World

Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign targeting individuals affiliated with Taiwan research organizations. The operation, tracked as UAT-11985, uses fake event invitations to lure victims toward an adversary-in-the-middle (AitM) phishing framework built to harvest Google account credentials and multi-factor authentication (MFA) codes.

The campaign relies on social engineering rather than software exploits. Targets receive what appear to be legitimate event invites, and clicking through redirects them to a phishing page that proxies the real Google login flow. Because the victim interacts with a live, proxied session, the attackers can capture both passwords and the MFA codes entered during authentication — a technique that defeats many forms of MFA, including one-time passcodes and push-based prompts.

Key points from the disclosure:

• The threat actor is tracked as UAT-11985.
• The targeting focuses on people affiliated with Taiwan research organizations.
• Initial contact comes via fake event invitations.
• The credential harvesting is performed through an AitM phishing framework impersonating Google.
• Both account credentials and MFA codes are at risk of being captured.

Additional technical details, including any specific indicators of compromise or mitigation guidance, were not included in the available reporting. Organizations and individuals in research-focused roles should treat unexpected event invitations — especially those leading to login pages — with heightened suspicion, and should verify links before authenticating with any account.

Source: The Hacker News
Has anyone in your organization received similar fake event invites, and how are you handling verification of external links?

A new class of AI model has emerged almost overnight, and it is already reshaping how AI-driven security operations center platforms are built. These models are designed for rapid decision-making rather than long-form reasoning, a distinction drawn from Kahneman's concept of fast, intuitive thinking.

TypeSafe AI released a model called Jev on September 15, describing it as a System One model. Shortly after, OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl also published cribl-decision, an open LoRA adapter that can be run locally. Other players, such as Laya, are entering the same space.

The article does not provide specific CVE identifiers, affected version numbers, indicators of compromise, or mitigation steps, so none are listed here.

Key developments at a glance:

• TypeSafe AI launched Jev on September 15, positioned as a System One model.
• OpenAI introduced a Decisions API, with a public beta starting October 6.
• Cribl released cribl-decision, an open LoRA adapter for local deployment.
• Laya and other vendors are also pursuing this category.

Source: The Hacker News

How do you see fast decision models changing the way SOC platforms triage and respond to alerts?

Burger King Japan has disclosed a significant data breach affecting approximately 11.18 million customer records after attackers gained access to a server storing the data. The fast-food chain's Japanese subsidiary confirmed the incident, making it one of the larger customer data exposures reported in the region this year.

Key details as currently known:

• The compromised server contained records tied to roughly 11.18 million customers
• The breach was disclosed by Burger King Japan, the Japanese subsidiary of the global Burger King brand
• Attackers accessed the server directly, though the full scope of what data was exposed has not been detailed in the disclosure

This is a developing story, and XploitLK will update this thread as more technical specifics emerge, including any indicators of compromise or mitigation guidance issued by the company.

If your organization handles customer data at this scale, now is a good time to review server access controls and monitoring for unauthorized access attempts.

Source: Unknown

Are you concerned this breach could extend beyond Burger King Japan's systems to other regional operations?

A China-nexus cyber espionage group tracked as Armory Castle, previously known as UNC5221 or Warp Panda, exploited a newly disclosed flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.

The vulnerability is tracked as CVE-2026-102764 and carries a CVSS score of 9.3. It stems from improper origin validation in an internal messaging component, allowing attackers to take over remote support servers.

Key details:

• Targeted product: BeyondTrust Remote Support (formerly Bomgar)
• Threat actor: Armory Castle (also tracked as UNC5221 / Warp Panda)
• Exploitation window: late August 2026, as a zero-day
• Vulnerability type: improper origin validation in an internal messaging component
• Severity: CVSS 9.3

Organizations running BeyondTrust Remote Support should treat this as high priority given active exploitation in the wild.

Source: [email protected] (The Hacker News)

Has your organization reviewed its BeyondTrust Remote Support deployment for exposure tied to this campaign?

