Intelligence Feed

2w ago · hacker-news

Attackers remotely hijacked Danfoss AK-SM and AK-SC series refrigeration controllers used in French supermarkets, raising fridge temperatures to as high as 50°C and causing significant food spoilage. The attack affected hundreds of stores across major retail chains including Intermarché, Carrefour, and Monoprix. CERT-FR issued an alert urging operators to disconnect or tightly filter access to these controllers, which are often exposed to the internet. While no specific vulnerability or intrusion method was confirmed, older unsupported models (AK-SM 800, AK-SC 355) were primarily targeted, and Danfoss had previously disclosed CVEs in newer models that could allow authentication bypass and remote code execution.

2w ago · hacker-news

Multiple active threats were reported this week, including exploitation of a critical Atlassian Data Center vulnerability (CVE-2026-21589) within hours of disclosure. A new variant of the DarkSword iOS exploit kit, P7 DarkSword, enables on-device keychain and crypto-wallet theft via watering hole attacks. The Russia-aligned threat actor UAC-0099 continues to evolve its MATCHBOIL malware for persistent execution and payload updates. Google disclosed unauthorized HTTPS certificates were issued after attackers hijacked ccTLDs for .gh, .as, and .sl by compromising third-party operators. A vulnerability in GoBalance allowed attackers to hijack TOR .onion sites, including the darknet forum Dread. Additionally, the FBI disrupted infrastructure linked to the China-aligned Flax Typhoon group.

2w ago · hacker-news

A critical vulnerability, CVE-2026-85097 (CVSS 10.0), in the Bricksforge WordPress plugin is under active exploitation, enabling unauthenticated remote code execution (RCE). Attackers exploit a flaw in file upload validation by uploading a GIF/PHP polyglot file and manipulating the 'temporaryFileUploads' parameter to execute PHP code via mismatched URL extensions. Exploitation targets the '/wp-json/bricksforge/v1/form_submit' or '/wp-admin/admin-ajax.php' endpoints with crafted payloads, using techniques like alternate PHP extensions, case manipulation, and URL encoding to bypass filters. At least 63 unique IPs have been observed in attack campaigns, with six responsible for nearly half of all requests, indicating automated, distributed exploitation. Users are urged to update to version 4.0.1 and audit for suspicious form submissions and unexpected PHP files in upload directories.

2w ago · hacker-news

A critical pre-authenticated server-side request forgery (SSRF) vulnerability, CVE-2026-102255 (CVSS score: 10.0), in SonicWall SMA 1000 appliances is being actively exploited shortly after public disclosure. Patches were released on October 6, 2026, but exploitation attempts began as early as October 8, with 135 observed attempts originating from two unique U.S.-based IP addresses. The flaw allows remote attackers to force the appliance to make unauthorized internal requests, potentially leading to initial access, credential theft, and lateral movement into internal corporate networks.

2w ago · hacker-news

Ledger has identified an unauthorized hardware implant in at least one Ledger device sold through the reseller CryptoBilis, leading to theft of cryptocurrency funds exceeding $86 million from affected users in Southeast Asia. The compromised devices were tampered with, potentially including pre-generated recovery phrases or hardware modifications, allowing attackers to access user wallets. Ledger is warning users who purchased from CryptoBilis in the last 90 days to avoid setting up their devices and to move assets to a new Ledger signer if they already set up the device. The incident highlights supply chain risks from unauthorized resellers, and Ledger is investigating the scope with CryptoBilis having paused all hardware wallet sales.

3w ago · hacker-news

Multiple U.S. states have filed lawsuits against TP-Link Systems over claims of misleading consumers about router security and ties to China. The complaints highlight real-world attacks involving TP-Link routers, including exploitation by state-backed hackers from China and Russia. Specific vulnerabilities in TP-Link devices, particularly those supplied by ISPs under the Aginet brand, were disclosed and technically detailed by SEC Consult, allowing unauthenticated attackers to gain full control of affected devices. These flaws, including CVE-2025-30237 through CVE-2025-30241, enable privilege escalation, command execution, and credential decryption, with fixes distributed via ISPs but not always accessible to end users.

3w ago · hacker-news

The China-linked threat actor Flax Typhoon has exploited five vulnerabilities in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND to gain initial access to organizations and exfiltrate sensitive data. These vulnerabilities were added to CISA's Known Exploited Vulnerabilities (KEV) catalog, and federal agencies are mandated to patch or discontinue use by October 11, 2026. The attacks involve scanning tools, cross-site scripting, password spraying on Microsoft Exchange servers, persistence via VPN software, and data exfiltration using scripts.

