Security · Top stories
US Charges Russians for Operating 'Bulletproof' Hosting Services Linked to $62M in Cybercrime Losses
U.S. prosecutors have unsealed charges against three Russian nationals linked to bulletproof hosting providers Media Land and ML.Cloud. The Russians allegedly supported ransomware attacks through these services, causing over $62 million in damages. A $10 million reward is offered for information leading to their arrests.
Microsoft Patches Windows Defender 'RoguePlanet' Vulnerability CVE-2026-50656
Microsoft has patched the 'RoguePlanet' vulnerability (CVE-2026-50656) affecting Windows Defender on Windows 10 and 11, which allowed SYSTEM privileges escalation. The vulnerability was disclosed by researcher Nightmare Eclipse, and a month later Microsoft released the patch in Malware Protection Engine update version 1.1.26060.3008. The flaw's potential use in privilege escalation makes its resolution important for system security.
Google and FBI Disrupt NetNut Proxy Network of 2 Million Devices
Google, the FBI, Lumen, and others disrupted the NetNut residential proxy network involving over 2 million devices used for malicious activities. The operation disabled command-and-control features, protecting home devices from being exploited. This action significantly reduces cybercriminals' ability to mask their activities using residential IPs.
Former EU Parliament Member Hacked with Pegasus While Investigating Spyware
Stelios Kouloglou, a former European Parliament member, was targeted with Pegasus spyware during his work on the PEGA Committee, which investigated commercial spyware misuse. The hack occurred as the committee prepared recommendations on regulating spyware. This incident underscores concerns about government surveillance practices in the EU.
Nikkei Discloses Breaches of Employee Microsoft and Google Email Accounts
Japanese publishing company Nikkei reported two separate security incidents involving employee email accounts. Attackers accessed a Google Workspace account in July, potentially exposing personal information of 1,646 individuals, and a Microsoft 365 account in September, which was used to send 9,000 phishing emails to staff and interviewees.
Canadian Extradited to US for Alleged Cryptomining Hacks on University Supercomputers
Ryan James Roach, a 35-year-old Canadian, has been extradited to the US to face federal charges for allegedly orchestrating a cyber campaign that hijacked university supercomputers to mine cryptocurrency. From June 2016 to December 2019, Roach and co-defendant Mathiew James Stubbings, 41, allegedly compromised systems at academic institutions in New York, Massachusetts, North Carolina, and Tennessee, stealing credentials and deploying mining software. Stubbings' extradition proceedings are ongoing in Canada.
cPGuard Update System Compromised, Backdoor Deployed to Linux Servers
Attackers compromised the cPGuard security tool's update system on November 2, distributing a malicious script to customer Linux servers running versions 5.88.12 through 5.88.19. The script installed a backdoor, collected password hashes and sensitive files, and uploaded them to a cPGuard licensing server. OPSSHIELD detected and stopped the distribution within 12 hours, advising users to update to version 5.88.25 or later and rotate credentials.
Xen Hypervisor Flaws Allow Malicious VM to Read/Write Other VM Memory
Two critical flaws in the Xen hypervisor (CVE-2026-102703, CVE-2026-102704) enable a malicious guest VM to read and write the memory of other VMs, including the privileged dom0, on the same host. All Xen versions from 4.6 onward are vulnerable, and patches have been released for newer versions, requiring immediate updates and reboots for affected systems.
Russian State-Linked Group Midnight Blizzard Targets iOS, Android Devices in Espionage Campaign
The Russian state-sponsored threat actor Midnight Blizzard (APT29) conducted a watering hole campaign targeting iOS and Android users in Europe and the US. The group compromised legitimate websites and injected malicious JavaScript to fingerprint visitors before delivering zero-click exploits, aiming to steal sensitive data like passwords, messages, and browser information.
Banking Scam Infrastructure Fakes Domain Suspensions to Evade Detection
KELA researchers uncovered a financial scam operation using hundreds of fraudulent websites that display fake suspension notices to evade detection by security scanners. These sites clone legitimate banking domains and target business banking customers, showing a false takedown page on a visitor's second visit while remaining active for victims.
