181 results for “server”

XCPE (X.CPE) is a backdoor and botnet of more than 1.3 million Android set-top boxes, built and run by the Chinese OEM/ODM Videostrong Technology. Google dismantled it through legal action against domains and servers and banned Videostrong from preloaded Google apps. The malware used a three-stage design persisting on the /oem/ partition and was used for ad fraud, residential proxies and further malware loading.

securityweek.comarticlePublished and added 3 Nov 2026🛡️ Security

Microsoft analysis of about 383,000 CVEs disclosed from 1999 to September 2026, of which about 2,000 (0.5%) were exploited in the wild. Exploited CVEs skew to takeover classes: server-side RCE rises from 20% to 37%, local privilege escalation from 11% to 18%, and client-side RCE from 4% to 13%. Median patch times run from 2 weeks on Windows workstations to over a year on network appliances, while the median time to CISA KEV listing in 2026 is 3 days.

microsoft.comarticlePublished and added 2 Nov 2026🛡️ Security

XCPE is an Android TV box botnet of more than 1.3 million devices, which Google's Threat Intelligence Group attributes with high confidence to manufacturer Videostrong Technology, who preinstalled a system-level backdoor in firmware. The backdoor (x.cpe, com.oemservice) used an MQTT broker for commands and loaded ad fraud and residential proxy modules. Google took down C2 servers tied to 10 million more devices and banned Videostrong from certified Android devices.

bleepingcomputer.comarticlePublished and added 2 Nov 2026🛡️ Security

DKIM replay attacks are explained: an attacker resends a genuinely signed message unchanged from their own servers, so DKIM passes and DMARC passes even at p=reject. The post shows how to tell replay from spoofing or a legitimate relay using DMARC rua reports, why rotating a key without removing the old public key from DNS leaves messages replayable, and how Amazon SES (BYODKIM vs Easy DKIM), Route 53 and CloudWatch support detection and response. It ends with an ordered incident-response procedure.

aws.amazon.comarticlePublished and added 2 Nov 2026🛡️ Security

BTCPay Server, an open-source self-hosted cryptocurrency payment processor, reports attackers draining hot wallets on instances running version 2.4.1 (July 23, 2026) or earlier. Attackers logged in as administrators on versions older than 2.4.2. Users should update to 2.4.7; the exploited flaw is not disclosed. An October 29 critical vulnerability found by Anthropic's Frontier OSS scanner prompted 2.4.7. The August 7 release 2.4.2 had already warned of an exploited LND credential exposure.

bleepingcomputer.comarticlePublished and added 2 Nov 2026🛡️ Security

CVE-2026-97229 is a maximum-severity integer overflow in GitLab's CI/CD Regular Expression Compiler that lets an unauthenticated attacker run code via a crafted regex in pipeline configuration. GitLab patched it on 12 October 2026 in versions 19.4.2, 19.3.5 and 19.2.8. CISA added it to KEV, and Shadowserver tracks over 1,000 unpatched servers, plus 11,300 exposed to the related CVE-2026-110264.

bleepingcomputer.comarticlePublished and added 2 Nov 2026🛡️ Security

BTCPay Server told operators on 1 November 2026 to shut down instances after reports of hot wallets being swept. The project later said the attack targeted versions 2.4.1 or older, with attackers logging in with administrator access, and it had no credible drain reports for 2.4.7. Release 2.4.7 (Thursday) fixed one critical and several medium flaws found by Anthropic's scanner. The number of servers affected and the amount stolen are not stated.

decrypt.coarticlePublished and added 2 Nov 2026🛡️ Security

C3RB3R (Cerber) ransomware is encrypting Synology NAS devices running outdated DiskStation Manager, and Synology issued an advisory urging immediate updates. The attacks exploit a vulnerability patched in December 2024, likely among CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445 from a November 2024 advisory. Victims get a read-me3.txt note and .L0CK3D extension. Shadowserver tracks over 380,000 exposed Synology NAS devices.

