to encrypt data and extort ransom.” The warning highlights how devices left without security updates can remain exposed long after vendors have released a fix. The company hasn’t identified the exact vulnerability used in the attacks. Instead, it refers customers to Synology-SA-24:20, a security advisory published on November 5, 2024, which documents three flaws affecting DSM. The advisory was updated as fixes became available across different software branches, with the DSM 6.2 update released on December 5. The three vulnerabilities have different security implications. CVE-2024-10441 is the most severe, with a CVSS score of 9.8. It affects the system plugin daemon and could allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable device. CVE-2024-50629 has a CVSS score of 5.3 and affects the DSM webapi component. It could allow remote attackers to read limited files. The third issue, CVE-2024-10445, is rated 4.3 and concerns improper certificate validation in the update functionality. It could allow an attacker in an adjacent network position to write limited files. Synology hasn’t confirmed which of these vulnerabilities attackers are exploiting. The three flaws should therefore be considered part of the security advisory, not three confirmed entry points in the current ransomware campaign. The vendor has released corrected builds for all the affected DSM branches. Users should check the full version number installed on their NAS and compare it with the minimum fixed releases listed in the advisory: DSM 7.2.2: 7.2.2-72806-1 or later. DSM 7.2.1: 7.2.1-69057-6 or later. DSM 7.2: 7.2-64570-4 or later. DSM 7.1: 7.1.1-42962-7 or later. DSM 6.2: 6.2.4-25556-8 or later. The impact of a ransomware infection on a NAS can extend well beyond the storage device itself. Businesses often use these systems to keep shared documents, operational files and backup copies in one place. If attackers encrypt that data, employees may lose access to essential information, while recovery can become much harder if the NAS also holds the backups needed to restore other systems. Updating DSM is therefore an immediate priority for administrators and home users alike. Synology is also advising customers to enable automatic updates so that future security fixes don’t depend entirely on someone checking for them manually. “Synology also recommends enabling automatic updates to keep DSM up to date at all times.” concludes the advisory. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, NAS)
A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host. Researchers at cybersecurity company Bitdefender believe the threat actor may have used AI-generated commands and an automated agentic loop to carry out the operation. The conclusion is based on a sequence of repeated commands that were slightly modified at each attempt and issued at roughly regular intervals of 40 to 100 seconds. "We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself: which model it was, whether it ran locally or remotely, or even whether a person was copying and pasting instructions and results between the implant and the model," Bitdefender explains.
Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords, resetting two-factor authentication (2FA), and removing passkeys. The warning came in an email sent on November 3 in the name of developer mSeven Software. It says the company recently learned of suspicious activity linked to the app but
Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device. The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3)
Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services. The tactic is called LLMjacking, a form of resource hijacking adapted for the LLM era, where an attacker obtains an API key through phishing, source code leaks, misconfigured environments, or exposed client-side code
Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. "These attacks aim to encrypt data and extort ransom," it said in a statement
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running
Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract
Confirm this action.
Leaving now will discard your changes.