The Administrative Office of the US Courts has confirmed that a cyberattack on defense contractor BAE Systems has disrupted court operations, taking down the notice system relied upon by federal bankruptcy courts. The incident has affected the ability of bankruptcy courts to send and receive case notifications, which are essential for keeping creditors, debtors, and legal representatives informed of filings and proceedings.

BAE Systems, a major government contractor, has not publicly disclosed the full scope of the breach, and no specific CVE ID or advisory identifier has been released in connection with the attack. The disruption appears to stem from the contractor's role in operating or supporting the affected court systems rather than a direct compromise of the judiciary's own networks.

Key points:

• The Administrative Office of the US Courts reported the outage of the bankruptcy court notice system.
• The cause is linked to a cyberattack on contractor BAE Systems.
• No specific CVE ID or advisory number has been provided in the available reporting.
• The full extent of the breach and any data exposure remain unclear.

Source: Unknown

Has your organization reviewed contingency plans for third-party contractors that support critical legal or administrative systems?

BeyondTrust has issued an urgent patch for a critical vulnerability in its Remote Support (RS) product, warning customers that the flaw has been actively exploited in zero-day attacks since late August.

The company disclosed the issue on Thursday, urging all customers to apply the fix as soon as possible. Given that exploitation has been ongoing for an extended period, organizations running affected versions should treat this as a high-priority remediation item rather than a routine update.

Details on affected versions and mitigation steps are available in the vendor's advisory. Administrators should review their deployments, confirm whether their environment is impacted, and apply the patch immediately if they haven't already done so.

• Apply the vendor's patch for Remote Support (RS) without delay
• Review systems for signs of prior compromise, given exploitation dating back to late August
• Consult BeyondTrust's official advisory for affected version details and guidance

Source: BleepingComputer

Has your organization already patched its BeyondTrust Remote Support deployment, or are you still assessing exposure?

The threat actor tracked as Silent Lynx has been linked to a new campaign targeting government organizations across the Commonwealth of Independent States (CIS). Observed between June 2025 and August 2026, the activity spans four distinct infection chains, giving the group multiple paths into victim environments.

The infection methods include macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell payloads, and specially crafted WinRAR archives. The WinRAR component points to exploitation of a WinRAR flaw to deliver a reverse shell, a technique that can provide attackers with persistent remote access once a crafted archive is opened.

• Macro-enabled documents used as initial infection vectors
• PS2EXE downloaders to convert and execute PowerShell scripts
• PowerShell payloads hosted on GitHub
• Crafted WinRAR archives exploiting a WinRAR flaw for reverse shell deployment

Organizations in CIS government sectors should treat these indicators as active threats and review exposure to archive-based delivery and macro-enabled documents in their environments.

Source: The Hacker News

Has your organization reviewed its defenses against macro-enabled documents and crafted archive-based attacks?

This week's roundup of security stories covers a wide range of threats, from remote code execution flaws to a backdoor with an unusual twist. A recurring theme across these incidents is how a single weakness or a small permission can be leveraged into a much larger compromise.

Adobe patched a remote code execution vulnerability, a reminder that widely deployed creative and document tools remain attractive targets for attackers looking to gain a foothold.

In a separate campaign, attackers are abusing DNS records to steal cryptocurrency wallets, redirecting victims through infrastructure they can quietly control. Researchers also detailed an NVIDIA container escape, where an attacker who lands inside a container can break out to the underlying host.

One of the more unusual findings is a self-healing backdoor that automatically restores itself after removal. An attacker can persist on a system even after defenders believe they have cleaned it out.

Beyond these highlights, there are more than twenty other stories covered in the full writeup, touching on:

• Old vulnerabilities finding new victims
• Trusted logins being used to hide the wrong person
• Familiar tools being repurposed for malicious ends

The common thread is that small permissions and trusted components continue to be the most reliable path to a significant breach.

Source: The Hacker News

Which of these techniques, from the self-healing backdoor to the container escape, is most concerning for your environment, and how are you detecting them?

A critical Linux kernel vulnerability, tracked as CVE-2026-99999 and nicknamed PwnEscape, allows code running inside a virtual machine to read memory belonging to the host machine it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel has confirmed the issue.

