Technical details and PoC exploit code for the critical Penpot file takeover flaw are now public. Upgrade to version 2.18.0 now.

Related Posts:

• Attackers Exploit SonicWall SonicOS SSLVPN Flaw CVE-2026-19868 in the Wild
• Veeam Releases Kernel Updates to Fix Critical CVE-2026-98432 Flaw Across Backup Appliances
• JetBrains Patches 61 Flaws Across Hub, Datalore, YouTrack, and IntelliJ IDEA

The post Penpot File Takeover Flaw Details and PoC Exploit Publicly Disclosed appeared first on Daily CyberSecurity.

A new wave of fridge cyberattacks hit supermarket refrigeration systems across five European countries, raising temperatures and causing food losses.

A new wave of fridge cyberattacks has affected supermarket refrigeration systems in several European countries. Fridges and freezers suddenly rose in temperature overnight, with some incidents suspected to be caused by hackers. On Monday, November 2, Ahold Delhaize and Colruyt reported an IT incident affecting dozens of stores in Belgium and Luxembourg. Swedish supermarket chains ICA and Coop also reported similar problems.

“Ahold Delhaize and Colruyt said on Monday that an IT ​incident overnight hit fridges and freezers in dozens of stores in Belgium and Luxembourg, while Swedish grocers ‌ICA and Coop reported similar temperature spikes, with one store blaming a cyberattack.” Reuters states.

“Problems were discovered at several grocery stores in Sweden overnight Monday.” reported Sweden Herald.

“We are aware that a limited number of stores were affected by an incident overnight that affected their refrigeration and freezer systems. Ica is providing support in handling the incident, Ica Group press officer Gustaf Nilsson tells TT.”

The latest incidents follow a similar wave of fridge cyberattacks in France last month. In mid-October, a large cyberattack hit the refrigeration systems of hundreds of French supermarkets, BFMTV revealed. The attackers targeted equipment from the Danish maker Danfoss that many French stores use to regulate their cold. Fresh and frozen stock was destroyed, and the Paris prosecutor says there were also fires.

The method is simple and nasty. Refrigeration systems have a forced defrost function that clears ice buildup, and the attackers appear to have triggered it remotely in a continuous mode, with a temperature setting of 50 degrees. The equipment heated for several hours instead of keeping goods cold, and when staff opened the fridges and freezers in the morning, a sector source told BFM, “a wave of heat” came out.

The attack caused fires and food losses. However, cybersecurity consultant Emil Olofsson of Integrity 360 told Swedish news agency TT that temperatures reached 80°C in some cases and several units caught fire. This figure differs from the one reported by police.

ICA Kvantum in Sjöbo said on Facebook that a cyberattack caused the refrigeration problems. ICA Hägerstensåsen in Stockholm was also reportedly affected. According to the Sjöbo store, the temperature inside its fridges and freezers rose to 50°C.

In Belgium, Delhaize detected unusual temperature increases in its refrigeration systems on Monday. Spokesperson Sarah De Meester said the company is investigating the incident.

Stephan Moelans, CEO of Sabcobel, the company that manages Delhaize’s refrigeration systems, told news agency Belga that hackers had switched the units’ evaporators to defrost mode. His office declined to comment to Reuters. Colruyt Group, which operates Spar stores in Belgium through a franchise system, said five stores had suffered attacks on their refrigeration systems. Meanwhile, Belgian newspaper Le Soir reported that dozens of Delhaize and Carrefour stores were affected.

It follows a similar attack in France last month. Police said hackers seized control of the cooling units at hundreds of supermarkets and raised temperatures as high as 50 degrees Celsius (122 Fahrenheit), which caused fires and food losses. Cybersecurity consultant Emil Olofsson of Integrity 360 told TT, Sweden’s news agency, that temperatures there reached 80 degrees and some units caught fire, a figure that differs from the police number.

In Belgium, Delhaize noticed temperature increases in its cooling systems on Monday, spokesperson Sarah De Meester said, and the company is investigating. Stephan Moelans, CEO of the refrigeration firm Sabcobel, which runs Delhaize’s systems, told the news agency Belga it was a cyberattack that switched the units’ evaporators to defrost mode. His office declined to comment to Reuters. Colruyt Group, which runs Spar stores in Belgium under a franchise system, said five shops had their fridge systems attacked, and Le Soir reported that dozens of Delhaize and Carrefour stores were affected.

Ahold also reported a cybersecurity incident to Dutch police last month, after it detected suspicious activity in its infrastructure. Nothing in the reporting ties that report to Monday’s incident.