3w ago · hacker-news

Threat actors are exploiting two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, in the AhsayCBS backup utility to gain remote code execution on affected systems. The attackers chain the flaws to bypass authentication and execute arbitrary commands, leading to the deployment of web shells and XMRig cryptocurrency miners disguised as Microsoft Edge. Post-exploitation activities include reconnaissance, cryptomining, and the use of an AI-assisted PowerShell script that interferes with Windows Task Manager to avoid detection.

3w ago · hacker-news

Security researchers have published a working exploit called AnyPwn for a pre-authentication remote code execution vulnerability in AnyDesk Linux versions prior to 8.0.3. The flaw is a heap buffer overflow in the session protocol that allows attackers to achieve root access via direct TCP connections on port 7070. The exploit relies on a 32-bit integer overflow when calculating buffer size, leading to a heap-based buffer overflow that corrupts adjacent memory and enables arbitrary code execution using a ROP chain. Although AnyDesk patched the issue in June 2026, no CVE has been assigned and no formal advisory was issued.

3w ago · hacker-news

P7 DarkSword is a new variant of the DarkSword iOS exploit kit that enhances stealth and data theft capabilities, including exfiltration of iCloud Keychain, cryptocurrency wallet data, and remote command execution on compromised iPhones. The kit leverages previously undocumented iOS vulnerabilities CVE-2025-24201 and CVE-2025-31200 to escape browser sandbox and achieve kernel-level privileges. It has been used in attacks targeting Saudi Arabia, Turkey, Malaysia, and Ukraine by multiple threat actors, including PARS Defense and Star Blizzard. Researchers also identified active C2 infrastructure and open directories linked to Chinese-speaking operators running exploitation-as-a-service with a focus on cryptocurrency theft.

3w ago · hacker-news

The FBI has arrested another suspected member of the ShinyHunters extortion group, believed to be involved in the breach of the FBI's jobs portal, FBIjobs.gov. The breach, attributed to ShinyHunters, resulted in the theft of sensitive data on FBI agents and job applicants, including personal, medical, and psychiatric information. The breach occurred due to a contractor's failure to apply a security patch on a third-party platform, reportedly Oracle's PeopleSoft, managed by Accenture. The FBI has linked ShinyHunters to over 140 breaches and at least $70 million in extortion payments since the previous year.

3w ago · hacker-news

A credential-theft campaign dubbed GhostAction has compromised developer accounts of high-profile open-source maintainers to inject malicious GitHub Actions workflows into hundreds of repositories. The injected workflows, named 'security-audit.yml' or 'github_actions_security.yml', exfiltrate secrets such as API keys, cloud credentials, and tokens to a hard-coded IP address over HTTP. The attack chain begins with stolen personal access tokens, followed by reconnaissance and deployment of the malicious workflow under the victim's identity, enabling harvesting of credentials from both the working tree and git history.

3w ago · hacker-news

A targeted campaign against South Korean financial firms, including Shinhan Bank and Yegaram Savings Bank, leveraged the open-source AI-powered penetration testing tool ARTEX, developed by Autumn-27, to conduct data theft operations. The attacks, active from late September to early October 2026, involved a suspected Chinese-speaking threat actor using a Hong Kong-based IP address hosting the ARTEX instance and interacting with LLMs such as DeepSeek, GLM, and Grok. The actor also used Claude to research methods for selling stolen Korean data on Telegram and referenced the Telegram account @YY520CN. CrowdStrike linked the activity to financial motivation, though no group has been definitively attributed. In response, the ARTEX developer discontinued the project and moved it to closed source due to misuse.

3w ago · hacker-news

Citrix has patched a critical vulnerability, CVE-2026-107406, in NetScaler ADC and NetScaler Gateway appliances that could allow remote code execution or denial-of-service when the devices are configured as SAML identity providers or service providers. The flaw, which has a CVSS score of 9.5, is memory overflow-based and requires specific SAML-related configurations to be exploitable. While there is no evidence of active exploitation to date, Citrix warns that Secure Private Access Hybrid deployments are also affected and must be upgraded to patched versions to mitigate risk.

