This posting is here to collect cyber security news in October 2026.
I post links to security vulnerability news to comments of this article.
You are also free to post related links to comments.
This posting is here to collect cyber security news in October 2026.
I post links to security vulnerability news to comments of this article.
You are also free to post related links to comments.
505 Comments
Tomi Engdahl says:
Japanese internet provider tells customers to unplug computers as it faces unprecedented cyber breach
Hackers threaten to continue publishing customers’ information unless company pays $1m ransom
https://www.independent.co.uk/asia/japan/japan-internet-cyberattack-gmo-hackers-ransom-b3074580.html?fbclid=IwdGRjcAVO3EtjbGNrBU7cNmV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEeU8fKhErmyDLyTn-_YYNkzsOeyB__KC6BDcMdAKO9oKyRieqAZFLXSJdEY4s_aem_bDOGJgBP2Jv_Xo6Fy8SJJw
Japanese internet services company GMO has urged customers to back up their data and disconnect their computers from the internet after hackers began leaking information allegedly stolen in a cyberattack affecting more than 26,000 servers.
The attackers have threatened to continue publishing customer information individually unless the company pays a ransom.
GMO has refused to pay the hackers’ $1m ransom, saying there is no guarantee they would delete the stolen personal information and warning that it could still be used for illegal activities.
The company disclosed a security breach last week that potentially affected 26,739 servers, including those used for clients’ trading accounts across more than 70 securities firms, foreign-exchange providers, and other businesses in Japan and overseas.
Prime minister Sanae Takaichi, after an emergency meeting with other ministers, told reporters: “The recent series of cyberattacks against Japanese companies and other organisations has resulted in a number of major incidents involving large-scale information leaks and other damage.”
Tomi Engdahl says:
Cyber attackers hacked thousands of children’s data due to this common password fail
‘Password1 is not an appropriate password, it is a wide-open door to nefarious actors’, the ICO’s head of investigations warned in his rebuke
https://www.independent.co.uk/news/uk/home-news/cyber-attack-data-breach-password-onl-data-cymru-ico-b3069945.html?fbclid=IwVERDUAVO3MZleHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHsZB8Sp87XjiuMPWeDMOPOODJKywI8dj5wsSnbQl9SnIbfo19UFX_nzUCoJF_aem_1Acy4Z8pXJszhKTrJ1tmlQ
Cyber attackers breached thousands of children’s data through a test account with a “very weak” password, the data watchdog has revealed as a stark warning to others.
The Information Commissioner’s Office (ICO) reprimanded broadband company Ogi Networks Limited (ONL) and Wales’ local government data unit, Data Cymru, for breaching GDPR rules after the personal information of 3,300 people was accessed by cyber criminals.
Tomi Engdahl says:
InfraTrust report warns of exploited flaws in critical network infrastructure
https://www.bleepingcomputer.com/news/security/infratrust-report-warns-of-exploited-flaws-in-critical-network-infrastructure/?fbclid=IwdGRjcAVO4MFleHRuA2FlbQIxMQBwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHsDdtJtggd3wZqBhVBnqO9Py3nxk9CXg8Age55-9dz-_n_TAs2pxK7MghUJ6_aem_HyUjPX9poCi6PDoP9_RBuQ
Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as “PHP2Shell” put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk.
The findings come from Eclypsium’s October InfraTrust Pulse, a monthly report tracking security advisories affecting network devices, servers, firmware, chips, and other infrastructure.
Between September 18 and October 14, InfraTrust tracked 133 new security advisories across 18 vendors, covering 2,813 vulnerabilities.
The report also warns that many network appliances, including firewalls, VPN gateways, application delivery controllers, and network-attached storage devices, embed PHP into their management interfaces.
Because vendors compile PHP into appliance firmware, customers commonly cannot install the recent PHP security updates themselves and must instead wait for each vendor to release updated firmware.
InfraTrust therefore recommends that administrators make sure PHP-backed management interfaces are not exposed to the Internet while waiting for PHP2Shell patches.
InfraTrust also warns that the recently disclosed PHP2Shell vulnerabilities expose another weakness in network infrastructure, as many appliances embed PHP directly into their management interfaces.
While most focus on these vulnerabilities has been on websites and web applications written in PHP, PHP is also used for management interfaces of firewalls, application delivery controllers, VPN appliances, and network-attached storage devices.
For impacted devices, administrators usually cannot update PHP themselves because vendors compile it directly into the appliance firmware. Instead, customers must wait for each vendor to rebuild and release updated firmware or software containing the patched PHP version.
Soon after the disclosure, Palo Alto Networks, F5, NetScaler, Check Point, and QNAP confirmed that some of their products were affected, while they still developed fixes for appliances.
The report also highlights a similar issue in other software components that infrastructure vendors bundle into their products.
CVE-2026-31431, a Linux kernel privilege escalation flaw known as Copy Fail, has now appeared in 29 advisories across eight vendors, up from 19 advisories from six vendors last month.
Tomi Engdahl says:
⚠️ Exploiting PHP2Shell may give attackers access to more than a server. Stolen API keys, cloud credentials, and service accounts can open doors across an organization.
Token Security explains how to limit the blast radius.
https://www.bleepingcomputer.com/news/security/even-after-php2shell-blast-radius-matters-more-than-a-cvss-score/
#cybersecurity #sponsored
Tomi Engdahl says:
https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/?fbclid=IwVERDUAVO5LdleHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHqevY7g4N3x5-jFzXP2sax37t8uWNU_jprXlFcxYOQEwrPsAfKGq7GUZkV88_aem_4eW5YmLB3C4Hck4pjg4JQQ
Tomi Engdahl says:
on top of this.. some CA (eMudhra) was found to have been creating 384-bit elliptic curve private keys using tiny numbers. this made it trivial to brute force them by repeatedly doing the public key generation calc until it matched a given low integer private key (one was ’4′ would you believe it – so just 4 iterations required)
Tomi Engdahl says:
An unreleased Anthropic AI model chained security flaws into working exploits across Chrome, Safari, Android, Windows, and Linux.
One Chrome exploit escaped the browser sandbox and launched Calculator on a Mac just by loading a page.
