Faultline

Live05:11:17 UTC

Cyber incidents on critical systems, sorted by how strong the evidence is. Every entry links to its source.

Loading globe

Signal
Claim
Reported
Confirmed
Drag to turn

One marker per country for the last 24 hours, coloured by the strongest evidence there. A ring pulses when a record was first seen in the past hour. 4 records have no country in the source. Data read 05:11 UTC, 9 of 9 sources reading.

Leak-site claims in the United States, last 7 days

172

Busier than 99% of weeks in the past year. The yearly average is 78 a week. Counted through Nov 13, the last full day in UTC.

Forecast: new claims in the next 7 days, United States

Sector	Likely	80% range	Range held
All sectors	88	58 to 128	74%
Water, energy, health and government	18	10 to 28	78%
Health	13	6 to 21	81%
Government and citizen data	3	1 to 5	88%
Energy and utilities	2	0 to 4	89%
Water	Too rare to forecast: 2 in 13 months. Base rate about 3% a week.

80% range most likely last 7 days. Range held is how often the range was right when each of the last 224 daily forecasts was replayed. The target is 80%. This forecasts leak-site posts, not attacks. How the forecast works

New leak-site claims per day in the United States, last 13 weeks

Peak 52 on Nov 9

Aug 15Sep 29Last 7 days are brighter. Through Nov 13

By sector

Sector	Signal	Claim	Reported	Confirmed
	0	0	0	0
	0	0	0	0
	0	0	0	0
	0	0	0	0
	0	0		0
	0		0	0
	0		0	0
	0		0	0

Sector comes from the source, an official industry code, or a narrow match on the organization’s own name. Anything else stays unclassified.

By country

10 records: United States, last 24 hours

Vulnerabilities attackers are using now

36 added to CISA’s Known Exploited Vulnerabilities catalog in the last 30 days, 1,781 in total. This confirms exploitation, not who was hit.

Nov 13CVE-2026-114713 UnrealIRCd Improper Neutralization of Delimiters Vulnerability
Nov 13CVE-2026-123039 Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
Nov 10CVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability
Nov 10CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Nov 10CVE-2026-116606 Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Nov 10CVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Nov 10CVE-2026-125350 Google Chromium Use-After-Free Vulnerability

Control system advisories

38 CISA advisories for industrial and medical equipment in the last 30 days. An advisory is a known weakness, not an attack. Sector labels are CISA’s.

Nov 12ICSA-26-316-05 Siemens RUGGEDCOM APE1808Critical Manufacturing. Highest CVSS score 9.8
Nov 12ICSA-26-316-04 Siemens RUGGEDCOM APE1808Critical Manufacturing. Highest CVSS score 9.8
Nov 12ICSA-26-316-03 Siemens Industrial Edge ManagementCritical Manufacturing. Highest CVSS score 9.8
Nov 12ICSA-26-316-02 Siemens Desigo, GridscaleCritical Manufacturing, Energy, Information Technology. Highest CVSS score 9.8
Nov 12ICSA-26-316-01 Siemens Building Automation and Energy ProductsEnergy. Highest CVSS score 9.8
Nov 3ICSA-26-307-01 Subnet Solutions PowerSYSTEM CenterCritical Manufacturing, Energy. Highest CVSS score 9.0
Oct 29ICSA-26-302-03 Hitachi Energy CoreTec ProductEnergy. Highest CVSS score 8.8

Headlines

Word for word from six security news outlets. Headlines are context and are not counted as incidents.

8 h agoFAA Ground Stop Issued Due to ‘Extraordinary Circumstances’SecurityWeek
8 h agoFBI flash alert says Artex tool automating cyberattacks at ‘machine speed’The Record
8 h agoResearchers continue to find serious vulnerabilities in internet connected refrigeratorsCyberScoop
8 h agoIndustry guidelines for offensive cyber tools unveiled through international Pall Mall ProcessCyberScoop
9 h agoCurious about “Curious Worm”DataBreaches.net
9 h agoCity of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidentsThe Record
10 h agoTrezor confirms crypto-stealing implants in three wallets, releases fixBleepingComputer
11 h agoNYC to bar surveillance pricing as momentum for bans grows nationwideThe Record
12 h agoGerman military drone operations disrupted by cyberattackBleepingComputer
12 h agoUniversity of Texas at Arlington warns personal information stolen during cyberattackThe Record

Sources

Source	State	Last read	Records
Internet outage detectionIODA, Georgia Institute of Technology. 1136 single-method alerts not shown	Reading	3 min ago	15
Ransomware leak-site postsransomware.live	Reading	3 min ago	1,204
Leak-site claim historyransomware.live. 380 days through 2026-11-13	Reading	2 min ago
Press reports of cyberattacksransomware.live press index	Reading	3 min ago	100
SEC Form 8-K, Item 1.05US Securities and Exchange Commission, EDGAR	Reading	3 min ago	5
Known Exploited Vulnerabilities catalogCISA	Reading	3 min ago	36
Industrial control system advisoriesCISA	Reading	3 min ago	38
Infocon threat levelSANS Internet Storm Center	Reading	3 min ago
Security news headlinesBleepingComputer, The Record, CyberScoop, SecurityWeek, DataBreaches.net, Krebs on Security	Reading	3 min ago	60

Each source is re-read every 5 to 30 minutes. What each source measures and where it falls short