BreachFeed

Know the moment the organizations you depend on are breached

BreachFeed watches security news, breach disclosures, and government advisories around the clock for breaches, incidents, and outages. Track everything from companies, keywords, locations, agencies, and get alerted, in real-time, via email or push.

Start tracking freeBrowse tracked entities
sources read around the clock
51
reports taken in this week
1.8K
incidents on record
341
organizations tracked by members
93

How it works

  1. 1

    Track what you depend on

    Companies, keywords, agencies, locations and threat actors — your vendors, your bank, your employer. Paste a vendor list and it is imported in one go.

  2. 2

    We read the news for you

    51 sources, read around the clock: security news, breach disclosures and filings, government advisories, status pages. Every report is matched to what you track, and incidents are kept on record with their timeline and severity.

  3. 3

    You hear about it first

    Alerts by email or push, and to Slack or Teams on the paid plans — instant or on a cadence you choose, per entity, and limited to confirmed incidents if that is all you want to hear about.

  • Email · every plan
  • Push · the iPhone app
  • Slack, Teams & webhooks · Personal Pro and up
  • Weekly brief · every plan
  • Read-only API · Business

Spotlight

companyPHPTrack
confirmedcriticalVulnerabilityFirst reported Oct 21, 2026 · Updated Oct 21, 2026

PHP: emergency patches for two critical PHP2Shell RCE flaws amid exploit attempts

PHP released emergency updates fixing two critical remote code execution flaws, collectively called PHP2Shell, that allow an unauthenticated attacker to run code on a web server. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws reside in the PHP runtime itself, and exploit attempts are reported to be emerging.

Disclosure PDF (96 KB) ↗

In the News10

Latest Confirmed Breaches

All incidents →
companyOpenCodeTrack
confirmedmediumData breachFirst reported Oct 18, 2026 · Disclosed Oct 17, 2026 · Updated Oct 19, 2026

OpenCode: breach exposed third-party API keys of some Console users

OpenCode disclosed a security breach affecting 1.4% of its Console users, warning that third-party API keys saved in affected workspaces may have been exposed. In an October 17 statement, the company linked the incident to a large-scale distillation attack and said it was working with Anthropic, OpenAI, and Google to address it.

Full record and coverage →

Plans

Compare plans →

Free

No card

5 tracked entities, email alerts, the weekly brief and the incident record.

Personal

$4.99/month · 10 tracked entities

For individuals watching their own digital footprint.

Personal Pro

$9.99/month · 25 tracked entities

For power users tracking a wider circle.

Business

$29.99/month · 25 tracked entities

For teams tracking their vendors and their own brand.

Every paid plan starts with a 7-day free trial — nothing is charged until it ends.

Real-time News Feed

live feed
Insecure.Org·· latest
Share

Link — click to select, then copy:

https://breachfeed.com/article/cmvt16f7joeh1htu2o35xp689

[0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 command injection in the Executer program activation path (7.2)

Posted by disclosure via Fulldisclosure on Oct 28 0day Rubbish Research Team is publicly disclosing a vulnerability in the Moxa MAR-2000 series industrial 4G/LTE cellular router, firmware image FWR_MAR2000_V1.0_Build_15010909, from Moxa Inc. (Taiwan). An authenticated administrator converts one stored configuration field into arbitrary command execution as the identity of the product's model process, because the Executer model builds the launch command of an operator program as a shell...

2 reports from 1 source · show all coverage

  1. Insecure.OrgFirst report[0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 command injection in the Executer program activation path (7.2)
  2. Insecure.Org[0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 IPsec tunnel address command injection through the route-management shell commands (7.2)
Cyber Security News·· latest 2 sources
Share

Link — click to select, then copy:

https://breachfeed.com/article/cmvpfxn7jfv04htu2icalw704

PHP Releases New Windows Build Security Updates to Fix Critical HTTP2Shell Vulnerability

The PHP team has released updated Windows builds to fix a serious flaw known as HTTP2Shell. The new packages are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, and PHP announced them on October 26, 2026. Each build now includes Brotli 1.2.1, which fixes CVE-2026-111497. Windows users who run PHP should install these packages without delay. The […] The post PHP Releases New Windows Build Security Updates to Fix Critical HTTP2Shell Vulnerability appeared first on Cyber Security News.

4 reports from 2 sources · show all coverage

  1. Cyber Security NewsFirst reportPHP Releases New Windows Build Security Updates to Fix Critical HTTP2Shell Vulnerability
  2. Cyber Security NewsHackers Can Abuse Logged-In WordPress Admin Sessions to Secretly Install PHP Backdoors
  3. Insecure.OrgCVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2)
  4. Insecure.OrgRe: CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2)
Insecure.Org·
Share

Link — click to select, then copy:

https://breachfeed.com/article/cmvt16f7joeh3htu2f04tjpfs

Maximised JSON Array Attacks -- "Let the Commas Hit the Floor" Proof of Concept

Posted by Daniel Owens via Fulldisclosure on Oct 28 On 29 August 2026, we released "Commas of D00m" -- an old proof of concept that demonstrates unconstrained resource consumption in many JSON parsers. As recently discussed (in "Continued Apache Struts2 JSON Plugin Insecure Deserialisation"), the Apache Struts2 JSON Plugin's S2-072 and prior code changes fail to sufficiently protect against this style of attack. In that write-up, we examined the code and the...