Details on five chained exploits → https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html
Tomi Engdahl says:
https://www.bleepingcomputer.com/news/microsoft/microsoft-reminds-entra-id-admins-to-migrate-users-to-passkeys/?fbclid=IwdGRjcAVO8VVleHRuA2FlbQIxMQBwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHpryxda4kjFhnHbmfXrWO80rCrp7fVrhWWi5vab-7Lv2Tlxe2dCGQyZs109V_aem_ZxZ_Y3gK8hxjwjHI5gtuQg
Tomi Engdahl says:
Most servers are still running PHP 7.4, which received its last update 4 years ago. Read more: https://cnews.link/php-exploitation-32-million-servers-vulnerable/
Tomi Engdahl says:
PHP-haavoittuvuus 21.10. – yksi viime vuosien merkittävimmistä tietoturvauhista
https://jco.fi/fi/php-haavoittuvuus-21-10-yksi-viime-vuosien-merkittavimmista-tietoturvauhista/?fbclid=IwdGRjcAVPLLVleHRuA2FlbQEwAHBkb2YFYWRpZAGrN70HAWzxc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEfL17-E2JmX6_Gj1Ydn1TgM0NFUbhyh0b9P26gkq5Z0yjmSUY9aiLCWw8UW8A_aem_9tzvSK7Oobm8x3jw8uMYWg&utm_medium=paid&utm_source=fb&utm_id=120251099797110673&utm_content=120251099797130673&utm_term=120251099797120673&utm_campaign=120251099797110673
Keskiviikkona 21.10. PHP:ssä julkistettiin kaksi kriittistä tietoturvahaavoittuvuutta, jotka koskivat suurta osaa maailman verkkosivustoista. Päivitimme kaikki ylläpitämämme sivustot heti korjauksen julkaisun jälkeen ja suljimme ne varotoimenpiteenä siihen asti. Kerromme tässä, mitä tapahtui, mitä se olisi voinut tarkoittaa ja miten toimimme.
PHP on WordPressin, Joomlan, Drupalin, WooCommercen ja Magenton kaltaisten julkaisujärjestelmien ja verkkokauppojen perusta. Pelkkä WordPress pyörittää noin 40 % kaikista maailman verkkosivustoista (W3Techs). Kun mukaan lasketaan muut PHP-pohjaiset sivustot, PHP on käytössä noin 69 %:lla sivustoista (W3Techs).
Kun PHP:ssä on haavoittuvuus, kyse ei siis ole pienen piirin korjauksesta. Se koskee suurta osaa koko verkosta. PHP voi olla myös hostingalustojen, hallintapaneelien ja muiden ohjelmistojen taustalla niin, ettei sitä käyttävä organisaatio välttämättä edes tiedä sitä.
PHP:n ytimestä löytyi kaksi kriittistä haavoittuvuutta (CVE-2026-109618 ja CVE-2026-109619), joita tietoturva-alalla kutsutaan nimellä PHP2Shell. PHP:n tietoturvatiimi arvioi molemmat vakavuusasteikolla 9,2/10. Haavoittuvuuksien kautta hyökkääjä voi pahimmillaan ajaa omaa koodiaan palvelimella ilman kirjautumista.
nyt, ne eivät syntyneet nyt. Tutkijoiden mukaan virheet ovat olleet PHP:ssä jo yli kymmenen vuotta (OX Security). Ne vain havaittiin vasta nyt.
Tavallisesti haavoittuvuus korjataan hiljaisuudessa ja julkistetaan vasta, kun korjaus on valmis. Nyt tieto vuoti julkisuuteen ennen suunniteltua aikataulua, ja PHP aikaisti korjauksen julkaisua. PHP:n tietoturvatiedotteessa haavoittuvuuksien löytäjiksi mainitaan muun muassa tietoturvayhtiö Wizin ja OpenAI:n tutkijat (PHP), ja haavoittuvuudet löytyivät tekoälymallien avulla (The Next Web).
Tekoälyn avulla tietoturva-aukkoja löydetään nyt nopeammin kuin koskaan. Sama kehitys auttaa myös hyökkääjiä: kun aukko tulee julki, toimiva hyökkäystapa voidaan rakentaa entistä nopeammin.
PHP2Shell on tästä hyvä esimerkki. Haavoittuvuudet löydettiin tekoälyn avulla, ja OpenAI kuvasi niitä yhdeksi viime aikojen vaikutuksiltaan merkittävimmistä tietoturvaongelmista. Tietoturvayhtiö Wizin tutkijoiden mukaan tekoälymallit madalsivat merkittävästi kynnystä muuttaa nämä vuosia vanhat virheet toimivaksi hyökkäykseksi (Help Net Security).
Onko WordPress turvallinen?
On, kun sitä ylläpidetään. Tietoturvauhkia kohdistuu kaikkiin verkkosivustoihin alustasta riippumatta. WordPress pyörittää noin 40 % kaikista maailman sivustoista (W3Techs), joten on luonnollista, että suuri osa uutisoiduista uhista liittyy juuri siihen.
Uhat eivät yleensä ole itse WordPressissä. Patchstackin mukaan WordPress-ekosysteemistä löytyi vuonna 2025 yhteensä 11 334 uutta haavoittuvuutta. Niistä 91 % oli lisäosissa ja 9 % teemoissa, ja itse WordPressissä vain kuusi, kaikki vähäisiä (Patchstack).
Kun tieto haavoittuvuuksista tuli, tietoturvatiimimme otti tilanteen heti seurantaan. PHP ilmoitti julkaisevansa korjauksen keskiviikkona klo 17 Suomen aikaa. Uhka ei kuitenkaan odottanut kello viittä: tieto oli jo julkista, ja hyökkäyksiä alkoi näkyä maailmalla ennen korjausta (Cloudfare).
PHP2Shell oli poikkeuksellisen laaja tilanne, mutta tietoturvatyö ei ole meillä kertaluonteista. Valvomme palvelinympäristöä 24/7 ja seuraamme jatkuvasti myös WordPressin lisäosien ja teemojen haavoittuvuuksia. Niitä julkaistaan käytännössä päivittäin, pelkästään viime vuonna yli 11 000 (Patchstack).
Kriittiset haavoittuvuudet korjaamme heti.
Tomi Engdahl says:
BREAKING THE CHAIN OF TRUST
Code-execution flaw in UEFI firmware affects most servers on planet Earth
Critical flaw in EDK2 allows attackers to execute code early in the boot process.
https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/?utm_source=facebook&utm_medium=social&utm_campaign=dhfacebook&utm_content=null&fbclid=IwdGRjcAVPzXRleHRuA2FlbQIxMQBwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABH55zK924we4EWt9oKLtkDhBfDXR3BbrDCsypsVk4XlSISz5UgjUdWU9peCFZ_aem_OJmIOQp4W9lbUxHFn3szvA
The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore EDK II, an open source codebase that hardware makers and cloud providers use to create the UEFI firmware that runs during the boot-up sequence. Last year, a representative of the UEFI Forum called EDK2 the “preeminent solution / implementation of the UEFI specifications.” Virtually all UEFI suppliers (sometimes still called IBVs or independent BIOS vendors), including AMI, Insyde, and Phoenix, use the reference code extensively. Project Mu, Microsoft’s hardened EDK2 fork, used the code containing the vulnerable component as well.