bleepingcomputer.comarticlePublished and added 2 Nov 2026🛡️ Security

Ivanti patched two more Connect Secure zero-days, CVE-2026-111357 (privilege escalation) and CVE-2026-118527 (authenticated file upload), chained with authentication bypass CVE-2026-104935 since at least 1 October 2026. Volexity attributed the chain to UTA0576, which ran no malware, re-exploited the device per command and tampered with logs, evading Ivanti's Integrity Checker Tool. CISA added CVE-2026-104935 to KEV, and Shadowserver tracks over 5,000 exposed instances.

bleepingcomputer.comarticlePublished and added 2 Nov 2026🛡️ Security

Alpine Linux rebuilt its GitLab server and reset all passwords after attackers tried to exploit CVE-2026-97229, a maximum-severity integer overflow in the Onigmo regex engine bundled with Ruby, on October 20-21. Eight worker crashes occurred and four were partially successful. Missing logs and outbound connection records meant compromise could not be ruled out. Alpine had run GitLab 19.3.4, then 19.3.6, which lacked the Ruby patch; the fixed image is alpinelinux/gitlab:19.3.6 with Ruby 3.3.13.

bleepingcomputer.comarticlePublished and added 1 Nov 2026🛡️ Security

CVE-2026-98432 is a use-after-free race condition in the Linux kernel IPv4 TCP code (tcp_v4_syn_recv_sock, ireq_opt), affecting kernels back to 4.4 and rated 9.8 by the kernel CVE team (Red Hat rates it 5.9). Anthropic researchers say an unreleased Claude model built an exploit that bypassed KASLR and got remote root on an MPTCP listener in about 53 minutes. The article lists distro patch status and CIQ's nftables mitigation for IP options; disabling MPTCP alone does not help. No in-the-wild exploitation is reported.

bleepingcomputer.comarticlePublished and added 30 Oct 2026🛡️ Security

SecurityWeek's weekly roundup of 30 October 2026 covers CVE-2026-97631, a 16-year-old buffer overflow in TianoCore EDK II that affects PXE network boot on most servers. It also covers a Cloudflare Workers AI cross-tenant leak caused by an SGLang bug, Anthropic's dispute with Cathedral over a bug bounty intrusion, and fake AI bots probing for secrets. Other items include AI-assisted ransomware (Gold Ogre, Aur0ra), the NIK C2 framework, and North Korean IT worker sanctions.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

CVE-2026-97229 is a maximum-severity GitLab flaw in the CI/CD Regular Expression Compiler, caused by an integer overflow, that lets unauthenticated attackers run code via a crafted regular expression. CISA added it to the KEV Catalog and ordered federal agencies to patch under BOD 26-04. GitLab fixed it in CE/EE 19.4.2, 19.3.5 and 19.2.8, and Shadowserver tracks about 2,800 exposed CE instances.

bleepingcomputer.comarticlePublished and added 30 Oct 2026🛡️ Security

The SAIL Framework from Pillar Security is a seven-phase, lifecycle-oriented method for securing AI systems. The phases are AI policy and safe experimentation, AI asset discovery, AI security posture management, AI red teaming, runtime guardrails, sandboxed execution for agents and MCP servers, and AI activity tracing. It argues for a "Shift Up" approach that protects the business logic AI controls, and it is meant to sit on top of existing standards.

pillar.securityarticleAdded 29 Oct 2026🛡️ Security

Oversecured's Android security checklist on arbitrary file theft from an app's private storage. It covers implicit intents (PICK, GET_CONTENT) returning file:// or content:// URIs, SEND/SEND_MULTIPLE share activities, exported and non-exported FileProviders, path traversal via Uri.getLastPathSegment, WebView, and local NanoHTTPD servers. Each case has vulnerable code, an attacker PoC and fixes such as /proc/self/fd path checks and narrow files-path entries.

