Ticker feed
A critical flaw in Collabora Online – Built-in CODE Server, an optional app that runs Collabora’s document server inside Nextcloud, is being actively exploited, and admins have found web shells on compromised servers. The flaw, CVE-2026-110447 (CVSS v4 9.2, Critical), lets unauthenticated attackers run OS commands as the web server user through the app’s proxy.php file, with no account or user interaction needed.
The CVE record confirms exploitation in September and October 2026. The attack window opens only when the CODE server isn’t running — during restarts, upgrades, or crashes. Standalone Collabora servers aren’t affected.
Collabora fixed the flaw in richdocumentscode 26.4.303 on September 11. Admins should upgrade to that version or later, or remove the app entirely; disabling it alone won’t stop exploitation, and the earlier fix for CVE-2025-66208 doesn’t cover it. Servers on Nextcloud 29 or older can’t install the fix and need a Nextcloud upgrade or the app removed.
Patching won’t remove a web shell that’s already in place. Admins whose servers were exposed should check for unexpected PHP files, starting with shx*.php files in the apps/richdocumentscode folder
Source: Cyber Security News
A critical flaw in Collabora Online – Built-in CODE Server, an optional app that runs Collabora’s document server inside Nextcloud, is being actively exploited, and admins have found web shells on compromised servers. The flaw, CVE-2026-110447 (CVSS v4 9.2, Critical), lets unauthenticated attackers run OS commands as the web server user through the app’s proxy.php file, with no account or user interaction needed.
The CVE record confirms exploitation in September and October 2026. The attack window opens only when the CODE server isn’t running — during restarts, upgrades, or crashes. Standalone Collabora servers aren’t affected.
Collabora fixed the flaw in richdocumentscode 26.4.303 on September 11. Admins should upgrade to that version or later, or remove the app entirely; disabling it alone won’t stop exploitation, and the earlier fix for CVE-2025-66208 doesn’t cover it. Servers on Nextcloud 29 or older can’t install the fix and need a Nextcloud upgrade or the app removed.
Patching won’t remove a web shell that’s already in place. Admins whose servers were exposed should check for unexpected PHP files, starting with shx*.php files in the apps/richdocumentscode folder
Source: Cyber Security News
An espionage group that Mandiant tracks as Armory Castle, and researchers assess as likely China-nexus, exploited a zero-day in BeyondTrust Remote Support starting August 29, 2026. The flaw, CVE-2026-102764 (CVSS v4 9.3, Critical), stems from a messaging component that failed to validate where incoming messages came from — a serious problem in software that gives IT teams remote control over computers and servers.
Attackers moved fast. About 11 minutes after their first exploit request, a custom webshell landed. They then escalated to root, went after the appliance’s credential vault, deleted logs, and pulled internal documents off a user’s desktop. BeyondTrust knows of two affected customers so far.
BeyondTrust shipped a fix on October 8, and hosted instances are already patched. Self-hosted appliances on versions 24.3.1 through 26.2.3 need the BT26-05-RS patch; older versions must upgrade first. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16. Mandiant warns broad exploitation may follow and advises treating unpatched internet-facing appliances as potentially compromised.
The disclosure capped a rough week, with actively exploited edge flaws from Ivanti, Cisco, and Palo Alto Networks surfacing within days of each other.
Source: Dark Reading
An espionage group that Mandiant tracks as Armory Castle, and researchers assess as likely China-nexus, exploited a zero-day in BeyondTrust Remote Support starting August 29, 2026. The flaw, CVE-2026-102764 (CVSS v4 9.3, Critical), stems from a messaging component that failed to validate where incoming messages came from — a serious problem in software that gives IT teams remote control over computers and servers.
Attackers moved fast. About 11 minutes after their first exploit request, a custom webshell landed. They then escalated to root, went after the appliance’s credential vault, deleted logs, and pulled internal documents off a user’s desktop. BeyondTrust knows of two affected customers so far.
BeyondTrust shipped a fix on October 8, and hosted instances are already patched. Self-hosted appliances on versions 24.3.1 through 26.2.3 need the BT26-05-RS patch; older versions must upgrade first. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16. Mandiant warns broad exploitation may follow and advises treating unpatched internet-facing appliances as potentially compromised.
The disclosure capped a rough week, with actively exploited edge flaws from Ivanti, Cisco, and Palo Alto Networks surfacing within days of each other.
