Daily Cyber Incidents
Every day I pick one or two real cyber incidents from the news and explain them simply: what happened, how the attack worked (high-level only), how to defend and a checklist. Each one sits next to the course lesson it teaches, with English, मराठी and हिंदी tabs. Newest first.
Why read a daily incident?
- Real attacks show which mistakes really get companies hacked: stolen logins, old forgotten systems, unpatched VPNs, too many permissions.
- Each story is linked to a lesson, so you see the concept and a real case side by side.
- Interviewers love "tell me about a recent breach". These give you real, dated examples.
All incidents (newest first)
Microsoft 365 token spray – stolen sign-in sessions replayed into 79 organisations, no password needed New
Attackers stole Microsoft 365 sign-in tokens with fake login relays and device-code phishing, then replayed them to get into email accounts at 79 organisations without a password or MFA prompt. Huntress, reporting on 22 Oct, saw fake devices, swapped MFA methods and hidden inbox rules used for payroll fraud; Conditional Access stopped the attacker at four organisations.
Read it in Lesson 41.7 Detection – Logs, Concurrent Sessions, SIEM Signals →
eMudhra – eight Indian CA intermediate keys were made with weak randomness, so anyone could forge HTTPS certificates
Eight intermediate certificate authority keys from the Indian CA eMudhra were made with weak randomness, so anyone could work out the private keys and fake trusted HTTPS certificates. Chrome and Firefox blocked them within hours of the 17 Oct report, no misuse is known, and the emSign ECC Root CA - G3 is being removed.
Read it in Lesson 33.5 Digital Signatures, Certificates, PKI and TLS →
LiteLLM – a poisoned release of a popular AI library on PyPI and Docker stole cloud and AI keys
An attacker used GitHub tokens that had leaked into an internal tool's logs to push a poisoned LiteLLM 1.107.0 to PyPI and Docker for about two hours. It stole cloud, developer and AI keys every time Python started, and stolen AWS keys were soon used to try Amazon Bedrock.
Read it in Lesson 29.7 The Rest: Design, Components, Integrity, Logging, SSRF →
PHP2Shell – two critical PHP flaws let attackers run commands on web servers without a login
PHP fixed two critical flaws that let a stranger make any PHP web server run commands with one request and no login. Attacks started before the fix, and governments took websites offline until they could patch.
Read it in Lesson 9.8 Secure PHP Settings → · Read the full article →
OVHcloud CLI – a hijacked GitHub account swapped release files and their checksum file to steal secrets
An attacker used a hijacked developer GitHub account to swap the download files of five OVHcloud CLI releases, and the checksum file too, so for about an hour and a half new installs got a program that steals secrets from the disk.
Read it in Lesson 33.5 Digital Signatures, Certificates, PKI and TLS →
ETS (California state tests) – one stolen SFTP login used for four months to copy student records
Someone used one stolen login on the SFTP site that ETS used to swap California state test files, and copied student records again and again from May to September 2026 before it was noticed.
BeyondTrust Remote Support zero-day CVE-2026-102764 – from a web shell to root, stolen admin access and deleted logs
A suspected China-nexus spy group used an unpatched flaw in BeyondTrust Remote Support to plant a web shell, become root with an SUID copy of the shell and delete logs. CISA says it is being actively exploited.
Read it in Lesson 32.4 Patching, Users, Permissions and Services →
ConnectWise Cloud Backup (SkyKick) – one stolen vendor app secret used to sign in to hundreds of Microsoft 365 tenants
Attackers signed in to customer Microsoft 365 tenants as the backup app itself. Almost 1,000 tenants saw sign-in attempts, more than 300 succeeded, and MFA never applied.
Read the full article → · Read it in Lesson 30.2 IAM Done Right →
CERT-In CIAD-2026-0049 – AI agents used exposed keys to reach live systems of Indian organisations
A Critical CERT-In advisory: AI agents reached live systems of Indian organisations using keys left in config files, public code and loose cloud roles.
Read it in Lesson 30.6 EC2 Metadata, SSRF and a Leaked-Key Incident →
AOMEI Backupper update servers tampered for minutes at a time to push a backdoor – UNC7017
Update files on AOMEI's own servers were swapped for 5 to 10 minutes at a time, so some copies downloaded a backdoor instead of a real update.
Read it in Lesson 29.7 Design, Components, Integrity and Logging →
Ivanti Connect Secure zero-day CVE-2026-104935 – VPN login bypass used to steal credentials and data
A login bypass in Ivanti Connect Secure VPN let attackers run commands with no password. CISA added it to its Known Exploited Vulnerabilities list.
Read it in Lesson 32.6 Network Hardening: Segmentation, VPN and IDS/IPS →
Meta – stolen employee GitHub login used to take code and personal data
One employee's stolen login was used to take code and some personal data from Meta's GitHub repositories. About 1,500 people are being notified.
Read it in Lesson 30.4 Protecting Data: S3, Encryption and Secrets →
Ginkgo Bioworks – data taken from old, forgotten cloud environments
An intruder took data mainly from legacy cloud environments of a former business. Ginkgo cut off access, rotated credentials and took old systems offline.
Yoido Full Gospel Church – web shell on the ERP server leads to data on 850,000 members
A web shell on the church's ERP server led to about 47.3 GB of data on an overseas server. Data on 850,000 members may have leaked.
FortiBleed – stolen VPN and firewall logins used to lock admins out of FortiGate devices
The FBI and US Secret Service warned that reused stolen logins are used to take over FortiGate firewalls and lock the real admins out.
Read it in Lesson 32.6 Network Hardening: Segmentation, VPN and IDS/IPS →
Denmark CPR register – a company's legitimate access abused to pull 8.8 million records
A private company's legal access to Denmark's national CPR register was misused to pull names, addresses and CPR numbers of about 8.8 million people.
Osaka Metropolitan University – ransomware inside the virtualization platform stops about 500 servers
Ransomware got into the virtualization platform and about 500 servers stopped. Much of the backup data was encrypted too.
Nikkei – hacked employee email accounts used to send about 9,000 phishing emails
A taken-over Microsoft 365 employee account sent about 9,000 phishing emails to Nikkei staff and news contacts.
DTU (Technical University of Denmark) – stolen logins used to download IAM data
Stolen user logins were used to download a large amount of data from DTU's identity system. Up to 200,000 people may be affected.
City of Vicksburg ransomware – systems offline, 911 still up
Ransomware made the city shut down its computer systems, while 911, police, fire and utility services kept running.
Zammad / DIVD – session fixation chain to root
Two chained Zammad helpdesk zero-days, a session fixation flaw and a root privilege escalation, were used to breach DIVD. CISA added both to KEV.
Read it in Lesson 41.3 Session Fixation and Predictable IDs →
Older cards open the lesson page and jump to the "Real incident" box. All content is defensive and based on public reporting, with sources listed in each box.
Learn it properly