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems
A new UEFI bootkit, BlackX, is targeting diplomatic organizations in Central Asia, bypassing Secure Boot on Windows systems. BlackX exploits the Baton Drop vulnerability (CVE-2022-21894) on systems that have not applied manual Secure Boot revocation mitigations, even if patched.
Operation Serengeti III Disrupts 11,000 Cybercrime Networks, Arrests 1,400 in Africa
Law enforcement agencies, coordinated by Interpol, disrupted nearly 11,000 cybercriminal networks and arrested over 1,400 individuals in Africa during Operation Serengeti III. The operation targeted business email compromise, ransomware, and online scams, leading to the recovery of over $105 million in illegal funds.
Google Cloud VRP Introduces New $250,000 Root-in-Cloud Reward Tier
Google Cloud's Vulnerability Reward Program (VRP) added a new $250,000 "Root-in-Cloud" reward tier for discovering high-impact architectural vulnerabilities. This tier targets human-led research into tenant-isolation bypasses and complex cross-service logic flaws, requiring full administrative control over Google Cloud organizations or projects without prior access.
WorkOS Internal Sales App Breached Using ARTEX AI, Exposing Customer Contact Data
WorkOS, a developer infrastructure company, experienced a data breach where an attacker accessed an internal sales application, exposing business contact details, customer communication summaries, and account histories. The attacker utilized the ARTEX AI offensive security framework to automate reconnaissance and exploitation, marking a notable instance of AI-powered attack tools in use.
Nvidia Hardware Valued at $11.4 Million Stolen in Transit Between Oakland and Texas
An $11.4 million shipment of Nvidia hardware disappeared during transport from Oakland to Fort Worth, Texas, in late August. The theft, which involved a truck bearing a food transportation company's logo, was discovered in early September when the cargo failed to arrive, and police have made no arrests or recoveries.
Firecracker MicroVM Escape Achieved, Allowing Root Code Execution on Host
Researchers successfully escaped a Firecracker microVM, achieving root code execution on the host system. This exploit, a continuation of previous work, leverages a host memory primitive to modify saved registers and redirect execution when a vCPU thread returns from KVM.
InfoHawk Uncovers 820 Restaurant Impersonation Domains Running Payment-Skimming Campaigns
InfoHawk research identified 820 suspicious domains impersonating major US restaurant chains like Jersey Mike's and Chipotle. These sites use reverse-proxying to mimic legitimate ordering experiences while deploying sophisticated payment-skimming attacks that capture credit card details and bank SMS verification codes. This campaign poses a significant risk to consumers ordering food online, as the fake sites are highly convincing.
Medical Services Company Settles with Four States Over 2023 Data Breach Affecting 13M Patients
Perry Johnson Companies, a medical services firm, has agreed to pay $300,000 and implement significant security changes after a March 2023 data breach exposed the data of over 13 million individuals. The settlement with Connecticut, New Jersey, New York, and Michigan addresses the company's failure to use multi-factor authentication and properly monitor its systems, which allowed hackers to access sensitive patient records for two months.
Japan Announces Emergency Cybersecurity Package After Recent Data Breaches
Japan has introduced a 10 billion yen ($63 million) emergency cybersecurity package in response to recent data breaches affecting government agencies and major companies. The initiative includes forming expert teams, utilizing AI for threat detection, and implementing active cyber defense measures to improve national cybersecurity capabilities.
QNAP NAS devices breached via Plex2Shell vulnerabilities; users urged to update Plex Media Server
QNAP has reported multiple compromises of its Network-Attached Storage (NAS) devices due to the Plex2Shell vulnerability chain affecting Plex Media Server. Users are advised to update Plex Media Server to version 1.43.3.10861 or later through the QNAP App Center to mitigate the risk. If compromised, a clean reinstall of the OS and credential resets are recommended.
FBI Agent Pleads Guilty to Stealing $2.4 Million in Cryptocurrency from Investigations
A senior FBI Supervisory Special Agent, Patrick Steven Yaroch, pleaded guilty to wire fraud and money laundering for stealing over $2.4 million in cryptocurrency. Yaroch used his position to access FBI systems and transfer funds from wallets linked to nation-state hackers and crime victims across 35 FBI investigations. His actions compromised multiple FBI investigations by exposing sources and methods to the targets.
