Chainalysis suffered a cyberattack exposing customer names, emails and user IDs, while investigation data and passwords remain safe. Blockchain analytics firm Chainalysis says it was the target of a cybersecurity incident. A threat actor accessed its systems and internal tools and stole some non-sensitive customer data. “This month, Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools.” reads the statement published by the company, which also includes the full email sent to affected customers. Chainalysis says it discovered the attacker this month and described the methods used as offensive techniques involving AI agents. However, it did not explain how the attack was carried out. The company also warned that AI-powered attacks are becoming more common across the industry and said it is taking a company-wide approach to dealing with this growing threat. The data the attacker reached matters most. According to Chainalysis, attackers gained access to user IDs, full names, email addresses and organization role labels for users on the platform. The company is still working out which records belong to which customer and promises a detailed breakdown when it finishes. What the attacker didn’t reach is just as important. So far, Chainalysis has found no sign of access to investigation content such as graphs, notes or cases, or to transaction and query results. It also found no clear-text passwords, MFA secrets or user session tokens in the attacker’s hands. “Based on the evidence available to date, we have found no indication that these incidents resulted in the unauthorized access of investigation content (such as graphs, notes, or cases), transaction or query results, passwords in clear text, MFA secrets, or user session tokens.” continues the press release. Some non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed, including such information relating to your organization and users. We are in the process of determining the records for your organization that were accessed and will provide a detailed breakdown as soon as that analysis is complete.“ The company says it’s patching vulnerabilities and hardening its systems around the clock. It has hired outside cybersecurity experts and is using large language models to support a wider review that goes beyond the flaws the attacker used. It has already told all its customers and will keep them updated. Chainalysis advises customers to watch out for unexpected password reset requests or login approval prompts. The company also strongly recommends enabling two-factor authentication (2FA) for all organizations that have not already done so. Since the exposed data includes names and email addresses, attackers could use it to launch phishing campaigns. The company also clarified that the security incident has nothing to do with the recent theft of more than $6 billion from Binance. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Chainalysis)
Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said last week. Langflow is an open-source tool for building AI agents and workflows, and its vulnerability reports go to IBM. Every release from 1.0.0 through 1.12.8 has the flaws, and the only fix is version 1.13.0. Neither flaw is in CISA's Known
Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller. Microsoft said in a report that it investigated two such intrusions, one of which resulted in company
OpenAI has just confirmed that it's rolling out ChatGPT Work capabilities directly into regular Chat, while also combining usage allowances across ChatGPT and Codex. In an email seen by BleepingComputer, OpenAI noted that it will test a combined experience for Chat and Work tabs in the coming weeks, initially with a small group of users. If you're selected for the test, you'll be able to move from ordinary conversations to more complex tasks without switching modes. "This will enable you to move from exploring an idea to having ChatGPT carry it through, all in one place," OpenAI explained. "You can bring in your files and plugins and ask ChatGPT to build a website, create a presentation, or do things for you on the web, while reviewing and guiding its work." The combined experience will initially be tested with a small group of users before OpenAI expands it to more people.
A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certificate. Once in, the attacker would act as that client, with access to the cluster and its virtual machines. If the impersonated account is
Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $2.7 million to 726 affected wallets. Blockchain records show crypto worth about $2.64 million reached
Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys. Northflank is a cloud platform that allows developers to deploy and manage applications, containers, databases, and AI applications without managing the underlying infrastructure. The company disclosed a security incident on October 30, warning customers to immediately rotate their environment variables and API keys after receiving a threat alert from cloud security company Wiz. Soon after, Northflank told all customers to assume their environment variables had been decrypted and that the secrets stored within them were stolen. "Assume all environment variables have been decrypted. Disable/rotate all keys," Northflank warned in an October 30 update.
Drupal warns that attackers are exploiting a critical authorization flaw in Commerce Core, putting vulnerable online stores at risk. Drupal warns that threat actors are exploiting a highly critical security flaw, tracked as CVE-2026-118539, in its Commerce Core module. The vulnerability is caused by missing authorization checks. “This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs. The module doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor.” reads the advisory. This vulnerability is being actively exploited in the wild.” The module allows websites to sell products and services through shopping carts, checkout forms, and APIs. “Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.” reads the advisory. Researchers Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson), and Robert Snyder (rsnyd) reported the vulnerability. The maintainers at the open-source project confirmed that the vulnerability is being actively exploited in the wild. Drupal recommends that users update their installations to the latest available release. Those running the 3.x branch should upgrade to version 3.3.13, while users on earlier releases should move to Commerce Core 8.x-2.41. In May, Drupal warned that attackers were exploiting an SQL injection flaw, tracked as CVE-2026-9082, in its database abstraction API. The vulnerability could allow attackers to gain higher privileges, access sensitive information, and execute malicious code remotely. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CVE-2026-118539)
American blockchain analysis firm Chainalysis said it was the target of a cybersecurity incident in which an external actor accessed non-sensitive customer data. However, the company noted that the breach did not result in unauthorized access to its investigation content, authentication credentials, or session tokens. "This month, Chainalysis detected an external actor using offensive agentic
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a
Confirm this action.
Leaving now will discard your changes.