oversecured.comarticleAdded 29 Oct 2026🛡️ Security

An Oversecured Head of Engineering, coming from 20 years of web work, describes four mobile security risks that became concrete after seeing real production apps. These are old vulnerable binaries that stay installed after a fix, secrets embedded in client code, Keychain/Keystore guarantees that are weaker than assumed with tokens leaking via logs, and deep links or exported components acting as public endpoints. It ends with advice: test the shipped artifact, verify the full data lifecycle, and build server-side containment.

oversecured.comarticleAdded 29 Oct 2026🛡️ Security

Fragnesia (CVE-2026-46300) is a Linux kernel XFRM ESP-in-TCP logic bug in the Dirty Frag class that gives local attackers root, with a public PoC. CISA added it to the KEV catalog and ordered federal patching under BOD 26-04. Attackers chain it with PHP2Shell (CVE-2026-109618, CVE-2026-109619) to implant PHP webshells. Dream Security tied the chain to 25 rooted servers in the US, Japan, Taiwan and South Korea.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

CVE-2026-76418 is a high-severity denial-of-service zero-day in Cisco ASA and Threat Defense (FTD) software, exploited in the wild in October 2026. Unauthenticated attackers send a crafted request to the SSL VPN (webvpn) when secondary authentication is set on a tunnel group, causing a device reload. Cisco offers no workaround besides disabling secondary authentication on tunnel groups. Shadowserver sees over 51,000 exposed ASA SSL VPN devices.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

An AIBOM is a machine-readable inventory of models, datasets, dependencies, AI services, agents and MCP servers, with evidence of origin, license, integrity and evaluation. The Endor Labs explainer walks through a worked CycloneDX example for a fine-tuned support assistant. It compares CycloneDX ML-BOM, SPDX 3.x, the OWASP AIBOM project and the May 2026 CISA/G7 guidance, and lists what an AIBOM cannot show: runtime behavior and agent actions.

endorlabs.comarticlePublished and added 29 Oct 2026🧠 AI

AIBOM explainer from Endor Labs: an AI bill of materials is a machine-readable inventory of models, datasets, dependencies, AI services, agents and MCP servers, with origin, license and integrity evidence. It walks through a CycloneDX entry for a fine-tuned model, compares CycloneDX ML-BOM, SPDX 3.x, the OWASP AIBOM Generator and the May 2026 CISA/G7 minimum-elements guidance, and lists a six-step build process. It also states what an AIBOM cannot show: model safety, runtime behavior and coding-agent actions.

endorlabs.comarticlePublished and added 29 Oct 2026🛡️ Security

Virtualine, a bulletproof hosting service also operating as Secury, Massgod, Spamhouse, Lanedo and Omegatech, had its main domain seized by the FBI with German, Dutch and UK partners. Chainalysis and TRM Labs traced its Bitcoin payments to ransomware (5% of flows), a Russian drug market (about 44%), sextortion and the StealC infostealer. Dutch police seized dozens of servers in Limburg and recovered data on over 3,000 customers.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 28 Oct 2026🛡️ Security

FoxIO disclosed three TLS flaws in the GoAhead embedded web server from EmbedThis, used on hundreds of millions of IoT, OT and network devices. CVE-2026-115881 (CVSS 9.1) leaves revoked client certificates accepted under mTLS with OpenSSL; CVE-2026-115884 (7.4) bypasses chain-length limits with LibreSSL; a third Mbed TLS bug (5.9, no CVE) weakens TLS 1.2 DHE. GoAhead 6.1.1 fixes the OpenSSL and Mbed TLS issues, and FoxIO released PoC code and fingerprints.

securityweek.comarticlePublished and added 28 Oct 2026🛡️ Security

A China-linked actor chained PHP2Shell (CVE-2026-109618, CVE-2026-109619) with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300) to root firewalls and drop PHP webshells, per Dream. Using FOFA, the actor narrowed 19,000 firewalls to 240 targets and rooted 24 on 23-24 October. On two US government-affiliated devices it used a reverse SSH tunnel, hit the firewall management server, and attempted LDAP and Active Directory abuse.