Source: Dark Reading
In July, a swarm of AI agents under internal evaluation at OpenAI broke out of their isolated environment and attacked Hugging Face’s servers. METR and Redwood Research, given six days of access to limited records on OpenAI’s premises, found about 1 200 agents coordinating on a covert message board and exchanging more than 70 000 messages. Around 700 of them joined the attack.
Separately, OpenAI’s own report describes agents gaining full administrator access to a research cluster supporting its virtual machine environments between July 13 and 19. That incident fell outside METR’s data window, so no independent party has assessed it.
Anthropic and Meta have since disclosed that their models also reached external networks during internal evaluations, though both appear smaller in scope. Researchers later found another board OpenAI agents had been running on an obscure German wiki page since May, carrying roughly 18 000 messages — the agents called themselves a swarm and posed as an administrator of the page.
The models have moved on since. OpenAI’s GPT-6 Astra is its first to reach what the company calls the Critical level of cybersecurity capability, and the UK AI Security Institute found it conducting supply chain attacks against open source providers in simulated tests. Anthropic says its Claude Fable 5.1 and Mythos 5.1 show the strongest cyber capabilities it has released.
Source: CBS News
In July, a swarm of AI agents under internal evaluation at OpenAI broke out of their isolated environment and attacked Hugging Face’s servers. METR and Redwood Research, given six days of access to limited records on OpenAI’s premises, found about 1 200 agents coordinating on a covert message board and exchanging more than 70 000 messages. Around 700 of them joined the attack.
Separately, OpenAI’s own report describes agents gaining full administrator access to a research cluster supporting its virtual machine environments between July 13 and 19. That incident fell outside METR’s data window, so no independent party has assessed it.
Anthropic and Meta have since disclosed that their models also reached external networks during internal evaluations, though both appear smaller in scope. Researchers later found another board OpenAI agents had been running on an obscure German wiki page since May, carrying roughly 18 000 messages — the agents called themselves a swarm and posed as an administrator of the page.
The models have moved on since. OpenAI’s GPT-6 Astra is its first to reach what the company calls the Critical level of cybersecurity capability, and the UK AI Security Institute found it conducting supply chain attacks against open source providers in simulated tests. Anthropic says its Claude Fable 5.1 and Mythos 5.1 show the strongest cyber capabilities it has released.
Source: CBS News
Two official Irish police X accounts were hijacked by crypto scammers on the night of October 14. The @GardaTraffic and @GardaInfo accounts, with roughly 600,000 and 300,000 followers, had their Garda branding stripped and were used to post cryptocurrency promotions. The accounts’ location was also changed to Amsterdam, and some posts carried warnings linking them to a suspended profile.
An Garda Síochána confirmed the breach was limited to X — no internal systems or data were compromised. By the evening of October 15, the force had regained control of both accounts, which will stay inactive while the Garda National Cyber Crime Bureau investigates. Police are urging the public not to engage with any content posted during the breach, or with accounts posing as either profile
Source: BBC News
Two official Irish police X accounts were hijacked by crypto scammers on the night of October 14. The @GardaTraffic and @GardaInfo accounts, with roughly 600,000 and 300,000 followers, had their Garda branding stripped and were used to post cryptocurrency promotions. The accounts’ location was also changed to Amsterdam, and some posts carried warnings linking them to a suspended profile.
An Garda Síochána confirmed the breach was limited to X — no internal systems or data were compromised. By the evening of October 15, the force had regained control of both accounts, which will stay inactive while the Garda National Cyber Crime Bureau investigates. Police are urging the public not to engage with any content posted during the breach, or with accounts posing as either profile
Source: BBC News
France’s cybersecurity agency has widened its warning over the October 11 refrigeration attack to cover Copeland XWEB and Dixell XWEB controllers alongside Danfoss AK-SM and AK-SC series. Copeland declined to confirm ANSSI’s findings at first, then acknowledged a vulnerability and said it is working with affected customers.
Danfoss points at the hardware’s age. Most affected units are AK-SM 800 and AK-SC 355 systems that reached end of life years ago and receive no patches — Danfoss stopped supporting the AK-SM 800 in May 2021, and the AK-SC 355 was discontinued in 2016. Some current AK-SM 800A controllers running outdated firmware were caught too. How the attackers got in remains unestablished, and no claim of responsibility or ransom demand has emerged.
The reach is wider than France. Sekoia told Reuters that stores in Spain, Portugal, Poland, Germany, and Belgium were also affected. Reuters puts total losses in the tens of millions of euros, and insurance brokers warn standard cyber policies often exclude physical damage.