Insecure.Org·
Share

Link — click to select, then copy:

https://breachfeed.com/article/cmvt16f7joeh4htu2r4jr8u99

Continued Apache Struts2 JSON Plugin Insecure Deserialisation

Posted by Daniel Owens via Fulldisclosure on Oct 28 Summary Thus far we have written extensively about the rampant number of insecure JavaScript Object Notation (JSON) deserialisers available today, like in "Struts2 and Related Framework Array/Collection DoS" (26 October 2025) and "JSON Deserialiser Unconstrained Resource Consumption Quick Overview" (07 March 2026), along with a naïve proof of concept script that demonstrated what we were talking about -- "JSON...

Data Breach Today·· latest 2 sources
Share

Link — click to select, then copy:

https://breachfeed.com/article/cmvt0w5f0odrghtu2e59l3piw

Fortinet Sees AI Security Boom Outlasting Past Cycles

CEO Ken Xie Says AI Infrastructure Expansion and New Threats Are Fueling Demand Fortinet executives say AI infrastructure expansion and emerging threats are driving a cybersecurity spending cycle larger and more durable than past booms, lifting third-quarter revenue 20% and prompting the network security vendor to raise its annual outlook for the third time.

2 reports from 2 sources · show all coverage

  1. Data Breach TodayFirst reportFortinet Sees AI Security Boom Outlasting Past Cycles
  2. BankInfoSecurity.comFortinet Sees AI Security Boom Outlasting Past Cycles
Yahoo·· latest 3 sources
Share

Link — click to select, then copy:

https://breachfeed.com/article/cmvr0nu73jkxkhtu20kdymsev

Sony Data Breach Hits 2.58 Million So-net and Plala Users

3 reports from 3 sources · show all coverage

  1. YahooFirst reportSony Data Breach Hits 2.58 Million So-net and Plala Users
  2. Cyber Security NewsSony Suffers Massive Data Breach- 2.58 Million So-net and Plala Users Data Exposed
  3. r/technologyRedditSony Data Breach Hits 2.58 Million So-net and Plala Users
Wired·· latest 9 sources
Share

Link — click to select, then copy:

https://breachfeed.com/article/cmvsjquusn8odhtu2rviftp2r

Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents

The leaked records include the locations of ICE and CBP facilities, workers' cellphone numbers, and the members of groups tied to wiretap programs, Palantir software, and xAI’s Grok chatbot.

9 reports from 9 sources · show all coverage

  1. WiredFirst reportMassive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents
  2. TechCrunchHacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents
  3. NBC NewsDHS hack exposes 40,000 employee names and undercover ICE agents, activists say
  4. CyberScoopLeak site publishes data on more than 41,000 DHS employees obtained by hacktivists
  5. CBCPersonal data of 40,000 U.S. Homeland Security employees leaked in security breach
  6. Nextgov/FCWDHS personnel leak exposes contact details and sensitive job information
  7. Cyber Security NewsHackers Leak Records of 41,000 DHS Personnel, Exposing Undercover ICE Agents
  8. NPRHackers expose the identities of more than 40,000 DHS employees
  9. shattered.ioDHS Data Breach: 40,000+ Staff, 5 Lessons [2026]
Cyber Security News·
Share

Link — click to select, then copy:

https://breachfeed.com/article/cmvt0lumdod8qhtu2fs31rl1g

Hackers Chain PHP2Shell and Linux Kernel Exploits to Gain Root Access on 25 Servers

Hackers combined PHP2Shell vulnerabilities with a Linux kernel exploit to gain root access on 25 servers across the United States, Japan, Taiwan, and South Korea, including three systems in a US government-affiliated environment. Dream researchers uncovered the campaign’s files on October 25, revealing a path from exposed firewall management interfaces to internal Active Directory services. […] The post Hackers Chain PHP2Shell and Linux Kernel Exploits to Gain Root Access on 25 Servers appeared…

Questions, answered

What does BreachFeed watch?
Hundreds of sources, read around the clock: security news, breach disclosures and 8-K filings, government and CERT advisories, vendor status pages and the social accounts researchers report on. Every report is matched against the organizations, keywords, agencies, locations and threat actors you track.
What is the difference between news and a confirmed incident?
News is any report that mentions what you track. An incident is a record BreachFeed keeps once an event is established — with its status (suspected, claimed, confirmed, resolved), severity, timeline and every report behind it. You can route any alert channel to confirmed incidents only.
How fast are alerts?
Sources are read continuously. On Personal Pro and above, alerts go out the moment coverage lands; every plan can choose a digest cadence from thirty minutes to monthly, per tracked entity. Confirmed incidents can be delivered immediately whatever the cadence.
How do alerts reach me?
By email, push through the iPhone app, and Slack, Teams or any webhook on the paid plans. Each channel is set per tracked entity, and each can be limited to confirmed incidents.
Is there a free plan?
Yes: five tracked entities with email alerts, the weekly brief and the incident record, with no card. Paid plans start at $4.99 a month and begin with a 7-day free trial.
Can my team share one list?
On the Business plan, five seats share one tracked list with role-based access; each member gets their own alerts and settings. Vendor lists can be imported in one go.
What happens to my data?
Your account, what you track and your alert settings are held on BreachFeed’s own servers; there are no advertising or analytics cookies and no third-party trackers. You can download everything held about your account, and delete the account yourself, from the account page.

Start with five entities, free

Track the organizations you depend on and hear about it the moment one of them is hit. No card, and nothing to install.

Create your account