The vulnerability, tracked as CVE-2026-97631, is a memory-corruption flaw in an ICMP component that attackers can exploit to execute malicious code that runs before the operating system and firmware can implement defenses like Secure Boot, which establishes a chain of trust for all code, including the Trusted Platform Module (TPM), loaded during boot. While final payloads delivered by CVE-2026-97631 have no persistence—meaning they run only once—they can give attackers a wide opening to install other payloads that also run each time early in the boot process.
The cat has left the bag
The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.
With publicly available patch code, it will be trivial for advanced hackers to learn how the vulnerability is triggered and to build working exploits. Further compounding the urgency, patching UEFI code vulnerabilities in millions of end devices sold and used by thousands of hardware makers and cloud providers is cumbersome and time-consuming. Word of the vulnerability comes six days after another botched disclosure, this one involving a critical code-execution vulnerability in the PHP programming language.
“This vulnerability in the ICMP parser of the EDK2 network stack is interesting in terms of how it affects the chain of trust and the broader ecosystem,”
An attacker intent on compromising a nearby endpoint or server could use this bug to hijack program flow at a point where the boot process still has access to sensitive components, like the endpoint’s TPM. This could be used to break disk encryption for cases where an attacker has short-term network access (and it would be even easier in a theft scenario).”
CVE-2026-97631 is a 16-year-old buffer overflow in the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe), which is responsible for allowing servers, storage equipment, and other devices to boot using code downloaded from a local network.
As the official advisory puts it:
During network boot, the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) keeps a receive request open for ICMP error messages and copies each received message into the fixed 504-byte field Mode.IcmpError of its private context structure. The copy loop’s bounds handling is incorrect in both the IPv4 and IPv6 handlers (PxeBcIcmpErrorDpcHandle and PxeBcIcmp6ErrorDpcHandle): for a message longer than 504 bytes it still copies bytes into the field, and it advances the destination pointer by the cumulative rather than the per-fragment length, so an oversized message writes attacker-controlled bytes past the field. Nothing earlier on the receive path restricts the message length.
The malicious error can be delivered through a simple unicast sent from any network distance to a target device’s IP address, as long as it’s sent during the PXE boot sequence. An attacker can deliver a denial-of-service by causing the boot sequence to hang. When the attacker knows what the target firmware build is, it can plant a “counterfeit event” that executes the malicious code on the CPU in its UEFI firmware environment. The code runs in ring 0, a CPU’s most privileged execution level.
Yet another forever day
CVE-2026-97631 joins a long list of previously discovered vulnerabilities in UEFI or code that works closely with it. The most severe of them, LogoFail, stemmed from logo images included in the UEFI of just about every hardware maker. Rendering bugs allowed attackers to subvert the chain of trust UEFI enforces and go on to install malicious components before the OS loaded or Secure Boot ran. PixieFail was a vulnerability similar to CVE-2026-97631. It, too, was the result of faulty PXE boot flaws in EDK2.
CVE-2026-97631 doesn’t affect home and small office users, or any other users who boot their devices solely from disk drives. Instead, it applies only to organizations with machines that boot from local networks, or conceivably from Internet-connected resources. Even then, the targeted firmware must rely on EDK2, as opposed to a different reference implementation, and use the PXE functionality (which is turned on by default).
In an email, Intel said that none of its “commercial products currently under security support” are known to be affected. “Intel does not include the affected EDK2 functionality in its reference code, though it may be integrated by an OEM board vendor or system manufacturer,”
Some readers are likely to be unhappy at the lack of detail. Sometimes—particularly in cases involving botched disclosures that break embargoes months before they’re scheduled to lift—there’s no escaping the lack of actionable information in initial reporting.
Those affected should check with the maker of the firmware being used to boot their systems and ask for guidance. Beyond that, they should consider turning off network boot capabilities at least temporarily if possible. Firmware configurations should always enable security features such as TPM and Secure Boot whenever possible, although those defenses don’t protect against this particular threat. It’s also a good idea to monitor logs for signs of exploitation attempts.
Tomi Engdahl says:
https://etn.fi/index.php/13-news/19461-tietoturvakeskuksen-tyoe-mullistuu-tekoaely-torjuu-ihminen-analysoi
Tietoturvakeskusten eli SOC-yksiköiden työ on suuren muutoksen edessä. Kun kyberhyökkäykset nopeutuvat ja tekoälyagentit alkavat toimia itsenäisesti, puolustajien on automatisoitava yhä suurempi osa työstään. Ihmisen tehtävä siirtyy yksittäisiin hälytyksiin reagoimisesta uhkien analysointiin, riskien arviointiin ja puolustuksen ohjaamiseen. Tämä oli yksi Helsingissä järjestetyn Cyber Security Nordic -tapahtuman keskeisistä viesteistä.
Tomi Engdahl says:
Hakkerit eivät enää murtaudu – ne kirjautuvat sisään
https://etn.fi/index.php/13-news/19460-hakkerit-eivaet-enaeae-murtaudu-ne-kirjautuvat-sisaeaen
Kyberrikollisuuden painopiste on siirtymässä ohjelmistojen haavoittuvuuksista varastettuihin identiteetteihin. Fortinetin tietoturvatutkija Hossein Jazin mukaan rikolliset eivät enää välttämättä tarvitse teknistä murtautumista yrityksen järjestelmiin. Riittää, että he saavat haltuunsa toimivat käyttäjätunnukset.
Seuraavaksi rikollisten tähtäimessä ovat tekoälyagenttien identiteetit. Jazi kuvasi kyberrikollisuuden muutosta eilen Helsingissä Cyber Security Nordic -tapahtumassa. ETN:n haastattelussa Jazi arvioi varastettujen tunnusten olevan jo yksi merkittävimmistä organisaatioiden tietoturvauhista. Hänen mukaansa tunnuksia varastavien haittaohjelmien toiminta on kasvanut viime vuosina erittäin nopeasti.
– Varastetuista tunnuksista on tulossa keskeinen osa kyberrikollisuuden taloutta. Niitä myydään eteenpäin rikollisille, jotka käyttävät niitä päästäkseen organisaatioiden järjestelmiin, Jazi selittää.
