World

The U.S. Department of Justice has charged 14 individuals and seized roughly 187 computers and KVM devices as it moves to disrupt a North Korean remote IT worker scheme. The defendants include a mix of U.S. citizens and Chinese nationals, accused of participating in an IT worker conspiracy that affected more than 70 U.S. companies. The charges filed include wire fraud.

Authorities also shut down more than 40 laptop farms tied to the operation, which used the machines and KVM hardware to make overseas workers appear as though they were connecting from within the United States. The action is part of the DoJ's broader effort to counter North Korea's use of fraudulent remote IT employment to generate revenue.

Affected organizations should review their remote hiring and identity verification processes, with particular attention to:

• Device and IP geolocation inconsistencies during onboarding and day-to-day work
• Contractors or remote staff routed through third-party intermediaries
• Shared or proxied access to corporate systems via KVM setups

Source: [email protected] (The Hacker News)
Has your organization reviewed its remote contractor verification process in light of these laptop farm takedowns?

Microsoft, working alongside Health-ISAC, the Japan Cybercrime Control Center (JC3), and a coalition of private sector partners including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, has announced the disruption of three phishing kits. The kits are tracked as CoGUI (also known as NX or FA), Haozi (also known as Phoenix), and Iron Man System.

According to the announcement, the threat actors behind these kits have been responsible for a massive volume of scam messages since January 2026 — collectively linked to over 1 billion fraudulent messages.

Key details from the disclosure:

• Three phishing kits disrupted: CoGUI (aka NX / FA), Haozi (aka Phoenix), and Iron Man System
• Operation involved Microsoft, Health-ISAC, JC3, and private partners Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs
• The actors behind these kits have driven scam message campaigns since January 2026
• The kits are tied to more than 1 billion scam messages

The disruption highlights the ongoing value of cross-industry collaboration between technology vendors, threat intelligence firms, and regional cybercrime authorities in dismantling phishing infrastructure at scale.

Source: The Hacker News

Has your organization seen any activity tied to these phishing kits, and what detection or mitigation steps are you taking?

Attackers have been exploiting a vulnerability in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers and backdoor them. At least three administrators reported the issue on GitHub, with the earliest logged attack dating to September 10.

A web shell is a small file that lets an attacker execute arbitrary commands through web requests, running with the privileges of the web server account. Once dropped, it gives the intruder a persistent foothold on the host.

Key points so far:

• Affected component: the Collabora Online - Built-in CODE Server app, which is optional rather than part of a default Nextcloud install.
• Impact: remote attackers can deploy web shells, leading to command execution on the server.
• Reporting: the first reports came from three administrators on GitHub; the initial observed attack occurred on September 10.
• No specific CVE ID or patch identifier has been provided in the source reporting at this time.

Administrators running the Built-in CODE Server app should review their Nextcloud instances for unexpected files, check web server logs for suspicious requests, and consider disabling the app if it is not required until more details emerge. Because the reports are still developing, watch the official Nextcloud and Collabora channels for updates rather than relying on unofficial advisories.

Source: The Hacker News

Are you running the Collabora Built-in CODE Server app in your environment, and if so, have you checked it for signs of compromise?

AhsayCBS has released new security updates to address two vulnerabilities that have been actively exploited in the wild to deploy web shells and XMRig cryptocurrency miners. The flaws, tracked as CVE-2026-105133 and CVE-2026-105134, can reportedly be chained together to bypass authentication and execute arbitrary commands on affected systems.

The updates follow earlier patches that were found to be incomplete, which is why Ahsay Backup has now shipped additional fixes. The report notes that the vulnerabilities were published earlier, and exploitation has already been observed in real-world attacks.

Key points:

• Affected product: AhsayCBS (Ahsay Backup)
• Vulnerabilities: CVE-2026-105133 and CVE-2026-105134
• Impact: Authentication bypass and arbitrary command execution when chained
• Observed activity: Deployment of web shells and XMRig cryptocurrency miners
• Status: New fixes released after previous patches proved incomplete

Administrators running AhsayCBS should apply the latest updates as soon as possible and review their systems for signs of compromise, particularly unexpected web shell files or unauthorized mining activity.

Source: The Hacker News

Has anyone running AhsayCBS in their environment already applied these fixes, and did you find any signs of prior exploitation?

Threat actors are actively exploiting a critical security flaw in Langflow, an open-source platform used to build AI applications and agentic workflows, according to an alert from Previdian. Langflow's parent company, DataStax, was acquired by IBM in February 2025.

The vulnerability is tracked as CVE-2026-105740 and carries a CVSS score of 9.9. It is described as a case of authenticated remote code execution, meaning an attacker who can authenticate to the platform may be able to execute arbitrary code on the underlying system. The flaw has drawn significant attention from adversaries, with 1,423 honeypot exploit attempts recorded as they target the vulnerability in the wild.

