Entrar
The Cyber Express Weekly Roundup: FBI Blames North Korea for $6B Binance Hack, Hackers Turn Up the Heat on Europe’s Fridges and More
Visualização de leitura
Stockal Confirms Unauthorized Trades in 13 Customer Accounts
No Breach of Borderless Systems Found
Borderless stated that it has found no evidence that its platform, interface, infrastructure or internal systems were breached or compromised in the cyberattack on Stockal. It has brought in independent cybersecurity specialists to examine its systems. The company believes the account holders may have been targeted through a social engineering attack that used information exposed in another company's data breach several weeks earlier. However, it stressed that this link remains unconfirmed and under active investigation.Support for Customers Hit by the Stockal Cyberattack
Borderless called support for affected customers its immediate priority. Its teams have been in direct contact with them since shortly after the incident and are working with DriveWealth to establish the facts, review the transactions and explore "appropriate avenues for a fair resolution." The company noted that this help is offered in good faith and "does not constitute an admission of liability, wrongdoing, negligence or responsibility for the unauthorized activity." It added that it will keep supporting customers while the facts and respective responsibilities are established.New Safeguards After the Stockal Cyberattack
As a precaution, Borderless has introduced additional authentication and account-protection measures. Based on the information reviewed so far, it said the unauthorized trading identified was limited to the 13 accounts. It has found no evidence of threats to the wider Borderless platform, its other products or other customer accounts, and it continues to monitor its systems as the investigation progresses.Cooperation With Authorities
Borderless said it is cooperating with relevant authorities and regulators over the Stockal cyberattack. It also clarified that it had responded substantively to media enquiries before reports were published, sharing the information it had at the time. The company said its statement reflects its current understanding and may be updated as further facts emerge. The firm said transparency, accountability, and protecting customers' interests remain central to how it operates. It added that it built Borderless on the belief that customers deserve "a trusted, responsible & globally connected financial platform," and that it will keep communicating as verified information about the cyberattack on Stockal becomes available.
Alpine Linux SSH Flaw Lets Attackers Log In Without a Password
How the OpenSSH Server Flaw Works
An attacker who can reach the SSH port gets in with a single connection that works every time, with no retries. The attacker needs the name of an account whose password field is * (normal for key-only accounts) plus at least one other account with a $5$ or $6$ hash, then sends a password of 257 to 1,024 bytes. One user with a password exposes every account without one. When built without PAM, sshd hashes each attempt with crypt() and compares it to the stored field, borrowing another account's salt when that field is too short to hold one. musl's crypt() returns * as an error indicator for keys over 256 bytes, which exactly matches the stored field of passwordless accounts. OpenSSH 10.6p2 fixes this, and no CVE had been assigned at the time of writing.Which Alpine Linux Servers Are Affected
Alpine Linux servers are vulnerable when they run openssh-server (built without PAM) or openssh-server-pam with UsePAM no, keep the default PasswordAuthentication yes, hold at least one local $5$ or $6$ hash, and have an account with a * password field. That includes root, shipped as root:* in the base image since about Alpine 3.16. The default PermitRootLogin prohibit-password shields root unless it is set to yes, but not if another account can become root through doas. Key-only users created with adduser or usermod -p '*', directory users via musl-nscd (nslcd, winbind, sssd), and the tiny-cloud alpine user also count. Every release checked is affected: 3.21 through 3.24, edge, and the older 3.16 to 3.20. Safe setups include containers not running sshd, systems with PasswordAuthentication no or UsePAM yes, locked accounts (user:! in /etc/shadow), machines with no $-style hash, and cloud-init images, which write PasswordAuthentication no.Patching the OpenSSH Server
Running apk upgrade -U -a, followed by rc-service sshd restart, applies the fix, which ships in Alpine 3.21.10, 3.22.8, 3.23.8 and 3.24.4. Fixed builds are edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1, 3.20 9.7_p1-r6, 3.19 9.6_p1-r3, 3.18 9.3_p2-r4, 3.17 9.1_p1-r7 and 3.16 9.0_p1-r6. Although 3.21 reached end of support on 2026-11-01, patched packages go back to 3.16. For the workaround, root should first confirm key login works and keep the current session open. A drop-in file, /etc/ssh/sshd_config.d/00-no-passwords.conf (read from 3.19 onward), sets PasswordAuthentication no, while a sed command flips every such line in sshd_config, Match blocks included, and saves sshd_config.bak. Running sshd -t && rc-service sshd restart, then sshd -T | grep -i passwordauthentication, should print passwordauthentication no. Deleting the drop-in and restoring the backup undoes it.Cloud Images and Spotting Attacks on Alpine Linux Servers
Official tiny-cloud images (qcow2, VHD and AMI) from 3.18.11 through 3.24.3 ship an alpine user with a * field and passwordless doas. They are safe on first boot but become exploitable once any $6$ hash appears, such as a console password or a user-data account with hashed_passwd, giving attackers a shell as alpine and then root. Instances from earlier point releases need updating or password logins disabled. Admins should check /var/log/messages for sshd "Accepted password" lines on passwordless accounts and review doas use, new users, files, and authorized keys. If a login cannot be ruled out, the machine should be treated as compromised. Özgün Kültekin of Wakefield reported the issue. Damien Miller and Darren Tucker of the OpenSSH project delivered the fix and the 10.6p2 release; Timo Teräs helped analyze the bug, and Natanael Copa built and uploaded the updated packages.
