This brief covers the trailing ~48 hours ending October 12, 2026. It was a quieter window for new advisories, so the items below are drawn from vendor, researcher and company disclosures and checked against primary pages. Active campaigns that began slightly earlier are listed at the end.
Ledger confirms hardware implant in wallets sold by reseller CryptoBilis
Ledger · October 11, 2026
Ledger said an affected device contained an unauthorized hardware implant, and that the incident involves a “limited” number of devices, all sold through the reseller CryptoBilis in Southeast Asia. CryptoBilis has paused sales of its hardware wallet inventory while the investigation continues. Ledger told buyers from this reseller in the last 90 days not to begin setup, and advised anyone who already set up a device to move assets to a new signer with a new seed. Blockchain investigator Specter estimated losses above $86 million (an estimate, not a Ledger figure). No CVE applies; this is a supply-chain tampering case.
“Also, we strongly advise users not to purchase from unauthorized resellers” — Ledger, October 11 update
Source: Ledger update, Oct 11 · Ledger implant disclosure · The Hacker News
Daiichi Kosho: malware at contractor Nippon Columbia exposes about 8.7 million records
Daiichi Kosho / BleepingComputer · October 11, 2026
Japan’s largest karaoke operator, Daiichi Kosho, disclosed that malware on an employee’s computer at its contractor, Nippon Columbia Group, exposed 8,631,000 customer records and 93,000 employee records. Exposed fields include names, genders, dates of birth, email addresses and phone numbers; the company says passwords are not included. NCG reported the infection on October 5 and isolated the system the next day. Data theft has not been confirmed. No CVE or KEV entry applies.
Daiichi Kosho “has not confirmed any data theft or leaks” — as reported by BleepingComputer
Source: BleepingComputer, citing Daiichi Kosho’s website notices
CrowdStrike: attacker used ARTEX AI and Claude agents against South Korean banks
CrowdStrike / BleepingComputer · October 10, 2026
CrowdStrike confirmed that a Chinese-speaking actor used the ARTEX AI penetration-testing suite together with Claude agents in attacks on South Korean financial institutions, including Shinhan Bank, KB Kookmin Bank and Hana Bank. The intrusions exposed client personal and credit card data and caused outages in some cases. CrowdStrike found open directories holding Claude Code session histories and ARTEX configuration files, and saw no clear plan to monetize the stolen data. The ARTEX developer has since closed the source and stopped updates, though derivatives exist. No CVE is involved.
“The threat actor likely accessed DeepSeek via the likely LLM API proxy/reseller xcai[.]pro,” — CrowdStrike, as reported by BleepingComputer
Source: BleepingComputer
Still developing
SonicWall SMA 1000 SSRF (CVE-2026-102255) draws exploitation attempts
SonicWall / Help Net Security · patched October 6–7, 2026; exploitation attempts reported October 8–12
A pre-authentication server-side request forgery in the Appliance Work Place interface affects SMA 1000 models 6210, 7210 and 8200v. It is fixed in hotfixes 12.4.3-03670 and later, and 12.5.0-03082 and later. The Hacker News reports a CVSS of 10.0 and 135 exploitation attempts seen by Previdian; Defused Cyber also reported attempts beginning October 8. It is unknown whether any succeeded, and no KEV listing has been confirmed. SMA 100 Series and SonicWall firewalls are not affected.
Unauthenticated attackers could “direct the appliance to issue requests on their behalf” — SonicWall, via Help Net Security
Source: SonicWall PSIRT SNWLID-2026-0017 · Help Net Security · BleepingComputer · The Hacker News
Bricksforge WordPress plugin file upload (CVE-2026-85097, CVSS 10.0) exploited
Patchstack · October 8, 2026
An unauthenticated arbitrary file upload in Bricksforge versions 3.1.8.9 and earlier allows remote code execution. Patchstack first saw exploitation on October 7 at 21:47 UTC; the fix is version 3.1.8.10. No KEV listing has been confirmed.
“Our telemetry shows active exploitation attempts targeting Bricksforge installations” — Patchstack
Source: Patchstack · The Hacker News
P7 DarkSword: new iOS spyware variant steals crypto-wallet data
iVerify · October 8, 2026
iVerify identified P7 DarkSword during an August investigation of an infected customer device. It leaves a smaller on-device footprint, extracts keychain data, steals crypto-wallet data (including from imToken), and supports two-way command-and-control with a configurable beacon. The iVerify post names no CVEs; module names reference iOS 18.4 through 18.7.
“P7 DarkSword improves on earlier variants in three areas:” — iVerify
Source: iVerify · The Hacker News
This brief covers the trailing ~48 hours (October 10–12, 2026).
Primary sources: