Security · Top stories
Alleged Administrator of OLVX Cybercrime Market Arrested in North Macedonia
North Macedonian police, in a joint operation with the FBI, arrested the alleged administrator of the OLVX cybercrime marketplace. OLVX operated from 2023, facilitating the sale of stolen personal data and login credentials, impacting thousands of individuals.
Bank of America Hires 1,000 Contractors to Patch AI-Exposed Software Flaws
Bank of America hired 1,000 external contractors to address software vulnerabilities identified by advanced AI models, including Anthropic's Mythos. This action highlights the financial sector's response to AI's capability to expose legacy software flaws, leading to significant remediation costs.
Apate.ai deploys AI agents to gather fraud intelligence from scammers
Apate.ai, an Australian startup, uses AI agents to engage with scammers, collecting intelligence such as bank accounts, crypto wallets, and malicious websites. This information helps banks, telecom companies, and government agencies improve their anti-fraud measures.
Polish PM states spyware manufacturer accessed data harvested by former government
Polish Prime Minister Donald Tusk announced that an investigation found the spyware manufacturer NSO Group had technical access to data collected by the former Polish government's use of Pegasus spyware. The Central Anti-Corruption Bureau (CBA) lacked full control over the system, with NSO Group maintaining exclusive control over the infection module and access to administrative privileges, raising concerns about data security and potential foreign access to sensitive information.
Google Automatically Links Phone Numbers to All Signed-In Accounts on Android
Google is automatically linking phone numbers to all Google accounts signed in on an Android device, even if the number was only provided for one account. This change means a single phone number can become associated with multiple Google profiles without explicit user action for each account.
ICS Patch Tuesday: Siemens, Rockwell, and Schneider Electric Release Security Advisories
Industrial control system (ICS) vendors Siemens, Rockwell Automation, and Schneider Electric released security advisories this Patch Tuesday. Siemens issued 17 advisories, Rockwell fixed an ArmorBlock takeover flaw, and Schneider Electric addressed vulnerabilities in Pro-face STW6000 and Sage RTUs. These updates address critical and high-severity vulnerabilities that could lead to device takeover, denial of service, or unauthorized access in industrial environments.
Russian Travel Platform Anywayanyday Suspends Bookings After Cyberattack
Russian online travel agency Anywayanyday suspended new bookings following a cyberattack on its IT infrastructure, preventing customers from purchasing tickets or booking hotels. The incident impacts one of Russia's oldest online travel services, which partners with 800 airlines and 330,000 hotels.
curl Patches HTTP/2 Upload Flaw Allowing Client-Side Code Execution
curl released version 8.23.0 to fix a use-after-free vulnerability (CVE-2026-92392) in its HTTP/2 upload handling that could lead to client-side memory corruption and potential code execution. This flaw affects curl and libcurl versions 8.12.0 through 8.22.0 and requires clients to upload a file to a malicious server.
Node.js Project to Release Security Updates for 26.x, 24.x, and 22.x Branches
The Node.js Project will issue new versions for its 26.x, 24.x, and 22.x release lines on October 21, 2026, to resolve security vulnerabilities. These updates address high-severity issues across all affected active branches, requiring users to update to maintain system security.
FBI Warns Generative AI Used in Terror Plots, Safeguards Insufficient
Law enforcement documents reveal a 2025 car bombing used generative AI for planning, prompting FBI concerns that threat actors will increase AI use for attacks. The FBI notes current AI safeguards are insufficient against 'jailbreaking' techniques, indicating a growing challenge for law enforcement in combating AI-enabled crime.
US Report Details Dating App Scam Extent, Citing Outdated Tinder Security Systems
A US congressional report revealed that romance scams cost Americans at least $1.3 billion annually, with nearly 1.5 million scammers on Tinder and Hinge matching with users. The report cited internal Match Group documents indicating Tinder had not updated most of its machine learning models for years, hindering scam detection.
Bank of England and IMF Warn Cyber Attacks Threaten Trust in Financial System
The heads of the Bank of England and the International Monetary Fund (IMF) stated that increasing cyber-attacks risk undermining public trust in the global financial system. They highlighted concerns about AI agents, major hacks, and the growing cost of cyber-fraud, suggesting people might withdraw from formal financial systems.
Researchers Execute Code in Windows SmartScreen Enclave via Four-Byte Write and Timing Bug
Security researchers demonstrated code execution within a protected Windows SmartScreen enclave, bypassing its isolation mechanisms. This proof-of-concept attack, tracked as CVE-2026-83498, allowed code to run in a VBS enclave designed to guard sensitive data, even with system-level compromise. Microsoft patched the vulnerability in September 2026.
