Author: The Virus Informer

Hackers exploited a software vulnerability to steal sensitive information from customers of FirstVDS, a major Russian hosting provider. The attackers accessed passwords, credentials, configuration files, and cryptocurrency wallet data stored on customer virtual servers. The breach was discovered Saturday and affected only portions of the company’s infrastructure. FirstVDS stated that customer operations were not disrupted during the attack.

The vulnerability was found in VMmanager 6, a virtualization management platform created by Russian software company ISPsystem. Hackers deployed malware that copied data from customer servers by mounting their disks in read-only mode, leaving no traces of the attack. FirstVDS disabled external access to the vulnerable system and advised affected customers to change their passwords. Although ISPsystem released patches, the vulnerability has not been completely resolved, and the company continues operating with limited functionality.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.

Attackers have begun exploiting a series of vulnerabilities in Plex Media Server to install cryptocurrency miners and reverse proxy backdoors. The exploitation chain, known as Plex2Shell, combines four different security flaws that allow unauthorized remote code execution on vulnerable systems. The vulnerabilities were disclosed to Plex in July 2026 and patched in version 1.43.3.10861 released in August. Active attacks began shortly after technical details became public on October 16, 2026.

The malicious payloads deployed include a Linux backdoor and reverse proxy tool called “myawesomeproxy” and an XMRig cryptocurrency miner labeled “mylovelyminer.” The miner connects to servers associated with a domain previously linked to the AISURU DDoS botnet. Multiple Plex users have reported compromised instances on social media. Plex Media Server users are urged to update to the latest version to protect against these active attacks.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

Between April and July 2026, hackers compromised AOMEI’s servers to distribute malware through its Backupper backup software. The attackers briefly modified configuration files controlling the software’s update and notification systems, then restored them to hide their tracks. Security researchers from ManageEngine, Google, and Mandiant discovered the campaign and attributed it to a threat actor called UNC7017, who used the compromised infrastructure to spread two malware programs: CROSSROAD, a downloader, and SHINYROAD, a backdoor. Organizations in multiple countries across IT services, telecommunications, and higher education sectors were affected.

The attackers exploited three brief windows when malicious files were distributed, lasting between 5 and 10 minutes each. The CROSSROAD downloader performed reconnaissance and established persistence, while SHINYROAD used legitimate Radmin components to connect to attacker-controlled servers. Researchers also identified attempts to steal Windows authentication hashes. AOMEI stated that its chief technology officer was leading an investigation after the company secured its servers and patched vulnerabilities, though the company did not confirm how attackers gained initial access or whether the compromise was fully resolved.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

A security vulnerability in the Linux kernel’s vhost subsystem, tracked as CVE-2026-74580 and named Vghost, allows local users to gain root access across nearly a decade of kernel versions. In certain virtualization setups, untrusted virtual machines can exploit the flaw to write to the host’s memory and take control of the program running the virtual machine. Tencent Zhuque Lab discovered the flaw and released a fix on August 3, publishing detailed documentation and working demonstrations on October 12. No public evidence of exploitation has emerged.

The vhost subsystem manages network and input/output acceleration for virtual machines and containers. The vulnerability stems from a cache mechanism that fails to clear when ring configurations change, allowing attackers to access kernel memory without bounds checking. The flaw affects Linux kernels from version 4.11 through 7.2-rc4 and has been confirmed on major distributions. Users should install patched kernels or restrict access to vhost device nodes as a temporary measure. Major Linux distributors including Red Hat, Amazon, and Oracle have released fixes.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

Microsoft has identified problems with this month’s Windows Server security updates that are disrupting Exchange Server operations. The company confirmed that users on Windows Server 2019 and later versions are experiencing difficulties signing into Outlook on the web and receiving email after installing the October updates. Some affected systems display specific error messages and event logs indicating mailbox access failures.

Microsoft attributes the issues to a new default memory limit on Endpoint Mapper that restricts simultaneous lookup calls to 512, which proves insufficient during heavy Exchange Server usage. While the company works on a permanent solution, it has released a temporary workaround involving a registry modification that administrators can apply to affected systems. Microsoft clarified that the problems are not caused by Exchange Server security updates themselves and advised customers against uninstalling the Windows Server updates.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

A vulnerability in Broadcom’s Wi-Fi setup software allows attackers within radio range to execute code with root privileges on affected routers without needing the network password, according to a disclosure by security researcher Quentin Kaiser on October 16. The flaw affects routers from multiple vendors, with Kaiser demonstrating successful attacks against home gateways supplied by three Belgian internet providers. In some cases, the exploit extracted the Wi-Fi password from the device, while in others it established a remote command shell over the air.

The vulnerability exists in Broadcom’s Wi-Fi Protected Setup implementation and stems from improper handling of fragmented setup messages, which can corrupt router memory. Millions of devices worldwide are estimated to be affected, including older eCos-based chips that will likely never receive patches. No CVE has been assigned despite Broadcom’s knowledge of the flaw since 2018, and no fixes have been deployed to affected routers. Defenders can use YARA rules and scanning scripts to identify vulnerable equipment, though replacement remains the only option for devices incapable of receiving patches.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

Anne Arundel County, Maryland, confirmed that unauthorized actors accessed government computer systems and copied files during a breach discovered on August 28. County officials launched an investigation into the incident, which affected a limited number of systems. Authorities are currently reviewing the stolen files to determine whether any data related to county residents was compromised. The county notified federal law enforcement and other government agencies about the breach. The Baltimore suburb is home to over 600,000 residents and hosts numerous federal agencies, including the Defense Department and Internal Revenue Service.

The Rhysida ransomware gang claimed responsibility for the attack and threatened to release 2.6 terabytes of stolen documents unless a $2 million ransom was paid. This marks the second cyberattack on Anne Arundel County in recent years, following a separate ransomware incident last year. Rhysida has targeted multiple government entities worldwide, including cities in Seattle and Columbus, and Kuwait’s Finance Ministry. County officials noted an increase in cybercrimes targeting state and local governments, with several municipalities across the United States experiencing service disruptions from cyberattacks in recent weeks.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.

Proofpoint has announced plans to acquire Varonis Systems in an all-cash transaction valued at $6.3 billion. The deal will combine two established cybersecurity companies, with Proofpoint traditionally focused on email security and identity threat defense, while Miami-based Varonis specializes in data visibility and security. The merged entity will serve more than 16,000 enterprises and millions of organizations worldwide, positioning itself as a major player in the cybersecurity industry.

The combined company aims to develop a unified platform addressing artificial intelligence security concerns, enabling organizations to identify sensitive data, manage access controls, and prevent data loss. Both firms are recognized for their cybersecurity research capabilities. Proofpoint is owned by private equity firm Thoma Bravo. This acquisition represents one of several major consolidation moves in the cybersecurity sector this year, following comparable deals such as Accenture’s stake in Dragos and Cyera’s acquisition of Oasis Security.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.