Security · Top stories
Telegram Android Flaw Allowed Remote Code Execution via Voice Calls
A flaw in Telegram for Android, present in versions 8.6.2 through 12.10.3, allowed remote code execution when users answered voice calls. This vulnerability, if chained with other bugs, could lead to full phone control, and was fixed in version 12.10.4.
26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories
A researcher discovered 26,400 active cloud and AI service credentials exposed in public Gitee repositories, which were still functional when tested. These credentials, including keys for Alibaba Cloud, YouTube API, DeepSeek, Zhipu, and OpenAI, could allow unauthorized access and potential misuse of services. Developers who have committed keys to public Gitee repositories should consider them compromised.
iRhythm Data Breach Impacts 8.2 Million Individuals, HHS Filing Confirms
Medical equipment provider iRhythm reported a data breach in June 2026 affecting 8.2 million individuals, as confirmed by an HHS filing. The breach compromised personal and device data, including names, addresses, dates of birth, and account information, from third-party-hosted business applications.
Microsoft Edge Full Chain Exploit Uses Only Logic Bugs, No Memory Corruption
Orange Tsai of DEVCORE Research Team achieved a full chain exploit against Microsoft Edge at Pwn2Own Berlin 2026, utilizing four logic bugs to bypass the sandbox. This exploit earned $175,000 and 17.5 Master of Pwn points, demonstrating a novel approach to browser exploitation without relying on memory corruption vulnerabilities.
Apple and Microsoft Added to Russian Surveillance Registry, Mandating Data Storage and Access
Apple and Microsoft are now subject to Russian regulations requiring them to store user communications and provide them to security agencies upon request. This move places them on Russia's "organizers of information dissemination" registry, impacting user privacy and data handling for these companies within Russia.
PDF Implementations Use Weak Randomness for AES-256 Keys, Allowing Decryption
Researchers discovered that several PDF implementations, including MuPDF and Foxit, generate AES-256 file keys using insufficient random states, making them vulnerable to enumeration and recovery. This flaw allows for passwordless decryption of protected PDF documents, undermining their security. The issue stems from poor random number generation practices, such as using time-based seeds or limited random state bits.
US Sanctions Russians, North Koreans for Laundering IT Worker Earnings
The U.S. Treasury Department sanctioned Russian and North Korean individuals and companies for their involvement in laundering cryptocurrency earned by North Korean IT workers. These workers are accused of exploiting U.S. companies and using fraudulent activities to generate funds for North Korea.
Fingerprinting script found to contain bioweapon-related code strings
A web crawling project discovered a fingerprinting script from servicepipe.tech that contained unusual function names and strings related to bioweapons, such as "computeRicinLethalDosageForWaterSupply". This finding highlights the unexpected and potentially concerning content found within web scripts used for browser fingerprinting.
Moldova Investigates Possible Foreign Involvement in Major Government Cyberattack
Moldova is investigating potential foreign state actor involvement in a cyberattack that exposed sensitive personal data of approximately 750,000 citizens and disrupted dozens of public services. The attackers exploited vulnerabilities in government systems between October 19 and 23, making 11 million data access requests.
South Korean Financial Sector Hit by New Cyberattacks on Brokerages and Crypto Exchange
South Korean financial institutions, including Daishin Securities, Mirae Asset Global Investments, and crypto exchange Bithumb, experienced new cyberattacks. These incidents follow previous attacks and highlight ongoing cybersecurity vulnerabilities in the region, prompting calls for stronger security measures.
Microsoft urges Entra ID admins to migrate users from SMS/voice authentication to passkeys
Microsoft is advising Entra ID administrators to transition users to phishing-resistant authentication methods, such as passkeys, before SMS and voice authentication are retired in February 2027. This change aims to improve security by moving away from methods vulnerable to phishing and SIM-swap attacks. The retirement applies to Entra ID workforce tenants, not Azure AD B2C or Entra External ID.
US Marines Join NATO Mission to Protect Baltic Sea Undersea Infrastructure
A team of US Marines is deploying to the Baltic Sea to support NATO's Enhanced Vigilance Activity Baltic Sentry operation. This deployment provides advanced surveillance and reconnaissance capabilities to protect undersea internet cables and gas pipelines amid concerns over sabotage.
Critical 16-Year-Old UEFI Flaw Allows Code Execution Before Secure Boot on Network-Booting Servers
A 16-year-old critical flaw in EDK II, the open-source code for UEFI firmware, allows an attacker to run code before the operating system loads on machines booting over a network. The vulnerability, CVE-2026-97631, is a buffer overflow in the network-boot code (PXE) and has a severity rating of 9.5 out of 10.
