CySecurity News - Latest Information Security and Hacking Incidents

API CAPTCHA CVE Drupal Vulnerability E Commerce fraudulent activities orders sql injection Vulnerabilities and Exploits

Drupal Commerce Flaw Exposes Online Stores to Fraudulent Order Manipulation

Drupal has confirmed active exploitation of a highly critical access bypass vulnerability in its Commerce Core module, warning online retailers that attackers could manipulate orders and circumvent payment processes. The company has urged administrators to install the latest security updates and investigate existing transactions for unauthorized modifications.

Tracked as CVE-2026-118539, the vulnerability affects Drupal Commerce Core, a contributed module that enables websites to sell products and services through shopping carts, checkout systems and payment integrations. It also supports headless commerce architectures, where external applications interact with Drupal through APIs.

According to the original security advisory, certain application routes and entity fields do not have sufficient access restrictions, allowing unauthorized users to bypass established permission checks. This could enable attackers to manipulate commerce-related information, potentially causing direct financial losses for merchants.

Published on October 28 under advisory SA-CONTRIB-2026-254, the vulnerability received a Drupal security risk score of 21 out of 25, placing it in the highly critical category. Its assessment identifies the flaw as exploitable without authentication or special access requirements, regardless of the module's configuration.

Drupal has confirmed that the vulnerability is being actively exploited in the wild. However, its initial advisory did not disclose the attack methodology, affected organizations or the number of compromised websites.

Fraudulent Order Attempts Reported on Live Websites

Additional information published on October 29 by Centarro, the maintainer of Drupal Commerce, provides further insight into the exploitation activity.

According to Centarro, it received two reports from merchants who observed suspicious attempts to place fraudulent orders on their live websites. Following an investigation conducted alongside the Drupal Security Team, the maintainers stated that they had not found evidence of scripted or widespread exploitation beyond the initially reported sites.

The vulnerability affects both traditional, full-stack Drupal Commerce installations and headless deployments, although the potential attack paths differ depending on the website's architecture.

Centarro identified several suspicious transaction patterns that administrators should investigate. These include orders placed without corresponding payments, transactions marked as paid despite having no associated payment records, product prices modified without legitimate promotions, and unauthorized discounts, fees or other adjustments applied to orders.

Some reported attempts involved products listed at unusually low prices, including $0.01, while others used apparently normal prices to make fraudulent transactions less conspicuous.

The maintainers also warned that the vulnerability may have existed in earlier Commerce Core releases for several years. Exploitation was theoretically possible from version 8.x-2.18, released in May 2020, on installations using Drupal's JSON:API module. Other configurations became potentially vulnerable from version 8.x-2.25, released in June 2021.

Consequently, organizations should not restrict their investigation to transactions created shortly before the October security disclosure.

Security Updates and Additional Commerce Vulnerabilities

Drupal has released Commerce Core 3.3.13 and 8.x-2.41 to address CVE-2026-118539. Administrators running the 3.x branch should upgrade to version 3.3.13, while installations using the earlier 8.x-2.x branch should move to 8.x-2.41.

Centarro has also recommended updating the associated Commerce API, Commerce License, Commerce Shipping and Commerce Stripe modules, which received separate security releases. Websites that do not require write operations through JSON:API should consider restricting the interface to read-only access.

The October 28 security releases addressed several additional vulnerabilities across Drupal's contributed projects.

Among them, CVE-2026-118558 affects Commerce Stripe through a cross-site request forgery (CSRF) vulnerability. The module does not include a CSRF token in the return URI used during Stripe Connect authorization. An attacker could exploit this weakness by tricking an administrator into following a malicious link, potentially causing an order to be marked as paid without an actual payment.

Another issue, CVE-2026-118582, affects the CAPTCHA module. The vulnerability results from inadequate invalidation of previously solved CAPTCHA sessions, allowing an already-submitted protected form to be submitted again without completing another challenge. This could weaken protections against automated registrations, comment spam and login brute-force attempts. Drupal's advisory indicates that exploit code exists, although it does not confirm active exploitation.

Drupal also disclosed information disclosure vulnerabilities in Commerce Core and Media Alias Display. The former can expose information about unpublished product variations under certain JSON:API configurations, while the latter involves improperly configured caching that could expose files containing information intended to remain inaccessible.

Earlier Critical Drupal Vulnerabilities

The October disclosures follow another security release on October 14, when Drupal addressed two critical remote code execution vulnerabilities.

CVE-2026-108097 affects the Field UI module in Drupal Core, while CVE-2026-108099 impacts the contributed Entity List module. Although neither component independently exposes the vulnerabilities through its default functionality, certain contributed modules and custom implementations can introduce exploitable pathways. Drupal identified at least one potential attack path that does not require authentication.

Another vulnerability, CVE-2026-9082, involved SQL injection in Drupal Core's database abstraction API, affecting websites using PostgreSQL databases. The flaw could allow unauthenticated attackers to execute specially crafted database queries, potentially resulting in information disclosure, privilege escalation or remote code execution. The vulnerability was added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog in May 2026 following confirmed exploitation.

With CVE-2026-118539 now confirmed under active exploitation, administrators should prioritize security updates, examine historical order records and verify that payment confirmations correspond to actual transactions before fulfilling orders. Centarro has also recommended comparing suspicious transactions against website access logs to establish whether they originated through legitimate checkout processes.

Cyber-Attacks Target Ukraine and Russia Emergency Alert Apps



 

Ukraine

Cyber Attacks Emergency alerts Russia Ukraine

Cyber-Attacks Target Ukraine and Russia Emergency Alert Apps

Ukraine and Russia have both reported cyber-attacks on their emergency warning applications, sending false alerts that briefly raised fears of nuclear, chemical, and street-fighting threats. In Ukraine, residents began receiving fake red-level air-raid notifications at around 22:47 local time on Sunday, followed by warnings of radiation, a chemical attack, and fighting in Kyiv. The alerts were cancelled within an hour, and Ukraine’s air force said there was no radiation threat, blaming Russian interference. Hours later, Russia said its own emergency ministry app had also been hit by a “massive cyber-attack,” although it insisted the country’s wider public alert system remained operational.

The false messages caused understandable alarm, particularly in Kyiv, where residents are already accustomed to repeated warnings of drone and missile attacks. One resident, Olena, told the BBC that her first reaction was fear because she had prepared for blackouts and disruptions to heating and water, but not for a nuclear attack. She said later alerts written in Russian made her realise the application had been compromised, since official notifications normally arrive in Ukrainian. Ukraine’s emergency service urged citizens to rely on loudspeaker announcements and avoid clicking links from unknown sources.

A possible tit-for-tat attack

The nature of the messages has led cyber experts to suspect hacktivist involvement rather than a highly disciplined state operation. Some alerts were informal and provocative, while a newly created Telegram channel linked to one message quickly attracted more than 15,000 subscribers and spread anti-Ukrainian propaganda. The BBC’s cyber correspondent reported that dozens of hacktivist groups have emerged on both sides since Russia’s full-scale invasion, often using attention-grabbing hacks for political messaging. However, no group has officially claimed responsibility, and it remains unclear whether the two incidents were directly connected.

The near-simultaneous attacks have also raised questions about retaliation. Reports suggest Ukraine’s Trivoha app was compromised first, followed shortly by Russia’s emergency app, prompting speculation of a tit-for-tat cyber exchange. A Ukrainian parliamentarian said he could neither confirm nor deny Ukrainian involvement in the attack on Russia, while arguing that Russia was likely behind the intrusion into Ukraine’s system. Russian officials, including President Vladimir Putin’s press secretary Dmitry Peskov, said government digital resources face constant cyber-threats, though they did not directly attribute the emergency app incident.

The episode highlights how digital infrastructure has become a central battlefield in the Russia-Ukraine war. Beyond physical strikes, attacks on communications and warning systems can undermine public trust, create confusion during emergencies, and weaken civilians’ sense of security. UK Defence Secretary Wes Streeting said the identity of the attacker was not yet known but that Britain was monitoring the situation closely, while EU foreign policy chief Kaja Kallas described cyber-attacks as part of Russia’s broader warfare against Ukraine. As both countries continue exchanging strikes on energy and military targets, the hacking of emergency alert apps shows that the conflict is increasingly fought through screens as well as on the ground.