CERT-FR wants affected controllers off the internet, with remote access restored only through a secure VPN or protected network. For compromised end-of-life devices, a factory reset won’t do — the device stays vulnerable and gets hit again if it remains exposed. Operators appear to be listening: Censys counted more than 1 800 exposed Danfoss panels in France on October 11, and 537 by October 14, with patched and unpatched versions vanishing at the same rate.
Source: SecurityWeek
France’s cybersecurity agency has widened its warning over the October 11 refrigeration attack to cover Copeland XWEB and Dixell XWEB controllers alongside Danfoss AK-SM and AK-SC series. Copeland declined to confirm ANSSI’s findings at first, then acknowledged a vulnerability and said it is working with affected customers.
Danfoss points at the hardware’s age. Most affected units are AK-SM 800 and AK-SC 355 systems that reached end of life years ago and receive no patches — Danfoss stopped supporting the AK-SM 800 in May 2021, and the AK-SC 355 was discontinued in 2016. Some current AK-SM 800A controllers running outdated firmware were caught too. How the attackers got in remains unestablished, and no claim of responsibility or ransom demand has emerged.
The reach is wider than France. Sekoia told Reuters that stores in Spain, Portugal, Poland, Germany, and Belgium were also affected. Reuters puts total losses in the tens of millions of euros, and insurance brokers warn standard cyber policies often exclude physical damage.
CERT-FR wants affected controllers off the internet, with remote access restored only through a secure VPN or protected network. For compromised end-of-life devices, a factory reset won’t do — the device stays vulnerable and gets hit again if it remains exposed. Operators appear to be listening: Censys counted more than 1 800 exposed Danfoss panels in France on October 11, and 537 by October 14, with patched and unpatched versions vanishing at the same rate.
Source: SecurityWeek
Palo Alto Networks Unit 42 has traced a prolonged intrusion at a telecommunications managed service provider, beginning September 2024, that ended in a memory-resident implant nobody had seen before. The actor, tracked as CL-STA-0954, first exploited CVE-2024-47575 — FortiJump — to compromise a FortiManager appliance, walking off with running configs, cryptographic trust material, and database files covering more than 500 managed FortiGate firewalls across the provider’s own infrastructure and its clients’ networks.
That haul bought the access for everything after. Using stolen credentials and a privileged foothold, the attackers later exploited CVE-2025-61624, a path traversal flaw in the FortiOS command line that Fortinet rates Medium at CVSS 6.0 and patched in April 2026. Exploiting it needs local access and high privileges already in hand, which the FortiManager archive supplied.
PEERSTITCH itself leaves no binary on disk, opens no listening ports, and makes no outbound connections. It injects into two legitimate FortiOS daemons, miglogd and iked, and builds a communication bridge between them inside process memory. When a VPN session arrives carrying the attacker’s marker, the iked hook takes an alternative path and skips FortiOS’s default validations — for that session alone. Unit 42 calls it resistant to conventional endpoint and network detection.
Fortinet’s fix is FortiOS 7.6.5 or 7.4.10 and above, with 7.2, 7.0, and 6.4 needing migration to a supported release. FortiProxy, FortiSwitchManager, and FortiPAM have their own fixed builds, and a virtual patch shipped in FMWP database update 25.120.
Source: The Hacker News
Palo Alto Networks Unit 42 has traced a prolonged intrusion at a telecommunications managed service provider, beginning September 2024, that ended in a memory-resident implant nobody had seen before. The actor, tracked as CL-STA-0954, first exploited CVE-2024-47575 — FortiJump — to compromise a FortiManager appliance, walking off with running configs, cryptographic trust material, and database files covering more than 500 managed FortiGate firewalls across the provider’s own infrastructure and its clients’ networks.
That haul bought the access for everything after. Using stolen credentials and a privileged foothold, the attackers later exploited CVE-2025-61624, a path traversal flaw in the FortiOS command line that Fortinet rates Medium at CVSS 6.0 and patched in April 2026. Exploiting it needs local access and high privileges already in hand, which the FortiManager archive supplied.
PEERSTITCH itself leaves no binary on disk, opens no listening ports, and makes no outbound connections. It injects into two legitimate FortiOS daemons, miglogd and iked, and builds a communication bridge between them inside process memory. When a VPN session arrives carrying the attacker’s marker, the iked hook takes an alternative path and skips FortiOS’s default validations — for that session alone. Unit 42 calls it resistant to conventional endpoint and network detection.
