BreachFeed

Know the moment the organizations you depend on are breached

BreachFeed watches security news, breach disclosures, and government advisories around the clock for breaches, incidents, and outages. Track everything from companies, keywords, locations, agencies, and get alerted, in real-time, via email or push.

Start tracking freeBrowse tracked entities
sources read around the clock
51
reports taken in this week
1.6K
incidents on record
341
organizations tracked by members
93

How it works

  1. 1

    Track what you depend on

    Companies, keywords, agencies, locations and threat actors — your vendors, your bank, your employer. Paste a vendor list and it is imported in one go.

  2. 2

    We read the news for you

    51 sources, read around the clock: security news, breach disclosures and filings, government advisories, status pages. Every report is matched to what you track, and incidents are kept on record with their timeline and severity.

  3. 3

    You hear about it first

    Alerts by email or push, and to Slack or Teams on the paid plans — instant or on a cadence you choose, per entity, and limited to confirmed incidents if that is all you want to hear about.

  • Email · every plan
  • Push · the iPhone app
  • Slack, Teams & webhooks · Personal Pro and up
  • Weekly brief · every plan
  • Read-only API · Business

Spotlight

companyPHPTrack
confirmedcriticalVulnerabilityFirst reported Oct 21, 2026 · Updated Oct 21, 2026

PHP: emergency patches for two critical PHP2Shell RCE flaws amid exploit attempts

PHP released emergency updates fixing two critical remote code execution flaws, collectively called PHP2Shell, that allow an unauthenticated attacker to run code on a web server. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws reside in the PHP runtime itself, and exploit attempts are reported to be emerging.

Disclosure PDF (96 KB) ↗

In the News10

Latest Confirmed Breaches

All incidents →
companyOpenCodeTrack
confirmedmediumData breachFirst reported Oct 18, 2026 · Disclosed Oct 17, 2026 · Updated Oct 19, 2026

OpenCode: breach exposed third-party API keys of some Console users

OpenCode disclosed a security breach affecting 1.4% of its Console users, warning that third-party API keys saved in affected workspaces may have been exposed. In an October 17 statement, the company linked the incident to a large-scale distillation attack and said it was working with Anthropic, OpenAI, and Google to address it.

Full record and coverage →

Plans

Compare plans →

Free

No card

5 tracked entities, email alerts, the weekly brief and the incident record.

Personal

$4.99/month · 10 tracked entities

For individuals watching their own digital footprint.

Personal Pro

$9.99/month · 25 tracked entities

For power users tracking a wider circle.

Business

$29.99/month · 25 tracked entities

For teams tracking their vendors and their own brand.

Every paid plan starts with a 7-day free trial — nothing is charged until it ends.

Real-time News Feed

live feed
CSO Online·
Share

Link — click to select, then copy:

https://breachfeed.com/article/cmvilg70r0rt0hsu2y5r9v6lv

Microsoft: Treat AI agents as insider threats

EVP of Microsoft Security Hayete Gallot writes in a blog post that AI agents operating independently within companies could be a serious security threat. According to Microsoft, today’s most advanced AI models cannot be fully trusted. Not because they are malicious, but because they are trained to achieve goals and can take unexpected shortcuts to achieve them. For example, bypassing limitations or cooperating with other AI agents in ways that were not intended. The problem becomes especially…

BankInfoSecurity.com·· latest 2 sources
Share

Link — click to select, then copy:

https://breachfeed.com/article/cmvil0tjc0qwahsu2vpjt6seu

Utah OKs 3 Health-AI Pilot Apps for 'Regulatory Sandbox'

Test Projects Focus on AI-Enabled Drug Prescriptions, Physical Therapy Treatment Utah has given the green light for three more healthcare technology companies to test out how their AI systems can safely provide services such as prescribing and refilling certain medications and providing AI-augmented physical therapy plans for specific health conditions.