In Sweden, John Billow, head of the national cybersecurity centre, told Reuters his team was working on several incidents involving refrigeration systems in grocery stores around the country. An ICA Kvantum store in Sjöbo said on Facebook that a cyberattack caused its problems, and an ICA store told its followers that its temperatures had been “hacked” overnight and set to 50 degrees. Fifty degrees is fine for a beach and poor for ice cream. That store later said it had opened.

At ICA Baronen in Stockholm, a notice said all the freezers were broken because of a cyberattack. The sales manager said the attack came at 2 a.m. and staff noticed it at 5:30 a.m. ICA Hägerstensåsen in Stockholm was reportedly hit too.

ICA said only a limited number of stores were affected and that it is helping them deal with the incident. However, press officer Gustaf Nilsson did not say how many stores were involved.

Coop told Swedish news agencies Aftonbladet and TT that six stores in central Sweden had similar problems. Press manager Carlos Cancino said it was still unclear whether any food would need to be thrown away or whether the refrigeration units had simply stopped working or had switched to heating mode. He also did not rule out further incidents affecting other stores.

An Estonian supermarket chain was also affected. Its refrigeration systems were reportedly set to 50°C, technology provider Kitman Coldtech told public broadcaster ERR. CEO Jann Mutso did not reveal the name of the supermarket chain, saying: “This is very recent. It happened this morning.”

How did the attackers get in? In France, Olofsson says they obtained login details for the control systems, which were exposed directly to the internet. He says the attack targeted a product that controls the cooling systems and that the hack isn’t very complicated, so amateurs may have carried it out.

Billow says Swedish authorities have noticed in recent weeks that quite a lot of exposed operational technology devices exist in Sweden, and they’ve been clear that these must be updated or patched.

Refrigerators and heating systems, security cameras and alarm networks were once largely mechanical, and now they can be monitored and controlled remotely. That gives cybercriminals new openings. Authorities haven’t said who was behind last month’s incidents, and nobody has claimed responsibility.

The Sweden Herald reported that the cause of the attacks on Swedish supermarkets remains unknown.

Update 20:00 Rome Time

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, fridge cyberattacks)

The OpenAI Dot SMS feature enables ChatGPT Pro subscribers to control autonomous AI agents directly through iMessage and RCS texting.

Related Posts:

• Claude CarPlay Update Adds Hands-Free AI Voice
• Reddit Mandatory Login Tests Expand to Curb AI Scraping
• GitHub Code Activity Surges Amid AI Agent Adoption

The post OpenAI Dot SMS Feature Launches for ChatGPT Pro appeared first on Daily CyberSecurity.

Ukraine warns that attackers can remotely access Dahua cameras and recorders via Easy4IP, viewing video and changing settings.

Ukraine’s cyber incident response team CERT-UA has warned about attackers taking over video surveillance systems made by Dahua. In its alert dated October 23, 2026, it reports unauthorized remote access to IP cameras and video recorders. The attackers have watched the live video, changed device settings and created accounts of their own. The alert doesn’t say who was targeted or how many devices are affected.

The attackers abused Easy4IP, Dahua’s cloud feature that lets users access devices remotely. When this feature is enabled, the camera or recorder connects to Dahua’s cloud and registers using its serial number. Anyone who knows the serial number may be able to access the device through the cloud, without needing an open port or a public IP address. This means the connection can bypass the protection normally provided by a router’s firewall.

As a result, a camera that isn’t directly exposed to the internet may still be at risk. CERT-UA warns that devices with Easy4IP enabled may be vulnerable even when they cannot be accessed directly from the internet.

“The main vector is the P2P/cloud access function (Easy4IP). The device independently initiates an outgoing connection to the manufacturer’s cloud infrastructure and registers in it by serial number. Access to the device is then established via the cloud by serial number, bypassing NAT and firewall, without published ports and a “white” IP address.” reads the report published by CERT-UA. “Thus, the lack of direct access from the Internet does not guarantee the security of the device with the active P2P function.”

Serial numbers follow predictable patterns, so attackers may be able to guess them automatically and check which devices are registered in the cloud. Simply keeping a serial number private isn’t enough to ensure security.

Once attackers connect to a device, they need to get past its login. They may try common or weak passwords or exploit security flaws in outdated firmware, especially CVE-2021-33044 and CVE-2021-33045. These two vulnerabilities allow attackers to bypass authentication without a password, so even a strong password won’t protect a device running vulnerable firmware.

