SockAnalystBreaches · Patches · Defense.
What happened, who's affected, the fix, a hunt check and the CISA deadline. Built for SOC teams who need to act now.
⏱ CISA KEV deadlines
Latest · Patch Now playbooks
Ivanti Connect Secure: three-CVE chain gives unauthenticated root
CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities (KEV) catalog. Chained with auth bypass CVE-2026-104935, attacke…
Open playbook →Northflank breached: assume every env var was decrypted
Northflank's status page tells customers to assume ALL environment variables were decrypted and to rotate every secret and API key. Users report stole…
Open playbook →VAPOR PANDA runs ARTEX AI-agent attack framework against 200+ orgs
CrowdStrike says China-nexus VAPOR PANDA ran ARTEX, an AI agent attack framework (DeepSeek plus a second LLM), against 200+ organizations in 14+ count…
Open playbook →Linux kernel CVE-2026-98432: no-login remote root via MPTCP listeners
A TCP use-after-free (CVSS 9.8) that Anthropic turned into an unauthenticated remote root exploit on servers with an MPTCP listener. Go 1.24+ apps ope…
Open playbook →Florida Dept. of Education: ~4.9M exposed in financial aid site breach
Hackers hit Florida's Student Financial Aid website. Detected Oct 19, disclosed Oct 29. The site is offline and FDLE is investigating.…
Open playbook →MUJI app breach: up to 27.26M customer records
Ryohin Keikaku, MUJI's operator, says its official app was breached. Access is blocked and a fix applied. No IOCs or entry vector published yet.…
Open playbook →Amadeus airline booking breach hits JAL, ANA, Cathay
Someone used valid system-account credentials to access the Amadeus passenger service system from Aug 10, 2023 to Sep 23, 2026. Korean Air and Asiana …
Open playbook →Chainalysis discloses breach of customer contact data
Chainalysis says an external actor using "offensive agentic techniques" accessed customer data. Chainalysis says it is unrelated to the Binance incide…
Open playbook →The free daily SOC brief
One email every morning: the breaches, patches and hunt queries that matter. No fluff.
Daily brief launching soon. Signups are not open yet. Follow @SockAnalystHQ for the launch.
🎓 Career corner
SOC career tips three times a week. Start with a home lab.
🧦 Shop
SOC merch and hunt-query packs. Coming soon.