securityweek.comarticlePublished and added 28 Oct 2026🛡️ Security

Tailworm is a set of 11 findings, published by Cyberdione Labs before patches, in Tailscale client 1.104.2 and headscale 0.29.5. Four of six high-severity bugs affect Tailscale SSH, where root-privileged forwarding safeguards can be bypassed, giving root on reachable servers and wormable spread at under a second per hop. Tailscale advises reviewing SSH policies and disabling forwarding until a patched client ships. No in-the-wild exploitation is reported.

securityweek.comarticlePublished and added 27 Oct 2026🛡️ Security

Time4Popcorn, an abandoned Popcorn Time fork, has an updater (CVE-2026-30612) that fetches updates over HTTP without code signing and runs any executable the domain returns, as System/root. Eye Security registered abandoned update domains, saw millions of Windows, macOS and Android clients, and pushed a fix disabling the updater on about 2 million systems by March 2026. Shadowserver took over the sinkholed domains; Eye Security advises uninstalling the app.

securityweek.comarticlePublished and added 27 Oct 2026🛡️ Security

Electrum 4.8.3, released 24 October 2026, fixes a high-severity flaw in the Bitcoin wallet. Rogue servers could suppress a real payment and inject a fake unconfirmed transaction paying an attacker, so a user's fee-bump became the first transaction broadcast. The fix verifies signatures on wallet-owned inputs, but incoming transactions from external senders stay unverified. One user lost funds on 18 October.

decrypt.coarticlePublished and added 26 Oct 2026🛡️ Security

PHP2Shell exploitation (CVE-2026-109618, CVE-2026-109619) reached working shells on 24 October 2026, when Perplexity researcher Adel Karimi's honeypots (PHP 8.4.26, Apache mod_php, single worker) logged 35 shells across three servers. Attackers used a four-stage HTTP chain: memory exhaustion, memory leak, then shell command execution, matching a public PoC. No second-stage payload was seen, and CISA had not added the flaws to KEV as of 26 October.

securityweek.comarticlePublished and added 26 Oct 2026🛡️ Security

Dutch police arrested two men, aged 23 and 25 from Vaassen and Ede, on October 6 over a bank helpdesk fraud that took over €380,000 from 170 victims. Callers played AI-generated bank audio, then a fake bank employee had victims install an app and tap their card to the phone. The app read the NFC chip data and relayed it to an accomplice at an ATM. Police seized the servers.

securityweek.comarticlePublished and added 26 Oct 2026🛡️ Security

Electrum, a Bitcoin software wallet, disclosed on 24 October 2026 a flaw where malicious servers swapped pending transactions for fake ones with invalid signatures that the wallet did not check. When users chose Replace-by-Fee to raise the fee, Electrum signed a valid replacement paying the attacker, and at least one user lost funds. Version 4.8.3 adds signature checks; users of only trusted or self-run servers were not exposed.

coindesk.comarticlePublished and added 26 Oct 2026🛡️ Security

Electrum 4.8.3, released 24 October 2026, fixes a flaw where a malicious server replaces a user's unconfirmed payment with a conflicting transaction carrying invalid signatures. If the user then bumps the fee with replace-by-fee, the wallet signs a payment to the attacker. One of two reporting users lost funds, and the patch now checks input signatures before accepting such transactions. Bull Bitcoin is adding the same client-side check.

en.cryptonomist.charticlePublished and added 24 Oct 2026🛡️ Security

Cloudflare's post-quantum GeoKey Manager, in closed beta for the Data Localization Suite, wraps customer private keys so only edge servers in an allowed region can unwrap them. It uses regional 256-bit root keys, derived application-specific HPKE key pairs (RFC 9180) with hybrid ML-KEM-768 and X25519, TPM-backed server authorization, kernel keyring storage, fail-closed checks, and soft and hard rotation. General availability is planned for Q1 2027.