Cloudflare Report Highlights Changing DDoS Attack Trends in Q3 2026



 

Network Security

Botnet Attacks Cloudflare Threat Report Cyber Attacks Cybersecurity Threats DDOS Attacks DDoS Protection Distributed Denial Of Service DNS Amplification Mirai Botnet Network Security

Cloudflare Report Highlights Changing DDoS Attack Trends in Q3 2026

DDoS attack patterns have undergone a significant shift as a result of the latest Cloudflare DDoS threat report, with cybercriminals increasingly focusing on frequent, short-duration attacks in place of concentrated traffic floods. According to the company, 18.2 million network-layer DDoS attacks were mitigated during the third quarter of 2026, an increase of 208% from the previous period.

It was published on October 29, analyzing attack activity between July and September. Cloudflare's threat intelligence team, Cloudforce One, also reported mitigating 14.4 trillion HTTP DDoS requests during the quarter. There were approximately 8,226 network-layer attacks per hour, which equates to one attack every 0.44 seconds. These findings provide an indication that attackers are altering their operational approaches.

In Q3, Cloudflare recorded 251 attacks exceeding 1 terabit per second (Tbps), compared with 805 in Q3. This represents approximately a 69% decrease in attacks exceeding 1 Tbps. There was a significant increase in smaller, short-lived attacks as one of the most notable findings. According to Cloudflare, 96% of network-layer DDoS incidents lasted less than 10 minutes, while 98% generated traffic below one gigabyte per second.

Even though these attacks have relatively low bandwidth, they can cause disruptions to websites, servers, and online services, particularly when infrastructures lack network capacity or are inadequately protected. Security teams that rely on manual investigation and response may have difficulty identifying and resolving these attacks due to their short duration, since attacks may end before analysts can identify and address Cloudflare's incident associated with DDoS-for-hire, commonly referred to as booters or stressers.

The use of such services allows attackers to flood targeted websites without requiring sophisticated attack infrastructure. These campaigns targeted software development, gambling and gaming businesses, as well as information technology companies. As a consequence of law enforcement operations in 2026 that disrupted four major Internet of Things botnets: Aisuru, KimWolf, JackSkid, and Mossad, hyper-volumetric attacks decreased earlier in 2026.

The reduction in compromised connected device threats has not been eliminated, however. Cloudflare has continued to observe emerging IoT botnet variants, including Dysphoria and Evooo1Bot, which indicates the ecosystem continues to operate despite disruption efforts. Additionally, Mirai-classified traffic remained substantial in August, reaching 57.23 petabytes in mitigation.

Organizations should also monitor exposed network services as attack methods change. DNS resolvers and directory services accessible from the public internet can be abused to perform reflection and amplifier attacks. To prevent attackers from exploiting these systems to generate malicious traffic, security teams must ensure that these systems are properly configured and restricted. It is also evident that Cloudflare's findings point to a broader distribution of DDoS targets.

Although Media, Production & Publishing was the most attacked industry in Q3, the share dropped by approximately a quarter compared to its previous quarter. There was substantial activity in information technology, computer software, telecommunications, as well as internet infrastructure in Q3. The top ten also included Consumer Services and Adult Entertainment, ranking eighth and ninth respectively. Geographic targeting indicated similar changes.

The United States regained its position as the most attacked country, followed by China, while Indonesia became third with 2.93% of recorded attacks. Among the sharpest increases occurred in Canada, which moved from 16th to sixth place after attacks targeted retailers, telecommunications companies, service providers, and marketing firms. Furthermore, Israel jumped seven places to reach tenth place after sustained DDoS activity occurred during September.

Cloudflare attributed the increase to heightened tensions in the region and domestic political developments in September. With the increasing frequency of short-duration attacks, organizations relying on manual incident response face a particular challenge. In the event of a network-layer attack ending within ten minutes, security teams may not have time to investigate alerts and implement countermeasures before the attack ends.

The repeated disruption of online transactions, customer-facing platforms and other internet-based services, regardless of whether or not they cause prolonged outages, can also adversely affect them. A significant component of modern DDoS protection is automated detection and mitigation, according to Cloudflare. With a global network of more than 330 cities and a reported capacity of 500 Tbps, Cloudflare provides protection across more than 330 cities.

The company provides a free DDoS Botnet Threat Feed that assists hosting providers, cloud platforms and internet service providers in detecting malicious IP addresses and accounts related to botnet activity. Over 800 networks worldwide have enrolled in this service. DDoS protection must be capable of addressing both high volumes of attacks as well as repeated smaller disruptions, according to Q3 findings.

The presence of new variants and changing traffic techniques continues to pose risks to internet-facing infrastructure, even as law enforcement operations reduce the frequency of some large-scale botnet attacks.

Northflank Breach Exposes Customer Secrets, Leading to Unauthorized AI API Key Usage



 

Northflank

AI API Data Breach data security Northflank

Northflank Breach Exposes Customer Secrets, Leading to Unauthorized AI API Key Usage

Cloud application hosting platform Northflank has warned customers to rotate their stored credentials and API keys following a security breach that resulted in unauthorized use of customers' artificial intelligence (AI) API keys.

Northflank provides a cloud-based platform that allows developers to deploy and manage applications, containers, databases and AI applications without having to manage the underlying infrastructure.

About the incident

After the warning, Northflank advised customers to immediately change their environment variables and API keys stored on the platform. The company later issued a stronger warning, asking users to assume that all environment variables had been decrypted and that the sensitive information stored inside them had been stolen.

Environment variables are commonly used by applications to store sensitive information, including database passwords, cloud service credentials, authentication tokens and API keys. If attackers gain access to these details, they can use them to compromise other services, steal data or misuse accounts to generate unauthorized charges.

Northflank later confirmed that several customers had reported unauthorized use of AI API keys stored on its platform.

"Users have reported unauthorised use of AI API keys supplied to the Northflank platform," the company said in an update. It urged customers who had not yet changed their stored secrets to do so immediately.

The company also advised users to examine their AI service providers' usage and billing records for unusual activity. Any suspicious usage should be reported to Northflank and the relevant AI service provider.

According to the company's incident timeline, Wiz notified Northflank about the security breach at 11:43 UTC on October 30. Its engineering team began investigating the alert one minute later. Northflank initially introduced a network policy patch and deployed additional security updates at 12:50 UTC and 13:05 UTC. The company also requested assistance from Wiz's incident response team.

As part of its response, Northflank enabled credential rotation for PostgreSQL, MongoDB, MySQL and Redis databases. It also introduced audit logs for all customers, including users on free accounts, to help them identify suspicious activities.

According to Wiz, attackers are increasingly targeting environment variables that contain AI service credentials. Stolen API keys can be used in a practice known as LLMJacking, in which attackers exploit another organization's AI accounts to access expensive AI models without permission. They may also resell access to these services to other users.

In two cases investigated by Wiz, attackers used compromised enterprise credentials to make approximately 2.5 million requests to Amazon Bedrock, resulting in nearly $100,000 in AI usage charges.

AI Scams: How Criminals Use Deepfakes, Fake Websites and Voice Cloning to Target Consumers



 

fake websites

AI Risks AI Scams AI Voice Scam Consumer Protection Cyber Security cybercriminals deepfake scams Digital Security fake websites

AI Scams: How Criminals Use Deepfakes, Fake Websites and Voice Cloning to Target Consumers

As criminals use Artificial Intelligence (AI) to help produce realistic scams such as fake online shopping sites, cloned voices and realistic fake videos, consumer protection authorities in the UK are urging shoppers to take extra care.

National Trading Standards has published its first list of AI scams to help raise awareness of new methods being used by criminals. Fake online retailers are becoming an increasing problem. These look genuine by appearing to be family run and local in the UK. They may even appear professional with their website design and pictures of UK high streets and union jacks.

