Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Attackers Exploit Critical UnrealIRCd Flaw Enabling Server Command Injection

  A high-severity vulnerability in UnrealIRCd, an open-source IRC server, is being actively exploited by attackers. Tracked as CVE-2026-1147...

All the recent news you need to know
Trezor
cryptocurrency cryptotheft Hardware implant Trezor

Trezor Confirms Hardware Implants in Three Safe 5 Wallets Sold Through Malaysian Reseller

 


Trezor has confirmed that three of its Safe 5 hardware wallets contained malicious circuit board implants capable of stealing cryptocurrency recovery phrases and transmitting them over a mobile network to an attacker-controlled server. The company published its investigation findings on November 13 and released a firmware patch two days earlier that neutralizes the implants found so far.

All three affected devices were purchased from CryptoBilis, a Malaysia-based hardware wallet retailer operating across Southeast Asia, between August 20 and September 23, 2026. No customers who bought from other regional resellers have been flagged, and no affected CryptoBilis customer has reported stolen funds so far.


How the Implant Works

The malicious component is a secondary circuit board installed between the Safe 5's main board and its display. It does not touch the legitimate firmware or the wallet's Secure Element, which is precisely what makes it difficult to catch through standard software checks. Instead, it sits passively and watches the screen.

When a user sets up a new wallet or restores an existing one, the implant reads the recovery words as they appear on the display. It can also capture passphrases. Once it has what it needs, it encrypts the data and sends it over a mobile network to a remote server. If the device has no mobile connection at that moment, the implant holds the data and keeps attempting transmission until it goes through.

The design mirrors what security researchers at Tibane Labs found inside tampered Ledger wallets traced to the same reseller weeks earlier. In those devices, the implants used an eSIM and a shielded LTE module alongside a microcontroller, with chip markings scraped off in at least one variant to slow identification.


How Trezor Found Them

The investigation began in October 2026 after a customer reported finding an unfamiliar circuit board inside a Safe 5 purchased from CryptoBilis. At the time, Trezor had not yet received the physical device and could not confirm what the implant was actually doing. It issued a warning and asked CryptoBilis customers to get in touch.

Forty-eight customers responded. Trezor examined some devices directly in its lab and checked others by reviewing photographs of internal components submitted by owners. That process turned up two more compromised wallets beyond the original one.


The Fix and What It Cannot Do

Firmware version 2.13.1, released on November 11, is designed to block the specific implants Trezor has examined from reading information off updated devices. The company described the patch as making "the current batch of implants useless."

There is an important limit to what the update can accomplish. If a device was implanted and a user set it up or restored a wallet before installing the firmware, the recovery phrase was already captured and sent. The patch stops future captures but cannot retrieve data that has already left the device.

Trezor is advising everyone who purchased a Safe 5 from CryptoBilis to move their funds to a new wallet generated with a freshly created recovery phrase. The company is offering replacement devices to any customer who bought from CryptoBilis since March 2026, including those whose devices have not been confirmed compromised.

CryptoBilis sits at the center of a supply chain problem that has now touched two of the most recognized hardware wallet brands. Ledger confirmed implants in its own devices sold through the same reseller in early October, shortly after users began reporting fund losses. Ledger's investigation showed that all reported drains traced back to CryptoBilis, and the company asked the retailer to stop selling and shipping its products.

Tampered Ledger devices were reportedly sold at roughly half the standard retail price, which in hindsight was a signal that something was wrong with how those units were sourced.

Trezor had already announced plans in October to tighten its reseller network following the Ledger reports, before its own implants were confirmed. It has since cut approximately 80 percent of its global reseller partners. The company said the removed resellers were not themselves untrustworthy, but that they did not meet the stricter supply-chain security requirements Trezor put in place after the CryptoBilis situation came to light. Remaining partners now face tighter controls over how devices are sourced, stored, and physically handled before they reach customers.


What Buyers Should Do

Anyone who purchased a Trezor wallet from CryptoBilis is being directed to contact Trezor directly. Those who set up or restored a wallet on the device before the November 11 firmware update should treat their current recovery phrase as exposed and generate a new one on a trusted device. Trezor's recommendation is to move funds before doing anything else.