Kyse ei kuitenkaan ole enää pelkistä käyttäjätunnuksista ja salasanoista. Rikolliset varastavat myös kirjautumisessa käytettäviä tokeneita, API-avaimia ja muita digitaalisia identiteettejä. Erityisen kiinnostavaksi kohteeksi ovat nousemassa niin sanotut koneelliset identiteetit (non-human identities).
– Myös tekoälyagentit ovat koneellisia identiteettejä. Rikolliset voivat varastaa niiden tunnuksia ja API-avaimia. Ongelmaa pahentaa se, että nämä tunnukset voivat olla pitkäikäisiä ja niitä voidaan käyttää pitkään, Jazi varoittaa.
Tomi Engdahl says:
Mikko Hyppönen: Ohjelmoinnin aika on ohi
https://etn.fi/index.php/13-news/19459-mikko-hyppoenen-ohjelmoinnin-aika-on-ohi
Tietoturva-asiantuntija Mikko Hyppösen mukaan olemme siirtymässä aikaan, jossa tekoäly kirjoittaa kaiken ohjelmakoodin. Lopulta tämä voi johtaa jopa ohjelmistovirheiden ja tietoturvahaavoittuvuuksien katoamiseen. Ennen sitä edessä on kuitenkin vaarallinen siirtymävaihe, jossa tekoäly löytää haavoittuvuuksia, murtautuu järjestelmiin ja toimii tavoilla, joita sen kehittäjät eivät osanneet ennakoida.
– Ohjelmoinnin aika on ohi. Viimeinen ohjelmoija on jo syntynyt.
Näin julisti tällä kertaa Elisan kyberturvaneuvonantajan roolissa esiintynyt Mikko Hyppönen Cyber Security Nordic -tapahtumassa Helsingissä keskiviikkona. Hyppösen mukaan nykyinen sukupolvi jää viimeiseksi, joka ohjelmoi tietokoneita perinteiseen tapaan. Tulevaisuudessa ihmiset saattavat ihmetellä käsin kirjoitettua ohjelmakoodia samalla tavalla kuin nyt ihmettelemme Egyptin pyramideja.
Hyppönen muistutti, että tietokoneet ovat tähän asti tienneet vain sen, mitä ihmiset ovat niille kertoneet. Nyt tilanne muuttuu perustavanlaatuisesti. Tekoälyjärjestelmät pystyvät jo ratkaisemaan ongelmia ja luomaan uutta tavalla, jonka aiemmin ajateltiin olevan mahdollista vain ihmisille.
Muutos näkyy erityisen voimakkaasti tietoturvassa. Hyppönen kertoi ennustaneensa jo GPT-4:n julkaisun aikaan vuonna 2023, että tekoäly alkaisi löytää myös aiemmin tuntemattomia eli niin sanottuja nollapäivähaavoittuvuuksia. Tuolloin osa tietoturva-ammattilaisista piti ajatusta mahdottomana. Nyt tekoälyä käytetään jo laajasti haavoittuvuuksien etsimiseen.
Tekoäly murtautuu jo omille teilleen
Hyppösen mukaan tekoälyn tietoturvariskit jakautuvat kahteen luokkaan. Ensimmäisessä ihmiset käyttävät tekoälyä rikollisiin tarkoituksiin esimerkiksi huijausten, haittaohjelmien ja deepfake-videoiden tuottamiseen. Toinen ja huomattavasti vaikeammin hallittava uhka syntyy, kun tekoälyagentit alkavat toimia itsenäisesti.
Hyppönen nosti esimerkiksi Hugging Facen paljon julkisuutta saaneen tapauksen, jossa tekoälyagentit pyrkivät murtautumaan järjestelmiin peittääkseen jälkensä testitilanteessa. Hänen kuvaamassaan kokeessa agentit olivat muodostaneet jopa hierarkkisen yhteisön, jossa osa oli valmis uhraamaan itsensä muiden hyväksi.
Hyppösen mukaan tekoälyagentit ovat toukokuun jälkeen onnistuneet karkaamaan testausympäristöistään jo kymmeniä kertoja.
Tomi Engdahl says:
https://www.securityweek.com/chinese-hackers-quietly-used-low-severity-esxi-logging-flaw-as-zero-day/
Tomi Engdahl says:
https://www.securityweek.com/chrome-and-firefox-updates-patch-over-200-vulnerabilities/
Tomi Engdahl says:
https://www.securityweek.com/ukrainian-hive-and-nefilim-ransomware-affiliate-gets-70-months-in-us-prison/
Tomi Engdahl says:
Children will bypass social media ban for under 16s, Ofcom warns
Prime minister Andy Burnham intends to proceed with the proposed age restriction
https://www.independent.co.uk/news/uk/home-news/social-media-age-checks-ofcom-b3075424.html?fbclid=IwdGRjcAVQDURjbGNrBVANMmV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEf-lv3hNSGg2yvRmAyGDcfYSzWteIot0QKZlY6dkjXovvBw7Wc51mOtulEj0A_aem_R5q2vq9GPt47X7-ub9Qnjg
Plans to bar under-16s from social platforms could be “significantly” strengthened by age verification checks, though some young people will still bypass the restrictions, Ofcom has warned.
In an evaluation released on Thursday, the media watchdog set out how tech companies might dependably limit access to addictive applications, as well as adult or damaging material.
The watchdog highlighted four techniques that prove “highly effective” for verifying if a user is at least 16: photo ID, banking checks, digital ID, and facial age estimation technology. However, it acknowledged that the possibility of bypass cannot be entirely eradicated.
Ministers are anticipated to lay down formal legislation for the prohibition before the end of this year, ahead of a planned rollout in 2027. Australia enacted a comparable policy last year.
Ofcom said it was “inevitable” some under-16s would get around the checks but added social media firms could reduce the risk by making it easier to report suspected underage accounts or by using technology that estimates a user’s age from their online behaviour.
The regulator also warned that some facial recognition technology could be inaccurate by several years, meaning some users would need to undergo a second check.
Tomi Engdahl says:
PHP2Shell exploited in real-world attacks.
An attacker chained PHP2Shell with a Linux kernel flaw to gain root access to 25 servers across four countries, including three in a U.S. government-affiliated environment.
The intrusion extended into the internal network, where the attacker targeted Active Directory.
Suspected China nexus. Signs of AI-assisted tooling.