There are three signs that a device may have been compromised. First, look for accounts you don’t recognize. Second, check for changed settings, including text added over the video image. However, the absence of these labels does not mean the device is safe. Third, check the audit logs for logins using Dahua’s DVRIP protocol from the local address 127.0.0.1, which can indicate access through the cloud service.

CERT-UA recommends four steps:

1. Turn off P2P and cloud access if you don’t use it.
2. Keep cameras off the internet. For remote access, use a VPN and allow only authorized IP addresses.
3. Check the account list for ones you didn’t create, and check which cloud accounts are linked to the device and disconnect unknown ones.
4. Update the software by hand to the latest version, and set up a regular update routine.

CERT-UA advises organizations that detect signs of unauthorized access to report them to cert@cert.gov.ua and check all Dahua devices on their networks, including those that may have been forgotten. The agency warns that all devices with active P2P functionality are at risk.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, IP cameras)

Em 21 de outubro, duas vulnerabilidades críticas foram divulgadas no PHP, a linguagem de script usada por muitos sites e serviços online: CVE-2026-109618 e CVE-2026-109619. Os invasores podem explorá-las para executar comandos remotamente em qualquer servidor que execute PHP, sem necessidade de autenticação. O exploit foi batizado de PHP2Shell.

A equipe de segurança do PHP anunciou uma atualização emergencial em 20 de outubro e lançou os patches que corrigem as vulnerabilidades já no dia seguinte.

Anteriormente, abordamos os detalhes técnicos dessas vulnerabilidades e explicamos o que empresas e administradores de servidores devem fazer. Talvez você tenha ignorado tranquilamente essa notícia por não administrar nenhum servidor — mas, infelizmente, o problema não se limita às empresas.

Quase 70% dos sites usam PHP, incluindo serviços que utilizamos todos os dias: wikis, lojas online, dispositivos inteligentes com interfaces web, sistemas domésticos de armazenamento conectado à rede (NAS), controladores de casa inteligente e muito mais.

Hoje, explicamos como essas vulnerabilidades podem afetar você pessoalmente e o que fazer para reduzir os riscos.

Como as vulnerabilidades podem afetar usuários domésticos

Roubo de contas e dados pessoais

A vulnerabilidade permite que um invasor roube tokens de autenticação da memória do servidor. Esses tokens funcionam basicamente como passes eletrônicos, informando ao site que o usuário já fez login. Como resultado, um invasor pode conseguir acessar a conta de outra pessoa sem inserir uma senha nem um código de autenticação de dois fatores, colocando em risco mensagens, documentos, endereços de entrega, históricos de pedidos e outras informações confidenciais.

Perda de arquivos em dispositivos domésticos

Se você tem em casa um sistema de armazenamento conectado à rede (NAS) ou um sistema de videovigilância que usa uma versão vulnerável do PHP, ele também pode estar em risco. Dependendo do nível de acesso obtido, os invasores podem conseguir copiar, excluir ou criptografar os arquivos aos quais tiverem acesso.

Infecção por malware

Se um invasor obtiver acesso a um site vulnerável, poderá usá-lo praticamente da maneira que quiser: enganar visitantes para que baixem um arquivo malicioso ou cliquem em um link de phishing, exibir instruções perigosas, substituir formulários de pagamento ou páginas de login por versões maliciosas — e a lista continua. Como resultado, alguém que visite um site legítimo pode não apenas perder o acesso à própria conta, mas também perder dinheiro ou infectar acidentalmente o dispositivo com malware.

A seguir, apresentamos exemplos de serviços diretamente afetados pelas vulnerabilidades.

Quais serviços são afetados pelas vulnerabilidades do PHP

Jeedom

Jeedom é uma plataforma de casa inteligente que permite controlar iluminação, sensores, aquecimento, persianas e dispositivos IoT domésticos. Os invasores podem explorar isso de várias maneiras: desativar o alarme, acompanhar quando o morador está fora de casa, acessar as imagens do vídeo porteiro e muito mais.

Os desenvolvedores confirmaram que a nova vulnerabilidade afeta o aplicativo e já lançaram uma atualização emergencial, o Jeedom 4.6.2. Os usuários precisam executar a atualização duas vezes para que ela funcione. Segundo os desenvolvedores, uma versão totalmente corrigida para usuários domésticos será lançada nos próximos dias.

Sites que usamos todos os dias

Como mencionado acima, o PHP é usado por aproximadamente 70% dos sites. Isso não significa que todos eles sejam vulneráveis: tudo depende da versão do PHP em uso e de os responsáveis pelo site já terem feito a atualização. Muitos sites governamentais na Europa já suspenderam suas operações por causa da nova vulnerabilidade.