Ahold Delhaize Estimates Cyberattack to Cost Up to €250M in Q4 Net Sales
Grocery retailer Ahold Delhaize estimates its October cyberattack will reduce fourth-quarter net sales by €200 million to €250 million and impact operating income by €75 million to €100 million. The company has revised its 2026 financial guidance downward due to the attack and new Serbian regulations. The incident primarily affected online capabilities and supply chain operations in the Benelux and US.
D-Link Warns of Unpatched Zero-Days in DGS-3130 Series Switches
D-Link has issued a warning about multiple unpatched security vulnerabilities affecting its DGS-3130 series managed Gigabit stackable switches. These zero-day flaws, found in the D-Link Discovery Protocol (DDP), could allow attackers to access sensitive data, alter configurations, or disrupt services. D-Link recommends disabling DDP and restricting management access until a firmware update is released.
Athena AI to Begin Disclosing 50 Vulnerabilities This Month, Joins Anthropic's Project Glasswing
Athena, an AI system, will start disclosing its first 50 vulnerability findings this month, having identified over 40,000 findings across 500+ projects since June. The project has also joined Anthropic's Project Glasswing to further its vulnerability discovery efforts and plans to open-source its infrastructure for disclosure and patching. This initiative addresses the challenge of responsibly managing and disclosing AI-discovered vulnerabilities at scale.
New Mexico Hospital Network Diverts Patients, Closes Clinics Due to Cybersecurity Issue
The University of New Mexico Health System experienced a cybersecurity issue, forcing it to divert ambulances, cancel appointments, and close clinics. This incident left the state without its only Level 1 trauma center and highlights ongoing vulnerabilities in critical healthcare infrastructure.
Alpine Linux GitLab Server Targeted by Exploit for Critical Ruby Vulnerability
An attacker attempted to exploit CVE-2026-97229, a critical GitLab vulnerability, on Alpine Linux's GitLab server, a week after GitLab released a fix. The flaw allowed code execution via crafted CI configurations, and Alpine Linux rebuilt the server and reset passwords due to uncertainty about the attack's success. The incident highlights that GitLab upgrades alone may not patch the vulnerability if GitLab runs on a separate Ruby installation.
Syrian Electronic Army Hacker Sentenced to 42 Months for Cyberattacks, Including AP Twitter Hijack
Ahmad Umar Agha, a Syrian Electronic Army (SEA) hacker known as "Th3Pr0," received a 42-month prison sentence in a U.S. federal court for his involvement in a hacking conspiracy. This conspiracy, organized by advisors to former Syrian President Bashar al-Assad, targeted Western news outlets and included hijacking the Associated Press's Twitter account in 2013, which caused a temporary $136 billion drop in the Dow Jones Industrial Average.
FBI Seizes Virtualine Domain for Alleged Criminal Hosting and Money Laundering
The U.S. Department of Justice announced the seizure of Virtualine.net, a domain associated with a bulletproof hosting provider. The service allegedly facilitated criminal activities including child exploitation material, nonconsensual intimate imagery, and international money laundering.
Drupal Patches Critical Field UI Flaw Allowing Unauthenticated RCE via Contributed Modules
Drupal released patches for a critical vulnerability, CVE-2026-108097, in its Field UI module that could lead to unauthenticated remote code execution (RCE) through specific contributed modules. Users are advised to update to versions 11.4.10, 11.3.19, or 10.6.19, or uninstall the Field UI module if immediate updates are not possible.
Volt Typhoon Uses 'Silent Train' Framework for Zero-Day Attacks on Critical Infrastructure
The Chinese state-sponsored hacking group Volt Typhoon has been using a framework called 'Silent Train' to conduct zero-day attacks against high-value targets, including critical infrastructure. This framework relies on rotating chains of compromised devices to hide attack origins and has been observed exploiting at least four zero-day vulnerabilities. Black Lotus Labs has tracked this activity for three years, noting its focus on entities providing scalable access to sensitive networks.