US indicts Malaysian national for Madagascar-based NFT investment scam
The US Justice Department indicted Malaysian national Chui Kok Wa and five others for allegedly stealing over $516,695 from Americans through fictitious NFT investment schemes operated from Madagascar. The operation moved to Madagascar after law enforcement actions in Cambodia, and US efforts to interview suspects were hindered by Madagascar's repatriation of individuals to China.
Israeli Ad Tech Firm Discover-Tech Linked to Suspected Starlink User Tracking
Discover-Tech, an Israeli ad tech company, is reportedly tied to a suspected surveillance effort targeting Starlink users, according to a Reuters report. Researchers believe the firm's aggressive bidding for ad space in over 100 countries, particularly in conflict zones, was intended to reveal user locations or enable further monitoring. This development raises concerns about the potential misuse of ad auction data for surveillance purposes.
Georgia Tech Tool Recovers Deleted Local AI Chat Data from Device Memory
Georgia Tech researchers developed ORISA, a tool that can recover deleted chat information from local AI assistants running on devices. This tool addresses a cybersecurity gap by enabling investigators to reconstruct deleted AI conversations, which was previously difficult due to the lack of centralized logging in local AI setups.
Counterfeit TikTok Shop is Surfshark's most-blocked phishing scam, global phishing blocks up 524%
A counterfeit TikTok Shop accounted for 19% of all global phishing domain blocks between May and September 2026, according to Surfshark data. Global phishing blocks increased by 524% from April to September 2026, indicating a significant rise in phishing activity.
UK police data suppliers repeatedly breached by hackers since 2021, watchdog finds
Hackers have repeatedly compromised third-party suppliers holding UK police data since 2021, according to a report by His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services. This highlights significant cybersecurity vulnerabilities within the UK policing sector's supply chain, particularly concerning sensitive information held by external vendors.
Huntress Identifies Top Cyber Threats for Small and Mid-Sized Businesses in Q1 2026
Huntress released its "Tragic Quadrant" report, detailing the most impactful cyber tactics affecting small and mid-sized organizations. The report highlights RMM abuse, mailbox manipulation, and adversary-in-the-middle attacks as primary concerns, providing guidance on defense prioritization.
Malicious Android Apps Target Russians with ZloyRAT Trojan Amidst Fuel Shortages
Cybercriminals are exploiting anxieties over fuel prices and drone strikes in Russia by distributing malicious Android applications that install the ZloyRAT trojan. These apps, disguised as traffic police locators, VPNs, and drone radars, steal personal and financial information from infected devices.
Denver Health Plan Notifies 238,000 Members of Data Breach via Vendor Key Leak
Denver Health Medical Plan (DHMP) is notifying 238,000 members that their personal and health information may have been compromised due to an access key leak by third-party vendor SquareML. The leaked key, exposed for over a year, could have allowed access to a database containing names, dates of birth, health metrics, and plan eligibility data, though no evidence of misuse has been found.
Microsoft Authenticator Android Flaw Allowed Unauthorized Token Theft by Malicious Apps
Microsoft fixed a vulnerability (CVE-2026-80097) in its Authenticator app for Android that allowed unprivileged malicious applications to impersonate legitimate Microsoft apps and steal work account sign-in tokens. The flaw, rated 8.6 CVSS, could grant full access to email, files, and calendars, but required user interaction and has not been exploited in the wild.
Australian Signals Directorate Disconnects 180,000 Computers from Amadey Malware Backend
The Australian Signals Directorate (ASD) gained access to an Amadey malware operator's backend and disconnected 180,000 infected computers globally. This action prevents the criminal from accessing or stealing data from these machines, though previously stolen credentials may still be at risk.
ENGIE discloses data breach affecting French customers via marketing platform
French energy company ENGIE confirmed a data breach impacting customers in France after attackers compromised a marketing platform used by its partners. The breach exposed customer contact details and energy contract information, but not banking data, with ENGIE's internal systems remaining uncompromised.
AWS uses AI agents to triage Linux kernel CVEs for EC2 infrastructure
AWS engineers detailed their process for handling Linux kernel CVEs in EC2, which involves an automated filter and an AI agent. This system helps manage the increased volume of kernel CVEs since the kernel project became a CVE Numbering Authority.
OpenAI Compaction Flaw Exposed Hidden Model Reasoning to Researchers
Security firm Xint discovered a flaw in OpenAI's compaction feature that allowed researchers to extract a model's hidden reasoning in plain text. This method bypassed protections OpenAI implemented in August against reasoning theft, but OpenAI confirmed and fixed the issue on October 23.
Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
A coalition of organizations, including Cydome and ClassNK, launched Blue Initiative, a free public vulnerability database for the maritime industry. This database aims to help maritime organizations identify and prioritize IT and OT vulnerabilities specific to their systems, improving risk management.