3w ago · hacker-news

A critical vulnerability in GoBalance, a Go-based reimplementation of Tor's OnionBalance used by dark web sites for availability, allows attackers to recover the full private key of a .onion service from publicly available descriptors. This flaw stems from GoBalance using only the first 32 bytes of a 64-byte Tor private key during signing, effectively exposing the secret randomness used in signatures and enabling full key recovery from a single descriptor. As a result, attackers can hijack .onion addresses by creating valid descriptors for the same address, redirecting traffic to malicious sites. High-profile dark web services including Dread and Omega were confirmed compromised, with Dread attributing the incident to this flaw after initially suspecting operator error.

3w ago · hacker-news

The npm package 'tensorlake' was compromised in a supply chain attack delivering a credential-stealing and self-propagating worm named Shai-Hulud. The malicious version 0.5.144 includes a preinstall hook that executes an obfuscated JavaScript loader, which deploys malware to harvest credentials from npm, GitHub, AWS, Kubernetes, Vault, SSH keys, and cryptocurrency wallets. The malware establishes persistence, exfiltrates data via GitHub repositories, uses Ethereum for C2 resolution, and can trigger destructive actions if stolen tokens are revoked. It also modifies project files in AI development environments to re-execute upon project access.

3w ago · hacker-news

Zhang Yu, a Chinese national and director at Shanghai Firetech Information Science and Technology, is wanted by U.S. authorities for his alleged role in state-sponsored cyber espionage activities linked to the HAFNIUM campaign. He is charged in connection with the 2021 Microsoft Exchange Server attacks that exploited zero-day vulnerabilities, including ProxyLogon, to compromise over 12,700 U.S. organizations. The U.S. State Department is offering up to $10 million for information leading to his identification or location. Zhang allegedly coordinated hacking operations on behalf of China's Ministry of State Security, targeting U.S. universities involved in COVID-19 research and an international law firm, alongside co-conspirator Xu Zewei, who was extradited to the U.S. in April 2026.

3w ago · hacker-news

Security researchers identified 16 malicious Firefox extensions designed to impersonate legitimate cryptocurrency wallets, specifically Rabby and OKX Wallets. These extensions intercept and exfiltrate cryptocurrency wallet recovery phrases and private keys by sending them to attacker-controlled Cloudflare Workers domains. The extensions are part of an ongoing campaign that reuses infrastructure and code while rotating names and versions, indicating a persistent threat targeting cryptocurrency users.

3w ago · hacker-news

Wazza is a newly identified phishing kit that targets banking, government, and manufacturing sectors across the US, EU, and Australia. It employs a multi-stage routing infrastructure to filter traffic and evade detection, only delivering the final Adobe-themed Device Code phishing page after validating session tokens and browser telemetry. This layered approach complicates automated analysis and increases investigation time for MSSPs, as the malicious behavior is hidden behind multiple redirects and access controls.

3w ago · hacker-news

A critical arbitrary file access vulnerability, CVE-2026-21589, in multiple Atlassian Data Center products is being actively exploited within hours of public disclosure. The flaw allows unauthenticated attackers to retrieve sensitive files from the webroot directory by exploiting path resolution logic in Atlassian's web-resource handling, requiring only knowledge of the target file's exact path. Exploitation attempts have already been observed from multiple IP addresses, with the potential to extract credentials and gain administrative access, particularly in Crowd and Jira instances. Immediate patching is advised as automated scanning via tools like Nuclei is expected to increase exploitation activity.

3w ago · hacker-news

The FBI and USSS have issued a warning about the ongoing FortiBleed campaign, which targets internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The threat actors exploit reused or leaked credentials and legacy SHA-256 password storage to harvest and crack authentication data at scale. The campaign has collected over 86,644 valid credentials from 194 countries, enabling lateral movement, privilege escalation, and data exfiltration. Attackers create new administrative accounts for persistence and are suspected to be initial access brokers selling access to ransomware groups such as INC and Lynx.

3w ago · hacker-news

A malware family named PoeLLM has infected over 3,400 servers by targeting exposed AI and LLM infrastructure, repurposing them for cryptocurrency mining and botnet expansion. The campaign, dubbed Canto Incognito, uses compromised servers to scan and exploit other vulnerable systems, connecting victims to the Kryptex mining service. The malware retrieves its command-and-control address from a poem hosted in a GitHub repository, with changes to the poem indicating C2 updates. The activity is attributed to an Italian-speaking threat actor with moderate confidence, targeting enterprise services like LiteLLM, Gotenberg, Gitea, and Ivanti Sentry.

