Ticker feed
Kim Jong-Un sent roughly 14 000 to 15 000 troops to fight alongside Russia in October 2024, and Proofpoint suspects Moscow never gave Pyongyang a timetable for getting them home. So North Korea appears to have gone to the other side of the front for answers. Hackers linked to the DPRK have been spear-phishing Ukrainian government officials, academics, and policy experts, and Genians Security Center assesses the campaign went looking for casualty numbers, how prisoners are being handled, and what happened to the two North Korean POWs Ukraine transferred to South Korea in September.
Those targets don’t open attachments from strangers, so the first email doesn’t carry one. No link either — just a credible greeting built to earn a reply and slip past email filters. One attack began on August 6, 2026, with an email impersonating the organizers of a Seoul security conference. Answer it, and the follow-up arrives: a malicious LNK file wearing a PDF icon and a double extension.
Patience is the whole technique, and it only half works. Recent attempts have been littered with errors, including emails inviting victims to Google Meet calls that contain Zoom links instead, and Genians says most of the observed attempts failed. Proofpoint’s Greg Lesnewich says the group takes little effort to hunt — the pace and volume are what wear defenders down.
Source: Dark Reading
Kim Jong-Un sent roughly 14 000 to 15 000 troops to fight alongside Russia in October 2024, and Proofpoint suspects Moscow never gave Pyongyang a timetable for getting them home. So North Korea appears to have gone to the other side of the front for answers. Hackers linked to the DPRK have been spear-phishing Ukrainian government officials, academics, and policy experts, and Genians Security Center assesses the campaign went looking for casualty numbers, how prisoners are being handled, and what happened to the two North Korean POWs Ukraine transferred to South Korea in September.
Those targets don’t open attachments from strangers, so the first email doesn’t carry one. No link either — just a credible greeting built to earn a reply and slip past email filters. One attack began on August 6, 2026, with an email impersonating the organizers of a Seoul security conference. Answer it, and the follow-up arrives: a malicious LNK file wearing a PDF icon and a double extension.
Patience is the whole technique, and it only half works. Recent attempts have been littered with errors, including emails inviting victims to Google Meet calls that contain Zoom links instead, and Genians says most of the observed attempts failed. Proofpoint’s Greg Lesnewich says the group takes little effort to hunt — the pace and volume are what wear defenders down.
Source: Dark Reading
A cyberattack hit French supermarkets overnight on Sunday, October 11, with hackers remotely triggering the forced-defrost function built into store refrigeration controllers and leaving it running. Fridges and freezers climbed to 50°C. Managers found the damage on Monday morning, and the French government now puts the count at around 700 stores.
France’s cybersecurity agency says the compromises involve remote-control modules from Danish firm Danfoss and US firm Copeland. Danfoss says the affected units were older models whose security software couldn’t be updated, and that it has long told customers to keep supported systems current.
Chains hit include Coopérative U, Intermarché, Carrefour, and Monoprix, with E.Leclerc affected through one of its refrigeration suppliers. Intermarché disconnected around 100 further stores from the internet to stop the same thing reaching them. Two stores in Alsace alone reported €270,000 in losses, with nationwide damages expected to reach millions. Some locations reported small fires.
French prosecutors have launched a cybercrime investigation, and the European Food Commissioner warned that “weaponisation of food has become a reality.”
Source: BBC News
A cyberattack hit French supermarkets overnight on Sunday, October 11, with hackers remotely triggering the forced-defrost function built into store refrigeration controllers and leaving it running. Fridges and freezers climbed to 50°C. Managers found the damage on Monday morning, and the French government now puts the count at around 700 stores.
France’s cybersecurity agency says the compromises involve remote-control modules from Danish firm Danfoss and US firm Copeland. Danfoss says the affected units were older models whose security software couldn’t be updated, and that it has long told customers to keep supported systems current.
Chains hit include Coopérative U, Intermarché, Carrefour, and Monoprix, with E.Leclerc affected through one of its refrigeration suppliers. Intermarché disconnected around 100 further stores from the internet to stop the same thing reaching them. Two stores in Alsace alone reported €270,000 in losses, with nationwide damages expected to reach millions. Some locations reported small fires.
French prosecutors have launched a cybercrime investigation, and the European Food Commissioner warned that “weaponisation of food has become a reality.”
Source: BBC News
On-chain investigator Specter estimates losses may top $86 million from a supply chain attack on Ledger hardware signers sold through Southeast Asian reseller CryptoBilis. Ledger’s Donjon security team confirmed an unauthorized hardware implant inside one affected user’s device, and says it hasn’t confirmed how many users were hit or how much went missing.