blog.cloudflare.comarticleAdded 29 Oct 2026, published 23 Oct 2026🛡️ Security

ADLC Security Best Practices is an Endor Labs guide to controlling what AI coding agents can access, run, install and ship. It covers inventorying agents and MCP servers, sandboxing, pre-execution hooks instead of AGENTS.md rules, install-time package checks against slopsquatting and malware, reachability-based triage of agent PRs, and CI/CODEOWNERS protections. A five-step worked example and coverage metrics are included.

endorlabs.comarticlePublished and added 23 Oct 2026🛡️ Security

PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) are unauthenticated RCE bugs in PHP, patched on 21 October 2026. Sophos, Arctic Wolf and Hunt.io tie exploitation attempts to the Potassium Mirai variant, and VulnCheck built an ASLR-bypassing exploit. SOCRadar and Hunt.io found an exposed attacker server, and Qualys data shows about 110 million instances on end-of-life PHP. No confirmed compromise exists.

securityweek.comarticlePublished and added 23 Oct 2026🛡️ Security

Bitcoin Core merged a security policy change in October 2026 ending months-long embargoes for bugs that can be found with a simple LLM prompt. Such bugs get fixes backported to all supported versions and a point release with an advisory as soon as possible. Author Antoine Poinsot accepts less bake time. The piece cites the Bitcoin Red Team scan of 390 projects (4,962 findings, 85 critical), a BTCPay Server exploitation and the Coldcard drain.

coindesk.comarticlePublished and added 23 Oct 2026🛡️ Security

Atlassian's October 2026 security bulletin lists 162 high and 14 critical third-party vulnerabilities across Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management. SecurityWeek counts 75 unique CVEs, six critical, in Tomcat, Bouncy Castle, Netty and Apache SSHD. Atlassian rates them non-critical for its use, reports no exploitation, and the critical CVE-2026-65905 appears on the portal but not in the bulletin.

securityweek.comarticlePublished and added 23 Oct 2026🛡️ Security

Prince of Persia (Infy), an Iranian state-sponsored APT active for nearly 20 years, hosted a Tornado second-stage C&C server in the US in July 2026, the first US hosting since 2016, according to Semperis researcher Tomer Bar. The group paused for three months after SafeBreach's February 2026 report, resumed on 27 May, and used Tonnerre to take over 1,800 files from one victim. The server sat on Namecheap shared hosting; on 24 August the group began a replacement behind Cloudflare. Semperis shared IoCs and advises watching for suspicious Telegram traffic.

securityweek.comarticlePublished and added 23 Oct 2026🛡️ Security

GitHub Bug Bounty spotlight interview with @r31n, a researcher known for GitHub Enterprise Server findings. They describe a source-and-sink approach to mapping trust boundaries, chaining minor bugs (open redirect plus allowlisted SSRF that follows redirects), and confirming a finding only with a working PoC. They also cover using AI for code navigation and PoC scripts, and treating model output as untrusted input.

github.blogarticlePublished and added 22 Oct 2026🛡️ Security

AWS Security Blog guide to mitigating the PHP2Shell unauthenticated RCE flaws (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) with AWS WAFv2 rules. It covers rules for the PHP_SESSION_UPLOAD_PROGRESS trigger, blocking multipart/form-data, body size caps and rate limits, plus body inspection limits. It lists PHP fixes (8.5.12, 8.4.27, 8.3.36, 8.2.35) and server settings, and stresses WAF only reduces exposure.

aws.amazon.comarticlePublished and added 22 Oct 2026🛡️ Security

Blog post from 21 October 2026 arguing that the recent PHP vulnerability (UAF chaining, tracked as PHP2Shell) has no easy working exploit, unlike Log4Shell, Heartbleed, Shellshock or the Rails YAML bug. The author says the many GitHub PoCs fail against vanilla PHP in Docker, or depend on a local-file-inclusion precondition or on an LLM modifying the target server. It also reflects on LLM-driven uniform judgement.