Read more »
UK Data Breaches
Cyber Extortion Cyber Security Cybersecurity Threats Data protection Data Theft ICO Cybersecurity Report Ransomware Attacks UK Cyber Incidents UK Data Breaches

UK Data Protection Regulator Sees Unprecedented Rise in Cyber Incident Reports


There was a record number of cyber incidents reported by British organizations to the country's data protection regulator during the third quarter of 2026, demonstrating the increasing strain on the UK's cybersecurity landscape. The latest data from the Information Commissioner's Office (ICO), which has been analyzed by Recorded Future News, indicates that 1,371 cyber incidents were reported from July to September, surpassing the previous quarterly record set in 2023. It is also estimated that the UK will surpass its previous record for cyber incident reports, which was also set in 2023. 

In addition to cyber-related incidents, the regulator received 4,604 reports regarding data security incidents during the third quarter, marking the highest quarterly total ever recorded. These included non-cybersecurity incidents, for example, sending sensitive emails to the wrong recipients accidentally. 

There are growing concerns among cybersecurity firms about the increasing number of British organizations appearing on data leak sites operated by cybercriminal groups. These groups increasingly use stolen information to pressure their victims into paying extortion demands. In addition, incident response providers have reported a sharp increase in demand, with employees at some firms stating that they have had to turn away prospective clients as a result of capacity limitations. 

ICO figures, however, provide a mixed picture of the ransomware threat. While reports of extortion-related activity continue to increase across the industry, the number of ransomware incidents formally reported to the regulator has continued to decrease. In 2023, the ICO recorded 1,253 ransomware incidents, followed by 752 in 2024 and 620 in 2025. It is estimated that 321, including 102 cases in the third quarter, have been reported in the third quarter of 2026, compared to 111 cases reported in the second quarter of 2026. 

ICO reports of cyber incidents are generally classified as 'other cyber incidents' rather than specifically classified as ransomware, phishing, or malware, which are most frequently reported. It is difficult to compare ransomware figures directly since the regulator's classification does not clearly indicate whether data theft and extortion without file encryption are included. While these limitations have been acknowledged, cybersecurity researchers have identified a significant increase in organizations being publicly identified by ransomware groups.

Rafe Pilling, director of threat intelligence at Sophos, stated leak-site numbers are imperfect but indicate a rise in ransomware attacks and data theft extortion activity, especially in the UK. As reported incidents increased, they were not limited to a particular industry. Retail and manufacturing organizations recorded the highest number of incidents, with reports increasing from 205 in the second quarter to 296 in the third quarter. 

A substantial increase has also been observed among charitable and voluntary organizations, with incidents rising from 79 to 145 during the same period. A significant increase has been observed at online technology and telecommunications companies, where incidents have increased from 76 to 120. There was a decline in reports in education and childcare among the six most affected industries, which fell from 135 to 115 reports.

Although there have been an increasing number of complaints, only a small percentage have resulted in formal regulatory investigations. ICO officials confirmed that only 18 of 1,371 cyber incidents reported during the third quarter were investigated, while the majority were handled by informal regulation or were closed without a formal investigation being initiated. 

Moreover, artificial intelligence is gaining traction in the evolving cyber threat landscape Rafe Pilling of Sophos cites the growing use of artificial intelligence by established cybercriminals and attacks involving AI agent frameworks as contributing factors to the wider threat. It is possible for threat actors to increase the speed and scale of their operations through the use of these technologies, facilitating the identification of vulnerabilities and the implementation of attacks. 

In the healthcare sector, the wider impact of unauthorized data access has also been of concern. ICO received and assessed more than 300 reports of unauthorized access to patient records between January and October 2026. Healthcare employees are reported to have accessed medical records without a legitimate reason, viewed information belonging to individuals they are acquainted with, and shared confidential patient information. 

Health care leaders have been instructed by the regulator to improve access controls, monitor suspicious activity, and take appropriate action against employees who have accessed records without authorization. Although established defensive measures remain essential for reducing cyberattack exposure, security experts continue to emphasize how effective these measures remain. 

To prevent unauthorized access to internet-facing systems, Pilling recommended that vulnerabilities in these systems be addressed and multifactor authentication, as well as passkeys, be implemented. Several organizations across all sectors are vulnerable to cyberattacks. The Information Commissioner has stressed how important it is to protect personal information from cyberattacks.