Someone along the distribution chain appears to have soldered a small circuit board inside the enclosure, under the screen. The implant reads the 24-word recovery phrase as the signer displays it during setup, then transmits it over LTE using a built-in eSIM — giving attackers full access to victims’ wallets.
Disclosed on October 9, the theft was pinned to CryptoBilis-sold units immediately, and every confirmed loss so far involves one. Ledger tells anyone who bought from the reseller in the last 90 days and hasn’t started setup to leave the device alone; anyone who has set one up should move assets to a new signer with a new seed.
Source: SecurityWeek
On-chain investigator Specter estimates losses may top $86 million from a supply chain attack on Ledger hardware signers sold through Southeast Asian reseller CryptoBilis. Ledger’s Donjon security team confirmed an unauthorized hardware implant inside one affected user’s device, and says it hasn’t confirmed how many users were hit or how much went missing.
Someone along the distribution chain appears to have soldered a small circuit board inside the enclosure, under the screen. The implant reads the 24-word recovery phrase as the signer displays it during setup, then transmits it over LTE using a built-in eSIM — giving attackers full access to victims’ wallets.
Disclosed on October 9, the theft was pinned to CryptoBilis-sold units immediately, and every confirmed loss so far involves one. Ledger tells anyone who bought from the reseller in the last 90 days and hasn’t started setup to leave the device alone; anyone who has set one up should move assets to a new signer with a new seed.
Source: SecurityWeek
SonicWall’s SMA 1000 appliances carry a flaw that scores a perfect 10.0 on CVSS, and attackers began probing for it two days after the fix shipped. CVE-2026-102255 is a pre-authentication server-side request forgery bug in the WorkPlace portal. SonicWall says an unintended access path lets a remote, unauthenticated attacker direct the appliance to issue requests on the attacker’s behalf and reach internal functionality.
The advisory landed on October 6, with SonicWall saying at the time there was no evidence any of its four flaws had been exploited in the wild. Defused logged unauthenticated SSRF traffic against its SMA decoys from October 8, and Previdian reported attempts on its sensors the next day. Benoît Sevens of Anthropic reported the flaw; technical details have not been published.
Upgrade the 6210, 7210 and 8200v to 12.4.3-03670 or 12.5.0-03082. September’s platform hotfixes, 12.4.3-03526 and 12.5.0-02952, are still vulnerable, so patching last month doesn’t cover you. There’s no workaround. SSL-VPN on SonicWall firewalls and the SMA 100 Series are unaffected.
Source: Dark Reading
SonicWall’s SMA 1000 appliances carry a flaw that scores a perfect 10.0 on CVSS, and attackers began probing for it two days after the fix shipped. CVE-2026-102255 is a pre-authentication server-side request forgery bug in the WorkPlace portal. SonicWall says an unintended access path lets a remote, unauthenticated attacker direct the appliance to issue requests on the attacker’s behalf and reach internal functionality.
The advisory landed on October 6, with SonicWall saying at the time there was no evidence any of its four flaws had been exploited in the wild. Defused logged unauthenticated SSRF traffic against its SMA decoys from October 8, and Previdian reported attempts on its sensors the next day. Benoît Sevens of Anthropic reported the flaw; technical details have not been published.
Upgrade the 6210, 7210 and 8200v to 12.4.3-03670 or 12.5.0-03082. September’s platform hotfixes, 12.4.3-03526 and 12.5.0-02952, are still vulnerable, so patching last month doesn’t cover you. There’s no workaround. SSL-VPN on SonicWall firewalls and the SMA 100 Series are unaffected.
Source: Dark Reading
Oleg Korniev, 42, a dual Ukrainian-Russian citizen, pleaded guilty on October 8 to helping lead Your Mule Cashout (YMCO), a massive money laundering network serving cybercriminals. YMCO recruited over 15 000 Americans as money mules through spam emails from fake companies, putting each one through a hiring process that looked real and telling them they would process payments for legitimate businesses. They were moving stolen funds to Eastern Europe, and they were never paid.
Cybercriminals paid YMCO a cut of whatever it moved. The network laundered at least $10 million from 750-plus US bank accounts, and Korniev ran it like a company: writing the procedures, hiring and firing staff, and rewarding or punishing them on performance.
