Oct 28, 2026

Started

• LiveMedium◐Partly patched

  Amplitude analytics security incident exposes Coinbase customer contact data

  Coinbase said on Oct 28 2026 that it was not breached itself, but that its product analytics vendor Amplitude had a security incident which exposed contact data for a small subset of Coinbase customers, as well as data belonging to other Amplitude customers. Coinbase says it found no evidence of unauthorized access to its own systems, customer funds are not affected, and it will notify affected customers and regulators as required. The claim of more than 70,000 affected users circulating on X has not been confirmed by Coinbase or Amplitude.

  Amplitude product analytics (customer data of Coinbase and other Amplitude clients)·Since Oct 28, 2026·updated Oct 28, 2026, 03:37 UTC

Updated

• LiveMedium◐Partly patched

  Bithumb internal groupware hacked, employee data leaked

  South Korean crypto exchange Bithumb detected unauthorized access by an outside party to its internal mobile groupware system on Oct 27 2026, leading to a personal data leak, and reported it to KISA and the Personal Information Protection Commission the same day. Information found so far mainly concerns employees, such as names, departments and contact details, but Bithumb has not ruled out that customer information shared in internal work files was included and is still analyzing the scope. Bithumb says its exchange systems are physically separated from the groupware and no crypto was stolen. Daishin Securities and Mirae Asset Global Investments reported separate breaches the same day.

  Bithumb internal mobile groupware (employee and possibly customer data)·Since Oct 27, 2026·updated Oct 28, 2026, 03:37 UTC

• LiveHigh◐Partly patched

  Tailworm: researcher drops 11 Tailscale and headscale flaws; Tailscale 1.104.4 fixes the SSH forwarding root escalation

  Erica Windisch of Cyberdione Labs published Tailworm, 11 lab-reproduced findings in Tailscale v1.104.2 and headscale v0.29.5 without coordinated disclosure. The main one: with Tailscale SSH enabled, unix-socket port forwarding runs as root, so anyone with one approved device and an SSH rule can reach root on the target and capture enrollment keys. Others cover experimental app connectors bypassing ACLs (cloud metadata, internal LANs), a tailscale serve forward to the local API, and headscale/DERP memory exhaustion. Tailscale confirmed the SSH issues as serious privilege-escalation bugs and on Oct 28 released Tailscale 1.104.4 with bulletins TS-2026-014 (SSH unix-socket forwarding to root-only sockets such as the Docker socket or local API), TS-2026-015 (SSH session memory exhaustion), TS-2026-016 (serve unix backends reaching privileged sockets) and TS-2026-017 (HTTP/2 serve capability mix-up). Upgrade to 1.104.4 or newer; the bulletins do not cover the app-connector or headscale findings. It is lateral movement from a foothold, not internet RCE.

  Tailscale client (tailscaled, Tailscale SSH, serve, app connectors) and headscale·Since Oct 25, 2026·updated Oct 28, 2026, 03:37 UTC