A strong cyber resilience program is essential, according to Jonathan Ellison, director of national resilience at the National Cyber Security Centre, who pointed out that many successful attacks continue to exploit known security vulnerabilities. In addition, artificial intelligence is facilitating the identification of vulnerabilities and potential exploitation of those vulnerabilities at a faster rate. 

Despite the growing trend of cybercriminal activity, British organizations have been under increasing pressure to improve their security controls, detect incidents and protect sensitive information as a result of increasing cybercriminal activity. These record figures underscore the increasing pressure that UK organizations face when it comes to strengthening their cybersecurity practices and protecting sensitive data. 

s criminal groups increasingly rely on data theft and extortion, effective access controls, timely security updates and phishing-resistant authentication remain essential. Organizations must also improve incident monitoring and response capabilities to limit exposure and maintain public trust.
Read more »
Email Attacks
Cloud Hosting Security Cloud Security Attack Cloud Service Cyber Attacks Cyber Security Ransomware Attacks Email Attacks

Ransomware Attack Disrupts Belarusian Cloud Provider ActiveCloud, Affecting Business Services

 

A ransomware attack on Belarus-based cloud services provider ActiveCloud has caused issues with websites, business email and virtual servers. The company has confirmed that their systems have been breached and some areas have been locked by ransomware. 

The company said on Tuesday that they had been hit by the ransomware attack which has affected their cloud hosting, email and customer support. Whilst some critical elements of their infrastructure have been restored by Wednesday, it will take longer to get customer systems back up and running. ActiveCloud said on Friday that they have now restored their core services, however some customers are still having issues. 

They added that their technical teams have been working around the clock to get everything back up and running and the most difficult part of the recovery process is now complete. The ransomware attack has impacted a number of services including their core cloud hosting product E-Cloud, secure hosting E-Cloud Protected and their business email SmartMail. Some customers also had issues getting their virtual machines running. 

ActiveCloud said that during their investigation they have found no evidence that customer data has been compromised. They have not said how the attackers gained access to their systems. The ransomware attack has impacted organisations using ActiveCloud. Belarus news organisation Smartpress have confirmed that they use ActiveCloud to host their website, however they are still publishing. Domino’s Pizza website and mobile app in Belarus have also had some downtime due to the issues. 

ActiveCloud provide cloud hosting, virtual servers, business email and other IT services to businesses and organisations in Belarus and Russia. This means that when issues occur with these services, a number of customers can be impacted. The attack comes after a number of incidents targeting hosting companies in Belarus and neighbouring Russia. On November 8, Russian hosting provider ESTT were hit by a ransomware attack which impacted their cloud services. This caused issues with websites, virtual servers and other customer services. 

They said that whilst their cloud management systems had been targeted, there was no evidence that customer data had been compromised. Just days earlier another Russian provider Beget fell victim to a destructive cyber attack. Attackers reportedly gained access to their infrastructure management systems and ran scripts to wipe data from some areas of their cloud. 

This caused issues with websites and online services for businesses, media and government. They also said that some of their virtual servers had been lost meaning it was harder to get everything back up and running. There is no confirmed evidence linking the attacks on ActiveCloud, ESTT and Beget. None of the companies have identified who is responsible.
Read more »
Reconnaissance
Cyber Attacks Drone Operations German Military Quantum Systems Reconnaissance

Cyberattack on Quantum Systems Disrupts German Military Drone Operations


German defence technology company Quantum Systems has confirmed that it was targeted in a cyberattack in late October.

The incident involved a compromised software update server used to distribute updates for the company's QBase ground-control and mission-planning software.

The company said it detected suspicious activity linked to an active cyberattack carried out by unidentified hostile actors. It responded by working with government authorities to contain the threat and ensure its unmanned systems could safely resume operations.

Quantum Systems manufactures reconnaissance and interceptor drones, along with software used to control and manage their missions. Its drone systems are deployed by the German military and are also used in support of Ukraine.

Malicious software update compromises drone systems

According to reports by German newspaper Der Spiegel and the Financial Times, attackers compromised a server responsible for distributing software updates for Quantum Systems' QBase platform.

The attackers placed a malicious update file on the compromised server, disguising it as a legitimate software update. Since QBase is used for ground control and mission planning, the incident raised concerns that malicious software could reach systems used by military drone operators.