Korniev admitted YMCO was responsible for over $14.7 million in actual and intended losses to confirmed victims, and that he intended to launder over $9.7 million and did launder at least $7 million. He pleaded guilty to five counts covering money laundering, computer fraud, access device theft, and aggravated identity theft, and faces two to 50 years. Four co-conspirators were extradited to the Western District of North Carolina before him and pleaded guilty, reportedly drawing 37 to 63 months each.
Source: SecurityWeek
Oleg Korniev, 42, a dual Ukrainian-Russian citizen, pleaded guilty on October 8 to helping lead Your Mule Cashout (YMCO), a massive money laundering network serving cybercriminals. YMCO recruited over 15 000 Americans as money mules through spam emails from fake companies, putting each one through a hiring process that looked real and telling them they would process payments for legitimate businesses. They were moving stolen funds to Eastern Europe, and they were never paid.
Cybercriminals paid YMCO a cut of whatever it moved. The network laundered at least $10 million from 750-plus US bank accounts, and Korniev ran it like a company: writing the procedures, hiring and firing staff, and rewarding or punishing them on performance.
Korniev admitted YMCO was responsible for over $14.7 million in actual and intended losses to confirmed victims, and that he intended to launder over $9.7 million and did launder at least $7 million. He pleaded guilty to five counts covering money laundering, computer fraud, access device theft, and aggravated identity theft, and faces two to 50 years. Four co-conspirators were extradited to the Western District of North Carolina before him and pleaded guilty, reportedly drawing 37 to 63 months each.
Source: SecurityWeek
Ransomware operation Settra has joined Qilin in exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ GlobalProtect VPN, according to a ReliaQuest warning posted October 9, 2026. Palo Alto disclosed the flaw on May 13, 2026, with fixes following that month, and CISA added it to its Known Exploited Vulnerabilities catalog on May 29. Five months on, attackers are still finding unpatched gateways.
Rated 7.8 (High) under CVSS v4.0 by the vendor and 9.1 (Critical) by NVD, the bug lets an attacker with no valid credentials open a VPN session — but only on portals or gateways with authentication override cookies enabled and a particular certificate setup. Panorama and Cloud NGFW are not affected.
ReliaQuest says the resulting traffic can pass for ordinary remote work until credential theft, lateral movement, or ransomware is already underway, and has seen Cobalt Strike, BloodHound, and SharpHound follow the initial access. Affected builds sit in PAN-OS 12.1, 11.2, 11.1, and 10.2, plus Prisma Access 11.2 and 10.2. Fixed releases are 12.1.7, 11.2.12, 11.1.15, and 10.2.18-h6 (or the hotfix for your branch), and Prisma Access 11.2.7-h13 and 10.2.10-h36.
Upgrade every portal and gateway together or cookies stop working between them, and expect users to sign in again once. Can’t patch yet? Either disable authentication override cookies or move them to a freshly generated certificate used for nothing else. Then terminate all active GlobalProtect sessions and investigate any you don’t recognize — patching alone won’t evict anyone already inside.
Source: Cybersecurity News
Ransomware operation Settra has joined Qilin in exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ GlobalProtect VPN, according to a ReliaQuest warning posted October 9, 2026. Palo Alto disclosed the flaw on May 13, 2026, with fixes following that month, and CISA added it to its Known Exploited Vulnerabilities catalog on May 29. Five months on, attackers are still finding unpatched gateways.
Rated 7.8 (High) under CVSS v4.0 by the vendor and 9.1 (Critical) by NVD, the bug lets an attacker with no valid credentials open a VPN session — but only on portals or gateways with authentication override cookies enabled and a particular certificate setup. Panorama and Cloud NGFW are not affected.
ReliaQuest says the resulting traffic can pass for ordinary remote work until credential theft, lateral movement, or ransomware is already underway, and has seen Cobalt Strike, BloodHound, and SharpHound follow the initial access. Affected builds sit in PAN-OS 12.1, 11.2, 11.1, and 10.2, plus Prisma Access 11.2 and 10.2. Fixed releases are 12.1.7, 11.2.12, 11.1.15, and 10.2.18-h6 (or the hotfix for your branch), and Prisma Access 11.2.7-h13 and 10.2.10-h36.
Upgrade every portal and gateway together or cookies stop working between them, and expect users to sign in again once. Can’t patch yet? Either disable authentication override cookies or move them to a freshly generated certificate used for nothing else. Then terminate all active GlobalProtect sessions and investigate any you don’t recognize — patching alone won’t evict anyone already inside.