Given the severity of the flaw and the volume of exploitation activity observed, organizations running Langflow should treat this as urgent. Review your exposure, ensure the platform is not accessible to untrusted users, and apply any available fixes or mitigations from the vendor as soon as possible.

• Tracked as CVE-2026-105740 with a CVSS score of 9.9
• Authenticated remote code execution vulnerability
• 1,423 honeypot exploit attempts observed
• Affected product: Langflow, now under IBM following the DataStax acquisition

Source: The Hacker News

Is your organization running Langflow, and if so, how are you mitigating exposure to this flaw?

The credential-theft campaign tracked as GhostAction has intensified, with activity targeting more than 30,000 repositories belonging to roughly 3,000 users and organizations. According to GitGuardian, the spike in malicious activity was observed on October 8 and 9, 2026.

The surge stemmed from the compromise of approximately 1,900 GitHub accounts. From there, the attackers attempted to extract 3,174 secrets from continuous integration (CI) workflows in public repositories. The campaign highlights the growing risk posed by abused CI pipelines, where stolen credentials can be harvested at scale from exposed repository automation.

Key points:

• Roughly 1,900 GitHub accounts compromised
• Over 30,000 repositories targeted
• About 3,000 users and organizations affected
• 3,174 secrets targeted for extraction from public repository CI

Developers and organizations should review their GitHub account security, audit CI workflow permissions, and rotate any credentials that may have been exposed through repository automation.

Source: The Hacker News

Has your organization reviewed its CI workflow permissions and secret exposure in response to this campaign?

Drupal has released patches for two critical vulnerabilities that could let attackers execute code remotely on sites running any supported version of the CMS. The project is warning that exploits may surface soon, so treating the update as urgent is advised.

The flaws affect supported Drupal releases, meaning site owners on current branches are in scope — not just those running outdated installs. Because the issue enables remote code execution, a successful attack could give an adversary direct control over the affected site.

Recommended actions:

• Update Drupal core to the latest patched release for your version branch as soon as possible.
• Review your site logs for unusual activity if you cannot patch immediately.
• Apply the update during a maintenance window if change control requires it, but do not delay beyond your normal emergency patching threshold.

No specific CVE identifiers were included in the source report, so none are listed here.

Source: BleepingComputer

Has your organization already applied the Drupal core update, or are you waiting on a maintenance window?

ConnectWise has taken its Cloud Backup service (previously known as SkyKick Cloud Backup) offline after attackers gained access to application identities and used them to compromise Microsoft 365 tenants. Customer access to the service has been shut down while the company responds to the incident.

The attack is being treated as a supply-chain compromise, with the intruders leveraging application identities tied to the backup platform to reach downstream Microsoft 365 environments. Details on the full scope of affected tenants have not been disclosed.

• ConnectWise Cloud Backup (formerly SkyKick Cloud Backup) is currently unavailable to customers
• Attackers accessed application identities and compromised Microsoft 365 tenants
• The incident is classified as a supply-chain attack

Organizations using the service should watch for further guidance from ConnectWise and review their Microsoft 365 tenant configurations and application consent settings for anything unexpected.

Source: BleepingComputer

Has your organization reviewed its third-party application permissions in Microsoft 365 since this disclosure?

Attackers are increasingly impersonating well-known AI products to deliver malware, hijack browser sessions, and take over business accounts, according to new research from ANY.RUN. Between April and October 2026, the firm tied 1,258 public sandbox analyses to these fake AI campaigns, underscoring how heavily the technique is being used in the wild.

The activity is not evenly distributed. US businesses accounted for 16% of country-attributed targets, and the volume of incidents is adding operational pressure on MSSPs that serve US organizations. Because these campaigns rely on familiar AI branding to lure users, early detection and rapid triage matter — MSSPs that can spot the malicious payloads and session-theft behavior quickly are better positioned to contain incidents before they escalate.

Key points:

• Attackers impersonate popular AI products to distribute malware, steal browser sessions, and compromise business accounts.
• ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns spanning April to October 2026.
• US businesses represented 16% of country-attributed targets.
• The campaigns increase operational pressure on MSSPs serving US businesses.

Source: The Hacker News

Has your organization seen fake AI product lures in email or web traffic, and how are you tuning detection to catch them early?

Cybersecurity researchers have uncovered a malicious npm package tied to a recently disclosed software supply chain attack campaign tracked as MALFEX.

The package, named imgdecode, was uploaded to the npm registry on September 30, 2026, by a user operating under the name malfexteste8. According to the researchers, the package conceals a shellcode loader within a Windows native addon, allowing malicious code to be loaded through what appears to be a legitimate library component.

At the time of reporting, imgdecode had been downloaded 979 times and remained available on npm. The report does not specify a CVE identifier for this package.

