Category: Cybersecurity & Malware

Attackers compromised a contributor’s GitHub account and replaced files in five OVHcloud command-line tool releases with malware designed to steal secrets from infected machines on October 19. The malicious files remained available for up to 94 minutes before OVHcloud removed them and released a clean version. Users who installed or updated the tool during that window through certain methods may have downloaded the compromised version.

OVHcloud founder Octave Klaba advised affected users to rotate all secrets stored on their systems. The company has since enabled release immutability on GitHub to prevent similar attacks. Researchers linked the compromised account to GlassWorm, a malware campaign that uses hidden Unicode characters and Solana blockchain transactions to distribute malicious code, though they acknowledged this connection as inference rather than confirmed fact.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

AOMEI, a Hong Kong-registered company that makes Windows backup software, has not yet identified or notified customers infected by malware following a supply-chain attack. Hackers compromised AOMEI’s update servers between April and July, temporarily redirecting users to download malicious files. Cybersecurity researchers from ManageEngine and Google detected the breach and warned AOMEI in June, though the company initially attributed the issue to attackers intercepting updates rather than problems with its own infrastructure. AOMEI only identified evidence of the intrusion after ManageEngine provided specific timing details in July.

Google researchers identified victims across telecommunications, IT services, and higher education in countries including the United States, Australia, India, and Brazil. However, the actual number of infected machines is likely much higher given the brief windows during which malware was distributed. The attackers exploited an unauthenticated channel used for promotional pop-ups rather than exploiting the backup tool itself. Experts warn that fixing AOMEI’s servers will not clean already-infected computers, and organizations are urged to search for signs of compromise throughout the April-July period. The attackers’ origin and motivation remain unknown.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.

Zeabur, a developer hosting platform, disclosed a major security breach occurring on October 14-15, 2026, in which attackers used leaked internal credentials stored in plaintext to access its infrastructure. The attackers compromised shared clusters and dedicated servers, eventually accessing the production database and stealing over 3.2 million environment variable records and information for 321,810 accounts. This represents the second significant security incident in two months, following an August 2026 breach. Security failures included storing credentials unencrypted, failing to rotate administrator credentials since January 2024, and leaving administrator portals publicly accessible on the internet.

In response to the ongoing security challenges, Zeabur announced it will shut down its services effective December 1, 2026, with complete closure by December 31, 2026. The company stated that scaling operations to meet market demand has become increasingly complex and difficult to maintain securely. Starting December 1, service renewals will be disabled and shared cluster services paused. By year-end, all dedicated servers will expire and shared clusters will cease operations. The company indicated users may receive additional time for data migration, though specific timelines have not been provided.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Eight intermediate certificate authority keys from Indian certification provider eMudhra have been compromised, according to announcements from Mozilla and Google’s Chrome Root Program on October 20. A researcher discovered the breach on October 17 and reported it to the root programs. The compromised keys could allow someone to issue fraudulent certificates for any website that browsers would accept. Chrome and Firefox blocked the affected certificates within hours of verification, and no unauthorized certificates using these keys had been logged to Certificate Transparency before the blocks were implemented.

Multiple software platforms have released emergency updates to address the vulnerability. Go released security updates blocking any certificate chain containing the compromised keys, Firefox pushed revocation lists to users, and programming libraries like Python’s certifi and Rust’s webpki-roots removed the affected root certificates from their bundles. Mozilla removed the compromised root from its NSS library, and Chrome plans to remove it from its root store in version 43. The circumstances surrounding how the keys were compromised and when the breach occurred remain under investigation by Mozilla, root programs, and other certificate authorities.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

Federal investigators are examining executives at ransomware negotiation firms for suspicious ties to the ShinyHunters hacking group, which recently breached FBI servers and stole sensitive personnel data. According to sources, one U.S.-based executive allegedly helped operate the ShinyHunters extortion website, which was active from May through October 2026 and featured nearly 100 victim organizations. The site pressured companies to pay ransoms by threatening to publish stolen files. Canadian cybersecurity executive Edward Dubrovsky was arrested in October in connection with the ShinyHunters investigation and charged with threatening to disclose stolen data and interfering with interstate commerce through extortion.

ShinyHunters, which has extorted over $70 million this year, was originally run by French cybercriminals but later came under control of a teenager from Jordan known as “Rey.” Investigators discovered that executives at negotiation firms had advance knowledge of ShinyHunters victims before the companies themselves learned of breaches. One executive allegedly knew about the FBI data theft but failed to report it to the agency before the group threatened to publish the stolen files. The findings highlight potential conflicts of interest within the ransomware negotiation industry, particularly when firms earn fees based on ransom amounts paid.