Source: Cybersecurity News
A high-severity vulnerability (CVE-2026-23870, CVSS 7.5) in React Server Components lets attackers freeze Next.js servers with a single crafted POST request — no authentication needed.
The flaw lives in how React rebuilds form data before running a Server Action. A request with 10 000 references and 10 000 form fields triggers roughly 100 million string comparisons, choking the CPU and blocking Node.js’s event loop. Researcher Simon Koeck showed that a request of around 900 KB is enough to trigger that workload, and the article notes legitimate users can end up with slow loads, timeouts, or 503s.
Because the parsing happens before your Server Action’s own code runs, checks written inside the action won’t help. Public endpoints are the most exposed, but any logged-in user who can reach a Server Action is enough.
React patched versions 19.0.0–19.0.5, 19.1.0–19.1.6, and 19.2.0–19.2.5 in releases 19.0.6, 19.1.7, and 19.2.6. Check your resolved dependency tree rather than your top-level Next.js version — the affected packages are react-server-dom-webpack, react-server-dom-turbopack, and react-server-dom-parcel, and they arrive through framework dependencies. Proxy body-size limits and rate controls cut exposure, but patching React is the actual fix.
Source: Cybersecurity News
A high-severity vulnerability (CVE-2026-23870, CVSS 7.5) in React Server Components lets attackers freeze Next.js servers with a single crafted POST request — no authentication needed.
The flaw lives in how React rebuilds form data before running a Server Action. A request with 10 000 references and 10 000 form fields triggers roughly 100 million string comparisons, choking the CPU and blocking Node.js’s event loop. Researcher Simon Koeck showed that a request of around 900 KB is enough to trigger that workload, and the article notes legitimate users can end up with slow loads, timeouts, or 503s.
Because the parsing happens before your Server Action’s own code runs, checks written inside the action won’t help. Public endpoints are the most exposed, but any logged-in user who can reach a Server Action is enough.
React patched versions 19.0.0–19.0.5, 19.1.0–19.1.6, and 19.2.0–19.2.5 in releases 19.0.6, 19.1.7, and 19.2.6. Check your resolved dependency tree rather than your top-level Next.js version — the affected packages are react-server-dom-webpack, react-server-dom-turbopack, and react-server-dom-parcel, and they arrive through framework dependencies. Proxy body-size limits and rate controls cut exposure, but patching React is the actual fix.
Source: Cybersecurity News
A Kansas City man is heading to federal prison after sabotaging the company he worked for and demanding 20 bitcoin, worth roughly $750,000 at the time. Daniel Rhyne, 59, was a core infrastructure engineer at a New Jersey industrial firm when he secretly scheduled tasks on the company’s domain controller in November 2023.
The tasks deleted 13 domain administrator accounts, reset 301 domain user passwords, and changed local administrator passwords affecting 254 servers and 3 284 workstations — mostly to “TheFr0zenCrew!”. Within an hour, employees received an email from an outside address claiming admins were locked out and backups destroyed, and threatening to shut down 40 random servers a day for ten days unless the company paid.
The company didn’t pay. It ran its own forensic analysis, matched internal logs against physical access records, and brought in the FBI, which traced the activity to Rhyne’s home IP address. Agents filed a criminal complaint in August 2024 and arrested him later that month in Kansas City, where he had since moved.
Rhyne pleaded guilty in April to extortion and intentional damage to a protected computer. He was sentenced on September 28, 2026 to 32 months in federal prison.
Source: SecurityWeek
A Kansas City man is heading to federal prison after sabotaging the company he worked for and demanding 20 bitcoin, worth roughly $750,000 at the time. Daniel Rhyne, 59, was a core infrastructure engineer at a New Jersey industrial firm when he secretly scheduled tasks on the company’s domain controller in November 2023.
The tasks deleted 13 domain administrator accounts, reset 301 domain user passwords, and changed local administrator passwords affecting 254 servers and 3 284 workstations — mostly to “TheFr0zenCrew!”. Within an hour, employees received an email from an outside address claiming admins were locked out and backups destroyed, and threatening to shut down 40 random servers a day for ten days unless the company paid.
The company didn’t pay. It ran its own forensic analysis, matched internal logs against physical access records, and brought in the FBI, which traced the activity to Rhyne’s home IP address. Agents filed a criminal complaint in August 2024 and arrested him later that month in Kansas City, where he had since moved.
Rhyne pleaded guilty in April to extortion and intentional damage to a protected computer. He was sentenced on September 28, 2026 to 32 months in federal prison.