Key details:

• Package name: imgdecode
• Registry: npm
• Upload date: September 30, 2026
• Publisher account: malfexteste8
• Download count: 979 as of writing
• Status: still available on npm as of writing
• Technique: shellcode loader hidden in a Windows native addon

If your organization relies on npm dependencies, it is worth checking whether imgdecode appears in your lockfiles or dependency trees, and reviewing any installs tied to the malfexteste8 publisher account while the package remains live.

Source: The Hacker News

Has your team audited its npm dependencies for this package or other artifacts linked to the MALFEX campaign?

Drupal has released security updates addressing a critical vulnerability in the Field UI module of Drupal core that could allow an attacker to execute code on the site's server. The fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19.

According to the Drupal Security Team's advisory, the flaw cannot be reached through core alone. However, several exploit paths exist through contributed modules, and at least one known path requires no authentication, making unauthenticated remote code execution a realistic risk for sites running affected contributed modules.

Site administrators should upgrade to the patched releases as soon as possible:

• Drupal 11.4.10
• Drupal 11.3.19
• Drupal 10.6.19

Given the unauthenticated exploit path via contributed modules, prioritising this update is strongly advised, and reviewing which contributed modules are in use is worthwhile.

Source: The Hacker News

Does your organisation run Drupal with contributed Field UI-dependent modules, and have you scheduled the upgrade yet?

Researchers are tracking an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 credential tied to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customer M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs).

According to the reporting, the stolen credential was used to sign in to 173 Microsoft 365 tenants. Because the service is designed for MSPs, a single compromised credential can potentially expose the environments of many downstream customers at once, which is what makes this campaign notable.

Key points from the report:

• The credential belongs to ConnectWise Cloud Backup, previously known as SkyKick.
• Attackers used it to authenticate into customer Microsoft 365 environments.
• Sign-ins were recorded across 173 tenants.
• The actors behind the campaign remain unknown.
• No specific CVE ID or advisory identifier was provided in the source report.

If your organization uses ConnectWise Cloud Backup or works with an MSP that does, it is worth reviewing tenant sign-in logs and auditing access associated with the service. No formal mitigation guidance beyond that was included in the reporting.

Source: The Hacker News

Does your organization rely on ConnectWise Cloud Backup or an MSP that does, and have you checked your tenant logs since this report?

Next.js has pushed an out-of-band security update addressing two critical vulnerabilities that permit unauthenticated remote code execution, plus a high-severity denial-of-service issue.

The first code-execution flaw affects React Server Components, while the second resides in librsvg — the open-source library that Next.js pulls in via the sharp package for SVG image processing.

The fixes are available in the latest release; administrators running affected versions should prioritize upgrading.

Source: The Hacker News

Are your Next.js deployments already patched, or are you still assessing exposure across your projects?

NGINX has released versions 1.30.6 and 1.31.7 on October 14, addressing five vulnerabilities in total. Notably, one of these flaws has existed in every release since May 2005.

F5, the company maintaining NGINX, reports that three of the issues are memory bugs capable of crashing a worker process or potentially enabling an attacker to execute code. Each of these three requires a specific configuration to be exploitable.

A fourth vulnerability allows an attacker to forge a TLS session that could bypass client-certificate checks. The article does not provide specific CVE identifiers for any of the flaws.

Administrators running affected NGINX deployments should upgrade to 1.30.6 or 1.31.7 as soon as possible.

Source: The Hacker News

Has your organization already applied the update, or are you waiting on internal testing before rolling it out?

A suspected advanced threat actor is exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware tracked as PEERSTITCH.

The vulnerability in question is CVE-2025-61624, a path traversal flaw in the command line interpreter affecting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. It carries a CVSS score of 5.4. According to the reporting, successful exploitation could allow an attacker to bypass checks on tagged VPN sessions.

Key points from the research so far:

• The malware, PEERSTITCH, is described as memory-resident and compiled for ARM64 architectures, and had not been publicly documented before this campaign.
• The flaw is a path traversal issue in the CLI interpreter shared across multiple Fortinet products, not just FortiOS.
• The actor behind the activity is described as suspected advanced, though attribution has not been confirmed.

Defenders running any of the affected Fortinet products should treat this as a priority: review exposure of management interfaces, monitor for unusual CLI activity, and watch for suspicious processes or artifacts consistent with in-memory ARM64 payloads. Because the malware resides in memory, traditional file-based scanning may miss it entirely, so behavioral detection and logging of tagged VPN session activity are worth prioritizing.

Source: The Hacker News

Has anyone in the community observed unusual CLI or VPN session behavior on their Fortinet appliances, and how are you approaching detection for memory-only payloads like this?

Attackers compromised the update infrastructure for AOMEI Backupper, a Windows backup utility, and used it to deliver a backdoor to users checking for updates. According to research from Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team, the attackers repeatedly swapped out the files that the software fetches from the vendor's own update servers.