Source: Read the full story at Krebs on Security

This summary was written with AI assistance from the linked source.

French cloud provider OVHcloud has alerted users that attackers compromised its open-source command-line interface tool to distribute malware designed to steal sensitive information. A threat actor gained access to a developer’s GitHub account and modified versions 0.11.0 through 0.15.0 of the CLI tool, which administrators and developers use to manage cloud services from a terminal. The company’s CEO reported that the compromised release appeared on October 19 and was detected and blocked within approximately two hours after a customer reported the issue. Older version 0.10.0 and the latest release 0.16.0 were unaffected by the breach.

OVHcloud has enabled GitHub’s release immutability feature to prevent similar incidents and considers the matter resolved. The company urges users who downloaded compromised versions to update or remove the tool and to revoke all secrets stored on their systems. Security researchers linked the attack to GlassWorm, a group known for targeting software development ecosystems including VSCode, OpenVSX, GitHub, and npm. The compromised GitHub account had been infiltrated for over six months, and the malware affected users on macOS, Linux, and Windows platforms, though source builds and Docker images remained clean.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Nikkei Inc., a major Japanese business and financial media company, announced its third data breach in approximately one month. The latest incident exposed 1.83 million personal information records after hackers used stolen credentials to access a development system on October 7. The company notified authorities on October 11 and stated that 150,000 records contained identifying information such as names, email addresses, and phone numbers, while the remaining 1.68 million records contained no identifiers. No credit card information was exposed.

The unauthorized access occurred in the company’s cloud storage system. As of October 16, Nikkei reported no evidence that the information was misused or shared online, and found no signs of system compromise or service disruptions. The company has revoked the compromised credentials and is investigating the breach’s full scope. This incident follows two earlier breaches: one in late July involving a compromised employee Google account and another in September involving a hijacked Microsoft 365 account used for phishing emails.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Hackers exploited a software vulnerability to steal sensitive information from customers of FirstVDS, a major Russian hosting provider. The attackers accessed passwords, credentials, configuration files, and cryptocurrency wallet data stored on customer virtual servers. The breach was discovered Saturday and affected only portions of the company’s infrastructure. FirstVDS stated that customer operations were not disrupted during the attack.

The vulnerability was found in VMmanager 6, a virtualization management platform created by Russian software company ISPsystem. Hackers deployed malware that copied data from customer servers by mounting their disks in read-only mode, leaving no traces of the attack. FirstVDS disabled external access to the vulnerable system and advised affected customers to change their passwords. Although ISPsystem released patches, the vulnerability has not been completely resolved, and the company continues operating with limited functionality.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.

Attackers have begun exploiting a series of vulnerabilities in Plex Media Server to install cryptocurrency miners and reverse proxy backdoors. The exploitation chain, known as Plex2Shell, combines four different security flaws that allow unauthorized remote code execution on vulnerable systems. The vulnerabilities were disclosed to Plex in July 2026 and patched in version 1.43.3.10861 released in August. Active attacks began shortly after technical details became public on October 16, 2026.

The malicious payloads deployed include a Linux backdoor and reverse proxy tool called “myawesomeproxy” and an XMRig cryptocurrency miner labeled “mylovelyminer.” The miner connects to servers associated with a domain previously linked to the AISURU DDoS botnet. Multiple Plex users have reported compromised instances on social media. Plex Media Server users are urged to update to the latest version to protect against these active attacks.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

Between April and July 2026, hackers compromised AOMEI’s servers to distribute malware through its Backupper backup software. The attackers briefly modified configuration files controlling the software’s update and notification systems, then restored them to hide their tracks. Security researchers from ManageEngine, Google, and Mandiant discovered the campaign and attributed it to a threat actor called UNC7017, who used the compromised infrastructure to spread two malware programs: CROSSROAD, a downloader, and SHINYROAD, a backdoor. Organizations in multiple countries across IT services, telecommunications, and higher education sectors were affected.

The attackers exploited three brief windows when malicious files were distributed, lasting between 5 and 10 minutes each. The CROSSROAD downloader performed reconnaissance and established persistence, while SHINYROAD used legitimate Radmin components to connect to attacker-controlled servers. Researchers also identified attempts to steal Windows authentication hashes. AOMEI stated that its chief technology officer was leading an investigation after the company secured its servers and patched vulnerabilities, though the company did not confirm how attackers gained initial access or whether the compromise was fully resolved.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.