Source: SecurityWeek
The FBI has arrested another suspect in the ShinyHunters hack of its own job recruitment website. Director Kash Patel confirmed the arrest Friday, calling it part of an ongoing push to “dismantle the group.” The bureau gave no name or location, but sources told CBS News the suspect is a Canadian citizen detained in Pennsylvania and believed to be directly involved.
Veteran agents say the September breach may be the worst of a federal government system since the 2015 Office of Personnel Management hack, which exposed more than 22 million records. ShinyHunters claimed responsibility, saying they stole 2–3 terabytes of FBI employee data through a new vulnerability in Oracle PeopleSoft.
The FBI’s cyber division says a review found that a contractor failed to apply a security patch to the targeted system, and that the contractor has since been removed. Reuters, citing sources, reported the individual worked for Accenture.
The Royal Canadian Mounted Police says it is aware of a Canadian arrested in the US over the hack but won’t comment on another country’s investigation. Other suspected co-conspirators remain at large. Two earlier arrests are tied to the group, in Jordan and Amsterdam — though the Amsterdam suspect went into custody on September 15, a week before ShinyHunters announced the FBI hack.
Source: CBS News
The FBI has arrested another suspect in the ShinyHunters hack of its own job recruitment website. Director Kash Patel confirmed the arrest Friday, calling it part of an ongoing push to “dismantle the group.” The bureau gave no name or location, but sources told CBS News the suspect is a Canadian citizen detained in Pennsylvania and believed to be directly involved.
Veteran agents say the September breach may be the worst of a federal government system since the 2015 Office of Personnel Management hack, which exposed more than 22 million records. ShinyHunters claimed responsibility, saying they stole 2–3 terabytes of FBI employee data through a new vulnerability in Oracle PeopleSoft.
The FBI’s cyber division says a review found that a contractor failed to apply a security patch to the targeted system, and that the contractor has since been removed. Reuters, citing sources, reported the individual worked for Accenture.
The Royal Canadian Mounted Police says it is aware of a Canadian arrested in the US over the hack but won’t comment on another country’s investigation. Other suspected co-conspirators remain at large. Two earlier arrests are tied to the group, in Jordan and Amsterdam — though the Amsterdam suspect went into custody on September 15, a week before ShinyHunters announced the FBI hack.
Source: CBS News
Google confirmed that several of its domains were caught up in a recent hijacking of three country-code top-level domains — .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). Attackers compromised the third-party registries behind them in late September, modified authoritative DNS records, and obtained unauthorized HTTPS certificates for Google and other organizations’ domains. Every domain ending in those suffixes was at risk, though Google says its own systems were never breached.
Google quickly blocked the rogue certificates for its own domains in Chrome and worked with certificate authorities to revoke them. Certificate Transparency (CT) log analysis turned up other global brands and popular services in the same position, and the company blocked those certificates too. The CAs aren’t at fault, Google says, given how the attacks worked. How attackers reached the registries, who ran the campaign, and when it started are all still unanswered.
Some domains may still be at risk. Domain owners should monitor CT logs across their whole portfolio, including parked and regional ccTLD names, and review recent entries for certificates they never requested. Restrictive CAA DNS records are worth publishing once DNS control is back. CAA can’t stop issuance during a live hijack, but CAs may reuse a cached domain validation check to mint fresh certificates after one ends, and a restrictive policy closes that door.
Source: SecurityWeek
Google confirmed that several of its domains were caught up in a recent hijacking of three country-code top-level domains — .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). Attackers compromised the third-party registries behind them in late September, modified authoritative DNS records, and obtained unauthorized HTTPS certificates for Google and other organizations’ domains. Every domain ending in those suffixes was at risk, though Google says its own systems were never breached.
Google quickly blocked the rogue certificates for its own domains in Chrome and worked with certificate authorities to revoke them. Certificate Transparency (CT) log analysis turned up other global brands and popular services in the same position, and the company blocked those certificates too. The CAs aren’t at fault, Google says, given how the attacks worked. How attackers reached the registries, who ran the campaign, and when it started are all still unanswered.
Some domains may still be at risk. Domain owners should monitor CT logs across their whole portfolio, including parked and regional ccTLD names, and review recent entries for certificates they never requested. Restrictive CAA DNS records are worth publishing once DNS control is back. CAA can’t stop issuance during a live hijack, but CAs may reuse a cached domain validation check to mint fresh certificates after one ends, and a restrictive policy closes that door.
Source: SecurityWeek