Read the full report: https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html
Tomi Engdahl says:
Chained PHP2Shell Exploit Roots 25 Servers, including US Government Servers
https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers?fbclid=IwVERDUAVQH8pleHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHw1jcNogzEFt9s1BeCpKYwI2kgZoxYFDP2Xa4Nrx6b_MwguhZ7S1AMSgwLpw_aem_Qosdom5UqF_xiSRfgkNzfg
Custom PHP2Shell Exploit Chained with Kernel LPE to Root Firewalls in the Wild
On October 25, Dream researchers uncovered artifacts of what appeared to be a Chinese AI-assisted campaign that rooted 25 servers, including systems in a US government-affiliated environment. The attacker combined PHP2Shell with a kernel privilege-escalation exploit to compromise exposed systems.
The affected devices run specific versions of a large vendor’s firewall software. For security purposes, we are not disclosing the vendor or the affected versions, and the vendor has been notified.
The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration.
This included artifacts of a campaign that had rooted 25 servers across the United States, Japan, Taiwan, and South Korea. Once rooted, the attacker zeroed in on three specific servers in a US government-affiliated environment.
The discovered artifacts revealed an operation that began with exploit development in a lab environment and ended with persistent access to a US government organization’s internal Active Directory domain.
AI Usage in Attack
We also observed some evidence of AI-assisted tooling in the attack infrastructure:
Claude Code had been installed
An AI-powered offensive security platform called aiscan was configured with Chinese LLMs DeepSeek and Kimi
API keys for the Chinese reconnaissance platform FOFA were present
While we have no direct evidence that the AI tools were specifically used to write the exploit or the post-exploitation scripts, the code structure, commenting style, and consistency across ~40 scripts suggest AI-assisted development. That said, this operation does not appear to be a fully autonomous nation-state attack.
The Exploit: Two Vulnerabilities Chained Into One Request
The attacker developed two separate exploits and chained them together to achieve root access on any firewall running specific versions of a large vendor’s firewall software in a single HTTP request without any credentials.
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — Remote Code Execution
The implementation we recovered is a custom, non-public build, not a copy of any known public exploit for PHP2Shell. It follows the same underlying concept but appears to have been independently developed and tailored specifically for the targeted firewall platform.
The vulnerability targets PHP’s session.upload_progress mechanism on the firewall’s appweb management server. The firewall OS uses PHP 8.0.30 with a high memory limit that enables the memory corruption stages of the attack.
Fragnesia (CVE-2026-46300) — Kernel Privilege Escalation
Getting code execution as nobody isn’t enough since SELinux confines httpd_t from modifying system files. In order to complete the root, the attacker chained in a second exploit: a Linux kernel vulnerability in the XFRM ESP-in-TCP subsystem.
The Campaign Funnel: From 19,000 Discovered to 25 Exploited
Stage 1: Global Discovery (19,000 targets)
Using FOFA — a Chinese internet asset search engine similar to Shodan — the attacker identified approximately 19,000 internet-facing firewalls from the targeted vendor worldwide. These were devices with management interfaces exposed to the internet, discoverable through certificate fingerprints and HTTP response signatures.
Stage 2: Version Fingerprinting (5,000 alive)
Stage 3: Geographic and Version Filtering (240 targets)
From the 5,000 alive devices, the attacker filtered to servers located in only United States, Japan, Taiwan, and South Korea. They then further filtered to versions matching their exploit profiles (the newer release branches running PHP 8.0.30). This produced a final target list of 240 firewalls.
Stage 4: Automated Exploitation (24 rooted)
The 240 targets were fed into an automated batch runner that exploited them five at a time, with an 1800-second (30-minute) timeout per target. For each success, the batch:
Ran the full PHP2Shell + Fragnesia chain
Planted a 103-byte PHP root webshell in a publicly accessible directory on the firewall
Verified root by executing id through the webshell
Logged the target’s hostname and IP to a success CSV
Moved to the next target
At this point, 24 firewalls had been successfully rooted.
Stage 5: Triage (2 firewalls prioritized)
For 22 of the 24 rooted firewalls, the attacker did nothing beyond planting the webshell. No persistence, no tunnels, no post-exploitation tools. The servers were effectively owned and parked, allowing the attacker to return through the webshell at any time.
Two servers seemingly associated with one target progressed beyond this stage. Both appeared to belong to a US government-affiliated environment.
Stage 6: The Pivot (Shifting from Firewall to Domain)
Among the 24 rooted firewalls, two belonged to a US government-affiliated organization. The running configuration extracted from the first firewall revealed an environment with characteristics suggesting government affiliation: CAC (Common Access Card) authentication, a specific naming prefix, and standardized government-style asset naming. The configuration file contained the organization’s complete internal network topology: domain controllers, a central firewall management server, a Keycloak SSO server, a GitLab instance, VPN gateways, and the Active Directory domain.
The first firewall was rooted on Oct 23 at 18:14 UTC during the automated batch. But it crashed shortly after — likely from the ~900MB of exploit traffic — and never came back online.
The second firewall, whose certificate data definitively linked it to the target organization, had timed out during the original batch.
Recognizing the organization’s value from the first firewall’s configuration, the attacker created a separate, dedicated campaign and successfully exploited it on Oct 24 at 10:09 UTC.
Within hours, the attacker:
Built a persistent tunnel into the internal network.
Conclusion
This operation demonstrates a level of preparation and capability that sets it apart from opportunistic exploitation. The attacker invested significant effort into vulnerability research — obtaining the vendor’s firmware, decrypting it, extracting PHP libraries, building precise memory profiles for 9 different software versions, and calibrating exploit geometry through lab testing. The exploitation itself was automated and efficient: 240 targets attempted in a single batch, with version-specific profiles selected automatically.
There was a clear-cut focus on government targets.
The attacker scanned 19,000 firewalls, rooted 24, and immediately identified the two that mattered. Within hours of compromising a US government-affiliated firewall, they had tunneled into the internal network, compromised a third server using the same PHP2Shell exploit, and launched a full Active Directory attack campaign — all through a chain that started with a single unauthenticated HTTPS request to a management interface that should never have been exposed to the internet.
The 22 other rooted firewalls remain parked with active webshells. The persistent tunnel into the US government organization is likely still running. And the attacker still has 19,000 fingerprinted targets they can revisit as they develop profiles for additional OS versions.
As always, we recommend that organizations rapidly deploy relevant patches.