Infelizmente, um site pode continuar vulnerável mesmo que pareça estar funcionando normalmente. Um invasor pode conseguir assumir o controle de qualquer site legítimo cujo servidor ainda não tenha recebido o patch. Ele pode falsificar páginas de pagamento ou login, hospedar arquivos maliciosos ou convencer usuários a baixar uma “atualização urgente” que, na verdade, é malware.

Usuários comuns não têm uma maneira confiável de verificar se essas instruções ou arquivos são seguros. Por isso, use uma proteção confiável contra phishing e malware. Se você suspeitar que seus dados podem ter sido roubados, verifique as sessões ativas nas configurações da sua conta. Caso encontre alguma atividade suspeita ou dispositivos que não reconheça, encerre todas as sessões ativas e altere sua senha. Use um gerenciador de senhas — ele pode gerar uma senha realmente forte e exclusiva, que você não precisará memorizar.

Videogames

Más notícias para os gamers: alguns videogames cujos servidores usam PHP também estão em risco. Se você não quer que invasores assumam o controle de suas contas, altere as senhas das suas plataformas, lojas e contas de jogos.

Para ganhar tempo para realizar as atualizações, alguns desenvolvedores tiraram seus serviços do ar temporariamente. Final Fantasy XIV, Pokemon Champions, jogos da Bandai Namco Entertainment, Uma Musume: Pretty Derby, Granblue Fantasy, Shadowverse: Worlds Beyond e muitos outros entraram em manutenção emergencial. O Nintendo Switch Online e as lojas GOG e Steam também foram afetados.

Infelizmente, também houve consequências mais drásticas. Ontem, os desenvolvedores de World Quest anunciaram que o jogo seria encerrado definitivamente após 15 anos: ele dependia de uma infraestrutura desatualizada cuja correção seria extremamente difícil e cara. Pelo mesmo motivo, o jogo para dispositivos móveis Please Save My Pandemonium! foi encerrado depois de mais de dez anos em operação.

Armazenamento conectado à rede (NAS) doméstico

As “nuvens domésticas” se tornaram populares nos últimos anos, e por um bom motivo: muitos usuários preferem manter backups dos próprios dados em casa em vez de armazená-los online. Diversas empresas fabricam dispositivos NAS, e pelo menos três — QNAP, Synology e ASUSTOR — informaram que as vulnerabilidades afetam seus produtos. Também foi lançada uma atualização para o Unraid, um sistema operacional para servidores domésticos, armazenamento em rede e servidores de mídia.

QNAP

O fabricante confirmou que as vulnerabilidades afetam várias versões de seus sistemas operacionais para NAS — QTS e QuTS hero —, além de aplicativos como QuMagie, Note Station 3 e determinadas versões do QVR Surveillance. Um ataque bem-sucedido pode colocar em risco fotos, documentos, anotações e gravações de câmeras.

No momento da publicação, a QNAP ainda está preparando atualizações. Portanto, a principal prioridade é desconectar temporariamente o NAS da internet. A QNAP recomenda desativar o redirecionamento de portas no roteador, impedir que o NAS abra portas automaticamente e permitir o acesso ao painel de gerenciamento somente pela rede doméstica ou por meio de uma VPN.

Synology

As duas vulnerabilidades foram oficialmente confirmadas nos pacotes PHP 7.3, 7.4 e 8.0–8.4, assim como no Mail Station e no Synology Calendar. Correções já foram lançadas para o PHP a partir da versão 7.4, além do Mail Station e do Synology Calendar. O PHP 7.3 não receberá correção. A empresa também ressalta que o componente PHP integrado ao sistema operacional não pode ser acessado de fora do dispositivo, portanto o risco de ataque é muito baixo.

ASUSTOR

A ASUSTOR também confirmou oficialmente as duas vulnerabilidades e removeu imediatamente do App Central os pacotes PHP 7, 7.3, 7.4 e 8.1. A empresa recomenda fazer imediatamente um backup dos dados, remover os pacotes antigos do PHP e usar o PHP 8.3 ou 8.4.

Unraid

Na atualização do sistema operacional lançada hoje, o PHP foi atualizado para a versão 8.4.27, que inclui correções para as vulnerabilidades. Os desenvolvedores recomendam que todos os usuários atualizem para o Unraid 7.3.4. Contêineres que possuem a própria instalação do PHP precisam ser atualizados separadamente: a nova versão do PHP no sistema operacional não substitui a versão instalada dentro dos contêineres.