FTC alleges Digital Forensics Corporation defrauded sextortion victims of $60 million
The Federal Trade Commission (FTC) filed a complaint against Digital Forensics Corporation (DFC) and its owner, Dmitry Belkin, for allegedly defrauding sextortion victims of at least $60 million. DFC reportedly charged victims for services like stopping attacks and tracking perpetrators, but provided none of the promised help, instead fabricating evidence and reusing location data.
UK Housing Ombudsman Service Investigates Third-Party IT Security Incident
The UK Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system, preventing new complaint submissions. The service has contained the incident and is assessing data involvement, notifying the ICO, and advising caution against scams.
West African Scam Compounds Raided, 100+ Suspected Trafficking Victims Identified
Police in Ghana and Nigeria, in collaboration with international agencies and tech companies, raided scam compounds, arresting 28 individuals and identifying 117 suspected human trafficking victims. The operation targeted various online fraud schemes, leading to the removal of over 3.7 million scam-linked accounts by tech companies and the identification of $11 million in potentially frozen funds.
Meta Reports GitHub Breach Affecting 1,500 Individuals, Mostly Employees
Meta is notifying approximately 1,500 individuals, primarily US employees, that their personal and business data was accessed after hackers compromised some of the company's GitHub repositories using stolen employee credentials. The breach involved software code and a small amount of personal data mistakenly stored on GitHub, prompting Meta to implement new controls and security measures.
North Korean Kimsuky Group Targets Ukrainian Experts for War Intelligence
North Korean hacking group Kimsuky has targeted Ukrainian experts in diplomacy, security, and international policy using fake conference invitations and malicious documents. This activity is likely aimed at gathering intelligence on the war in Ukraine, North Korean military involvement, and prisoner of war developments, amidst Pyongyang's military cooperation with Russia.
XWorm RAT Evolves into Surveillance Platform with New Plugins
The XWorm Remote Access Trojan (RAT) has expanded its capabilities with new plugins that enable surveillance features like location tracking, live audio streaming, and interactive browser session control. This evolution allows attackers to bypass multi-factor authentication and gain full remote control over browser sessions, increasing the malware's threat level.
LG Smart TVs Vulnerable to Local Network Root Takeover via webOS Vulnerabilities
Three vulnerabilities in LG's webOS can be chained to allow an attacker on the same local network to gain root access to certain smart TVs without authentication. LG has released a fix for these vulnerabilities, which were demonstrated at TyphoonPWN 2026.
Two Critical Flaws in MarkLogic Server Allow Privilege Escalation to Admin Control
Progress Software disclosed 31 new flaws in its MarkLogic Server database, including two critical vulnerabilities that allow delegated managers to gain full administrator control. Fixes are available in MarkLogic 11.3.7 and 12.1.0, and users of affected versions should upgrade immediately.
Amazon GuardDuty Extended Threat Detection Adds Five New Attack Sequence Indicators
Amazon GuardDuty Extended Threat Detection now includes five new indicator types: MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY. These additions correlate weak signals from services like Amazon Inspector and Amazon Macie to prioritize high-confidence attack sequence findings, improving threat detection on AWS workloads.
Canonical Websites Hit by Second DDoS Attack This Year
Canonical's websites, including ubuntu.com and canonical.com, experienced a distributed denial-of-service (DDoS) attack last week, causing approximately four hours of downtime. This marks the second such incident this year, following a larger attack in April that also affected developer services like Launchpad and the Snap Store.
Malware discovered in Zod 4.6.6, potentially compromising user systems
Malware was found in Zod version 4.6.6, which attempts to download and execute additional code from remote servers. This compromise could lead to unauthorized code execution and data exfiltration on affected systems.
Elgin Community College struggled to remove Flock Safety cameras after contract dispute
Elgin Community College attempted to cancel its contract with Flock Safety and remove its cameras due to concerns over data sharing and security, but Flock refused. The college resorted to covering the cameras, which Flock employees repeatedly uncovered, until the contract expired.
Cyberleek Threatens Full GTA 6 Build Leak for $30M Memecoin Goal and Take-Two Apology
The group Cyberleek, responsible for previous GTA 6 leaks, has issued an ultimatum to Take-Two Interactive and Rockstar Games, demanding a physical release for GTA 6 and an apology, or they will release the full game build. Additionally, Cyberleek states the full build will be released only if their $CYBERLEEK memecoin reaches a $30 million market capitalization, a significant increase from its current $5 million valuation.
Malware incident at Nippon Columbia exposes 8.7 million Daiichi Kosho customer and employee records
Nippon Columbia, a contractor for Japanese entertainment company Daiichi Kosho, experienced a malware infection that exposed over 8.7 million customer and employee records. The exposed data includes names, genders, dates of birth, email addresses, and telephone numbers, impacting customers of several karaoke chains.