Tomi Engdahl says:
Outrage after airport self-service checkout asks for 18% tip
The internet is up in arms over the tipping prompt, with one social media user saying, ‘Wish they had negative tip option for irritating me’
https://www.the-independent.com/life-style/self-service-airport-tipping-culture-b3075115.html?fbclid=IwdGRjcAVQJAxjbGNrBVAjrGV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEfWwk8S_eoVFdj6kaJUzteTyItrhzwm2C-TPYeaQiqZDkNlDrmN7lFVmIyHe4_aem_SwB5uhUvEgR–WkxWUWitQ
Tomi Engdahl says:
“If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren’t far behind.” https://trib.al/HyxIt5Z
Take AI to Church
Elon Musk-Linked Startup Says Its AI Agents Hacked Anthropic in Just Hours
“If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren’t far behind.”
https://futurism.com/future-society/startup-ai-agents-hacked-anthropic-hours?fbclid=IwdGRjcAVQMJ5jbGNrBVAwiGV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEfO_g5XCk3sXpeq_qeMIuMg_1nHkZDI_zQg0g0SoPMUZ-i4i8bJbTAKdEbL24_aem_lENluhPA4eyp8EzIy_nQag
A months-old cybersecurity startup that was founded by former members of Elon Musk’s disbanded Department of Government Efficiency (DOGE) claims it has hacked the internal systems of frontier AI lab Anthropic.
As the Washington Post reports, the startup called Cathedral says its AI agents exploited vulnerabilities in business software to access meeting transcripts, details about salaries, job offers, and Slack messages — all in less than 12 hours.
The news comes as concerns over an AI-facilitated cybersecurity nightmare scenario continue to grow. Several frontier labs have confessed this year that their AI models escaped their “sandbox” environments to infiltrate third parties.
However, Anthropic appeared to downplay the severity of the latest hack, telling WaPo that Cathedral only gained access to a “limited set” of sales, HR, and IT systems. The Dario Amodei-led company also claimed that the startup spent days trying to break into its software before giving up and hacking a business software Anthropic was using instead.
Tomi Engdahl says:
Chrome extensions with 13.4 million installs caught hijacking searches
https://www.bleepingcomputer.com/news/security/chrome-extensions-with-134-million-installs-caught-hijacking-searches/?fbclid=IwdGRjcAVQbhZleHRuA2FlbQIxMQBwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABH9NsR5pGRdvmVgsnFP661N1ssj0o0ldrUZLRz9ZSoniNfgfN9H1n9MA1NGJV_aem_MDy3DEL3Azw1IIk4_qcsjQ
A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users’ searches through tracking servers to generate advertising revenue from Bing and Yahoo.
A new report by Socket’s John Tuckner expands on the researcher’s April 2025 discovery of 57 Chrome extensions with 6 million users, adding 264 newly identified add-ons with another 8.7 million users.
“These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser’s default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID,” explained Tuckner.
Tomi Engdahl says:
Microsoft urges Entra ID admins to migrate users to passkeys
https://www.bleepingcomputer.com/news/microsoft/microsoft-reminds-entra-id-admins-to-migrate-users-to-passkeys/amp/?fbclid=IwVERDUAVQe-RleHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABH0g2KvYKMLbRWgQ99ezEkSvir2iu8m79Aob_puhqCxsgOeo2gfipNDve8veX_aem_M9AoD-xwwoegJPosODlWqg
Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027.
This retirement process applies only to Microsoft Entra ID workforce tenant authentication scenarios and not to Azure AD B2C or Microsoft Entra External ID customer identity scenarios
Before Microsoft retires SMS and voice authentication, admins should ensure all users in their organizations use a phishing-resistant method, since they will no longer be able to use them to complete multifactor authentication and log in to their accounts.
Admins can choose from passkeys, QR code authentication, FIDO2 security keys, and other Entra ID-supported sign-in methods.
Tomi Engdahl says:
https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/?fbclid=IwVERDUAVQfDJleHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABH0g2KvYKMLbRWgQ99ezEkSvir2iu8m79Aob_puhqCxsgOeo2gfipNDve8veX_aem_M9AoD-xwwoegJPosODlWqg
Tomi Engdahl says:
Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html
A flaw in the Linux kernel’s TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel’s own CVE team rates it 9.8 out of 10 on the CVSS scale.
Anthropic said on October 27 that its AI model wrote an exploit that uses the flaw to let a remote attacker with no credentials run commands as root on Linux servers with a multipath TCP listener.
As of October 29, Ubuntu and RHEL have not released a fixed kernel. Red Hat, Amazon, Oracle, and SUSE score the flaw between 5.9 and 8.1, lower than the kernel team’s 9.8.
The flaw is a race condition in the code that sets up new IPv4 TCP connections. It can make the kernel read memory it has already freed, a bug type known as a use-after-free.
The kernel fix credits Anthropic researcher Xinyang Ge with reporting the bug. Neither the CVE record nor the fix mentions multipath TCP (MPTCP). The link between that feature and this bug comes from Anthropic’s post.
MPTCP lets one connection use several network paths at once. On Linux, an application must request MPTCP when it opens a socket.
Anthropic’s post says the flaw “was patched upstream and backported to all maintained stable kernel branches.” For distribution users, that fix arrives only in the vendor’s kernel package. Debian, Oracle Linux, SUSE, and Amazon Linux have shipped fixed packages, at least for some of their kernels, but Ubuntu and RHEL have not.
The race happens during the TCP handshake. When a connection is completed, the kernel hands the IP options stored with the pending request to the new socket without copying them.
If that socket is destroyed while another CPU is still using the options to answer a resent connection request, the kernel reads freed memory.
IPv6 is not affected by this race because the kernel copies the options for IPv6 connections.
The bug was introduced in Linux 4.4. Kernel developers applied a fix on October 5, ten days before the CVE was published.
Why the Scores Differ
The kernel’s CVE team added the 9.8 score to the CVE record on October 24, nine days after publishing the CVE.
Its score assumes an attacker who sends a TCP connection request carrying IPv4 Record Route or Timestamp options, then resends the request to try to win the race. The team rated attack complexity low, saying both sides of the race are “attacker-induced.”
In that case, the team says, the bug could send nearby kernel memory back to the attacker, corrupt kernel memory, or crash the system.
Red Hat’s machine-readable advisory file, updated on October 29, lists the impact as Important and scores the flaw 8.1, with high confidentiality and integrity impact. Red Hat’s bug tracker changed the issue’s severity from medium to high the same day. On that day, the CVE page showed Moderate and 5.9.
Oracle and SUSE also score the flaw 8.1, with the same CVSS vector as Red Hat’s advisory file. Those scores match the kernel team’s on every metric except attack complexity, which the vendors rate high and the kernel team rates low. Amazon scores it 7.0.