No momento da publicação, não encontramos confirmação pública de outros grandes fabricantes, como TerraMaster, UGREEN, Buffalo ou Western Digital, de que seus dispositivos sejam afetados por essas vulnerabilidades — apenas discussões de usuários em fóruns.

Mas o fato de apenas alguns fabricantes de NAS terem confirmado o problema até agora não garante que seus dispositivos estejam seguros — principalmente se forem relativamente antigos ou fabricados por uma empresa pouco conhecida ou que já encerrou as atividades. Nesse caso, primeiro desconecte os dispositivos da internet, mantendo-os acessíveis apenas pela rede local, e depois investigue se eles são vulneráveis.

Armazenamento em nuvem Nextcloud

O Nextcloud é uma plataforma gratuita e de código aberto para criar seu próprio armazenamento em nuvem, funcionando como alternativa ao Google Drive, Dropbox e Microsoft OneDrive. Ele permite armazenar e sincronizar arquivos entre dispositivos, compartilhá-los com outros usuários e trabalhar com documentos, fotos, calendários e contatos. Os dados podem ficar armazenados no seu próprio servidor ou NAS, em vez dos servidores de uma empresa terceirizada.

Se você armazena dados importantes no Nextcloud, verifique como sua instância de nuvem está configurada. Se você usa o Nextcloud All-in-One, atualize para a versão 14.4.1, na qual a vulnerabilidade já foi corrigida.

Se a sua instalação do Nextcloud estiver configurada de outra maneira, será necessário atualizar o PHP manualmente no dispositivo ou servidor.

Como proteger seus dispositivos e dados

• Use proteção contra phishing e malware. Nossa solução de segurança bloqueia automaticamente páginas de phishing e malware, mesmo quando os invasores os colocam em sites legítimos.
• Fique de olho nas atualizações. Se você tem um sistema de armazenamento conectado à rede, uma casa inteligente, um servidor doméstico, um servidor de mídia ou qualquer outro dispositivo com interface web, primeiro consulte o site do fabricante e instale todas as atualizações disponíveis. Se ainda não houver uma atualização, desative temporariamente o acesso do dispositivo à internet.
• Use senhas fortes. A maioria das pessoas reutiliza a mesma senha, ou variações dela, em vários sites. Se um invasor encontrar uma dessas senhas em um servidor vulnerável, poderá conseguir comprometer também suas outras contas. Recomendamos gerar e armazenar senhas fortes e exclusivas no Kaspersky Password Manager para que você não precise memorizar suas credenciais. Não deixe de ativar a autenticação de dois fatores em todas as contas importantes — de preferência usando códigos de uso único gerados pelo mesmo gerenciador de senhas.
• Mantenha um backup offline dos seus arquivos importantes. Não dependa apenas do armazenamento em nuvem — mantenha uma cópia de segurança de todos os documentos importantes em um disco rígido e em um dispositivo externo. Para mais informações sobre como fazer backups corretamente, consulte nosso artigo A Internet não se lembra de tudo.

Que outros riscos seus dispositivos domésticos podem enfrentar? Leia nossos artigos:

• TV infectada por cavalos de Troia ou os novos riscos dos proxies maliciosos
• Ransomware passa a mirar em backups pessoais
• Sua TV box virou uma porta de entrada para terceiros?
• Seu roteador está trabalhando secretamente para inteligências estrangeiras?
• Três ataques comuns ao Linux residencial
• Como proteger sua casa smart

Kaspersky uncovered the BlackX UEFI bootkit APT41 campaign bypassing Secure Boot via Baton Drop to spy on Central Asian diplomatic agencies.

Related Posts:

• APT28 Uses Hookedge Backdoor to Spy on Naval Shipbuilder and Defense Firms in Two NATO Countries
• China-Linked Operator Used AI Agents to Breach 48 Government and Corporate Targets Across Asia
• Lazarus Operation FlashHole Abuses CrossWeb EX and GitHub to Spy on South Korean Firms

The post APT41 Deploys BlackX UEFI Bootkit Against Central Asian Diplomatic Agencies appeared first on Daily CyberSecurity.

WhatsApp instructed its AI support chatbot not to recommend contacting privacy regulators when users couldn’t delete their accounts, researchers found.

Privacy software company Redact discovered the hidden text on October 8. Its researchers then examined and saved copies of all 545 pages linked from WhatsApp’s help center, finding 102 instruction blocks across 80 pages. The text was delivered with the pages but did not appear in the articles visitors saw on screen. Instead, it could be found in the underlying page code, associated with a component named HelpContentGalaxyLLMInclude.