The flaw resides in the Linux kernel's networking code rather than in any specific cloud provider's configuration. Because the vulnerability lives at the kernel level, it affects the shared infrastructure layer common to many virtualized environments, meaning the exposure is not limited to a single platform or vendor setup.

Key points to note:

• CVE-2026-99999 is a Linux kernel networking flaw enabling guest-to-host memory disclosure.
• The attack path allows code inside a VM to read host memory.
• The issue was demonstrated against Vercel's cloud sandboxes, with the company confirming the finding.
• The root cause is in the kernel itself, not in a particular cloud deployment.
• Because it sits in shared virtualization infrastructure, the impact is far broader than one provider.

Source: The Hacker News

Are any of your workloads running on multi-tenant virtualized infrastructure that could be exposed to PwnEscape, and what mitigation steps is your team considering?

A threat actor has uploaded malicious packages to the Arch User Repository (AUR) that impersonate two widely used AUR helper tools, yay and paru. Users who installed these fake packages risked running malware with root privileges, since AUR helpers are typically invoked with elevated permissions during package installation and updates.

The affected package names reported are:

• yay (malicious impersonation published to the AUR)
• paru (malicious impersonation published to the AUR)

AUR is a community-driven repository where anyone can submit build scripts, so packages are not vetted the way official Arch Linux repositories are. Attackers abused this trust model by publishing look-alike entries for the legitimate yay and paru projects, hoping users would install them without checking the maintainer, package history, or PKGBUILD contents.

Because these helpers operate with root privileges, malicious code in a PKGBUILD can execute system-level commands during the build or install process. That makes the impact potentially severe, ranging from data theft to full system compromise.

Recommended precautions for Arch users:

• Verify the maintainer, vote count, and package history before installing anything from the AUR.
• Inspect the PKGBUILD and any accompanying scripts before building.
• Prefer the official repositories for tools like yay and paru where possible.
• Remove any suspicious AUR packages you may have installed and audit your system for unexpected changes.

Source: BleepingComputer

Have you ever audited a PKGBUILD before installing from the AUR, or do you trust the helper tools to handle it for you?

Researchers are seeing active exploitation of a critical remote code execution vulnerability in the Collabora Online - Built-in CODE Server app for Nextcloud, tracked as CVE-2026-110447. The flaw resides in the richdocumentscode component, which ships a bundled version of Collabora Online inside Nextcloud deployments to enable document editing and collaboration.

According to reports, attackers are leveraging this command execution issue to compromise exposed Nextcloud servers and establish persistent backdoors. The exact exploitation chain and post-exploitation tooling have not been detailed publicly, but the impact is severe: successful exploitation allows arbitrary code execution on the host, giving threat actors a foothold to maintain long-term access and potentially pivot deeper into victim environments.

Affected deployments are those running the richdocumentscode app with a vulnerable version of the bundled Collabora Online server.

Recommended actions for defenders:

• Identify any Nextcloud instances running the richdocumentscode app and confirm the installed version.
• Apply the vendor's patch or update as soon as one is available for CVE-2026-110447.
• If immediate patching is not possible, consider temporarily disabling the richdocumentscode app or restricting access to the affected endpoint.
• Review server logs for signs of unauthorized command execution, unexpected processes, or persistence mechanisms.
• Treat any confirmed compromise as a full host breach and conduct a thorough incident response, including credential rotation and integrity checks.

Given that exploitation is already ongoing in the wild, administrators should prioritize this over routine maintenance.

Source: BleepingComputer

Has anyone confirmed whether their Nextcloud deployment runs the richdocumentscode app, and if so, are you patching or disabling it?

A newly detailed proxyjacking campaign has compromised D-Link and Ubiquiti devices across 34 countries, quietly monetizing victims' internet connections by routing traffic through a commercial residential proxy network. Rather than stealing data or demanding a ransom, the operators sell access to the hijacked bandwidth, turning infected routers and similar hardware into an illicit revenue stream.

The campaign abuses known weaknesses in these devices to gain a foothold, after which the equipment is enrolled into the proxy network without the owners' knowledge. Because the activity blends into normal outbound traffic, affected organizations may not notice anything unusual until they investigate unexplained bandwidth consumption or suspicious connections.