2 reports from 2 sources · show all coverage

  1. BankInfoSecurity.comFirst reportUtah OKs 3 Health-AI Pilot Apps for 'Regulatory Sandbox'
  2. Data Breach TodayUtah OKs 3 Health-AI Pilot Apps for 'Regulatory Sandbox'
CISA Advisories·· latest 15 sources
Share

Link — click to select, then copy:

https://breachfeed.com/article/cmvh0fpk60j27hsu204ll5wkf

#StopRansomware: SafePay Ransomware

Advisory at a Glance Title #StopRansomware: SafePay Ransomware Original Publication October 20, 2026 Executive Summary This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using…

15 reports from 15 sources · show all coverage

  1. CISA AdvisoriesFirst report#StopRansomware: SafePay Ransomware
  2. The Record from Recorded Future NewsFBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
  3. Central Oregon DailySafePay ransomware group has targeted hundreds this year, US agencies say
  4. WKZOSafePay ransomware group has targeted hundreds this year, US agencies say
  5. Cyber Security NewsSafePay Ransomware Has Affected 600+ Organizations by Exploiting VPNs and Backup Servers
  6. Bleeping ComputerCISA: SafePay ransomware hit over 600 critical infrastructure orgs
  7. Technology OrgUS and Allied Agencies Warn SafePay Ransomware Has Hit 600 Victims
  8. The HIPAA JournalFeds Issues Advisory About SafePay Ransomware Group
  9. YahooFBI, CISA warn that SafePay ransomware poses threat to critical infrastructure
  10. Cybersecurity DiveFBI, CISA warn that SafePay ransomware poses threat to critical infrastructure
  11. tech-insider.orgFBI, CISA Warn: SafePay Ransomware Hit 600 Firms
  12. shattered.ioFBI, CISA Warn SafePay Ransomware Hit 600 Firms [2026]
  13. BankInfoSecurityUS, UK and Germany Warn of Active SafePay Ransomware
  14. BankInfoSecurity.comUS, UK and Germany Warn of Active SafePay Ransomware
  15. Data Breach TodayUS, UK and Germany Warn of Active SafePay Ransomware
Central Oregon Daily·· latest 2 sources
Share

Link — click to select, then copy:

https://breachfeed.com/article/cmvim21mc0tebhsu298olr0wx

New Zealand's Fisher & Paykel Healthcare hit by cyber breach

2 reports from 2 sources · show all coverage

  1. Central Oregon DailyFirst reportNew Zealand's Fisher & Paykel Healthcare hit by cyber breach
  2. StreetInsiderNew Zealand's Fisher & Paykel Healthcare hit by cyber breach
BankInfoSecurity.com·· latest 2 sources
Share

Link — click to select, then copy:

https://breachfeed.com/article/cmvil0tjc0qw9hsu2h7c2e44u

Weak Certificates From Indian CA Cause Cascade of Updates

eMudhra Says It Mistakenly Used Weak Certificates to Sign 8 Intermediary Certs An Indian certificate authority revoked intermediate certificates after a researcher found it used a private encryption key that was only one byte in length, making it trivial for hackers to recover the key and issue their own fraudulent certs. The issue has the most salience for app developers.

2 reports from 2 sources · show all coverage

  1. BankInfoSecurity.comFirst reportWeak Certificates From Indian CA Cause Cascade of Updates
  2. Data Breach TodayWeak Certificates From Indian CA Cause Cascade of Updates

Questions, answered

What does BreachFeed watch?
Hundreds of sources, read around the clock: security news, breach disclosures and 8-K filings, government and CERT advisories, vendor status pages and the social accounts researchers report on. Every report is matched against the organizations, keywords, agencies, locations and threat actors you track.
What is the difference between news and a confirmed incident?
News is any report that mentions what you track. An incident is a record BreachFeed keeps once an event is established — with its status (suspected, claimed, confirmed, resolved), severity, timeline and every report behind it. You can route any alert channel to confirmed incidents only.
How fast are alerts?
Sources are read continuously. On Personal Pro and above, alerts go out the moment coverage lands; every plan can choose a digest cadence from thirty minutes to monthly, per tracked entity. Confirmed incidents can be delivered immediately whatever the cadence.
How do alerts reach me?
By email, push through the iPhone app, and Slack, Teams or any webhook on the paid plans. Each channel is set per tracked entity, and each can be limited to confirmed incidents.
Is there a free plan?
Yes: five tracked entities with email alerts, the weekly brief and the incident record, with no card. Paid plans start at $4.99 a month and begin with a 7-day free trial.
Can my team share one list?
On the Business plan, five seats share one tracked list with role-based access; each member gets their own alerts and settings. Vendor lists can be imported in one go.
What happens to my data?
Your account, what you track and your alert settings are held on BreachFeed’s own servers; there are no advertising or analytics cookies and no third-party trackers. You can download everything held about your account, and delete the account yourself, from the account page.

Start with five entities, free

Track the organizations you depend on and hear about it the moment one of them is hit. No card, and nothing to install.

Create your account