However, when ordering from these businesses you could end up with cheap, mass produced items from countries like China. There are many other ways criminals are targeting consumers. It is easy to create a professional looking website with criminals using AI to clone real businesses. Romance scams are also a common method criminals are using. This allows them to keep track of personal details and have realistic conversations with victims for long periods of time.

Criminals are using voice cloning and deepfake videos to pose as family members or close friends. They may pose as someone you know and ask for immediate financial help. AI can also be used to create highly personalised phishing emails, texts and social media posts, making it hard to tell if they are a scam. Classic signs of scams may no longer be reliable.

As AI creates highly professional and realistic content, mistakes with spelling and grammar which used to be common in messages from scammers are no longer useful (Which?). National Trading Standards advises not to send money, gift cards or personal/financial details to people you haven’t met in person.

Always confirm businesses are genuine before purchasing. This can include checking the address of a retailer is genuine. You can check if a company is authorised to give you financial advice using the Financial Conduct Authority’s Firm Checker. You can also contact employers directly.

Do not assume people are genuine just because you recognise their voice. AI can create realistic audio and video. The main piece of advice is to stop and think before sending any money, giving out any information or rushing to help with an urgent request. Criminals often try to put pressure on you to get you to act quickly.

The Robot Vacuum in Your Living Room May Know More About You Than You Think



 

wifi network

2FA AI Cloud Security Data Theft firmware Privacy Robots Technology vacuums wifi network

The Robot Vacuum in Your Living Room May Know More About You Than You Think

The device quietly navigating your living room floor might be doing more than picking up crumbs. Robot vacuums, now a fixture in millions of homes, collect data that goes far beyond what most buyers realize when they pull one off the shelf. Depending on the model, a connected vacuum can generate detailed floor maps, record cleaning histories, capture ambient audio through built-in microphones, and stream live video to an app on your phone. Some models let you monitor progress remotely, routing that footage and data through the manufacturer's servers. And while the machine charts a path between your couch and your coffee table, it may be quietly building a picture of how you live.

iRobot, maker of the popular Roomba line, spells out its data practices in its privacy policy. Connected models can send room names, floor types, detected objects, robot movements, and Wi-Fi network details back to the company. That is not a hidden clause buried in fine print, but it is something most consumers never read before buying. For businesses, this kind of information carries real commercial value: consumer behavior data, household layouts, and everyday habits are precisely the intelligence that advertisers and smart home companies have long sought.

The Flaw That Opened 7,000 Homes

In February 2026, a software engineer named Sammy Azdoufal set out to do something benign: control his DJI Romo vacuum with a PlayStation 5 controller. What he found was a flaw that handed him access to roughly 7,000 other people's vacuums across more than 20 countries.

Azdoufal, an AI strategy specialist, reverse-engineered how the Romo communicated with DJI's servers. The backend authentication system accepted his device token as valid for thousands of other users' devices. From that position, he could view live camera feeds, hear microphone audio, see floor plans and room layouts, and check battery levels and cleaning status. He reportedly watched a journalist's vacuum operating in that person's living room in real time.

"Devices promising convenience can invite unseen observers into private spaces." [Dallas Express, February 2026]

Azdoufal notified DJI immediately. The company closed the vulnerability by late February and attributed the problem to a permission issue in its MQTT communication system, deploying automatic updates that required no action from users. The Romo model was removed from DJI's online store two days later. DJI said no widespread misuse had been detected. Critically, Azdoufal did not bypass encryption or use any sophisticated hacking technique. The problem sat on DJI's server, where device data was stored in plain text and access controls were loose enough that a legitimate customer's token opened thousands of doors.

This was not an isolated episode. In 2024, hackers took over Ecovacs Deebot X2 robot vacuums in several American cities, steering the machines remotely and playing racial slurs through their speakers. Minnesota lawyer Daniel Swenson, one of the affected users, described the intruder: "I got the impression it was a kid, maybe a teenager."

What the Vacuum Actually Knows About You

The data a robot vacuum collects is more revealing than it first appears. Floor maps trace the layout of your home, including where you sleep, where you store valuables, and the shape of your living spaces. Object detection features identify furniture, shoes, and personal items. Layer microphone access on top of that and the device starts resembling something other than a cleaning appliance. A privacy policy describes what a company intends to do with your data. It does not guarantee the product is free of security vulnerabilities. An attacker who reaches a manufacturer's servers could access whatever has already been collected, regardless of what any policy says.

Buying a Vacuum That Collects Less

Not every connected vacuum poses the same degree of risk. Buyers wanting to limit their exposure should look for models that process navigation data locally rather than routing it through manufacturer servers. Matic, a smaller company, builds its vacuum around that principle: maps stay on the home Wi-Fi network and all processing happens on the robot itself. Remote app access is available, but only through encrypted cloud infrastructure with explicit user consent.

One distinction worth keeping straight: a camera-free model still generates maps and sends account data to the manufacturer. "No camera" and "no data collection" are not the same thing. Mandatory cloud features, with no option to use the device offline, are a signal worth weighing as a dealbreaker before purchase.

Steps for People Who Already Own One

For the millions of households already running a connected vacuum, a few changes lower the risk without requiring a new purchase. Set a strong, unique password and enable two-factor authentication on any linked account. Keep the vacuum's firmware updated. Disable remote viewing and other cloud-connected features unless you actually use them. The fewer connections left open, the smaller the surface available to anyone looking for a way in.

ChatGPT Share-Link Flaw Could Expose Private Chats and Hijack Sessions



 

Vulnerabilities and Exploits

ChatGPT OpenAI Share-Link Flaw User Security Vulnerabilities and Exploits

ChatGPT Share-Link Flaw Could Expose Private Chats and Hijack Sessions

A recently disclosed vulnerability in ChatGPT demonstrated how a maliciously crafted shared conversation link could execute attacker-controlled code within a victim’s logged-in session. The issue was identified by security researchers at Parameter, who demonstrated that the flaw could expose private conversations and allow actions to be performed using the victim’s authenticated account. The vulnerability was reported to OpenAI through its bug bounty program on October 18 and was remediated eight days later. OpenAI classified the issue as P1, its highest severity rating.

The attack required no software installation, workspace membership, or separate login through the attacker. A victim could receive the malicious ChatGPT share link through email, a messaging platform, a support ticket, or social media. In the most reliable version of the attack, the victim opened the link and clicked the Preview button once. In a later variant, Preview opened automatically, meaning that merely opening the link was sufficient to trigger the attack.

Once triggered, the malicious code executed within the victim’s ChatGPT session and could interact with ChatGPT’s signed-in APIs. The researchers showed that it could list recent conversations, access a private chat that had never been shared, and transmit part of its contents to an external server under their control. Because the code operated within an authenticated session, it had the potential to perform actions on behalf of the affected user.

The vulnerability resulted from a combination of weaknesses in ChatGPT’s web architecture. ChatGPT’s Preview feature renders shared HTML in a sandboxed frame on a separate domain, intended to isolate it from the main ChatGPT application. However, an interactive graph in the shared conversation loaded the MathLive mathematics library into the main ChatGPT page. This library retained a message listener that accepted keyboard-related messages from any sender without verifying their origin. The researchers exploited this behavior to send raw HTML from the isolated Preview frame into the trusted main ChatGPT page.

OpenAI reproduced both the code-execution and private-chat proof-of-concept demonstrations and implemented fixes across two versions of its web frontend. By October 26, both versions rejected the messages on which the attack depended. Parameter published its technical analysis on October 28 after the remediation, and OpenAI awarded a total of $5,000 through its bug bounty program. The researchers also noted that the issue reflected broader weaknesses in message-origin validation, HTML handling, and sandboxing, rather than a problem that could be resolved simply by blocking third-party scripts such as YouTube.

Critical Linux Kernel Vulnerability Could Allow Hackers to Gain Remote Root Access



 

Remote Access

Critical Vulnerability Cyber Security Kernel Linux Remote Access

Critical Linux Kernel Vulnerability Could Allow Hackers to Gain Remote Root Access

A critical security vulnerability in the Linux kernel could allow attackers to remotely take control of vulnerable servers and execute commands with root privileges. Security researchers at Anthropic have developed an exploit demonstrating how the flaw can be used to compromise Linux systems running Multipath TCP (MPTCP) listeners.