Calendar Phishing Scams Show Exponential Growth, Exploiting Auto-Add Features
Calendar phishing scams are rapidly increasing, exploiting calendar applications' automatic invitation-adding features to trick users. These scams create fake meeting entries or service renewal prompts, leading users to malicious login pages and compromising credentials.
Rampart Open-Sourced for On-Device PII Redaction in Browsers
Rampart, an on-device personal information filtering system, has been open-sourced to prevent sensitive data from leaving a user's device when interacting with chatbots. It combines regular expressions and a small language model (MiniLM) to redact PII locally, addressing privacy concerns with remote servers and large PII removal models.
Danish CPR Data Breach Used '123456' Password
A data breach involving Danish CPR data occurred due to the use of '123456' as a password. This incident highlights a significant lapse in basic security practices for sensitive personal information.
Recruitment Firm Owner Accused of Doxxing Campaign Against RNLI and Anti-Racism Activists
Tom Watson, owner of a recruitment firm, is accused of operating an X account, "Big Time Charlie," that doxxed RNLI staff, anti-racism activists, and executives. The account allegedly used AI to scrape data for a "Traitorbase" before being deactivated after Watson was named by Hope Not Hate.
Telegram Desktop Vulnerability Allowed Remote File Theft via Malicious Links
A vulnerability in Telegram Desktop allowed attackers to steal any user's file by crafting a malicious link. The flaw exploited how Telegram Desktop handles inter-process communication and an internal URI scheme, enabling arbitrary file reads without user confirmation.
Federal Program Compels Cities to Share License Plate Reader Data with Surveillance Centers
The Trump administration is utilizing the High Intensity Drug Trafficking Area (HIDTA) program, an anti-drug trafficking grant from the 1980s, to mandate that cities funnel their automated license plate reader (ALPR) data into federal surveillance centers. This system aggregates data from local law enforcement's ALPR cameras, including those from companies like Flock and Axon, making it accessible to various federal, state, and local agencies. In some instances, this data is also shared with the Drug Enforcement Agency's (DEA) National License Plate Reader Program (NLPRP), raising concerns about data retention and access beyond local control.
GoBalance Flaw Allows .onion Address Hijacking via Tor-Format Key Recovery
A vulnerability in GoBalance, a tool used by dark-web sites for resilience, allows attackers to recover a site's .onion address private key using only public information. This flaw enables redirection of site visitors to attacker-controlled copies, impacting sites that store their master key in Tor's specific key format.
Trump Mobile Lacks FCC Authorization for International Calls, Faces Security Concerns
Senator Maggie Hassan has informed Trump Mobile that it appears to lack FCC authorization for its international calling services and has not submitted a required robocall mitigation plan. These issues, combined with a recent data breach affecting 3,615 customers and a vendor data exposure, raise concerns about the company's security practices and compliance with regulations.
Ransomware Attack Disrupts Japan's IDCF Cloud, Affecting 495 Companies and Government Clients
IDC Frontier's IDCF Cloud service experienced a ransomware attack on October 7, causing an outage in its East Japan Region 1 data center cluster. The attack impacts 495 companies and local governments, leading to system shutdowns and disabled customer access across all regions as the company investigates the breach.
Driver awarded $76 after ALPR-triggered traffic stop led to unconstitutional drug searches
A federal jury awarded Alek Schott $76 after finding that Bexar County deputies conducted an unconstitutional traffic stop and search based on an ALPR alert. The stop, initiated by a tip from a federal fusion center, was based on Schott's "one-day turnaround" trip, which deputies falsely claimed was for "lane drifting."
Japan Reports Sharp Increase in Web Data Leaks from Mobile API Abuse and Metabase Attacks
JPCERT/CC reported a surge in personal data leaks at Japanese organizations, attributing them to mobile app API abuse and exploitation of known software flaws, including in the Metabase BI tool. These incidents, separate from ransomware, have led to large-scale data compromises and are increasing, with 81 of 119 incidents this year occurring since July.
UAC-0099 Targets Ukrainian Government with New ASHVEIN RAT
The Russia-aligned threat actor UAC-0099 is using a new .NET infostealer and remote access trojan (RAT) called ASHVEIN in attacks against Ukrainian government personnel. ASHVEIN combines credential theft, surveillance, and remote-control capabilities, hiding commands within invisible HTML elements.
Hacker Convicted for Stealing $53 Million from Uranium Finance Crypto Exchange
Jonathan Spalletta was found guilty of computer fraud and money laundering for hacking the decentralized crypto exchange Uranium Finance twice in April 2021, stealing over $53 million. He exploited smart contract flaws to drain liquidity pools, leading to the exchange's shutdown, and laundered the funds through mixers and other exchanges.