Nov 2, 2026
0 new incidents, 2 with updates.
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Updated
- LiveMediumPartly patched
WorkOS says an AI-driven attacker breached its internal sales tool and accessed CRM and customer-conversation data
WorkOS, the developer platform that provides enterprise SSO, user management and directory sync APIs to thousands of companies, says it identified unauthorized access to an internal application used by its sales team on Oct 30 2026. In a Nov 2 bulletin it says the attacker accessed business contact details (names, emails, phone numbers, job titles, companies) from its CRM, account and relationship histories, summaries and excerpts from sales calls, support discussions and customer Slack conversations, and operational metadata about customers' product usage and connection or directory health. WorkOS says there is no evidence that WorkOS application data or production services were accessed, and that the attacker used an AI-assisted offensive security framework to automate reconnaissance and exploitation; CEO Michael Grinich later named it as the ARTEX AI framework. WorkOS disabled external access to the app, hired an outside forensics firm and is notifying affected customers directly. Customers have nothing to patch, but should expect targeted phishing that uses the exposed contact and conversation details.
WorkOS (internal sales application, CRM and support data)Since Oct 30, 2026
- LivePatched
Linux kernel CVE-2026-98432: TCP use-after-free rated 9.8, Anthropic says its AI built a remote root exploit
CVE-2026-98432 is a race-condition use-after-free in the Linux kernel's IPv4 TCP handshake code (ireq_opt/inet_opt freed without an RCU grace period), fixed upstream on Oct 15 and rated 9.8 by the kernel CNA. On Oct 28 Anthropic said an unreleased Claude model turned the bug into a zero-click remote root exploit against servers running a multipath TCP listener (about 48 minutes to defeat KASLR, five more to get a shell). The exploit was built in a lab and is not known to be used in attacks. Update to a fixed stable kernel.
Linux kernel (IPv4 TCP)Since Oct 15, 2026