The vulnerability, tracked as CVE-2026-98432, has received a critical severity rating of 9.8 out of 10 from the Linux kernel CVE team. It affects Linux kernel versions dating back to 4.4 and could put several widely used Linux distributions at risk.

About the problem

The security issue is caused by a use-after-free vulnerability in the Linux kernel’s IPv4 TCP networking code. It occurs because of a race condition during the handling of TCP connection requests.

The vulnerability affects both regular TCP connections and Multipath TCP (MPTCP). MPTCP allows a single network connection to use multiple network paths simultaneously, improving connection reliability and performance.

Researchers at Anthropic demonstrated that the flaw could be exploited remotely without authentication on servers running MPTCP listeners. Their exploit was developed using an unreleased Claude AI model and reportedly took around 53 minutes to achieve remote code execution with root privileges.

The exploit also managed to bypass Kernel Address Space Layout Randomization (KASLR), a security mechanism designed to make memory-based attacks more difficult.

Another concern involves Go 1.24, which enables MPTCP by default for TCP listeners on Linux when the underlying kernel supports the feature. This means some Go-based applications could expose vulnerable services without administrators being aware of it.

Who is impacted?

The vulnerability affects multiple Linux distributions, including Ubuntu, Red Hat Enterprise Linux (RHEL) and Rocky Linux. While the Linux kernel issue can also be triggered through ordinary TCP connections, publicly demonstrated remote root exploitation has so far focused on systems running MPTCP listeners.

Red Hat has assessed the vulnerability as a complex exploitation risk that could result in a denial-of-service condition, assigning it a lower severity score of 5.9.

How to address

The vulnerability has been fixed in the upstream Linux kernel, with patches also backported to maintained kernel branches. However, security updates were still pending for several distributions as of October 30, 2026.

Rocky Linux support provider CIQ has also recommended temporary firewall protections using nftables to block IPv4 TCP packets containing IP options. But simply disabling MPTCP is not sufficient because the underlying vulnerability can also be triggered through ordinary TCP traffic.

There are currently no confirmed reports of CVE-2026-98432 being exploited in real-world attacks.

Polymarket Traders Lose More Than $2 Million in Supply Chain Attack Involving DebugBear



 

Malicious Code

blocking unauthorized access Cyber Attacks Cybersecurity Threats Global Supply Chain Security Global Trade Hackers Steal Money Illegal Funds Malicious Code

Polymarket Traders Lose More Than $2 Million in Supply Chain Attack Involving DebugBear

Polymarket has halted trading on its global marketplace on October 29 after users reported over $2 million being withdrawn without authorisation. The issue was caused when a third party provider was compromised and malicious code was injected which exploited authorised user sessions to withdraw funds.

The prediction market first put their global marketplace into cancel only mode. However trading resumed around an hour later after they said they had “identified and resolved the issue.” Polymarket confirmed that they had reported the incident to law enforcement and would compensate those affected.

They have not yet identified the third party provider or confirmed how much was lost. The attack was attributed to malicious JavaScript from DebugBear, a UK based website performance monitoring company. Polymarket’s US marketplace was not impacted. DebugBear admitted they were currently responding to a security incident and requested that customers using their real user monitoring (RUM) product remove their script from their website. They also said specialised incident response teams had been deployed.

A copy of the malicious JavaScript was obtained by cybersecurity firm Hudson Rock. They identified that the script was searching for trading tools and portfolio data. Depending on the account type, the script would attempt to sell positions and move the funds or move the position tokens directly to the attacker controlled address. Although the code was looking for credential related data, Hudson Rock noted that there was no routine to pass on passwords, seed phrases, private keys or credential maps to their reporting endpoint.

This attack was exploiting existing permissions. The researchers identified a production build of the Polymarket platform with a timestamp of 17:59 UTC. This included a note that the DebugBear script had been removed. It is unclear how much was stolen. Hudson Rock analysed a screenshot that showed around $2.19 million at an address hard-coded into the malicious script as a fallback destination, but cautioned that the figure was not a verified loss total.

Blockchain security firm GoPlus estimated the losses at roughly $2.71 million had been stolen. They identified there were 710 deposit wallets and 731 addresses within the main attack path. This does not indicate how many individuals were affected. Arkham data shows there was a suspected attackers wallet with around $2.65 million. Hudson Rock have not identified how the malicious code was added or how many users were affected.

Their investigation has also not found any evidence that other DebugBear customers were targeted. This incident happened on the same day that Binance suffered a hack of around $6 billion, which blockchain intelligence firms attributed to North Korea. Polymarket had also disclosed a third-party security breach in June, when a malicious script was injected into its frontend and reportedly resulted in losses of around $3 million.

Florida Reports Major Data Breach Affecting 4.9 Million Financial Aid Applicants



 

Social Security Number Exposure

Data Breach Education Cybersecurity Financial Aid Website Hack Florida Department Of Education Personal Information Leak Social Security Number Exposure

Florida Reports Major Data Breach Affecting 4.9 Million Financial Aid Applicants

The Florida Department of Education (FLDOE) has disclosed a data breach involving its student financial aid website that may have exposed the sensitive personal information of approximately 4.9 million individuals. The compromised information reportedly includes Social Security numbers, names, residential addresses, phone numbers, email addresses, genders and dates of birth. According to the department, unauthorized criminal access to the Florida Student Financial Aid website was discovered on October 19, 2026.

The agency publicly disclosed the incident on October 29, describing it as a security breach involving unauthorized access to a system containing personal information. The exact method used to gain access and the identity of those responsible have not been disclosed. In a statement issued by the Florida Department of Education, it was noted that individuals who had used the state's financial aid portal may have been affected by the incident.

The website facilitates the application process for scholarship, grant, and other financial assistance programs, including the lottery-funded Bright Futures scholarship program. After identifying the intrusion, the department activated its cybersecurity response procedures. It has been determined that the unauthorized activity was stopped, contained, and the affected systems were secured.

As part of the response, the Florida Digital Service and the Florida Department of Law Enforcement are also involved, and the issue has been reported to the Attorney General's Office. According to information reported by The Record, the information exposed may pertain to nearly five million Florida students who applied for financial aid.

This incident is particularly concerning as Social Security numbers and dates of birth are included, as such information can be exploited for identity theft, fraudulent account creation, and other financial crimes. Rather than affecting the entire Florida Student Financial Aid network, the department believes that the breach was limited to the website. Despite this, the investigation is still ongoing, and officials have not confirmed a breakdown of the affected records or explained how the unauthorized party entered the system.

The FLDOE has taken the financial aid website offline as part of the response. During the recovery process and security measures, other departmental websites and online services may experience temporary disruptions. Although sensitive personal information was exposed in the incident, the department clarified that it did not affect the administration of financial aid.

Scholarship and grant eligibility, as well as student loan services administered by the department, are expected to continue without delay in spite of the exposure of sensitive personal information. A warning has been issued to potentially affected individuals to monitor their financial and online accounts for unusual activity and to regularly review their credit reports.

In addition, the department recommended that students consider placing an alert or placing a credit freeze with the major credit bureaus to prevent identity fraud. Currently, the investigation has not been able to determine who is responsible for the intrusion or how the financial aid website was accessed. No information has been provided by the Florida Department of Education as to whether the breach involved stolen credentials, exploited software vulnerabilities, or used another approach to attack.

Additionally, the authorities have not disclosed any further information concerning the nature of the intrusion, but stated that additional information will be provided once verified findings are available. The breach is not the only recent cyberattack involving government educational systems in the United States.

Separate data breaches were reported by the California Department of Education approximately one week earlier, which involved information associated with children who had been enrolled in public schools for the previous three years. Despite the lack of connection between these two incidents, the disclosures have raised concerns about the security of sensitive educational information. This year, Florida has also experienced several security breaches relating to government organizations.