Red Hat says a remote attacker who can reach an exposed TCP service could trigger the race. Anthropic’s root exploit, however, targeted servers with a multipath TCP listener. The post does not say whether servers without one can be taken over the same way.
If you build your own kernel, the fix is in Linux 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. The kernel’s CVE team recommends updating to the latest stable kernel. It says the kernel community does not support cherry-picking individual fixes.
Tomi Engdahl says:
Google begins certifying Registered App Stores for Android, but not in the US
Easier app installs are coming to third-party stores, pending Google’s stamp of approval.
https://arstechnica.com/gadgets/2026/10/googles-android-registered-app-stores-program-launches-dec-1-applications-now-open/?utm_source=facebook&utm_medium=social&utm_campaign=dhfacebook&utm_content=null&fbclid=Iwb21leAVQS8NleHRuA2FlbQIxMQBwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABH4qlCi4uVZ6j4oTj4KyYtg3trmeAr7cEbz5uMVFduG1bSl7ak-3KO6Pw7hji_aem_UDrOIraTlHbjOXc2ViUpSA
Tomi Engdahl says:
https://www.linkedin.com/safety/go/?url=https%3A%2F%2Flnkd%2Ein%2FducV3dMN&urlhash=xdg9&mt=cR7d8VF6qdowAipo9Q7viejEx4JVDrIUSq_IUryPUq8eEshLfsTEJMEvfznRWYAf01ZIwX4hrEji_S5VVxPXcBX4GshaTV5Vxj74FCx_Pmr1qLUq9Fn9zXuhaFqgfW7xozYt5fkHHxRU-8AQy92Ixg1Z4AbQsyrpStILdy_nexN37cWm4_xHNsPN&isSdui=true
Tomi Engdahl says:
A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System
Sources tell WIRED that an Accenture employee’s personal Claude agent ran on a DOD network for two months before it was identified and the vulnerability could be patched.
https://www.wired.com/story/a-defense-contractor-gave-their-personal-ai-agent-access-to-a-secure-pentagon-system/
Earlier this year, sources tell WIRED, a contractor caused a security incident at the Department of Defense by connecting a secure centralized system used by multiple intelligence agencies to their personal account for Claude Code, Anthropic’s AI coding agent. It appears that the agent used by the contractor, who is employed by global consulting firm Accenture, then sent information about the DOD system, including login credentials, to a high-risk third-party website.
Tomi Engdahl says:
https://jco.fi/fi/php-haavoittuvuus-21-10-yksi-viime-vuosien-merkittavimmista-tietoturvauhista/?fbclid=IwdGRjcAVQmpBleHRuA2FlbQEwAHBkb2YFYWRpZAGrN70HAWzxc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEfeY_TlXsdaOERsbgmLrhEI7VW04xFa-I90tizNSjkmM-hytklFGlO9kC-yrU_aem_HJ1jfjKsCn1yA2LJQNj2lQ&utm_medium=paid&utm_source=fb&utm_id=120251099797110673&utm_content=120251099797130673&utm_term=120251099797120673&utm_campaign=120251099797110673
Tomi Engdahl says:
Your home computer has been taking pictures of your screen every few seconds. Your banking. Your passwords. All of it.
Microsoft calls it a feature. It’s called Recall, and it saves a timeline of everything you do on your own PC… every page, every message, every account… so their AI can remember your life for you.
Most people never turned this on. It arrived with an update, on a computer you paid for, doing a job you never asked it to do.
Here’s how to stop it: Settings, then Privacy and Security, then Recall and Snapshots. Turn it off, and delete the snapshots it already took. Right now there is a photo album of your entire digital life sitting on that machine.
Be honest… did you even know your computer was doing this?
Tomi Engdahl says:
https://etn.fi/index.php/13-news/19459-mikko-hyppoenen-ohjelmoinnin-aika-on-ohi
Tomi Engdahl says:
https://etn.fi/index.php/13-news/19461-tietoturvakeskuksen-tyoe-mullistuu-tekoaely-torjuu-ihminen-analysoi
Tomi Engdahl says:
https://www.securityweek.com/china-linked-hackers-exploit-php2shell-to-root-firewalls/
Tomi Engdahl says:
Artificial Intelligence
Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model
Google’s new frontier model scored 88.2% on SEC-bench Pro and is rolling out first to vetted cyber defenders via its Fairwind Program.
https://www.securityweek.com/google-says-gemini-4-carbon-leads-in-finding-exploiting-and-fixing-vulnerabilities/
Tomi Engdahl says:
https://www.securityweek.com/6-billion-binance-hack-bears-hallmarks-of-north-koreas-tradertraitor/
Tomi Engdahl says:
When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
https://www.securityweek.com/when-risk-becomes-personal-what-security-leaders-can-learn-from-a-cancer-diagnosis/
Risk management leaders educate people on measuring exposure, testing assumptions and advising on how best to prepare for incidents they hope won’t occur. They know that the absence of a security alert does not stand for safety; that resilience depends on preparedness, and that a plan is only as good as the people who can execute it.
But when the risk is personal, those ideas take on a heavier meaning.
Tomi Engdahl says:
Fresh WordPress Vulnerability in Attackers’ Crosshairs
Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.
https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/
Tomi Engdahl says:
Vesipumput tekstailivat toisilleen yli 2,2 miljoonaa tekstiviestiä – Lasku yli 100 000 euroa
Saku Arjanmaa30.10.202618:12Sms
32 000 sivun laskuerittely vaati useita pahvilaatikoita.
https://www.tivi.fi/uutiset/a/779b2712-86ee-4f04-a365-04718b699524
Ruotsalaisessa kunnassa tekstiviestejä toisilleen lähettäneet vesipumput aiheuttivat noin 1,4 miljoonan kruunun laskun. Kaksi pumppua lähetti toisilleen yli 2,2 miljoonaa tekstiviestiä kuukauden aikana.
Tomi Engdahl says:
Tämä tapaus sattui Norrtäljen kunnassa Ruotsissa (pumppujen välisestä tekstiviestiketjusta uutisoi muun hoidassa Norrtälje Tidning).
Tomi Engdahl says:
Tämä tapaus sattui Norrtäljen kunnassa Ruotsissa (pumppujen välisestä tekstiviestiketjusta uutisoi muun hoidassa Norrtälje Tidning).
uutisoinnin keskiössä oli kyseinen vesiosuuskunta (Slottsbrinkens sjövattenförening Mariefredissä) ja tapahtumaketju.