Der Spiegel reported that the Vector reconnaissance drone, known as Falke in German military service, is among the systems whose missions are planned using QBase software.

The unauthorised update triggered alarms within Quantum Systems after it was distributed to customers. However, it remains unclear how many customers downloaded or installed the malicious file.

German military grounds drones as precaution

The cyberattack disrupted German military drone operations, prompting the armed forces to ground Quantum Systems' drones as a precautionary measure.

According to media reports, the decision also resulted in the company's drone systems being excluded from a recent military exercise.

Quantum Systems said it believes the company was targeted because of its support for Ukraine. The company has also highlighted the growing number of cyberattacks against European defence organisations.

German authorities investigate the incident

Germany's military counterintelligence service (MAD), domestic intelligence agency (BfV), and Federal Office for Information Security (BSI) are involved in the investigation.

Quantum Systems said it is cooperating with government authorities to investigate the incident and address the security concerns. However, the company has not publicly identified the attackers or provided details about their methods and objectives.

In July, Australian drone manufacturer CubePilot also experienced a DNS hijacking attack that caused operational disruption.

Read more »
Vulnerabilities and Exploits
Cryptojacking N-able N-Central Zero-Day RMM Security Vulnerabilities and Exploits

Hackers Exploit New N-able N-central Zero-Day Hours After PoC Release

 

Hackers began exploiting a new zero-day vulnerability in N-able N-central within hours of a proof-of-concept exploit becoming public. The flaw, called 4EverAble2Shell, can let unauthenticated attackers execute code with root privileges on vulnerable N-central servers, including systems running the latest available patches. 

The vulnerability was published on GitHub by security researcher Sean Bales, two days after N-able released fixes for several other flaws he had disclosed. 4EverAble2Shell chains an exploit for a recent Apache Axis vulnerability, CVE-2026-90436, with an unspecified flaw affecting N-central deployments that have the Legacy API enabled. The Apache Axis issue has a CVSS score of 9.8, reflecting its critical severity. 

Modus operandi 

The attack chain first exploits the Apache Axis bug to achieve remote code execution. It then attempts to elevate its privileges to root and run a shell script. Researchers said the chain works against N-central servers updated to 2026.4 HF2, build 2026.4.1.26, which had already received fixes for earlier Able2Shell zero-days. This means applying the latest hotfix alone does not fully eliminate the risk. 

N-able responded by restricting several N-central features and integrations, including the Legacy API and Intune integration. The company said it had identified additional indicators of compromise and was working with affected customers to assess and mitigate potential risks. On November 12, Bales also published proof-of-concept code for Agent2Shell, a set of roughly a dozen zero-day flaws that could allow attackers to execute commands on managed Windows agents with System privileges. 

Threat intelligence firm Previdian reported that attackers began using the 4EverAble2Shell proof of concept within hours of publication. WatchTowr also observed probes targeting N-central systems with the Legacy API enabled. Lupovis and Huntback found evidence of successful compromises about five hours after the exploit was released, with attackers deploying an XMRig cryptocurrency miner and using systemd or cron for persistence. 

The attackers named each miner after the victim’s IP address. Lupovis said the attacker’s wallet showed 21 rigs connected to compromised N-central servers in the United States, South Africa, Canada, the United Kingdom, Germany, France, and Sweden. The researchers said their decoy systems did not execute the exploit, confirming that the listed systems were real victims. 

Huntback found that 19 victims had already applied N-able’s latest patches. The firm warned that the miner may be the only observed payload, but the privilege escalation gives attackers root access to a server that manages customer endpoints. Security teams should therefore treat any successful exploitation as a full compromise rather than a minor cleanup task. 

Organisations using N-central should immediately disable the Legacy API where possible, apply vendor guidance, review logs for exploitation indicators, and rotate credentials connected to affected systems. They should also inspect AWS, Azure, and other connected environments for suspicious access, because root-level compromise of an RMM server can expose downstream customer networks.
Read more »
Vulnerabilities and Exploits
AI Anthropic CVE PostgreSQL SQL Vulnerabilities and Exploits

PostgreSQL’s Largest Ever Security Release Patches 52 Flaws, Including a 22-Year-Old Bug Any Logged-In User Could Weaponize

 


The PostgreSQL Global Development Group shipped security updates on November 12 for all five supported major versions, issuing fixes for 52 vulnerabilities at once: the largest security release the project has published. Thirty-two of the 52 flaws carry a CVSS 3.1 score of 8.8, with no user interaction required, full confidentiality and availability impact, and network reachability through a low-privilege login. The fixed releases are 18.7, 17.12, 16.16, 15.20, and 14.25.