During September, the Department of Motor Vehicles reported a breach involving a prominent hacking group. According to The Record, the hackers continued to advertise the stolen DMV information on cybercriminal forums throughout October.

In a separate incident, a central Florida county experienced significant internet service disruption following an alleged cyberattack. The increasing number of incidents involving public institutions emphasizes the risks associated with large amounts of personal information stored in government databases.

A majority of educational and administrative portals maintain records containing personal information, which may make unauthorized access particularly concerning when the information relates to millions of individuals. In accordance with Florida's law requiring notification of data breaches, Section 501.171 of the state statutes requires organizations covered by the law to implement reasonable measures to protect electronic personal information.

There is generally a 30 day notification period for a breach that affects 500 or more Florida residents in order for the Department of Legal Affairs to be notified of the breach. According to applicable legal exceptions, affected individuals must also be notified as soon as possible. The incident occurs in the context of a wider increase in reported data exposures.

At least 3,43 million people were affected by 5,429 breach notification filings in the first half of 2026, according to the Privacy Rights Clearinghouse, which covered 1,969 distinct incidents. As a result, 33.8% of the reported breach incidents were unable to be determined from public filings during this period, compared with 22.6% in 2022. There remains a priority for the Florida Department of Education in determining the extent of the exposure.

In the ongoing criminal investigation, the final number of affected individuals, the method of intrusion, and the identity of the unauthorized party are still unknown. Public-sector systems that store sensitive personal and financial information face increasing security risks as a result of this incident.

There will be a continuing need to determine how the attackers gained access to the system as well as ensuring affected individuals are given timely protection as the investigation proceeds.

North Korean Hackers Drain $6.3 Billion from Binance in Record-Breaking Crypto Theft



 

stablecoin

Binance Blockchain Crypto Theft cryptocurrency Data Breach North Korea stablecoin

North Korean Hackers Drain $6.3 Billion from Binance in Record-Breaking Crypto Theft

Hackers tied to North Korea stole roughly $6.36 billion from Binance on Wednesday, stripping the world's largest cryptocurrency exchange of funds across ten blockchains in a heist that blockchain intelligence firms are calling the largest crypto theft in history.

The attack, which began at 8:05 p.m. UTC on October 29, moved faster than most exchange security teams could respond. The bulk of the money was gone within 20 minutes.

Binance suspended deposits and withdrawals shortly after detecting the breach and said user funds would be covered in full. "Investigating a potential security issue," the exchange wrote in an early-evening post, adding that user assets were safe. By late that night, a coalition of blockchain infrastructure firms had frozen roughly $3 billion of the stolen assets, though more than $2.4 billion remained in the attacker's control as of press time.

How They Got In

Blockchain intelligence firm TRM Labs, which traced the attack in near real-time, said the intrusion bore the hallmarks of TraderTraitor, the North Korean state-sponsored hacking unit that the FBI also attributed to February's $1.5 billion Bybit breach.

The preparation started at least 36 hours before the theft. TRM Labs found that the attackers funded an operator wallet with small withdrawals from Tornado Cash, a crypto mixing service, then ran test transactions across wallets they controlled. In the day before the main theft, the attackers rehearsed the final version of their code on a third wallet before installing it on a live Binance hot wallet.

The technical method on Ethereum was particularly precise. The attackers used EIP-7702, an account delegation feature introduced in a recent Ethereum upgrade, to effectively convert a Binance hot wallet into a sweeper they controlled. A single transaction carried 50 pre-signed authorizations; one matched the wallet's transaction count exactly, granting the attackers the ability to sweep new incoming deposits for hours after the initial theft, all the way until 11:56 p.m. UTC.

On nine other blockchains, including Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, and several Ethereum layer-2 networks, wallets sent funds through standard signed transfers during the same window. TRM's analysis concluded the most likely explanation was that the attacker had somehow obtained the ability to instruct Binance's hot wallet signing infrastructure to authorize transactions of their choosing. Binance has not yet published a root cause analysis.

What Was Taken

The breakdown by chain is staggering. Ethereum accounts for the largest slice: about $3.79 billion, including 200,630 ETH and roughly 1.875 billion USDT. Bitcoin follows with 18,270 BTC worth approximately $1.47 billion. Tron contributed about $628 million, primarily USDT, and XRP Ledger added 233 million XRP worth around $296 million. The remaining losses were spread across Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon.

At those figures, the theft dwarfs every previous crypto hack on record by a considerable margin. The Bybit breach in February 2025, which itself broke every prior record, involved $1.5 billion. This attack is roughly four times larger.

The Freeze Race

Within hours of the theft, stablecoin issuers and blockchain governance bodies began freezing assets. Tether moved first, blacklisting 971 million USDT across wallets traced to the attacker at 9:01 p.m. UTC. Circle followed three minutes later with a freeze on $823 million in USDC, acting in coordination with law enforcement. Ripple froze 40.5 million RLUSD at 10:01 p.m. The Arbitrum Security Council executed forced transfers of 8,426 ETH and 74.6 million ARB tokens after midnight.

By 11:35 p.m. UTC, Binance said the verified total of frozen assets had reached $2.54 billion. TRM Labs placed the figure closer to $2.7 billion by 12:30 a.m. the following morning.

The attacker, however, moved quickly to convert portions of the stolen funds. Some USDT was swapped for ETH at a discount of more than 10%, and the attacker used Aave, a decentralized lending protocol, to borrow ETH against frozen stablecoin positions. As of the morning of October 30, the attacker still held more than 420,000 ETH and all 18,270 BTC, assets beyond the reach of any issuer's freeze function.

North Korea's Crypto Playbook

The FBI said it was aware of the incident and working with partners to assess the activity. The U.S. Secret Service had not responded to a request for comment at time of publication.

The timing fits a pattern that intelligence analysts have tracked closely. Chainalysis reported that North Korean operatives stole about $2 billion in cryptocurrency throughout 2025. TRM Labs found that two North Korea-linked groups accounted for three-quarters of all crypto hack losses in the first quarter of 2026 alone. The funds are widely believed to support Pyongyang's weapons programs, which have been cut off from conventional financial markets through international sanctions.

TRM Labs said it expects the attacker to route remaining funds through cross-chain bridges, swap services, and over-the-counter brokers in the coming weeks, and said it was monitoring those flows in real time.

Cyberattack Clouds Political Spending Transparency in America



 

FEC

America Midterms Campaign Finance Cyber Attacks Cyberattack election transparency FEC

Cyberattack Clouds Political Spending Transparency in America

A cyberattack targeting the United States Federal Election Commission disrupted access to campaign finance disclosures shortly before the November 3 midterm elections, prompting concerns about electoral transparency. The commission suspended its filing systems for approximately 41 hours after an unidentified malicious actor attempted to gain access. This interruption prevented campaigns and political organizations from submitting certain time-sensitive financial reports, temporarily limiting public oversight of election funding. The incident concerned financial disclosure infrastructure; the available information did not establish any interference with voting systems or election results.

The disruption affected disclosures ordinarily required within 24 or 48 hours, producing an information gap during a particularly consequential period of campaign activity. Millions of dollars in political financing may have remained outside immediate public scrutiny while the systems were unavailable. Nevertheless, delayed reporting does not demonstrate that contributions were permanently concealed or that donors deliberately exploited the interruption. Limited public information about the attacker, the techniques employed, and the underlying motive prevented definitive conclusions regarding the incident’s origins, scope, or broader political implications and consequences.

Transparency advocates emphasized that the timing substantially increased the significance of the outage. OpenSecrets executive director Hilary Braseth argued that delayed disclosure undermines meaningful public access to campaign finance information. Research director Brendan Glavin indicated that political spending before the interruption had reached approximately $50 million per day. At that scale, even a relatively brief suspension can impede efforts by journalists, researchers, and voters to identify financial interests behind election messaging. Information disclosed after voting may have less practical value for assessing candidates and their supporters.

The incident also renewed attention to SuperPACs and technology interests seeking to influence public policy through election spending. Political organizations supporting artificial intelligence development have invested substantial resources in promoting sympathetic candidates and challenging opponents. These activities coincide with disputes over data center construction, local infrastructure pressures, and potential regulatory restrictions. Electoral outcomes may therefore affect both technology policy and future investment decisions. Such connections underscore the importance of prompt financial disclosure, but they provide no basis for attributing responsibility for the cyberattack to these interests.