Ransomware Just Took New York’s Queens Library Offline, and It’s Not the First
What the Queens Public Library Ransomware Attack Shut Down
In a statement on Instagram, the library described a network outage affecting every location. All branches remain open on schedule, but several services are unavailable:- The library website, queenslibrary.org
- On-site computers
- Check-out and return machines
- Free Wi-Fi access
- The QPL mobile app
- Digital services, including digital media
Image source- Instagram[/caption]
Some virtual and in-person programmes may also be affected, and the library has asked visitors to check with their local branch. Renewals are unavailable during the outage. The library reminded customers that it does not charge late fines on borrowed materials.
"Our IT department is working to resolve the issue, and we will keep you informed," the library said, adding that people can call (718) 990-0728 for help.
When The Cyber Express tried to access the library's official website, it would not load and displayed the message "This site can't be reached." The Cyber Express reached out to the library for more information but had not received a response at the time of writing.
Why the Impact Reaches So Far
The scale of the system explains why an outage here matters. Queens Public Library is one of the largest library systems in the country, offering free access to more than 5 million books in 50 languages. Its reach also goes beyond its branches. It runs dozens of learning centres in public housing complexes across the borough, along with several mobile libraries. When on-site computers, free Wi-Fi and the website all go down at once, the services people come to a library for, beyond borrowing books, stop working too.Libraries Have Been Hit Before
The Queens Public Library ransomware attack follows a series of incidents at other libraries, and the pattern of disruption looks familiar. In 2024, the Seattle Public Library faced a ransomware attack that crippled its computer systems. On May 28, libraries across South Seattle were noticeably quiet, with signs telling patrons that all computer services were down. That included computer terminals, printing and in-building Wi-Fi, which many library users rely on. In December 2023, officials confirmed that a cyberattack was behind branch closures and service disruptions at the London Public Library. Three of its sixteen branches, Carpenter, Lambeth and Glanworth, were closed until January 2. The library said it experienced a systems outage early on December 13, 2023, and that cybersecurity experts were engaged immediately. It worked with a third-party security firm to repair the damage. In October 2023, the British Library faced a major outage that first looked like a technical glitch but quickly grew into a widespread disruption. It affected online systems, including the website, and onsite services such as public Wi-Fi and phone lines. Across all four cases, the same things tend to go dark: public computers, Wi-Fi and websites. Each library cyberattack shows how much everyday library services now depend on networks that can be taken down in one go.What Is Still Unknown About the Queens Public Library Ransomware Attack
Several key questions remain open. No ransomware gang has claimed responsibility, so it is not known who is behind the attack. The library has not said when services will be restored, whether any data was taken, or whether a ransom has been demanded. For now, the library's IT team is working on the issue, and updates are being shared through its social media channels.