Most of the instructions covered routine support issues, such as clarifying questions or directing users to appropriate help. But the researchers found two sets of instructions that stood out.

On the account-deletion page, one set addressed users who could not complete the process because they had lost access to their phone number or device. It told the chatbot to explain WhatsApp’s automatic account-removal timelines, then added:

“Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority.”

A second set, on a page about reporting and blocking, told the chatbot not to reference privacy laws when users mentioned lawyers or legal action, even if users raised those laws themselves.

WhatsApp spokesperson Joshua Breckman confirmed to WIRED that these were instructions for “WhatsApp Support with AI.” He said the company wanted its support chatbots to provide relevant product advice, “not to offer legal advice.”

Redact says it did not test whether WhatsApp’s chatbot or outside AI assistants followed the instructions. WhatsApp attributed the exposure to a bug it said had been fixed. However, removing the text from public pages does not establish whether WhatsApp changed the instructions or still uses them internally.

Why this is important

A support chatbot doesn’t need to act as your lawyer. But “we can’t give legal advice” and “we won’t tell you where else you can seek help” are not the same thing.

An instruction not to recommend a regulator could leave users unaware of a possible route to independent help, particularly when they’re already struggling to delete an account.

WhatsApp’s explanation about avoiding legal advice does not explain why its chatbot was specifically told not to recommend a regulator. Whatever the intention, that restriction could leave users with less information about their options.

How to delete your WhatsApp account

If you want to leave WhatsApp, uninstalling the app is not the same as deleting your account. WhatsApp provides a separate account-deletion option inside the app. You must be logged in on your primary phone to complete this procedure. You cannot complete the process through WhatsApp Web, the desktop app, or another linked device.

Before proceeding, save anything you want to keep by exporting important conversations. Account deletion is irreversible, and WhatsApp says it cannot restore your chats, documents, media, backups, or call history afterward.

If you still have access to your account

The steps are similar on Android and iPhone:

1. Open WhatsApp on your primary phone.
2. Open Settings. On Android, tap the three-dot menu first. On iPhone, tap Settings or your profile picture.
3. Select Account, then Delete my account.
4. Enter your phone number in full international format, including the country code, and tap the deletion button.
5. On Android, select a reason when prompted, then confirm the deletion. Follow any remaining on-screen prompts.

Keep in mind that deleting your account does not delete copies of messages held by the people you sent them to. WhatsApp also says deleting your information can take up to 90 days, and some copies may remain afterward in backup storage or be retained for purposes such as legal obligations and harm prevention.

If your phone is lost or stolen

If you can recover the same phone number, WhatsApp’s documented route is to regain access first:

1. Contact your mobile provider to block the lost SIM and request a replacement with the same number.
2. Activate the replacement SIM in another phone.
3. Install WhatsApp and register with that number again.
4. Once you have access, follow the account-deletion steps above.

Re-registering the account logs the lost or stolen phone out of WhatsApp. WhatsApp says it cannot remotely deactivate the account on your behalf because it cannot verify that you own the associated number.

If you can no longer access your account or recover your number

This is where WhatsApp’s self-service instructions fall short. Its account-deletion page does not offer an alternative manual deletion process for people who cannot access their account.

Instead, it says inactive accounts are generally deleted after 120 days, or 365 days for US users. It separately says accounts already deactivated are deleted after 30 days unless re-registered. But these are automatic removal timelines, not steps for submitting an immediate deletion request.

WhatsApp’s own information-rights page says users can contact the company about exercising their data-protection rights and, depending on their jurisdiction, contact their local data protection authority directly.

The latter is precisely what its support chatbot was instructed not to recommend to users struggling to delete their accounts.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Following the Secure Boot certificate expiration, Windows PCs transition to UEFI CA 2023 while booting normally. Learn how to verify your device.

Related Posts:

• Windows Server 2025 Gains Quick Machine Recovery
• Windows 11 Accelerated Launch Speeds Up Edge Startup
• Windows 11 Update Triggers Xbox Live Error 0x87DD0005

The post Secure Boot Certificate Expiration: Windows PCA 2011 Retires appeared first on Daily CyberSecurity.

Sam Altman confirms an OpenAI humanoid robot is coming, with a demo due in 2027. The real hurdle is building the robot's brain.

Related Posts:

• TP-Link Moves Router Assembly to the United States
• Google DMA Compliance Under EU Review After Fine
• ChatGPT Chrome Extension Now Reads Your Open Tabs

The post OpenAI Humanoid Robot Confirmed by Sam Altman appeared first on Daily CyberSecurity.