Security teams should consider the following precautions:

• Review D-Link and Ubiquiti devices for unauthorized configuration changes or unexpected outbound traffic.
• Apply the latest firmware updates and replace hardware that no longer receives vendor support.
• Disable remote management and default credentials where possible, and restrict administrative access to trusted networks.
• Monitor network egress for connections to residential proxy infrastructure and investigate anomalies promptly.

Source: BleepingComputer

Has your organization audited its edge devices for signs of proxyjacking, or do you rely on vendor firmware updates alone?

Researchers at Citizen Lab have traced a series of zero-click infections at Al Jazeera to Candiru, an Israeli spyware vendor that sells its tools to governments. According to the findings, the attacks did not require any interaction from the target—no clicks, taps, or other user action.

The delivery mechanism was ordinary online advertising. Malicious code embedded in ads executed the moment the ad loaded on screen, meaning simply visiting a page serving the ad was enough to trigger the infection. In some cases, the ad loaded outside the visible viewport, running silently in the background without the user ever seeing it.

Key points from the research:

• Attribution points to Candiru, a commercial spyware developer whose products are marketed to government customers.
• Targets were devices associated with the news network Al Jazeera.
• The infection vector was online ads, not phishing links or malicious attachments.
• Exploitation was zero-click: the payload fired automatically when the ad rendered, with no user action required.
• Some ad impressions loaded off-screen, allowing the attack to proceed covertly.

The findings highlight how legitimate advertising infrastructure can be abused as a stealthy malware delivery channel, and how zero-click exploits remove the last line of defense that user awareness normally provides. Organizations with high-risk profiles—journalists, activists, and media outlets in particular—should treat ad-borne threats as a serious part of their threat model.

Source: The Hacker News

Does your organization have controls in place to detect or block malicious ads, or does this change how you think about ad-blocking as a security measure?

AI penetration testing is drawing more attention as organizations look to scale security assessments, but the question of whether it can truly match a human pentester remains open. According to an analysis by Intruder, AI-driven pentesting can uncover vulnerabilities that human testers miss, yet it still falls short in several key areas.

The main limitations cited are consistency, risk assessment, and understanding of business context. While AI agents can add value to security testing workflows, they are not a straightforward replacement for human expertise.

• Strengths of AI pentesting: can surface vulnerabilities that human testers overlook
• Weaknesses: inconsistent results, weaker risk assessment, limited grasp of business context
• Where AI fits: augmenting security testing rather than replacing human testers

The takeaway is that AI agents may improve coverage and efficiency, but human judgment still matters for interpreting findings and prioritizing risk in context.

Source: BleepingComputer

Has your organization started incorporating AI-assisted pentesting, and if so, how are you handling the gaps in context and risk assessment?

Law enforcement agencies across 17 countries in Latin America and Europe have carried out a coordinated crackdown on the distribution of child sexual abuse material (CSAM) through online messaging groups, resulting in 95 arrests. The operation was coordinated by INTERPOL and involved authorities from both regions working together against networks that share this material.

The suspects were detained as part of an international effort targeting the spread of CSAM via messaging platforms, with INTERPOL facilitating cross-border cooperation among the participating nations.

• 95 suspects arrested
• 17 countries involved across Latin America and Europe
• Operation coordinated by INTERPOL
• Target: distribution of CSAM through online messaging groups

Source: Unknown

Do you think cross-border operations like this are effective at disrupting these networks long-term?

Palo Alto Networks has released security updates to address a high-severity vulnerability in PAN-OS that is currently being exploited in the wild.

The flaw, tracked as CVE-2026-0322, carries a CVSS score of 8.6. It is a remote code execution vulnerability that resides in the management interface of Palo Alto Networks PAN-OS software. Successful exploitation could allow an attacker to execute arbitrary code on affected systems.

Given that active exploitation has been observed, administrators should prioritize patching affected installations as soon as possible. Organizations running PAN-OS should review the vendor's advisory and apply the available updates without delay.