Cyberattack on BAE Systems impacts all US federal bankruptcy courts
A cyberattack on BAE Systems, a U.S. government contractor, has disrupted the Bankruptcy Noticing Center (BNC), affecting all federal bankruptcy courts nationwide. The incident has halted the production of bankruptcy notices and made BNC systems and websites unavailable, impacting critical court operations.
Microsoft Releases Key Windows Security Updates and Support Changes
Microsoft has rolled out security updates KB5101650 and KB5099414 for Windows 11 versions 25H2/24H2 and 23H2, fixing 571 vulnerabilities. Simultaneously, Windows 10 received its KB5099539 update addressing 570 vulnerabilities, with extended support until 2027. Windows 11 24H2 Home and Pro editions will no longer receive updates after October 13, 2026, urging users to upgrade.
Ransomware Operator Sentenced to 70 Months for Attacks with Nefilim and Hive Groups
Artem Stryzhak, a 36-year-old from Ukraine, received a 70-month prison sentence after pleading guilty to charges related to cyberattacks using Nefilim and Hive ransomware. Stryzhak targeted hospitals, government entities, and businesses in the U.S., Canada, and Australia, contributing to over $100 million in losses and disrupting critical services.
GoAhead Embedded Web Server Patches Three TLS Vulnerabilities
The GoAhead embedded web server, used in hundreds of millions of devices, has patched three independent TLS vulnerabilities. These flaws, discovered by Sébastien Féry of FoxIO, could allow revoked client certificates to be accepted, enable decryption of encrypted sessions, or bypass certificate chain depth limits, depending on the TLS backend configured. GoAhead version 6.1.1, released on August 2, 2026, addresses these issues.
Onamae Desktop Cloud Hacked, Up to 27,000 Customer Servers Affected
Onamae Desktop Cloud, a Japanese VPS provider, confirmed that hackers installed malware on up to 26,739 customer servers. The company shut down affected servers and advised customers to rotate credentials due to potential data exposure, though no misuse of information has been confirmed.
Senators Allege US Government Illegally Withholding FISA Court Ruling on Surveillance
Senators Ron Wyden and Adam Schiff state the US government is illegally withholding a Foreign Intelligence Surveillance Court (FISC) ruling concerning Section 702 of the Foreign Intelligence Surveillance Act (FISA). The ruling, which objected to search filters used to access Americans' communications without warrants, was due for public release by September 13, 2023, 180 days after its issuance in March. This alleged non-compliance occurs as intelligence officials seek renewal of Section 702.
Capcom confirms data breach affecting 11.7 million CAPCOM ID accounts
Capcom announced a data breach of its CAPCOM ID membership service, exposing email addresses and associated information for over 11.7 million accounts. This incident follows a 2020 ransomware attack and highlights ongoing security challenges for the gaming company.
FCC Blocks Gadgets Containing Huawei-Made "Surveillance Chips"
The FCC has begun blocking electronic gadgets that contain chips from companies on its national security threat list, specifically targeting the HiVision Hi3516CV610 UHD Smart Vision SoC, a chip designed for surveillance applications and made by a Huawei subsidiary. This action marks the first use of a new power granted to the FCC in October to prevent the use of components from banned entities in consumer devices.
1Password Launches "1Password for Agents" to Securely Manage AI Agent Logins
1Password introduced "1Password for Agents," a new platform that allows AI agents to sign into websites using user credentials without directly accessing or seeing the passwords. This system requires user approval for each sign-in request, with 1Password handling the login process and removing credentials after use, aiming to enhance security for AI-driven tasks.
Over 300 Tor exit nodes compromised to intercept SSH and unencrypted mail traffic
On October 2, 333 Tor exit nodes, representing 10% of the network, began intercepting SSH connections and unencrypted email traffic. The attackers had deployed the Ebury 1.8.3 payload two months prior to steal credentials and monitor SSH sessions. The Tor Project's network health team was notified and began contacting affected relay operators to remove the compromised nodes.