Category: Cybersecurity & Malware

A critical vulnerability in the Linux kernel, identified as CVE-2026-99999 and named PwnEscape, permits virtual machines to access memory on their host computer. Security researcher Paulos Yibelo demonstrated the flaw against Vercel’s cloud sandboxes, which the company confirmed. The vulnerability exists in the kernel’s networking code rather than in any specific cloud provider’s configuration, affecting the shared infrastructure layer that all major cloud services use to isolate customer workloads. The flaw was discovered during a Vercel security challenge and reported privately before public disclosure, with no evidence of real-world exploitation.

The researcher demonstrated that specially crafted network packets sent from inside a guest virtual machine could leak approximately 32 bytes of host memory per packet, with potential to crash the host or execute code on it. The kernel maintainers rated the vulnerability as critical with a score of 9.3 out of 10. A fix consisting of a single Linux kernel change has been merged into the mainline kernel and backported to stable branches. Users must update their host kernel to patched versions—ranging from 5.10.272 to 7.2.11 depending on their branch—and reboot, as updating only guest kernels does not resolve the issue.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

Hackers have compromised at least 143 devices across 34 countries in a scheme to steal and resell internet bandwidth. The attackers installed Pawns.app, a legitimate application that allows users to earn money by sharing their internet connections, without device owners’ knowledge or consent. By installing the software on multiple systems, the perpetrators accumulated larger financial payouts from the commercial residential proxy network.

Security researchers at GreyNoise identified the campaign and found that attackers exploited vulnerabilities in D-Link ShareCenter NAS devices, Ubiquiti UniFi Video NVR systems, SAP NetWeaver Visual Composer, and Hikvision and Dahua DVR/NVR devices to gain unauthorized access. In some instances, attackers also configured SSH key authentication as a backup entry point. Experts recommend users keep internet-connected devices updated, use strong credentials, implement secure configurations, and restrict network access to reduce compromise risks.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

The United Kingdom has imposed economic sanctions against Cryptomus, a cryptocurrency platform that authorities say facilitates payments tied to ransomware, drug trafficking, fraud and other cybercrime activities that help Russia evade financial restrictions. On October 8, the U.K. sanctioned Cryptomus—also known by previous names including Certa Payments and Xeltox Enterprises—for processing payments benefiting the Russian government and its institutions. The sanctions freeze any Cryptomus assets held in U.K. banks and prohibit British companies from doing business with the platform. Three other virtual payment services, VexPay, TokenSpot, and Tsunami Payments, were also targeted.

Cryptomus has operated under multiple identities since 2022, most recently rebranding as Heleket after Canada imposed a CAD $176 million fine for anti-money laundering violations. According to blockchain analysis firm Chainalysis, Cryptomus and Heleket together received more illicit funds than cryptocurrency mixers in their dataset, with over 900 illicit counterparties using the services in late 2025. A separate 2026 analysis found Cryptomus had processed more than $7 billion in transactions since inception, including those linked to child exploitation, terrorist financing and human trafficking. Experts note the U.K. sanctions are significant because they represent enforcement action by a major nation, unlike the unenforced Canadian fine.

Source: Read the full story at Krebs on Security

This summary was written with AI assistance from the linked source.

Microsoft has fixed a bug that caused black screens, desktop loading problems, and Windows Explorer malfunctions following Windows 11 updates released since August. The issue primarily impacted Azure Virtual Desktop hosts using FSLogix software, which enhances user profile loading in virtual environments. The company addressed the problem through cumulative updates released on October 13, 2026, and recommends users install the latest updates to resolve the issue without needing workarounds.

For users unable to install the current updates immediately, Microsoft provided a temporary solution involving manual launch of Windows Explorer through Task Manager. Enterprise customers received additional support through Known Issue Rollback group policies that disable the problematic change until a permanent fix is deployed in a future update. Microsoft also resolved separate issues this week involving Always On VPN connection problems and Remote Desktop failures affecting non-admin users with certain security features enabled.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

A credential-theft campaign called GhostAction has escalated significantly, compromising approximately 1,900 GitHub accounts and targeting over 30,000 repositories across thousands of users and organizations. Security researchers at GitGuardian detected the spike on October 8 and 9, 2026, during which attackers attempted to extract more than 3,100 secrets from public repositories’ continuous integration systems. The campaign represents a supply chain attack where threat actors inject malicious GitHub Actions workflows into software repositories after gaining write access through stolen credentials.

