SockAnalystBreaches · Patches · Defense.
What happened, who's affected, the fix, a hunt check and the CISA deadline. Built for SOC teams who need to act now.
⏱ CISA KEV deadlines
Pulled from the official CISA KEV feed on Oct 31, 2026. Federal agency due dates; everyone else should treat them as patch-now.
Latest · Patch Now playbooks
Binance theft: 90% replenished, SAFU transfer done, withdrawals targeted Nov 1
Binance's Update #3 says 90% of the stolen assets are now replenished (up from 80%). BTC, ETH, BNB, SOL, XRP, USDT, USDC and others are fully reserve-…
Open playbook →Ivanti Connect Secure: three-CVE chain gives unauthenticated root
CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities (KEV) catalog. Chained with auth bypass CVE-2026-104935, attacke…
Open playbook →Northflank breached: assume every env var was decrypted
Northflank's status page tells customers to assume ALL environment variables were decrypted and to rotate every secret and API key. Users report stole…
Open playbook →Linux kernel CVE-2026-98432: no-login remote root via MPTCP listeners
A TCP use-after-free (CVSS 9.8) that Anthropic turned into an unauthenticated remote root exploit on servers with an MPTCP listener. Go 1.24+ apps ope…
Open playbook →VAPOR PANDA runs ARTEX AI-agent attack framework against 200+ orgs
CrowdStrike says China-nexus VAPOR PANDA ran ARTEX, an AI agent attack framework (DeepSeek plus a second LLM), against 200+ organizations in 14+ count…
Open playbook →MUJI app breach: up to 27.26M customer records
Ryohin Keikaku, MUJI's operator, says its official app was breached. Access is blocked and a fix applied. No IOCs or entry vector published yet.…
Open playbook →Chainalysis discloses breach of customer contact data
Chainalysis says an external actor using "offensive agentic techniques" accessed customer data. Chainalysis says it is unrelated to the Binance incide…
Open playbook →Florida Dept. of Education: ~4.9M exposed in financial aid site breach
Hackers hit Florida's Student Financial Aid website. Detected Oct 19, disclosed Oct 29. The site is offline and FDLE is investigating.…
Open playbook →Amadeus airline booking breach hits JAL, ANA, Cathay
Someone used valid system-account credentials to access the Amadeus passenger service system from Aug 10, 2023 to Sep 23, 2026. Korean Air and Asiana …
Open playbook →The free daily SOC brief
One email every morning: the breaches, patches and hunt queries that matter. No fluff.
Free, one email each morning. Also follow @SockAnalystHQ on X.
🎓 Career corner
SOC career tips three times a week. Start with a home lab.
🧦 Shop
SOC merch and hunt-query packs. Coming soon.