# The Weekly KEV & Hunt Pack

2026-11-02 through 2026-11-08 (CT)

Queries are starting points; tune field names before use.

- [ARARA Message breach: 81 million email addresses taken from Japanese email-delivery service](arara-message-email-delivery-breach-81-million--arara-message-email-delivery-breach-81-million.txt) — [source playbook](https://sockanalyst.com/patch-now/arara-message-email-delivery-breach-81-million)
- [Mirae Asset Securities hacked twice in two days: 3,800 customer account numbers and 35,255 staff records leaked](mirae-asset-securities-breach--mirae-asset-securities-breach.txt) — [source playbook](https://sockanalyst.com/patch-now/mirae-asset-securities-breach)
- [SonicWall SonicOS SSL-VPN flaw (CVE-2026-19868) lets attackers bypass SAML and MFA; exploited, on CISA KEV](CVE-2026-19868--sonicwall-sonicos-sslvpn-saml-mfa-bypass-cve-2026-19868.txt) — [source playbook](https://sockanalyst.com/patch-now/sonicwall-sonicos-sslvpn-saml-mfa-bypass-cve-2026-19868)
- [DreamHost File Manager breach: FTP/SFTP passwords and some webmail sessions stolen](dreamhost-file-manager-ftp-webmail-breach--dreamhost-file-manager-ftp-webmail-breach.txt) — [source playbook](https://sockanalyst.com/patch-now/dreamhost-file-manager-ftp-webmail-breach)
- [NTT Docomo: up to ~300k customer records leaked from My docomo / Online Shop](ntt-docomo-my-docomo-online-shop-breach--ntt-docomo-my-docomo-online-shop-breach.txt) — [source playbook](https://sockanalyst.com/patch-now/ntt-docomo-my-docomo-online-shop-breach)
- [OpenSSH / Alpine “sshole” CVE-2026-123158: key-only account password-auth bypass](CVE-2026-123158--openssh-alpine-sshole-cve-2026-123158.txt) — [source playbook](https://sockanalyst.com/patch-now/openssh-alpine-sshole-cve-2026-123158)
- [APT29 watering holes hit unpatched iOS/Android; CISA adds Apple CVE-2024-27834 to KEV](CVE-2024-27834-CVE-2025-43529--apt29-watering-hole-apple-android-n-days-cve-2024-27834.txt) — [source playbook](https://sockanalyst.com/patch-now/apt29-watering-hole-apple-android-n-days-cve-2024-27834)
- [Chainstack breached: customer data and password hashes accessed, node credentials treated as exposed](chainstack-breach-customer-data-node-credentials--chainstack-breach-customer-data-node-credentials.txt) — [source playbook](https://sockanalyst.com/patch-now/chainstack-breach-customer-data-node-credentials)
- [Attackers set French blood bank plasma freezers to 110°C through refrigeration vendor Coolworld](efs-coolworld-plasma-freezer-setpoint-tampering--efs-coolworld-plasma-freezer-setpoint-tampering.txt) — [source playbook](https://sockanalyst.com/patch-now/efs-coolworld-plasma-freezer-setpoint-tampering)
- [Attackers drain BTCPay Server hot wallets on version 2.4.1 and older](btcpay-server-hot-wallet-thefts-2-4-1--btcpay-server-hot-wallet-thefts-2-4-1.txt) — [source playbook](https://sockanalyst.com/patch-now/btcpay-server-hot-wallet-thefts-2-4-1)
- [OPSSHIELD cPGuard update channel hijacked: fake updates ran as root on ~2,950 Linux hosting servers](opsshield-cpguard-update-channel-compromise--opsshield-cpguard-update-channel-compromise.txt) — [source playbook](https://sockanalyst.com/patch-now/opsshield-cpguard-update-channel-compromise)
- [WordPress Core CVE-2026-119977: upgrade-window RCE now on CISA KEV (due Nov 6)](CVE-2026-119977--wordpress-core-cve-2026-119977-upgrade-rce.txt) — [source playbook](https://sockanalyst.com/patch-now/wordpress-core-cve-2026-119977-upgrade-rce)
- [Supermarket freezers hacked overnight in Belgium and Sweden](supermarket-freezer-hacks-belgium-sweden--supermarket-freezer-hacks-belgium-sweden.txt) — [source playbook](https://sockanalyst.com/patch-now/supermarket-freezer-hacks-belgium-sweden)
- [VOLTA infostealer uses AI models to rank victims by what they're worth](volta-infostealer-llm-victim-ranking--volta-infostealer-llm-victim-ranking.txt) — [source playbook](https://sockanalyst.com/patch-now/volta-infostealer-llm-victim-ranking)
- [HYBE breach: hackers got in through a vendor's document-preview tool](hybe-vendor-doc-preview-breach--hybe-vendor-doc-preview-breach.txt) — [source playbook](https://sockanalyst.com/patch-now/hybe-vendor-doc-preview-breach)
- [Chainalysis discloses breach of customer contact data](chainalysis-breach--chainalysis-breach.txt) — [source playbook](https://sockanalyst.com/patch-now/chainalysis-breach)
- [Binance hot wallet theft (~$6.3B): losses covered, withdrawals resuming in phases](binance-hot-wallet-theft-recovery--binance-hot-wallet-theft-recovery.txt) — [source playbook](https://sockanalyst.com/patch-now/binance-hot-wallet-theft-recovery)
- [Florida Dept. of Education: ~4.9M exposed in student financial aid site breach](florida-doe-financial-aid-breach--florida-doe-financial-aid-breach.txt) — [source playbook](https://sockanalyst.com/patch-now/florida-doe-financial-aid-breach)
- [Amadeus airline booking breach hits JAL, ANA, Cathay, Singapore Airlines and others](amadeus-airline-breach--amadeus-airline-breach.txt) — [source playbook](https://sockanalyst.com/patch-now/amadeus-airline-breach)