Speculation that the outage facilitated undisclosed political contributions remained unsubstantiated. Political spending researcher Molly White expressed concern about diminished visibility into rapidly increasing expenditures while acknowledging uncertainty surrounding the incident. The episode demonstrates that effective campaign finance oversight depends on resilient reporting infrastructure as well as legal disclosure requirements. Authorities must therefore balance cybersecurity precautions with the need to maintain accessible public records. Reliable systems, timely reporting, and clear communication are essential to preserving scrutiny when voters are preparing to make consequential decisions about political representation.

U.S. Data Centers Face Security Risks From Physical Attacks, Insiders and AI-Powered Hackers



 

Hacker attack

AI Powered Cyber Attacks Cyberattacks Cybersecurity Data Center data centres data security Digital Infrastructure Hacker attack

U.S. Data Centers Face Security Risks From Physical Attacks, Insiders and AI-Powered Hackers

Attacks on data centers in other countries are raising concerns about the security of similar facilities in the United States. Although American data centers are unlikely to face the same kind of military strikes seen overseas, cybersecurity experts warn that they remain vulnerable to physical intrusions and cyberattacks. Earlier this week, Ukraine targeted Russian data centers.

In March, the Iranian military struck Amazon data centers in the United Arab Emirates, leaving the affected facilities out of service for several months. Charles Brooks, an adjunct lecturer in cybersecurity at Georgetown University, told Mashable that data centers are valuable targets because so much of modern life depends on them. Everyday activities such as watching Netflix, using Google Docs and accessing online banking services rely on servers housed in these facilities.

Data centers also support cloud services used by government agencies, hospitals, financial institutions and businesses, as well as communications between Earth and space. This makes them attractive to state-backed hackers and criminal groups seeking sensitive information or attempting to disrupt essential services. Brooks warned that a serious breach could have catastrophic consequences. He identified three major security concerns for American data centers.

The first is physical security. Although a drone-powered attack is considered unlikely, facilities could still face attacks involving explosives or unauthorized physical access. Even limited damage could serve as a symbolic victory for terrorist groups or organizations opposed to AI infrastructure. Brooks said security measures should extend beyond surveillance cameras, alarms and barbed-wire fences. He recommended stronger perimeter defenses, security guards and protected areas around sensitive sections, including control centers and water-cooling systems.

The second concern is the threat posed by insiders. Employees with authorized access to servers and infrastructure could expose sensitive information, reveal security weaknesses or interfere with operations. This could involve a disgruntled worker, someone recruited by an adversary or an employee who makes a costly mistake. Brooks recommended rigorous background checks comparable to those conducted for staff at hospitals and power plants. He also suggested AI-powered surveillance to identify unusual employee behavior, arguing that the potential security benefits could justify occasional false alarms.

The third threat comes from AI-assisted hacking. Artificial intelligence can help attackers automate cyber operations, identify weaknesses and expand espionage campaigns. Brooks pointed to an Anthropic security report describing how individuals, including foreign government-backed actors, have used AI to automate cyber spying. Hackers could use these tools to scan for vulnerabilities in data center systems or launch phishing attacks against employees to steal login credentials.

AI allows attackers to conduct these operations at greater scale and identify weaknesses more efficiently. Brooks said protecting data centers should be treated as a national security priority. A breach may not be immediately apparent to the public, but its effects could disrupt businesses, prevent people from working or expose personal information through ransomware attacks. He argued that stronger security requires cooperation between government agencies and the private companies that own and operate these facilities.

Trojanized Claude Code Extension on Cursor Marketplace Exposes Users to SSH Backdoor



 

Supply Chain Attack

Claude Code Extension Cursor Marketplace Cyber Security Developer Security Malicious Extension Remote Access Trojan Software Supply Chain SSH Backdoor Supply Chain Attack

Trojanized Claude Code Extension on Cursor Marketplace Exposes Users to SSH Backdoor

The Cursor IDE extension marketplace was flooded with modified versions of Anthropic's official Claude Code extension, exposing developers to a persistent SSH backdoor. This malicious package, version 2.1.313, appeared to be a legitimate update as opposed to a separate malicious application as it was published under the legitimate extension identity, making it appear to be an authentic update.

A report was issued on October 29, 2026, following the discovery of the compromised extension installing an attacker-controlled SSH key, establishing remote access, and maintaining persistence on affected systems. According to Cursor, the malicious version was accessible for approximately 11 hours from 2:27am to 1:35pm Pacific Time.

The company estimates that up to 5,000 users could have been affected. 66 lines of JavaScript code were inserted into the main code bundle of the extension by the attackers. The malicious component was designed to execute before the extension's normal functions, allowing it to perform unauthorized activities without requiring any suspicious interaction from users.

Despite the extension's continued normal operation, the injected code attempted to modify system files and establish connections with attacker-controlled infrastructure in order to alter the extension's behavior. According to researchers, the compromised package was distributed by Cursor under the legitimate extension identifier of Anthropic, anthropic.claude-code. This incident was particularly concerning because the malicious update appeared as an authentic publisher rather than as a mere imitation.

It remains unclear how the unauthorized package was introduced. Based on Microsoft Threat Intelligence's confirmation, the malicious versions have not been distributed via Microsoft's official Visual Studio Marketplace or Anthropic's npm package. Furthermore, Anthropic confirmed that the company had not been compromised and did not develop the malicious package. Based on the available evidence, Cursor's extension marketplace was the focus of the incident.

The injectable loader attempted to modify the victim's authorized_keys file to include an SSH public key labelled "svc-telemetry". This modification was intended to enable the attacker to access the affected user's account via SSH. In addition to enabling local SSH services and establishing reverse SSH tunnels to external servers 134.209.82[.]225, the malware also attempted to maintain access to the external server. This was accomplished by incorporating separate persistence mechanisms for Windows, Linux, and macOS, which allowed the backdoor connection to be restarted depending on the platform's startup configurations.

Additionally, the malicious payload collected information that could allow attackers to identify valuable developer environments by using system information. There was a collection of information on the device hostname, logged-in username, operating system, CPU architecture, home directory, the current working directory, public IP address, and the global Git email configuration. There were also up to 40 environment variables named KEY, TOKEN, SECRET, PASS, AWS and GCP, which contained up to 400 terms.

Even though the initial beacon did not transmit the values for these variables, this information can be used to identify what cloud services, development platforms and credential types are on a compromised system. As well as sending data to the attacker-controlled server at 134.209.82[.]225:8099/beacon, the loader attempted to send a request to a local loopback address as well.

It has been determined that the attacker's infrastructure has been permanently shut down with the assistance of its hosting provider, which prevents further communication through the reported server. However, the shutdown does not remove malicious files or persistence mechanisms that are already installed on affected systems. However, researchers have not identified any additional payloads, despite the possibility of attackers executing commands and transferring files via a successful SSH tunnel.

It was later clarified that two malicious versions of the software were released through Cursor's marketplace for Windows and macOS, respectively, during the exposure period of October 29 between 2:27 a.m. and 1:35 p.m. Pacific Time. According to the company, up to 5,000 users may have been affected. They will be contacted directly by the company. Cursor temporarily shut down its marketplace while investigating the incident following discovery of the affected packages.

A thorough audit of marketplace access by the company revealed no evidence of tampered with other extensions. After rotating the keys of the marketplace and rebuilding the marketplace, the company was able to restore service. Anthropic also confirmed that its official distribution channels and systems were not compromised.

The extension 2.1.314 was then released through Open VSX and Microsoft's Visual Studio Marketplace. However, Microsoft's Security teams have warned that simply uninstalling it is not sufficient to stop the threat. Scripts, scheduled tasks, cron entries, LaunchAgent files and unauthorized SSH keys marked svc-telemetry should be checked on affected systems.