Former Pentester Used ARTEX AI to Steal 8.2 Million Records from 90+ South Korean Organizations
South Korean police arrested a former pentester and six others for breaching over 90 organizations and stealing 8.2 million data records, primarily using the ARTEX AI pentesting framework. This incident highlights how AI tools are lowering the barrier for large-scale cybercrime, enabling individuals to conduct attacks previously requiring advanced skills.
Genesys Cyberattack Exposes Customer Data from Internal Systems
Genesys, a customer experience technology provider, experienced a cyberattack that resulted in unauthorized access to its internal business systems, including a learning management system and a customer relationship management environment. The incident potentially exposed customer business and account information, but core customer platforms were not compromised.
Critical Wasmtime Flaws Allow WebAssembly Sandbox Escapes, Affecting Multiple Versions
Two critical vulnerabilities in Wasmtime, a WebAssembly runtime, could allow malicious WebAssembly modules to escape their intended sandboxes. These flaws, rated 9.9 on the CVSS scale, primarily affect services that compile untrusted user-provided modules. Fixed versions were released on October 19 and 20, and users are advised to update immediately.
Dutch Police Arrest Two for NFC Relay Bank Fraud Scheme, Over $400,000 Stolen
Dutch authorities arrested two individuals involved in a bank helpdesk fraud scheme that used AI-generated audio and NFC relay attacks to steal over $400,000 from 170 victims. The suspects impersonated bank employees and tricked victims into scanning their debit cards, allowing unauthorized ATM withdrawals.
Australian Cyber Agency Warns of Increased Online Service Disruptions and AI-Enabled Threats
The Australian Signals Directorate (ASD) has warned Australians to expect more online service outages due to rising cyber threats, emphasizing that system security must take precedence over availability. The agency also urged the use of AI for defense, noting that AI is enabling more dangerous attacks from foreign governments, criminals, and hackers. This comes as the ASD reported a 20% increase in cybersecurity incidents and an 80% rise in notifications of potential malicious activity.
uCreator Android Spyware Steals Telegram 2FA and Clones WeChat Accounts
A rentable Android spyware kit named uCreator is taking over Telegram and WeChat accounts by embedding malicious code within modified versions of these applications. This spyware, identified as Baohuo by Doctor Web in 2025, primarily targets users who sideload these tampered apps or use the kit makers' container app, posing a risk to mobile wallet and messaging app users.
Huntington, WV Debates Flock License Plate Readers After Mayor Cites Crime Solvability
Huntington, West Virginia's city council debated the implementation of Flock automated license plate reader technology. Mayor Patrick Farrell advocated for the system, citing its role in solving recent murder cases, while residents and some council members expressed concerns over privacy and potential misuse.
Proof-of-Concept Released for Steal My Bitcoin CTF PHP Vulnerability
A Python script has been released that reproduces the exploit chain for the Steal My Bitcoin Capture The Flag (CTF) challenge. The script demonstrates how memory exhaustion in PHP can lead to information leaks and remote code execution, highlighting a vulnerability in PHP's handling of multipart uploads and session management.
Samsung TVs reportedly use AI to record audio and screenshots for targeted ads
A cybersecurity researcher reverse-engineered a Samsung TV and found its Tizen OS collects detailed user telemetry, including audio, screenshots, and cross-device tracking IDs, to improve targeted advertising. This data collection involves AI models running on the TV to track user behavior, raising privacy concerns.
Cookie Theft Allows Fraudsters to Bypass MFA and Access Accounts
Fraudsters are increasingly targeting session cookies to gain unauthorized access to user accounts, bypassing traditional login credentials and multi-factor authentication. This method, known as session hijacking, allows attackers to impersonate users by stealing active session cookies from compromised devices.
PingCAP Suffers Data Breach, Source Code and Customer Records Stolen
PingCAP confirmed unauthorized access to its internal systems, resulting in the theft of source code and customer-related data. The cyber extortion group FulcrumSec claimed responsibility, alleging they stole 10.6 TB of data including TiDB Cloud control-plane records, customer SQL statements, and API keys. This breach impacts PingCAP customers whose data, including credentials, may have been exposed.
Google automatically links phone numbers to all Android accounts since September 2025
Google has been automatically linking Android phone numbers to every Google account signed into a device since September 2025. This default setting, which Google states enables features like account recovery and RCS messaging, applies to all accounts on the phone, including work and secondary accounts, and periodically re-verifies numbers.
Security Researchers Demonstrate iPhone Exploits at Hexacon
Security researchers presented several iPhone exploits at Hexacon in Paris, including a '1-click' Signal vulnerability and an iMessage exploit. The demonstrations suggest new methods for compromising iOS devices.