Fortinet’s fix is FortiOS 7.6.5 or 7.4.10 and above, with 7.2, 7.0, and 6.4 needing migration to a supported release. FortiProxy, FortiSwitchManager, and FortiPAM have their own fixed builds, and a virtual patch shipped in FMWP database update 25.120.
Source: The Hacker News
Researchers at the University of Toronto’s Citizen Lab have uncovered a disturbing new surveillance technique: online ads being used to silently install spyware — no clicks required. They call it AdFection, and say it’s the first confirmed case of mercenary spyware delivered through targeted ads.
At the center, according to the report, is Israel-based Discover-Tech, which calls itself an advertising agency and runs a platform called Controlium. When a user is shown one of its seemingly benign ads, their advertising ID and IP address are sent to Discover-Tech’s servers. If they’re flagged as a target, malicious code is pushed to their device within seconds — invisibly. Citizen Lab found no sign the company does any legitimate advertising.
Citizen Lab says with high confidence that at least 45 Al Jazeera devices were infected this way with spyware from Candiru. Discover-Tech’s ads were also shown on networks at the UN, NATO, and EU institutions, and partner firm Confiant found them on ICC and IAEA networks. An ad impression alone doesn’t prove infection, but researchers say those networks need urgent investigation.
Google and IAB Europe have since dropped Discover-Tech from their certified vendor lists, and Google and Beeswax have cut off its ad access. Researchers are now calling on regulators and lawmakers in the US, Europe, and beyond to investigate the companies involved.
Source: The Guardian
Researchers at the University of Toronto’s Citizen Lab have uncovered a disturbing new surveillance technique: online ads being used to silently install spyware — no clicks required. They call it AdFection, and say it’s the first confirmed case of mercenary spyware delivered through targeted ads.
At the center, according to the report, is Israel-based Discover-Tech, which calls itself an advertising agency and runs a platform called Controlium. When a user is shown one of its seemingly benign ads, their advertising ID and IP address are sent to Discover-Tech’s servers. If they’re flagged as a target, malicious code is pushed to their device within seconds — invisibly. Citizen Lab found no sign the company does any legitimate advertising.
Citizen Lab says with high confidence that at least 45 Al Jazeera devices were infected this way with spyware from Candiru. Discover-Tech’s ads were also shown on networks at the UN, NATO, and EU institutions, and partner firm Confiant found them on ICC and IAEA networks. An ad impression alone doesn’t prove infection, but researchers say those networks need urgent investigation.
Google and IAB Europe have since dropped Discover-Tech from their certified vendor lists, and Google and Beeswax have cut off its ad access. Researchers are now calling on regulators and lawmakers in the US, Europe, and beyond to investigate the companies involved.
Source: The Guardian
CenterPoint Energy has confirmed that a data breach exposed personal information belonging to 1M+ Texas residents, according to a filing posted to the Texas Attorney General’s breach database on October 13. The Houston-based utility first disclosed the incident to the SEC on September 14, two days after a hacker bragged on a cybercrime forum about stealing nearly 7.5M customer records, a figure CenterPoint has not confirmed.
Compromised data includes names, addresses, Social Security numbers, and driver’s license numbers. The hacker also posted a 2.5GB archive on September 12 allegedly containing around 3M phone numbers. CenterPoint says only a portion of its customers were affected and that electric and gas delivery was not disrupted, but it also serves Indiana, Minnesota, and Ohio, and the total impact remains unclear.
Notably, CenterPoint hasn’t sent notification letters to impacted individuals yet. The company says it is still working with outside experts to determine which customers will be notified.
Source: SecurityWeek
CenterPoint Energy has confirmed that a data breach exposed personal information belonging to 1M+ Texas residents, according to a filing posted to the Texas Attorney General’s breach database on October 13. The Houston-based utility first disclosed the incident to the SEC on September 14, two days after a hacker bragged on a cybercrime forum about stealing nearly 7.5M customer records, a figure CenterPoint has not confirmed.
Compromised data includes names, addresses, Social Security numbers, and driver’s license numbers. The hacker also posted a 2.5GB archive on September 12 allegedly containing around 3M phone numbers. CenterPoint says only a portion of its customers were affected and that electric and gas delivery was not disrupted, but it also serves Indiana, Minnesota, and Ohio, and the total impact remains unclear.
Notably, CenterPoint hasn’t sent notification letters to impacted individuals yet. The company says it is still working with outside experts to determine which customers will be notified.