Airline Data Breach Widens as Singapore Airlines Reports 46,000 Affected Records
What Singapore Airlines Disclosed About the Amadeus Cybersecurity Incident
SIA briefed the media on 3 November 2026. According to the airline, most of the affected records contained passengers' names, booking reference numbers, travel itineraries and booking classes. A smaller group of about 620 records carried more sensitive details. For these, email addresses, phone numbers, travel document information and KrisFlyer membership numbers may also have been viewed. The airline said no bank account or credit card data was exposed and no bookings were altered. SIA also stated that its own IT systems were not breached. It is reaching out directly to affected customers who have upcoming trips so they can change their booking reference numbers.Cathay Pacific: 53,000 Bookings Accessed Over Three Years
Cathay Pacific went public with its own statement on 30 October 2026, updated at 16:11 HKT (GMT+8) that day. The Hong Kong carrier said Amadeus first notified it on 28 October 2026 and shared further details on 29 October. According to Cathay, an unauthorized party had gained access to travel reservation data in Amadeus's systems "using login credentials assigned to its system account." Data supplied by Amadeus showed that around 53,000 Cathay Pacific bookings were affected, with the unauthorized access running from August 2023 to September 2026. In most cases, the exposed information covers booking references, passenger names, and flight details. In a smaller subset, email and phone contacts, travel document details, and frequent flyer numbers may also have been accessed. Cathay said there is no evidence that financial or payment data was touched. The airline said Amadeus has contained the incident, including through a password reset, and has added enhanced monitoring and detection on its systems. Amadeus has so far found no evidence that the data has been misused. Cathay stressed that the incident "has not impacted and is not impacting" its own systems or operations. It has informed the relevant authorities that they are still analyzing the information from Amadeus and plans to notify affected customers individually once the details are confirmed. "We apologise to our customers for the concern and inconvenience caused by this incident," the airline said.Malaysia Airlines Urges Vigilance
Malaysia Airlines issued its notice on 31 October 2026, describing Amadeus as its third-party airline reservation technology provider. The carrier said some customer information processed through Amadeus between August 2023, and September 2026 may have been affected. The airline said its own IT systems were not compromised and that there is currently no evidence that financial information was accessed. It is working with Amadeus and other relevant parties to investigate and gauge the impact. As a precaution, Malaysia Airlines asked customers to stay alert to suspicious or unsolicited messages, "particularly those requesting personal or financial information." The carrier said it would share further updates as more information emerges.Japanese and Korean Carriers Report Similar Airline Cyberattacks
Japan Airlines (JAL) reported earlier that Amadeus had informed it of unauthorized access to reservation records for both JAL and Japan Transocean Air flights. About 92,000 customers were affected, making JAL the hardest-hit carrier so far. Names, booking references, and flight information were exposed. Korean Air and Asiana Airlines also confirmed unauthorized access to data managed by Amadeus. Both said there was no evidence that their internal systems or databases had been breached.How Amadeus Explains the Breach
Amadeus has attributed the exposure to a software glitch that made certain booking-display data accessible. That explanation sits alongside Cathay Pacific's account, which describes an unauthorized party using system account login credentials. The company said its investigation is continuing and that it has found no evidence of payment or financial information was accessed. Amadeus also said there is no sign that the vulnerability was used for ransomware. It has since rolled out fixes, together with stronger monitoring and detection measures.The Full Reach of These Cyberattacks on Airlines
At least 15 international airlines are either confirmed as directly affected or are investigating possible customer data exposure from the supply-chain attack on the Spanish IT and reservations company. Because the breach hit a centralized booking display environment, it reached flag carriers as well as the regional partners that route reservations through them.Major carriers with confirmed exposure
| Airline | Reported impact |
| Japan Airlines (JAL) | About 92,000 passenger records |
| Cathay Pacific Airways | About 53,000 passenger bookings |
| Singapore Airlines (SIA) | About 46,000 booking records |
| All Nippon Airways (ANA) | Up to 37,800 customer profiles |
| Malaysia Airlines | Customer data exposed across August 2023 to September 2026 |
| Korean Air | Unauthorised access to customer reservation databases |
| Asiana Airlines | Passenger booking references exposed through system account credentials |
| Condor Airlines | Part of the German leisure carrier's international flight data accessed |
Regional and subsidiary carriers
Several smaller airlines were drawn in because they share back-end ticketing technology or corporate ties with the larger groups:| Airline | Link to the breach |
| Japan Transocean Air (JTA) | Affected through parent company Japan Airlines |
| Air Do | Affected through shared system pathways with ANA |
| StarFlyer | Affected through shared system pathways with ANA |
| Solaseed Air | Affected through shared system pathways with ANA |
| Ibex Airlines | Still determining the scope of exposure via its ANA integration |
| Oriental Air Bridge | Still determining the scope of exposure via its ANA integration |
Under investigation
Qantas Airways is formally investigating whether any Australian customer files were compromised. The airline maintains that its internal databases have not been breached.What the Amadeus Cybersecurity Incident Means for Travelers?