GhostAction operators seek to steal sensitive information including CI/CD secrets, cloud credentials, package registry tokens, and artificial intelligence provider API keys. The attack evolved through multiple payload versions, with later iterations adding git history scanning capabilities to detect various types of secrets such as AWS keys and cloud API credentials. GitHub began blocking the malicious workflows starting October 9, preventing subsequent attack waves from successfully extracting secrets. Notably, some victims had been compromised in previous GhostAction campaigns, suggesting attackers were attempting to exploit unrotated credentials.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

A 35-year-old Saudi engineer employed at OpenAI since July 2025 was arrested on October 9 and charged with illegally intercepting oral communications. The U.S. Department of Justice announced that Abdulrahman Alfozan allegedly planted a hidden recording device in an executive conference room at OpenAI’s San Francisco offices. Security personnel discovered the device on September 30, concealed in a USB port behind a television. According to authorities, the device was hidden in toilet paper and installed around September 28 with encrypted data inside. The conference room regularly hosted meetings involving OpenAI’s confidential research, product plans, technical capabilities, business relationships, and government engagements.

Surveillance footage allegedly showed Alfozan near the conference room multiple times despite lacking authorization to attend meetings there. Authorities say a chatbot account linked to Alfozan’s spouse was used to search for information about building and concealing recording devices. On October 5, security discovered a second similar device in a bag Alfozan had left unattended. OpenAI stated it used its own AI models to investigate and identify the responsible employee, who was subsequently terminated and referred to the FBI. The company reported no evidence of inappropriate access to model weights, source code, or customer data. If convicted, Alfozan faces up to five years in prison and a $250,000 fine.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Microsoft released patches for more than 1,400 security vulnerabilities across its Windows operating systems and other software. This month’s update significantly exceeds September’s previous record of nearly 1,000 fixes, which itself was roughly ten times the typical monthly patch volume. Among the flaws addressed, at least 78 are rated critical, meaning they could be exploited with minimal user interaction and potentially allow attackers to execute unauthorized code on affected systems.

One vulnerability patched this week, a Windows Shell security feature bypass affecting Windows 10 and 11 systems, has already been exploited in the wild. Additionally, a .NET Framework flaw was publicly disclosed before the patch release, potentially giving attackers time to develop exploits. Microsoft attributes the unusually high volume of bug fixes to large language models assisting in vulnerability discovery. Security experts warn that these massive patch releases strain corporate security teams, which must test updates before deployment. Researchers recommend prioritizing the 26 Microsoft vulnerabilities that have appeared in the U.S. Cybersecurity and Infrastructure Security Agency’s catalog of known exploited vulnerabilities.

Source: Read the full story at Krebs on Security

This summary was written with AI assistance from the linked source.

Microsoft has acknowledged a connectivity issue affecting Remote Desktop users on systems with Administrator protection enabled. The problem occurs when non-administrative users attempt to connect to devices running Windows 11 versions 24H2, 25H2, 26H1, or 26H2 after installing recent Windows updates. The failure displays error code 0xC000000D with a message stating the passed token is invalid. This issue primarily impacts enterprise-managed remote devices configured with Administrator protection, a security feature that restricts standard user permissions and requires authentication for system changes.

The Administrator protection feature became enabled by default in organizations using Windows security baselines following the October 2026 Windows security update. While Microsoft works toward a permanent solution, the company has provided a temporary workaround requiring IT administrators to disable Administrator protection through policy management tools such as Microsoft Intune or Group Policy. This incident follows similar Remote Desktop connection failures that Microsoft resolved in previous updates dating back to January 2025.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Microsoft announced the successful disruption of three major phishing platforms operating from China on Wednesday. Working alongside Japan’s National Police Agency and Health-ISAC, the company obtained a U.S. court order to seize and redirect domains associated with YAM Store, CoGUI, and Iron Man. Since January, these platforms collectively sent over 750 million malicious messages to Microsoft customers alone, impersonating more than 75,000 organizations. The campaigns targeted consumers, healthcare organizations, financial institutions, and businesses across more than 150 countries, generating tens of millions of dollars for their operators.

Each platform served distinct functions within the cybercriminal ecosystem. Iron Man operated as a phishing-kit-as-a-service offering more than 2,300 pre-built fraudulent pages, while CoGUI provided ready-made websites and messages impersonating trusted brands and government agencies. YAM Store functioned as a marketplace selling compromised or fraudulently obtained accounts from major technology providers. Through the enforcement action, Microsoft disabled over 20,000 accounts connected to YAM Store and blocked more than 100,000 domains used for impersonation, while coordinating with international law enforcement partners and cybersecurity firm Resecurity to remove additional infrastructure.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.