CikaBika Bot uses fake documents to infect Windows systems, then abuses Discord and Ngrok to execute commands, spy on victims, and steal files.

Darktrace researchers have documented a new campaign distributing a remote access trojan called CikaBika Bot, written in Rust and controlled entirely through Discord. The infection chain starts with a disk image that looks like a business proposal, and ends with an attacker who can run arbitrary commands, steal files, and capture your screen, all through messages in a chat platform.

“The infection chain begins with a disk image and a malicious Windows shortcut. A Nim loader extracts the final payload and attempts to plant it in Microsoft Edge’s installation directory using a PowerShell UAC bypass.” reads the analysis published by Darktrace. “Once running, the RAT collects host information, registers the device with Discord, and accepts commands through a dedicated channel.”

The attackers use a disk image named Proposition_Projet.img as a lure; it contains two files, a PDF that appears to be a legitimate French-language document about writing summaries, and a Windows shortcut disguised as a Word document.

Open the shortcut and a hidden PowerShell process starts running in the background while the PDF displays on screen to keep the victim occupied.

The shortcut starts PowerShell, which reads the fake PDF as raw data. It uses a value hidden inside the file as a key to decrypt and extract a program, then saves it to a temporary folder. This program is a loader written in Nim, a programming language that is less common in malware than C. Attackers may use Nim because security tools are less familiar with it. The loader contains two more components: a Rust DLL and a PowerShell script.

The PowerShell script then tries to copy the DLL into Microsoft Edge’s installation folder and name it dbghelp.dll. This is the name of a legitimate debugging library that Edge normally loads. To access the protected folder without triggering a User Account Control (UAC) prompt, the script changes a Windows registry setting and misuses computerdefaults.exe to bypass the security check. Darktrace describes the technique as DLL search-order hijacking.

“The attacker appears to be exploiting this dependency through DLL search-order hijacking. However, it does not export every function in Edge’s delay-import table, meaning its compatibility with the host is incomplete.” the analysis continues.”The observed code establishes the intended sideloading route, rather than proving that Edge successfully loaded the planted DLL.”

However, the researchers note that the malicious DLL does not provide all the functions Edge expects, so this technique may not work on every system.

Assuming the implant lands and runs, it immediately registers the infected machine with Discord, creating a dedicated channel for that specific device. It then collects system information, runs tasklist and ipconfig, takes a screenshot, and sends everything back to the operator through that channel. The attacker gets a full picture of the machine within the first few seconds of infection.

The command set from there covers most of what an attacker would need. Remote shell access, process listing and termination, file upload and download, and surveillance functions including screenshot capture, camera access, and screen streaming.

“Once installed, CikaBika Bot uses Discord as its C2 platform, allowing the attacker to manage compromised devices, execute commands, and retrieve files without maintaining dedicated C2 infrastructure.” the cybersecurity firm states. “The observed use of Discord channels for individual victims, alongside additional data exfiltration through ngrok, shows how legitimate services can be repurposed to support malicious operations.”

Discord is a legitimate service used by millions of people and organizations every day. Traffic to Discord doesn’t look unusual on most networks, it’s not blocked by default, and standard endpoint security tools aren’t designed to treat Discord messages as potential command-and-control traffic. The attacker never has to spin up a dedicated server, register a suspicious domain, or deal with infrastructure that can get taken down. They just need a Discord account.

One drawback for attackers is that Discord can detect abuse and shut down the accounts and servers they use. However, creating new accounts is easy and costs very little. The attackers also use Ngrok to transfer files instead of sending large amounts of data through Discord. This reduces their reliance on Discord and limits the impact if the platform shuts down their accounts.

“CikaBika Bot demonstrates how attackers continue to rely on social engineering techniques to deliver malware.” concludes the report. “Although the initial distribution method has not been confirmed, the use of a disk image containing a shortcut disguised as a Word document, alongside a legitimate-looking PDF, suggests the campaign was designed for phishing.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)

The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions.

Heleket’s support agent on Telegram claims, despite all evidence to the contrary, that it is not affiliated with Cryptomus. Image: Richard Sanders.

On October 8, the U.K. issued sanctions (PDF) against Cryptomus — previously known as Certa Payments and Xeltox Enterprises — for processing payments that benefit the Russian government and its financial institutions. The sanctions freeze any Cryptomus assets at U.K. banks, and bar British companies from offering it any business, virtual or otherwise. Also targeted in these sanctions were the virtual payment platforms VexPay, TokenSpot, and the Tsunami Payments service.