When evidence of malicious activity is present, systems should be isolated and confirmed malicious components removed after relevant evidence has been preserved. Additionally, organizations are being advised to review endpoint, network, and authentication logs in order to identify suspicious connections and activity involving SSH. Credentials and active sessions accessed from affected machines should be rotated or revoked from trusted devices.

Whenever unauthorized access is confirmed or its security cannot be restored, it may be necessary to rebuild the system. This incident adds to the series of attacks targeting trusted developer tools in the software supply chain. This follows the attack on OVHcloud's official command-line interface that resulted in the replacement of legitimate release binary packages with malware containing secret stealing features. The combined effect of these incidents demonstrates the risks associated with tampered software updates distributed through otherwise reputable channels.

Hacktivists Dump Records of 41,000 DHS Employees, Citing ICE Escalation



 

ShinyHunters

cisa systems Data Breach DHS Employee Data Hacktivist group ShinyHunters

Hacktivists Dump Records of 41,000 DHS Employees, Citing ICE Escalation

A hacktivist group has published internal records identifying more than 41,000 Department of Homeland Security employees and contractors, in what security researchers are calling one of the most detailed government workforce exposures in recent memory.

The group, which calls itself the "Department of Peace," shared the data with Distributed Denial of Secrets (DDoSecrets), a nonprofit that publishes leaked government datasets, and with Swiss hacker-journalist maia arson crimew. The records went public on October 29 and cover staff across nine DHS agencies.

The group tied the release directly to DHS Secretary Markwayne Mullin's July 17 comments, in which he told reporters he was "turning up the heat" on immigration enforcement. That remark, the group said, was the trigger.

What the data contains

The leaked dataset holds 41,191 records spanning employees and contractors across nine DHS sub-agencies, pulled from nearly 7,000 offices and more than 2,200 locations. Each record contains names, job titles, supervisor relationships, direct reports, employment status, workplace addresses, email addresses, phone numbers, and internal group memberships.

CBP accounts for the largest share with 21,329 records, followed by ICE at 6,598 and USCIS at 6,245. Homeland Security Investigations holds 3,421 records, DHS headquarters 1,755, and CISA 980. The Federal Protective Service, FLETC, and the Science and Technology Directorate account for the remainder. Combined, the exposed records represent roughly one-fifth of DHS's reported headcount of 222,538, according to the DOGE website. CISA records were pulled from the public-facing search results but remain in the underlying dataset.

The Icepick tool

Crimew, who faces a U.S. federal indictment tied to prior leaks, built a searchable interface called "Icepick" and hosted it at icepi.cx. The domain registrar pulled the site down shortly after launch. DDoSecrets responded by releasing the tool's source code publicly. By Thursday morning, the searchable site was offline, but the data itself continued to circulate.

DDoSecrets co-founder Emma Best said the dataset extends well beyond contact information. The records, she wrote, identify officials overseeing covert and undercover operations, the government's internal effort to track down leakers, and the now-defunct BlueLeaks investigation. Crimew described it as "a complete game changer for anyone investigating DHS" and said it "provides FOIA material for years to come."

Ryan Shapiro of Property of the People, a government transparency organization, offered a narrower read, noting that staff contact information could prove useful for Freedom of Information Act requests.

Okta in the spotlight

The Department of Peace claimed the data came from an Okta single sign-on service used internally at DHS. Okta said it reviewed the report and found no evidence that its systems or data had been affected.

That denial has not fully closed the question. CyberScoop verified that numerous active CISA employees appear in the dataset alongside former agency leaders who left government years ago. The records also reference internal groups tied to COVID-19 planning and a 2023 internal summit, suggesting the data spans multiple years and may reflect sustained access rather than a single point-in-time pull.

Bluesky moved to block links pointing to the leaked data and flagged them as malicious, according to WIRED. The speed with which journalists and researchers confirmed active employees in the dataset drew particular concern, given that portions of the records appear to touch on undercover personnel.

A pattern of DHS breaches

This is not the first substantial data exposure tied to DHS. In 2014, a breach potentially affected as many as 390,000 current and former employees, applicants, and contractors. In 2018, the department notified nearly 250,000 people after another incident. Earlier this year, security firm GitGuardian found a publicly accessible GitHub repository containing credentials for privileged AWS GovCloud accounts and internal CISA systems, with the exposure dating back to at least November 2025.

Last month, the hacking group ShinyHunters published a separate spreadsheet containing records on roughly 5,000 alleged FBI employees, including home addresses and emergency contacts, framing that release as retaliation for an FBI advisory about the group.

DHS confirmed it is investigating the current incident. "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively," as mentioned by a spokesperson, adding that the department would release further details as they became available. DHS did not respond to additional requests for comment by publication time.

Fake ChatGPT and Claude Apps Deliver Crypto-Mining Malware



 

Yoba

ChatGPT Claude cryptomining malware Yoba

Fake ChatGPT and Claude Apps Deliver Crypto-Mining Malware

Cybersecurity researchers have uncovered a malware campaign, known as Yoba, that uses fake desktop applications for ChatGPT and Claude to trick users into installing cryptocurrency-mining malware. The attackers created convincing GitHub projects and websites for supposed AI tools such as “GPT-5.6 Sol,” “GPT-6 Astra,” and “Claude Opus,” then distributed malicious ZIP files that appeared to be legitimate installers. According to Check Point Research, the campaign exploits public interest in AI tools and the trust people place in familiar technology brands.

The malicious archives contain two key files: a genuine, digitally signed executable from OpenAI or Anthropic, and a harmful Windows DLL named winmm.dll. When a user runs the legitimate-looking Setup.exe, Windows loads the malicious DLL alongside it. This technique, called DLL sideloading, lets attackers abuse trusted signed software to make malicious code appear less suspicious and evade basic security checks. Importantly, the research does not suggest that OpenAI, Anthropic, ChatGPT, or Claude themselves were compromised.

Once launched, the malicious DLL—called YobaDropper—checks that it is being run through the expected host executable, making it harder for researchers to activate it in a sandbox. It then copies a legitimate Windows media component, wmpdmc.exe, into a new folder and places another malicious DLL beside it. This second component, YobaLoader, establishes persistence through a scheduled task and retrieves further instructions from the attacker.

YobaLoader uses an unusual command-and-control method to avoid detection. It downloads an image from a Telegram channel, takes the final 50 bytes as a seed, and generates a new domain using a domain-generation algorithm. It then queries Google’s DNS-over-HTTPS service for a hidden command stored in a DNS TXT record, which leads it to download the next-stage payload. By using DoH and common file-hosting services, the attackers make their traffic resemble ordinary internet activity and evade passive DNS monitoring.

The downloaded payload is injected into Windows’ svchost.exe process, where it launches XMRig, a cryptocurrency miner. Victims may notice slower performance, higher CPU usage, increased electricity consumption, or unexpected system heat. Users should download AI applications only from official vendor websites or verified app stores, avoid installing “desktop versions” from random GitHub repositories, and be cautious of search results promoting unfamiliar AI tools. Organizations should also restrict installations from unknown sources and monitor endpoints for unusual scheduled tasks and mining activity.

Moldova Probes Possible Foreign State Involvement in Major Cyberattack Exposing Government Data



 

Government Data Theft

Cyber Attacks data attacks Data Breaches Data protection data security government data Government Data Breach Government Data Theft

Moldova Probes Possible Foreign State Involvement in Major Cyberattack Exposing Government Data

The Moldovan authorities are looking into whether the large cyber attack, which caused sensitive personal data to be breached and dozens of state services to be disrupted, could be linked to a larger operation targeting citizen data. Prime Minister Vasile Tofan said on Wednesday.

"We have seen coordinated attacks on a large scale. This shouldn’t be seen as an isolated incident. We’re looking at whether there was any foreign state actors involved," he said. The government has not named any countries or hacking groups.

In total, hackers targeted vulnerabilities between October 19 and October 23 to gain large amounts of personal data from government services. They made around 11 million requests to access data. Preliminary findings show that information relating to around 750,000 identification numbers was removed but this does not necessarily mean all personal data was compromised.