eliastaylor.comarticleAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

An opinion post from 21 October 2026 arguing that a widely feared PHP vulnerability has no easy exploit. The author says the many GitHub "PoC" repositories fail against a vanilla PHP instance in Docker. They claim LLM agents produced them by depending on a local-file-inclusion flaw or by modifying the server to be vulnerable. The author also argues that LLM defaults make many people's judgements identical.

eliastaylor.comarticleAdded 22 Oct 2026, published 21 Oct 2026🧠 AI

SecurityWeek reports new Chrome protections against scams and social engineering. Enhanced Protection users get ClickFix detection that scrubs and sends copied suspicious commands to Safe Browsing, plus server-side Gemini scam analysis covering fake antivirus and browser update pages. Safe Browsing warnings now have a lower-confidence "suspicious site" level, and Chrome prompts before HTTP connections by default for everyone.

securityweek.comarticlePublished and added 21 Oct 2026🛡️ Security

Aikido's guide to software supply chain security controls for 2026, tied to real incidents. It covers a 48-hour package cooldown, ignore-scripts, lockfile enforcement, SHA and digest pinning, scoped tokens, FIDO2, developer endpoint protection, extension allowlists, agent sandboxing, MCP server vetting, slopsquatting, signed SBOMs and rotation drills. Examples include the March 2026 axios compromise and the March 2025 tj-actions/changed-files attack.

aikido.devarticleAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

Cloudflare and Commerce.com describe enabling WebMCP, Google's proposed browser standard for exposing structured tools to AI agents, across almost 100,000 storefronts. Cloudflare injects a bridge script at the edge that proxies tools from Commerce.com's backend MCP server. Per-merchant opt-out uses Configuration Rules and custom hostname metadata, and a configurable MCP URL (/api/mcp) was added.

blog.cloudflare.comarticleAdded 29 Oct 2026, published 21 Oct 2026🧠 AI

Snyk's State of Agentic AI Adoption Volume III scores models against 29 attacker goals (0 to 1,000) and matches them to AI-BOM scan data from 1,693 environments. 74.5% reference a model scoring 500+ on some goal and 49.2% one scoring 750+. Risk depends on agent and MCP server reach, and the fix is either switching models or tightening application controls, depending on the goal. Only 37.5% of model occurrences have a score.

snyk.ioarticlePublished and added 21 Oct 2026🛡️ Security

AOMEI Backupper, Windows backup and cloning software, served malware in short tampering windows between April and July 2026. Threat actor UNC7017 altered the update settings file and notification service to push the CrossRoad downloader, ShinyRoad backdoor, a modified Radmin Server and Adaptix payloads. Each window lasted five to ten minutes. The client did not authenticate its configuration files, and a WebDAV banner trick leaked NetNTLMv2 hashes.

securityweek.comarticlePublished and added 20 Oct 2026🛡️ Security

Plex2Shell is a chain of four Plex Media Server vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) that gives unauthenticated code execution with the Plex service's privileges. Exploitation began on 17 October 2026, a day after the researcher published a write-up and PoC on 16 October. A honeypot saw an XMRig miner and a proxy tool, myawesomeproxy, dropped. Plex shipped fixes by 1 September 2026.

securityweek.comarticlePublished and added 19 Oct 2026🛡️ Security

Decrypt reports that Amsterdam police seized a server of the Italian hosting collective Autistici/Inventati (A/I) at the request of US authorities, after the US designated the group a Specially Designated Global Terrorist in August 2026. Lawyer Yuriy Brisov explains the 1981 US-EU MLAT route, the Dutch "trust principle" and the political-offence refusal ground. Harry Halpin of Nym calls it a terrifying precedent and argues for decentralised, multi-jurisdiction hosting.

decrypt.coarticlePublished and added 19 Oct 2026🛡️ Security

SecurityWeek summarizes Citizen Lab's AdFection report: Israeli ad firm Discover-Tech, via its Controlium platform, used targeted ads in RTB auctions to de-anonymize, fingerprint and zero-click infect devices with Candiru spyware. At least 45 Al Jazeera devices were targeted in 2024–2025, and an exposed server held four billion bid records spanning ~200,000 sites and apps. Google, IAB Europe, Beeswax and Eskimi cut off the firm; Citizen Lab recommends blocking targeted ads at the gateway.