As explained in our December 2024 investigation, “How Cryptocurrency Turns to Cash in Russian Banks,” Cryptomus has been a key payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services. The company has changed its name several times since emerging in 2022, most recently to “Heleket” last year after Canada levied a record CAD $176 million fine against the platform for anti-money laundering violations.

The blockchain data-crunching firm Chainalysis said the U.K. sanctions target the broader infrastructure supporting Russia’s wartime economy.

“Cryptomus and Heleket have emerged as major payment hubs for illicit activity,” Chainalysis wrote in an October 8 blog post. “Together, these services received more illicit funds across tracked categories than the mixers in our dataset and the number of illicit counterparties surged to more than 900 in a single month in late 2025.”

The Cryptomus support bot on Telegram, responding on Oct. 8 to an inquiry by saying the platform was suddenly unable to process transactions.

In April 2026, the blockchain analysis firm TRM Labs found Cryptomus had processed more than $7 billion in transactions since its inception in 2022, including transactions associated with child sexual abuse material vendors, terrorist financing networks, and human trafficking operations.

TRM noted that Cryptomus’s transaction volume cratered after the platform instituted new “know your customer” or KYC rules, and that the cryptocurrency platform responded to the Canadian fines by launching Heleket as a parallel service that continued to offer no-KYC payment processing.

Richard Sanders is a blockchain analyst and investigator who spent months mapping out Cryptomus’s payment infrastructure and transacting with its customers. Sanders said the U.K. sanctions on Cryptomus are important because Canada’s fine against the platform was ultimately unenforceable and uncollectible.

“A fine doesn’t stop a cryptocurrency payment processor from processing payments,” Sanders wrote on LinkedIn. “Sanctions kill the operation. The distinction matters.”

As our 2024 investigation noted, Cryptomus shared a Vancouver address with dozens of other foreign currency dealers and money transfer businesses — none of which appeared to be physically located there. Following the CAD $176 million fine for alleged money laundering violations, Cryptomus appealed the penalty, launched Heleket as a parallel service, and kept on processing large volumes of sketchy transactions, Sanders said.

Sanders said the sanctions also are notable because they are the first known instance of a “Five Eyes” country (referring to the Australia, Canada, New Zealand, the U.K. and the U.S.) sanctioning a cryptocurrency operation incorporated in another Five Eyes jurisdiction.

Where do entities like Cryptomus and Heleket derive their authority to offer international financial services? The answer appears to involve fake financial institutions overseen by a phony regulatory body positioned in a country that is not widely recognized as a sovereign nation.

Our 2024 investigation found the sole shareholder of Cryptomus’s parent company Certa Payments was a 25-year-old Ukrainian woman who also headed several other firms, including the WS Management and Advisory Corporation, which bills itself as the regulatory body that exclusively oversees licenses for cryptocurrency, foreign exchange and online gaming businesses incorporated in the disputed region in northwest Africa known as the Western Sahara.

That entity’s website — crasadr.com — says it assists applicants with bank setup and formation, online gaming licenses, and the creation and licensing of foreign exchange brokers. One of Certa Payments’ former sites — certa[.]website — also shared a server with 12 other domains, including rasd-state[.]ws, a website for the Central Reserve Authority of the Western Sahara.

The website crasadr dot com, the official website of the Central Reserve Authority of Western Sahara, which lists the entities awarded licenses for cryptocurrencies, gaming and foreign exchange services.

Discover the new Excel Copilot interactive canvas. Microsoft brings natural language reports, skill building, and advanced data cleaning to Microsoft 365.

Related Posts:

• Google Play AI Apps Revolutionize Android Publishing
• Google Gemini 4 Argon Model Officially Launches
• Codex CLI Daemon Autostart Sparks Developer Backlash

The post Excel Copilot AI Gains Interactive Canvas Feature appeared first on Daily CyberSecurity.

PoC and technical details for CVE-2026-103572, an 8.8-severity Visual Studio Copilot RCE and SSMS flaw, are now public. Patch your IDE immediately.

Related Posts:

• Public PoC Exploit Disclosed for CVSS 10.0 GitLab Remote Code Execution Flaw CVE-2026-97229 Affecting 25,766 Hosts
• Critical Nextcloud Collabora Online Flaw CVE-2026-110447 Actively Exploited in the Wild to Deploy Webshells
• Public PoC Exploit Code and Technical Details Disclosed for CVE-2026-74580 Linux vhost Vulnerability (Vghost)

The post Public Proof-of-Concept Disclosed for CVE-2026-103572 Remote Code Execution in Visual Studio Copilot and SSMS appeared first on Daily CyberSecurity.