At the center of the batch is CVE-2026-6460, a type confusion flaw in how PostgreSQL handles composite types — data structures built from named fields. When a field's type is changed after values of the original type are already stored, PostgreSQL's binary representation keeps those old bytes intact while the catalog metadata shifts around them. The server then reads a stale value through the new type's output function. That mismatch is enough for a database user who can create objects to run arbitrary code as the OS account running PostgreSQL, no superuser status, no extensions, no file access.

The trigger takes exactly four SQL statements. A user creates a composite type, prepares a query using it, alters the attribute to a different type, then executes the prepared query. The backend selects the wrong output handler, dereferences a null pointer, and crashes. That crash is the entry point.

Security researcher Mehmet Ince found the flaw and published a writeup alongside a demonstration on PostgreSQL 18.6. He traces the root cause to a commit made May 5, 2004, the one that added ALTER TABLE ... ALTER COLUMN ... TYPE. That logic never accounted for prepared statements holding values built against the old type. The code sat there for 22 years. His exploit chain defeats ASLR through a related confusion involving PostgreSQL's unnest() function, then calls system() through a forged object whose methods table points at the system call. He stopped short of publishing that final step. He found 21 variants of the problem in total, and six of the 52 CVEs in this release trace to his work. The release credits 18 researchers for CVE-2026-6460 alone, including PostgreSQL core developers Heikki Linnakangas and Andres Freund, along with the OpenAI Security Research Team and the Anthropic OSS program.

Before going public, Ince spent August coordinating with every major managed provider. He shared working proofs of concept with AWS covering both Aurora and RDS, Microsoft for Azure Database for PostgreSQL, Google for AlloyDB, Supabase, Databricks, and Ubicloud. Google AlloyDB escalated the report to its highest internal priority. Databricks validated the exploits the same day they arrived. Several vendors deployed their own mitigations before the upstream release shipped. Their current patch status is not public, so administrators on managed services should verify the minor version their provider is running.

The release also contains a flaw that skips authentication entirely. CVE-2026-116322, rated 5.3, lets any client restart a PostgreSQL 18 server without logging in. It involves a cancel request and a spinlock held during the authentication timeout window. Two further vulnerabilities sit in the client tools: a crafted archive fed to pg_restore can execute code as whoever invoked it, and a compromised source server can inject commands through the restore script inside pg_dump's tar output to any psql client connecting to it.

The November release permanently closes the PostgreSQL 14 branch. Version 14.25 is its last update. Administrators still on that version are running unsupported software from today. PostgreSQL 15 reaches the same status in November 2027.

Upgrading involves more than swapping binaries. The fix for CVE-2026-6460 changes the server's internal ABI for C-language extensions, which must be rebuilt against the patched version. Extensions compiled for the new release will not load on an unpatched server, so the upgrade and the rebuild must happen together. A new server setting, composite_type_mismatch, enables the type-version checks behind the fix; the project says disabling it carries security risk. Client tools must be updated on every machine running them, not just servers. Clusters managed by Patroni or any custom service unit need a manual restart. Users of incremental backups should take a new full backup before anchoring further incrementals. No workaround exists for the principal vulnerability on servers that cannot be patched, and PostgreSQL has reported no attacks in the wild.

The same acknowledgment list that names Ince, Linnakangas, and Freund also includes AI-assisted tooling. That dynamic cuts both ways. PostgreSQL 19, normally shipped in September or October, was pushed to November 19 partly because AI and LLM tools generated enough new reports to overwhelm the maintainers' review capacity before the feature freeze. Developer Robert Haas noted that LLM-drafted patches still need human review to meet project standards, and consultant Christophe Pettus pointed to the volume of low-quality machine-generated reports as a growing burden. The same tools that surfaced a 22-year-old bug made it harder to ship the next version.


Read more »
Subscribe to: Posts (Atom)

Featured