The tampering windows were narrow, lasting only five to ten minutes at a time, and occurred between May and July 2026. Any installation of AOMEI Backupper that polled for an update during one of those windows would silently download and execute a backdoor rather than a legitimate update.

Key details:

• Attackers modified files served directly from the vendor's update servers, not a third-party mirror.
• Exposure was limited to systems that happened to check for updates during the short tampering intervals.
• The campaign ran intermittently across a roughly three-month period.

Because the malicious files were hosted on trusted update infrastructure, standard signature or domain-based detection would not necessarily flag them as suspicious. Users and administrators should treat any AOMEI Backupper update activity during the affected period as potentially compromised and review endpoints accordingly.

Source: The Hacker News
Did your organization push or receive any AOMEI Backupper updates between May and July 2026, and how are you verifying update integrity going forward?

Security researchers at Calif have published a working local privilege escalation exploit that achieves root on OpenBSD 7.9, chaining an integer overflow that dates back roughly 37 years with a separate kernel flaw. According to the firm, the exploit also bypasses KARL kernel-address randomization along with the SMAP and SMEP hardware protections.

The root cause is an old integer overflow in OpenBSD's shared-memory handling, which the researchers combined with a second kernel bug to escalate privileges. Calif published a detailed writeup and full proof-of-concept code once OpenBSD shipped fixes for the issues.

At this time, no specific advisory or CVE identifier has been provided in the reporting, so administrators should track OpenBSD's official errata and patch channels for the corresponding fixes.

Mitigation guidance:

• Update OpenBSD installations to a version containing the vendor's fixes as soon as they are available.
• Monitor OpenBSD's official security announcements and errata for patch details.
• Treat local privilege escalation risk seriously on multi-user or shared systems, where an unprivileged local user could exploit the chain.

Source: The Hacker News

Has your organization applied the OpenBSD patches, or are you still assessing exposure on shared systems?

Researchers are warning about a maximum-severity vulnerability affecting Magento and Adobe Commerce that could allow attackers to execute arbitrary PHP code on store servers. The flaw has been assigned CVE-2026-103849 and is tracked as a critical issue, meaning exploitation could lead to full server compromise if left unpatched.

According to the researchers, the vulnerability could be exploited in the near future, and store operators are urged to act quickly. Because arbitrary code execution on the server is possible, a successful attack could let hackers run malicious scripts, access sensitive data, or take over the affected environment entirely.

Key points to be aware of:

• Affected platforms: Magento and Adobe Commerce
• Vulnerability type: arbitrary PHP code execution
• Identifier: CVE-2026-103849
• Severity: maximum / critical

If your organization runs either platform, review your patch status and apply vendor fixes as soon as they are available. Until then, monitor your store servers for unusual activity.

Source: Publication Name

Is your organization running Magento or Adobe Commerce, and how are you approaching mitigation for this one?

Candiru spyware was reportedly delivered to devices at Al Jazeera Media Network through targeted online advertisements, in what researchers describe as a zero-click attack. Rendering the malicious ads on a victim's device was reportedly enough to trigger the infection chain, with no user interaction required.

The reported campaign highlights how ad delivery networks can be abused as an initial access vector against high-value targets. Because the attack is triggered by ad rendering alone, traditional user-awareness training offers little protection in this scenario.

Details on specific affected versions, indicators of compromise, or mitigation steps were not provided in the source material.

Source: BleepingComputer

Does your organization treat third-party ad rendering as a potential attack surface, and if so, how are you mitigating the risk?

Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign targeting individuals affiliated with Taiwan research organizations. The operation, tracked as UAT-11985, uses fake event invitations to lure victims toward an adversary-in-the-middle (AitM) phishing framework built to harvest Google account credentials and multi-factor authentication (MFA) codes.

The campaign relies on social engineering rather than software exploits. Targets receive what appear to be legitimate event invites, and clicking through redirects them to a phishing page that proxies the real Google login flow. Because the victim interacts with a live, proxied session, the attackers can capture both passwords and the MFA codes entered during authentication — a technique that defeats many forms of MFA, including one-time passcodes and push-based prompts.

Key points from the disclosure:

• The threat actor is tracked as UAT-11985.
• The targeting focuses on people affiliated with Taiwan research organizations.
• Initial contact comes via fake event invitations.
• The credential harvesting is performed through an AitM phishing framework impersonating Google.
• Both account credentials and MFA codes are at risk of being captured.

Additional technical details, including any specific indicators of compromise or mitigation guidance, were not included in the available reporting. Organizations and individuals in research-focused roles should treat unexpected event invitations — especially those leading to login pages — with heightened suspicion, and should verify links before authenticating with any account.

Source: The Hacker News
Has anyone in your organization received similar fake event invites, and how are you handling verification of external links?