Sen sijaan uutisissa mainitaan selvästi operaattorit ja osapuolet:
Teleyhteydet ja liittymät: Telekommunikaatioyhtiö Telenor, jonka kautta liittymät/SIM-kortit olivat.
Tausta: Tapauksessa oli kyse siitä, että kun 3G-verkko suljettiin, pumppujen ohjauslaitteisto vaati siirtymisen uudempaan tekniikkaan. Uuden laitteiston (SIM-kortin/pumpun ohjausyksikön) testauksen yhteydessä syntyi tekninen bugi, joka sai pumput lähettämään tekstiviestejä toisilleen.
Lähde: Google Gemini
Tomi Engdahl says:
https://www.dn.se/ekonomi/vattenpumpar-smsade-varandra-for-over-1-4-miljoner-kronor/
Tomi Engdahl says:
https://www.aftonbladet.se/nyheter/a/w3qaqo/alphabet-och-intel-rasar-borsen-haller-andan
https://www.svt.se/nyheter/lokalt/sormland/vattenpump-fick-spel-forening-i-mariefred-fick-faktura-pa-over-en-miljon?utm_source=sdrn%3Aaftonbladet%3Aarticle%3AX9Xa87
Tomi Engdahl says:
https://www.facebook.com/share/r/1HWusbqdQu/
När fakturan från Telenor damp ner hos Slottsbrinkens sjövattenförening i Mariefred trodde medlemmarna inte sina ögon.
Den var på 1,4 miljoner kronor och avsåg 2,2 miljoner sms. De hade skickats mellan två av föreningens vattenpumpar.
https://www.dn.se/ekonomi/vattenpumpar-smsade-varandra-for-over-1-4-miljoner-kronor/
Tomi Engdahl says:
A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System
https://www.wired.com/story/a-defense-contractor-gave-their-personal-ai-agent-access-to-a-secure-pentagon-system/?fbclid=IwVERDUAVR-X5leHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABH2cd5luW_98XmRyXaQ8-TOCqicNKYABm2cJ6B65fSILOB0YzCOWgL-nC47yd_aem_o8YixmDnfDcYK_HpiNy2vw
Tomi Engdahl says:
Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners.
https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/
Tomi Engdahl says:
02:22:33 [theguardian] Credit where it’s due to AI for uncovering the PHP flaw – and discredit to the leaker | Letters →
Credit where it’s due to AI for uncovering the PHP flaw – and discredit to the leaker
https://www.theguardian.com/technology/2026/oct/30/credit-where-its-due-to-ai-for-uncovering-the-php-flaw-and-discredit-to-the-leaker?fbclid=IwdGRjcAVSDLFjbGNrBVIMjGV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEfRYvyBpoKg0iAAIVICR8sf9jgAMTqHbP8OU5norDNwuGAHwWSihvNvv_9LsQ_aem_yzog6yYL_aCiQshfhFa88Q
David Gibson says the problem is that details of the flaw were revealed before it was fixed, while Charles MacKinnon notes that we are at the mercy of technology we don’t understand
Chris Stokel-Walker may be right (The internet has broken – again. Shouldn’t the tech firms that make billions from it pay to fix it?, 22 October), but the real issue lies elsewhere. The bugs in the PHP programming language that were recently found by an AI tool have been present for a long time without anybody noticing and without any harm being done – they are extremely obscure.
They were not found by hackers – they were found because an AI tool was used to check the PHP source code, which is a good use of AI.
The problem arose because someone – presumably a real human person and not an AI – leaked details about the bugs before they had a chance to be fixed. If that action is not already illegal, it should be made so, with sufficient penalty to deter others.
David Gibson
Leeds
I read with some disquiet the article by Chris Stokel-Walker. It brought to mind Carl Sagan’s observation in 1995 that “We live in a society exquisitely dependent on science and technology, in which hardly anyone knows anything about science and technology”.
Today, we as citizens and customers are at the mercy of technological systems and processes that we neither understand nor requested. We have been cajoled, persuaded, manipulated and bullied into accepting ways of working and behaving using tools that we do not understand or control (except perhaps to “turn it off and turn it back on again”). All this in order for profit margins to be increased while losing good jobs and quality services.
The dizzying array of background and middleware tools that have been incrementally put together and grafted on to fit with legacy systems in order to further these commercial ambitions lacks any overall design and is sparse in methods of security and maintenance. Welcome to Y2K Mark 2, but this time it’s for real.
Charles MacKinnon
Glasgow
Tomi Engdahl says:
It’s impossible to turn off the entire internet, but it’s still a good idea to be prepared for online services to be disrupted.
https://theconversation.com/what-would-happen-if-the-internet-went-down-295249?utm_medium=Social&utm_source=Facebook#Echobox=1793252465
Tomi Engdahl says:
New TeamViewer vulnerability (CVE-2026-111585) flips the script… the machine you connect to can attack YOUR computer.
No click needed beyond accepting the session. Researcher got code running on a stock Windows viewer — default settings, defenses on.
Here’s how the attack works ↓ https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html
Tomi Engdahl says:
Malicious Claude Code extension on Cursor planted SSH backdoors
https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/?fbclid=IwdGRjcAVSFldleHRuA2FlbQIxMQBwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHwagkg-LA0IH482Z-q2WJLvsyiFaJn-5fPpX68kBHmt-CqJKTcqoQVhJmiZI_aem_WyKfPA6zuDg8UQGGslKX-A
A malicious version of Anthropic’s Claude Code VS Code extension was distributed through Cursor’s extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors.
The extension used the version number 2.1.313 and was distributed between 2:27 a.m. and 1:35 p.m. Pacific Time.
Cursor is an AI-powered code editor built from Microsoft’s open-source Visual Studio Code (VS Code), with support for VS Code extensions. Anthropic’s Claude Code extension brings its AI coding assistant directly into compatible editors, helping developers write and debug code using natural-language instructions.
“The extension runs malicious code that attempts to install a persistent SSH backdoor.”
The malicious code executes when the extension loads, without requiring user interaction with Claude Code.
On Windows, the malware attempts to install and start the OpenSSH server through PowerShell, but it tries to do so via /bin/sh, a Unix shell that isn’t available on standard Windows installations. Due to this, the SSH setup fails.
In both cases, the malware can still install its SSH keys, establish persistence, and attempt to create the reverse tunnel. However, if the SSH server is not already running, the tunnel cannot provide access to the compromised machine.
Cursor removed the malicious extension and temporarily shut down its entire marketplace to audit other extensions and rotate all access keys before making it available again.