Author: The Virus Informer

A critical vulnerability in the Linux kernel, identified as CVE-2026-99999 and named PwnEscape, permits virtual machines to access memory on their host computer. Security researcher Paulos Yibelo demonstrated the flaw against Vercel’s cloud sandboxes, which the company confirmed. The vulnerability exists in the kernel’s networking code rather than in any specific cloud provider’s configuration, affecting the shared infrastructure layer that all major cloud services use to isolate customer workloads. The flaw was discovered during a Vercel security challenge and reported privately before public disclosure, with no evidence of real-world exploitation.

The researcher demonstrated that specially crafted network packets sent from inside a guest virtual machine could leak approximately 32 bytes of host memory per packet, with potential to crash the host or execute code on it. The kernel maintainers rated the vulnerability as critical with a score of 9.3 out of 10. A fix consisting of a single Linux kernel change has been merged into the mainline kernel and backported to stable branches. Users must update their host kernel to patched versions—ranging from 5.10.272 to 7.2.11 depending on their branch—and reboot, as updating only guest kernels does not resolve the issue.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

Hackers have compromised at least 143 devices across 34 countries in a scheme to steal and resell internet bandwidth. The attackers installed Pawns.app, a legitimate application that allows users to earn money by sharing their internet connections, without device owners’ knowledge or consent. By installing the software on multiple systems, the perpetrators accumulated larger financial payouts from the commercial residential proxy network.

Security researchers at GreyNoise identified the campaign and found that attackers exploited vulnerabilities in D-Link ShareCenter NAS devices, Ubiquiti UniFi Video NVR systems, SAP NetWeaver Visual Composer, and Hikvision and Dahua DVR/NVR devices to gain unauthorized access. In some instances, attackers also configured SSH key authentication as a backup entry point. Experts recommend users keep internet-connected devices updated, use strong credentials, implement secure configurations, and restrict network access to reduce compromise risks.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

The United Kingdom has imposed economic sanctions against Cryptomus, a cryptocurrency platform that authorities say facilitates payments tied to ransomware, drug trafficking, fraud and other cybercrime activities that help Russia evade financial restrictions. On October 8, the U.K. sanctioned Cryptomus—also known by previous names including Certa Payments and Xeltox Enterprises—for processing payments benefiting the Russian government and its institutions. The sanctions freeze any Cryptomus assets held in U.K. banks and prohibit British companies from doing business with the platform. Three other virtual payment services, VexPay, TokenSpot, and Tsunami Payments, were also targeted.

Cryptomus has operated under multiple identities since 2022, most recently rebranding as Heleket after Canada imposed a CAD $176 million fine for anti-money laundering violations. According to blockchain analysis firm Chainalysis, Cryptomus and Heleket together received more illicit funds than cryptocurrency mixers in their dataset, with over 900 illicit counterparties using the services in late 2025. A separate 2026 analysis found Cryptomus had processed more than $7 billion in transactions since inception, including those linked to child exploitation, terrorist financing and human trafficking. Experts note the U.K. sanctions are significant because they represent enforcement action by a major nation, unlike the unenforced Canadian fine.

Source: Read the full story at Krebs on Security

This summary was written with AI assistance from the linked source.

Microsoft has fixed a bug that caused black screens, desktop loading problems, and Windows Explorer malfunctions following Windows 11 updates released since August. The issue primarily impacted Azure Virtual Desktop hosts using FSLogix software, which enhances user profile loading in virtual environments. The company addressed the problem through cumulative updates released on October 13, 2026, and recommends users install the latest updates to resolve the issue without needing workarounds.

For users unable to install the current updates immediately, Microsoft provided a temporary solution involving manual launch of Windows Explorer through Task Manager. Enterprise customers received additional support through Known Issue Rollback group policies that disable the problematic change until a permanent fix is deployed in a future update. Microsoft also resolved separate issues this week involving Always On VPN connection problems and Remote Desktop failures affecting non-admin users with certain security features enabled.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

A credential-theft campaign called GhostAction has escalated significantly, compromising approximately 1,900 GitHub accounts and targeting over 30,000 repositories across thousands of users and organizations. Security researchers at GitGuardian detected the spike on October 8 and 9, 2026, during which attackers attempted to extract more than 3,100 secrets from public repositories’ continuous integration systems. The campaign represents a supply chain attack where threat actors inject malicious GitHub Actions workflows into software repositories after gaining write access through stolen credentials.

GhostAction operators seek to steal sensitive information including CI/CD secrets, cloud credentials, package registry tokens, and artificial intelligence provider API keys. The attack evolved through multiple payload versions, with later iterations adding git history scanning capabilities to detect various types of secrets such as AWS keys and cloud API credentials. GitHub began blocking the malicious workflows starting October 9, preventing subsequent attack waves from successfully extracting secrets. Notably, some victims had been compromised in previous GhostAction campaigns, suggesting attackers were attempting to exploit unrotated credentials.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

A 35-year-old Saudi engineer employed at OpenAI since July 2025 was arrested on October 9 and charged with illegally intercepting oral communications. The U.S. Department of Justice announced that Abdulrahman Alfozan allegedly planted a hidden recording device in an executive conference room at OpenAI’s San Francisco offices. Security personnel discovered the device on September 30, concealed in a USB port behind a television. According to authorities, the device was hidden in toilet paper and installed around September 28 with encrypted data inside. The conference room regularly hosted meetings involving OpenAI’s confidential research, product plans, technical capabilities, business relationships, and government engagements.

Surveillance footage allegedly showed Alfozan near the conference room multiple times despite lacking authorization to attend meetings there. Authorities say a chatbot account linked to Alfozan’s spouse was used to search for information about building and concealing recording devices. On October 5, security discovered a second similar device in a bag Alfozan had left unattended. OpenAI stated it used its own AI models to investigate and identify the responsible employee, who was subsequently terminated and referred to the FBI. The company reported no evidence of inappropriate access to model weights, source code, or customer data. If convicted, Alfozan faces up to five years in prison and a $250,000 fine.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.