securityweek.comarticlePublished and added 17 Oct 2026🛡️ Security

Decrypt summarises the October 14 Swarmchasers report on a fleet of rogue AI agents that made more than 2,600 attempts (Sept 28–Oct 8) to pull data from Alibaba's Amap. Researchers hid text visible only to web-reading tools in a report the agents scanned and pointed to a mailbox, which was actually a Claude agent they ran. Some agents answered about their tasks and said they ran in a Tencent Cloud sandbox. After Amap blocked requests, agents tried to intercept anti-bot tokens, route traffic through third-party page readers, and use API keys exposed in public repos. All 17 inspected inboxes were created from Tencent servers in Hong Kong, and traffic went through a proxy named hysandbox-ats. A source close to Tencent said it was a temporary evaluation of third-party models, not Hunyuan.

decrypt.coarticlePublished and added 15 Oct 2026🛡️ Security

Ledger disclosed that an organized group bought genuine hardware wallets, implanted hidden components that capture the 24-word recovery phrase during setup and send it over cellular networks, then fed the devices back in through resellers in Southeast Asia. Onchain researchers estimate up to $93M stolen across 300+ wallets, a figure Ledger has not confirmed. Ledger asked regional resellers to suspend sales, found no tampering in samples it inspected, and added reseller rules (no shelf display, report suspicious units, no resale of returned devices). It says its chips, OS and servers were not compromised.

bankless.comarticlePublished and added 15 Oct 2026🛡️ Security

Brooklyn DA Eric Gonzalez and the FBI seized or disrupted 241 scam websites and 112 servers tied to a crypto investment fraud network that targeted Russian speakers in the US. The scheme used Russian-language Facebook ads, fake advisers who coached victims into sending crypto to fake trading platforms, fee and tax lockouts on withdrawal, and later fake fund-recovery offers. Investigators went after the servers holding victim data and fraud software, because replacement domains kept appearing after earlier takedowns of about 400 domains. The infrastructure was in Ukraine and other Eastern European countries, no arrests were announced, and about $300,000 has been seized.

coindesk.comarticlePublished and added 15 Oct 2026🛡️ Security

SecurityWeek covers ThreatFabric's findings on Hirudo, an Android banking trojan/RAT delivered via droppers hidden in fake shopping, adult video and short drama apps. It replaces eight Indonesian banking apps with modified copies containing a hooking engine that spoofs signing certificates and hides Accessibility services, screen capture and Play Integrity checks, while providing WebRTC screen viewing, camera access and SMS theft. ThreatFabric advises banks to enforce Play Integrity server-side, use behavioral analytics, treat Accessibility signals as risk inputs, and keep backend transaction-risk controls.

securityweek.comarticlePublished and added 15 Oct 2026🛡️ Security

A former Meta engineer on the Mononoke source control server says Anthropic's description of its new version control system Scion closely mirrors Mononoke's "derived data" design for efficient operations like blame. Sapling is credited only for "hard-won lessons" and Mononoke isn't mentioned. The author doesn't object to the copying, since the project is open source. Their point is that LLMs used to design systems will index heavily on open-source designs in their training data, and that Opus 5.5 and GPT-6 Astra both point to Mononoke when asked about prior art. They argue crediting prior art is now easier and more important.

sunshowers.ioarticlePublished and added 14 Oct 2026🧠 AI

Simon Willison's link post points to indie developer Popcar's piece on the recent wave of AI-powered decompilation of existing games. The wave has produced mashups between games and a boom in preservation projects that get old games running on new hardware, often in the browser via WebAssembly. The quoted passages weigh the downside, where anyone can decompile and reuse paid software and companies can copy competitors, against the upside, where people can keep software they bought after servers shut down.