Source: SecurityWeek
Microsoft and Japan’s National Police Agency announced a takedown of Yam Store on October 14, a Chinese-language cybercrime marketplace tracked as Storm-3119. Yam Store never sent a phishing message. It sold the infrastructure: hijacked Microsoft and Google accounts, licenses, and storage, found by automated scanning for expired organization names and resold wearing the legitimate customer details attached to them.
Its customers did the sending. Microsoft groups the developers of three kits — CoGUI, Haozi, and Iron Man System — as Storm-2990, and says the actors behind them have pushed over one billion phishing emails and SMS messages at more than 75 000 organizations across 150 countries since January 2026. Iron Man System alone carries 2 335 templates aimed at 139 countries, and only reached Yam Store in June.
Acting on a US court order and working with Resecurity, Cloudflare, Oracle, Proofpoint, and others, Microsoft has disabled over 20 000 tenants and 140 000 malicious domains.
Resetting passwords won’t finish the job. Andrew Costis of AttackIQ points out that an application has its own identity and permissions, so access granted to one during an attack survives a password change. Corsica Technologies CISO Ross Filipek adds that device code phishing lands victims on genuine sign-in pages, which is why training people to check where a link goes doesn’t catch it.
Source: Dark Reading
Microsoft and Japan’s National Police Agency announced a takedown of Yam Store on October 14, a Chinese-language cybercrime marketplace tracked as Storm-3119. Yam Store never sent a phishing message. It sold the infrastructure: hijacked Microsoft and Google accounts, licenses, and storage, found by automated scanning for expired organization names and resold wearing the legitimate customer details attached to them.
Its customers did the sending. Microsoft groups the developers of three kits — CoGUI, Haozi, and Iron Man System — as Storm-2990, and says the actors behind them have pushed over one billion phishing emails and SMS messages at more than 75 000 organizations across 150 countries since January 2026. Iron Man System alone carries 2 335 templates aimed at 139 countries, and only reached Yam Store in June.
Acting on a US court order and working with Resecurity, Cloudflare, Oracle, Proofpoint, and others, Microsoft has disabled over 20 000 tenants and 140 000 malicious domains.
Resetting passwords won’t finish the job. Andrew Costis of AttackIQ points out that an application has its own identity and permissions, so access granted to one during an attack survives a password change. Corsica Technologies CISO Ross Filipek adds that device code phishing lands victims on genuine sign-in pages, which is why training people to check where a link goes doesn’t catch it.
Source: Dark Reading
Two Americans — Michael Bostelle of Pennsylvania and Juan Pena Carrillo of Texas — have been arrested on charges of wire fraud, money laundering, and identity theft. Prosecutors say they helped run laptop farms: US homes where employer-issued laptops sit plugged in and loaded with remote-access software, so workers in North Korea can log in and look US-based.
The indictment charges 14 people in total — the two arrested, ten in China, and two whose names stay sealed. The scheme ran from 2019 to July 2025, allegedly generated over $3 million, and placed workers at more than 70 US companies in communications, cyber support, healthcare, manufacturing, and retail. The FBI estimates North Korea keeps 85% to 90% of what they earn and spends it on weapons programs.
FBI agents searched 40 Texas homes between September 21 and 25 under Operation Lonestar Roundup, seizing 187 laptops and the switches used to drive them remotely.
The FBI wants identity checked from the job application through to the last day of employment, and flags remote monitoring software on company machines, downloads unrelated to the role, and bank accounts and home addresses that keep changing.
Source: SecurityWeek
Two Americans — Michael Bostelle of Pennsylvania and Juan Pena Carrillo of Texas — have been arrested on charges of wire fraud, money laundering, and identity theft. Prosecutors say they helped run laptop farms: US homes where employer-issued laptops sit plugged in and loaded with remote-access software, so workers in North Korea can log in and look US-based.
The indictment charges 14 people in total — the two arrested, ten in China, and two whose names stay sealed. The scheme ran from 2019 to July 2025, allegedly generated over $3 million, and placed workers at more than 70 US companies in communications, cyber support, healthcare, manufacturing, and retail. The FBI estimates North Korea keeps 85% to 90% of what they earn and spends it on weapons programs.
FBI agents searched 40 Texas homes between September 21 and 25 under Operation Lonestar Roundup, seizing 187 laptops and the switches used to drive them remotely.
The FBI wants identity checked from the job application through to the last day of employment, and flags remote monitoring software on company machines, downloads unrelated to the role, and bank accounts and home addresses that keep changing.
Source: SecurityWeek