• Affected product: Palo Alto Networks PAN-OS
• Vulnerability type: Remote code execution in the management interface
• Identifier: CVE-2026-0322
• Severity: CVSS 8.6 (high)
• Status: Active exploitation reported
• Recommended action: Apply the latest security updates from Palo Alto Networks

Source: The Hacker News

Is your organization running PAN-OS, and if so, have you already applied the patch or are you still assessing exposure?

The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice responsible for managing the Public Defender Service, has confirmed that attackers who breached its IT systems in April 2025 exfiltrated records dating as far back as 1978.

The agency has not disclosed the full scope of the compromised data, but the timeline indicates the breach exposed decades of historical records rather than a narrowly contained set of recent files. Investigations into the incident remain ongoing, and further details on affected individuals and the exact nature of the stolen information have not been made public.

Affected parties and those seeking updates should monitor official LAA and Ministry of Justice channels for notifications regarding the breach.

• Breach occurred in April 2025
• Records dating back to 1978 were stolen
• Affected organization: Legal Aid Agency, part of the UK Ministry of Justice
• Full scope of compromised data has not been publicly confirmed

Source: BleepingComputer

If your organization handles decades-old records, how are you assessing whether legacy data stores fall within your breach response scope?

Cisco has issued an advisory warning that a critical vulnerability in Cisco Secure Email Gateway is being actively exploited in the wild. According to the advisory published on Wednesday, the flaw allows an attacker with no authentication to write files to the appliance's underlying operating system.

The attack vector involves sending an email with a crafted attachment through the gateway. If the exploitation succeeds, the attacker could then execute commands with root privileges on the affected appliance. Secure Email Gateway is used by organizations to filter inbound email for spam and malware, which makes this a high-value target for attackers seeking a foothold in enterprise networks.

At this time, no specific CVE ID has been assigned or disclosed in the available information. Administrators running Cisco Secure Email Gateway should monitor Cisco's advisory page for updates and apply any available patches or mitigations as soon as they are released.

Given that exploitation requires only a crafted email attachment and no valid credentials, the barrier to entry for attackers is low. Organizations should prioritize reviewing their exposure and ensure their gateway appliances are not internet-facing beyond what is strictly necessary.

Source: The Hacker News

Is your organization running Cisco Secure Email Gateway, and if so, what steps are you taking to mitigate exposure while a patch is pending?

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is urging security teams to immediately patch a vulnerability in Ivanti Connect Secure (ICS) that has been exploited in zero-day attacks since at least October 1st.

According to the reporting, the flaw affects Ivanti Connect Secure deployments, and the exploitation activity has been ongoing for an extended period, making prompt patching critical for organizations relying on the product for remote access.

Administrators should take the following steps:

• Apply the available fix for the affected Ivanti Connect Secure flaw as soon as possible.
• Prioritize internet-facing ICS appliances, since these are the likely targets of the ongoing exploitation.
• Monitor for signs of compromise tied to the vulnerability, especially on systems that may have been exposed since early October.
• Review vendor guidance and CISA advisories for any additional detection or mitigation details.

Given that exploitation has reportedly been underway since at least October 1st, any organization running Ivanti Connect Secure should treat this as urgent rather than routine patching.

Source: BleepingComputer

Has your organization already applied the Ivanti Connect Secure patch, or are you still working through the remediation process?

Palo Alto Networks has issued security updates to address a high-severity remote code execution vulnerability in PAN-OS, the operating system powering its firewall products. The flaw, tracked as CVE-2026-0322, is a zero-day that has already been exploited in attacks targeting firewalls in the wild.

According to the vendor's advisory, the vulnerability carries a high severity rating and allows attackers to execute arbitrary code. Organizations running affected PAN-OS versions should treat this as an urgent patching priority given confirmed active exploitation.

Affected customers are advised to:

• Review the Palo Alto Networks security advisory for the full list of impacted PAN-OS versions
• Apply the available security updates as soon as possible
• Check their environments for signs of compromise tied to this flaw

Admins who cannot immediately patch should consider restricting management interface exposure and monitoring firewall logs for suspicious activity while they plan their upgrade.

Source: BleepingComputer

Has your organization already patched its PAN-OS firewalls, or are you still working through the update window?