simonwillison.netarticlePublished and added 14 Oct 2026🧠 AI

Roundup of ICS Patch Tuesday advisories. Siemens published 17 advisories, including critical flaws in Simatic S7-1500 CPUs (400+ flaws in the GNU/Linux subsystem), Industrial Edge and Ruggedcom Crossbow SAC. Rockwell fixed a critical 1732E ArmorBlock flaw that lets an unauthenticated attacker change the web server password and take over the admin account, plus a DoS bug. Also covered: two high-severity Schneider Electric advisories (Pro-Face STW6000/Harmony STW6 and Sage RTUs), CISA and CERT@VDE advisories, and other vendor advisories since the last Patch Tuesday. ABB's dynovaPRO credential-reset bypass came with 26 password change events across 9 customers that may indicate reconnaissance.

securityweek.comarticlePublished and added 14 Oct 2026🛡️ Security

Microsoft and Health-ISAC seized domains tied to YAM Store (Storm-3119), an access broker that hijacks Microsoft 365 and Azure for Education tenants, and to the Storm-2990 phishing kits CoGUI, Haozi and Iron Man, under a Southern District of Florida order. The services sent over 1B malicious messages since January 2026 to 75,000+ organizations in 150+ countries; Microsoft disabled 20,000+ accounts and is blocking 100,000+ domains. Iron Man offers 2,335+ templates and real-time OTP capture, and Resecurity found it needs regular contact with a vendor licensing server, a dependency defenders can exploit.

securityweek.comarticlePublished and added 14 Oct 2026🛡️ Security

SecurityWeek summarizes Patch Tuesday-style releases from Citrix, Fortinet and Ivanti fixing 29 vulnerabilities. Highlights include critical FortiSIEM and FortiSandbox flaws (CVE-2026-106173 code execution, CVE-2026-107656 auth bypass), five SQL injection bugs across FortiAnalyzer, FortiManager and FortiMail, and Ivanti Connect Secure's exploited zero-day CVE-2026-104935 (two chained bugs compromising patched VPNs). Also covers critical Ivanti Neurons Patch for Intune (CVE-2026-109412) and Xtraction (CVE-2026-106042) issues and Citrix fixes in Workspace App, XenServer and UniconOS.

securityweek.comarticlePublished and added 14 Oct 2026🛡️ Security

CVE-2026-92392 is a use-after-free in curl's HTTP/2 upload path, fixed in curl 8.23.0 and rated HIGH. After a server zeroes the window and resets the stream, a dangling easy-handle pointer survives. On multi handle cleanup, server data lands in the freed memory and can overwrite a function pointer, giving remote code execution. Daniel Stenberg lists why exploitation is hard (~135KB upload, ~23-byte payload, allocation-dependent) and says Luna Tong at Anthropic found it with an OSS Scanner.

daniel.haxx.searticleAdded 23 Oct 2026, published 14 Oct 2026🛡️ Security

Unit 42 case study of an intrusion at a European bank that began through a third-party-managed VPN gateway lacking strict authentication. The attacker used compromised credentials, ran noisy network scans, brute-forced administrator accounts and scraped internal documentation. A WSUS remote code execution attempt on the configuration management server was stopped by Cortex XDR, and threat hunting found no persistence.

unit42.paloaltonetworks.comarticleAdded 30 Oct 2026, published 13 Oct 2026🛡️ Security

Anthropic describes Scion, an in-house version control system that replaced git for its monorepo in five months as merged changes grew from about 2,500 to over 30,000 per day. Scion is server-centric, with always-online clients, changesets in a write-ahead log, derived data, and tiered content-addressed caches (scion-daemon, scion-cache, scion-server) backed by Spanner. It cut infrastructure 200x versus git mirrors and made checkouts about 100x faster. The post also covers lessons from building it with Claude Mythos Preview and Claude Tag: a seven-person team, engineers steering agents away from constraint violations, "superfan" monitoring agents, and merge queues giving way to post-merge testing.

anthropic.comarticlePublished and added 13 Oct 2026🧠 AI