3w ago · hacker-news

A supply chain attack dubbed MALFEX has distributed eight malicious npm packages, collectively downloaded over 40,000 times, delivering the Overlord RAT and a Node.js-based information stealer. The threat actor, believed to be Portuguese-speaking, uses postinstall hooks to execute malicious JavaScript payloads that download Windows executables from suspicious domains. Some packages act as loaders for Overlord RAT, while others deploy a stealer targeting Discord, browsers, Telegram, and cryptocurrency wallets, with infrastructure hosted on a Brazilian application platform.

3w ago · hacker-news

A critical unpatched vulnerability, CVE-2026-105192, exists in LMCache versions 0.3.9 through 0.5.5 and affects release candidates and the development branch. The flaw resides in the multiprocess mode where the cache server uses ZeroMQ without authentication and deserializes untrusted data using Python's pickle module, allowing unauthenticated remote code execution. Attackers can execute arbitrary code with the privileges of the LMCache process, which runs as root in official container images. JFrog, who discovered the flaw, warns operators to avoid exposing the multiprocess server to routable networks until a fix is available.

3w ago · hacker-news

SonicWall has patched four vulnerabilities in its SMA1000 appliances, the most severe being a pre-authentication server-side request forgery (SSRF) flaw tracked as CVE-2026-102255 with a CVSS score of 10.0. This SSRF vulnerability exists in the WorkPlace portal and could allow unauthenticated attackers to send requests through the appliance to access internal functionality and perform unauthorized operations. The other three flaws require authentication and include an OS command injection, a Zip Slip vulnerability, and a stored cross-site scripting (XSS) issue. SonicWall has not observed exploitation in the wild for these newly patched flaws, but notes this is the third time in 2026 a CVSS 10.0 pre-auth SSRF flaw has been fixed in WorkPlace.

3w ago · hacker-news

Over 100 compromised websites have been injected with malicious JavaScript that displays a fake Cloudflare verification page to deliver LunexStealer, an information-stealing malware. The attack, attributed to threat cluster UAC-0277, uses social engineering via the 'ClickFix' technique to trick users into executing a malicious MSI package. The malware installs a malicious browser extension called LUNARAXE, which steals credentials and browsing data, and deploys an auxiliary component NAIVEMESS for file system access via PowerShell. The campaign uses Ethereum-based smart contracts (EtherHiding) to control script behavior and target Windows users arriving from search engines.

3w ago · hacker-news

A new ClickFix attack technique leverages browser cache smuggling to bypass Windows Run dialog character limits and execute malicious payloads. Attackers trick users into pasting commands that retrieve and execute cached scripts, such as VBScript, which then download PowerShell payloads and establish persistence. The attack chain leads to credential theft via .NET assemblies injected into legitimate processes like 'timeout.exe' and connects to malicious domains for further stages. This method has been used by nation-state actors like North Korea's Stardust Chollima and Russia's Sandworm.

3w ago · hacker-news

Unauthorized parties accessed the personal data of approximately 8.8 million individuals in Denmark's Central Person Register (CPR) by exploiting a private company's legitimate access rights. The breach occurred over a 10-day period in September, during which a large volume of automated queries were made to identify valid CPR numbers. The Danish digitalization ministry confirmed the incident, noting that names, addresses, and CPR numbers were exposed, though it remains unclear how attackers gained access to the company's credentials or whether the data was exfiltrated or used. The company's access has since been revoked, and investigations are ongoing by both the data protection authority Datatilsynet and law enforcement.

3w ago · hacker-news

The FBI removed an Accenture contractor following a data breach that exposed personal information of thousands of FBI employees. The breach occurred due to the contractor's failure to apply a critical security patch on Oracle PeopleSoft, which was exploited by the ShinyHunters threat group. ShinyHunters leveraged a URL-encoding bypass technique to exploit CVE-2026-35273 in the PeopleSoft Environment Management Hub (PSEMHUB), circumventing web application firewall protections. The FBI has taken steps to mitigate further risk and is actively investigating with partner agencies, resulting in multiple arrests linked to ShinyHunters.

3w ago · hacker-news

Linux backdoors have been observed targeting telecom and network appliances in South Korea and Taiwan by impersonating legitimate email security tools such as SpamSniper and ShareTech to evade detection. The threat involves a new variant of BPFDoor and a previously undocumented Linux implant named AVERAT, both using process name spoofing and C2 over SMTP on port 25. The BPFDoor variants are linked to the Red Menshen threat group and use BPF-based magic packet triggering wrapped in HTTPS POST requests to bypass deep packet inspection. AVERAT is deployed via a dropper that decrypts payloads using the key 'ShareTech' and supports extensive post-compromise capabilities including shell access, file upload/download, and process manipulation.