This could include personal information such as full names, date and place of birth, family relations, health insurance, social benefits, pensions, disabilities, drivers licences, images and car ownership. Financial information such as bank account numbers, tax liabilities and government payments could also have been accessed. However, authorities said there was no breach of bank cards and no evidence of the attackers attempting to tamper with official government documents.

Initially the hackers exploited vulnerabilities within services that did not require authentication. This was then used to access more records from the government services that are linked. The government have reviewed 82 digital public services and have disconnected the vulnerable services. Over 30 government information systems and administrative services were also disconnected. Several public services were impacted including applying for building permits, veterinary transport authorisations, importing medicine and food safety registrations.

Most of the services have now been secured, however they are being gradually reconnected following further security checks. On October 23 the authorities said unauthorised access was stopped. However, they said they identified further attempts on Sunday and Tuesday but these were unsuccessful. The government has warned that criminals could attempt to use the stolen information for fraud and impersonation. They could try to impersonate someone from a bank or public institution to get people to give them passwords or codes or send them money.

The incident could be part of a larger hybrid attack campaign, government spokesperson Dumitru Ciorici said. Moldova has been constantly targeted by cyber attacks and disinformation since Russia launched a full invasion of Ukraine in 2022.

Moldovan officials have previously accused Russia of launching disinformation campaigns to destabilise the country and weaken state institutions. They have also undermined confidence in the pro-European government led by President Maia Sandu. The latest incident has raised concerns over the security of Moldova’s digital services.

Data Breach at Japan Airlines Adds to Japan's Mounting Cybersecurity Challenges



 

Third-Party Security Risks

airline cybersecurity Amadeus Data Breach Aviation Cybersecurity Customer Information Leak Data protection Japan Airlines Data Breach Japan Cyber Attacks Passenger Data Exposure Third-Party Security Risks

Data Breach at Japan Airlines Adds to Japan's Mounting Cybersecurity Challenges

A data breach has been reported by Japan Airlines (JAL) involving approximately 92,000 customers following unauthorized access to its third-party technology provider, Amadeus IT Group, which exposed passenger reservation information. Due to several recent major cyber incidents reported by Japanese companies, this incident has raised further concerns about the security of customer data handled by external service providers.

Japanese Airlines and Japan Transocean Air use Amadeus' passenger services systems for flight reservations, ticketing, and check-in operations. According to the airline, Amadeus informed them on October 23, 2026, that unauthorized access to their systems had occurred. This incident involved the breach of customer reservation records stored within the provider's environment.

Passenger information included names, reservation codes, flight dates, routes, and travel classes of passengers that had been compromised. It is estimated that 90,000 customer information has been exposed. A second 2,000 passengers were also exposed with additional personal information contained in the compromised records, including passports, nationalities, frequent flyer numbers, email addresses, phone numbers, and flight, ticket, and seat numbers.

According to reports, the unauthorized access occurred from August 10, 2023, to September 23, 2026, suggesting that the affected environment may have been exposed for an extended period of time. Although the method employed by the attackers to gain access has not been publicly disclosed, Japan Airlines has clarified that credit card information and passwords were not compromised in the incident.

In addition, Amadeus has reportedly implemented security measures to address the issue, as the airline states there is no evidence that the exposed information has been misused and that flight operations have not been disrupted. According to JAL, affected passengers will be contacted individually and provided with necessary assistance.

Customers were also warned against phishing emails, fraudulent phone calls and suspicious websites impersonating the JAL Group, since exposed travel and contact information might be used in targeted scams. In addition, this incident highlights the risk that third-party technology providers pose in the aviation industry.

With its digital infrastructure providing airline, airport, hotel, and travel agency customers around the world, Amadeus makes security a critical concern for many organizations. Several airlines have reported possible exposures involving Amadeus systems, extending the impact beyond Japan Airlines. According to Korean Air and Asiana Airlines, unauthorized access to customer information managed by the same technology provider has been reported.

It is reported that both airlines were notified of the incidents by Amadeus on October 20 and reported them on October 23. Based on their initial findings, it appears that reservation reference numbers belonging to some customers were exposed. Also pointed out was the unauthorized use of credentials related to an Amadeus system account.

An incident similar to this one has also been reported by All Nippon Airways (ANA), another major Japanese airline. A notification of unauthorized access was received on October 29 by the airline and the provider is currently working to determine the extent of the exposure. As of now, ANA has not released the number of affected passengers or the specific categories of information affected.

Once additional information has been confirmed, ANA will inform customers. These incidents have raised questions about the security of Amadeus's travel booking infrastructure as a result of their connection. As of October 1, the company disclosed a vulnerability in its travel booking display environment that may be exploited by ransomware actors.

At that time, Amadeus stated that payment and other financial details had not been exploited by ransomware actors. Following the disclosures by multiple airlines, a closer examination of the earlier security issue has taken place. Amadeus provides technology services to more than 400 airlines, hotels, airport operators, and travel agents.

In the event of a security vulnerability in a widely utilized platform, information could be exposed to several organizations, although it remains unclear how many airlines and passengers are affected. A person who has access to passenger names, travel schedules, and booking references may use these information to create convincing communications impersonating airlines using the exposed reservation information. This may also lead to opportunities for targeted phishing and identity fraud.

It may be more credible for such attempts to possess additional information, such as passport numbers, email addresses, and telephone numbers. A broader cyber threat has prompted government intervention in Japan, as Prime Minister Sanae Takaichi called a cabinet meeting on October 26 to discuss the recent attacks and announced plans for emergency measures to strengthen cybersecurity protections for citizens and businesses. Her concern was expressed regarding the potential harm that might result from the misuse of personal information stolen.

When Shinjiro Koizumi and U.S. Defense Secretary Pete Hegseth met in the Philippines on October 28, cyber security concerns of Japan were also discussed. Both sides agreed to intensify cooperation against malicious cyber activities that could adversely affect citizens, economic operations, and national security.

Amadeus is still investigating these incidents, with the total number of passengers affected, the method by which the unauthorized access occurred, and the possibility of additional airline victims still being determined. It is evident from this incident that third-party technology providers in the aviation sector pose security risks. There remains an urgent need for stronger safeguards and a greater level of oversight in order to protect passengers' information as investigations continue to span multiple airlines.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

Report Abuse

About Me

Footer About

Labels

Showing result(s) for

Popular Posts

Pages

Drupal Commerce Flaw Exposes Online Stores to Fraudulent Order Manipulation

Cyber-Attacks Target Ukraine and Russia Emergency Alert Apps

Cloudflare Report Highlights Changing DDoS Attack Trends in Q3 2026

Northflank Breach Exposes Customer Secrets, Leading to Unauthorized AI API Key Usage

About the incident

AI Scams: How Criminals Use Deepfakes, Fake Websites and Voice Cloning to Target Consumers

The Robot Vacuum in Your Living Room May Know More About You Than You Think

ChatGPT Share-Link Flaw Could Expose Private Chats and Hijack Sessions

Critical Linux Kernel Vulnerability Could Allow Hackers to Gain Remote Root Access

About the problem

Who is impacted?

How to address

Polymarket Traders Lose More Than $2 Million in Supply Chain Attack Involving DebugBear

Florida Reports Major Data Breach Affecting 4.9 Million Financial Aid Applicants

North Korean Hackers Drain $6.3 Billion from Binance in Record-Breaking Crypto Theft

Cyberattack Clouds Political Spending Transparency in America

U.S. Data Centers Face Security Risks From Physical Attacks, Insiders and AI-Powered Hackers

Trojanized Claude Code Extension on Cursor Marketplace Exposes Users to SSH Backdoor

Hacktivists Dump Records of 41,000 DHS Employees, Citing ICE Escalation

Fake ChatGPT and Claude Apps Deliver Crypto-Mining Malware

Moldova Probes Possible Foreign State Involvement in Major Cyberattack Exposing Government Data

Data Breach at Japan Airlines Adds to Japan's Mounting Cybersecurity Challenges

Footer About

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Footer About

Labels

Showing result(s) for

Popular Posts

Pages

Menu Item

About the incident

About the problem

Who is impacted?

How to address