With the access window stretching from August 2023 to September 2026, the Amadeus cybersecurity incident spans more than three years and stands out among airline cyberattacks for how many carriers it touched through a single provider. None of the affected carriers has reported misuse of the data so far, and no airline has said payment details were taken. Even so, names, itineraries and booking references can be enough for convincing phishing attempts. That is why carriers such as Malaysia Airlines and SIA are asking passengers to watch for suspicious messages and, where advised, change their booking references. As investigations continue, more airlines may update their figures on how far these cyberattacks on airlines have reached.
Europol Seizes 100+ Servers Running Fake Trading Platforms
The Investment Fraud Supply Chain
The target was not a single scam group. Investigators say the company supplied fake trading platforms to criminal groups, operating what they describe as a crime-as-a-service model from Cyprus and Israel. Its suspected clients ran fraudulent call centres in Albania, Kosovo and North Macedonia. Those call centre operators allegedly persuaded victims to hand over their savings. In other words, one business built the storefront, and others did the selling.How Victims Were Drawn In
The scheme promised large, quick returns from trading in cryptocurrencies, foreign currencies or stocks. It started with an advert. The investigation found that affiliate marketing was abused to attract potential victims, with deceptive ads steering people towards fraudulent investment platforms and exploiting their trust in online promotions. The personal data collected this way was then sold to the criminal groups running the call centres. Operators contacted potential victims with supposed investment opportunities and turned that first flicker of interest into repeated demands for money.Why Victims Kept Paying in This Investment Fraud
The method relied on making the scam look like it was working. Victims were first encouraged to transfer a small amount. Their online accounts then showed fictitious profits, which made the platform seem credible and the investment successful. Supposed brokers used those fake gains, along with constant psychological pressure, to push victims into sending larger and larger sums. The problem surfaced when victims tried to withdraw. Operators used delaying tactics to block payments. Eventually, contact stopped altogether, and victims were left unable to recover their money.How a Couple's Complaint Exposed the Network
The case began in 2022, when a German couple reported that they could not withdraw money they had invested through an online trading platform. A first international action day that year led to two arrests and seized evidence. With Europol-supported analysis, investigators identified seven more suspects, including suspected call centre managers. A second action day in 2025 brought further arrests and seizures of money and evidence. Analysis of that material exposed the suspected infrastructure provider and its links to call centre operators, setting up this month's operation. In total, the case took four years to reach the company allegedly behind the platforms.The Role of Europol and Eurojust
Europol's European Financial and Economic Crime Centre analysed the data, cross-checked it against Europol's databases and brought national investigators together to plan joint action. On the action day, Europol sent experts to Albania and Kosovo to support digital forensic work, and its Virtual Command Post supported the coordinated intervention. Eurojust supported the execution of European Investigation Orders, European Arrest Warrants and freezing orders. Two joint investigation teams were set up at the agency: one involving Albania, Germany and Poland, and another involving Albania and Kosovo. Judicial actions on 3 November were coordinated from Eurojust's headquarters in The Hague.
UTA Investigates Suspected Cyberattack After MachForms Service Disruption
Timeline of the UTA cyberattack
Problems first appeared on Oct. 27, when MachForms became temporarily unavailable, according to the university's cybersecurity website. Technicians from the Office of Information Technology began investigating the issue at that time. On Wednesday, the office started corrective measures aimed at restoring services as soon as possible. Since then, public information has been limited. As of Tuesday night, the cybersecurity website had not posted any updates since Thursday.What the University of Texas Is Asking Students and Employees to Do
The university's email outlined several steps for students and staff to follow while the investigation into the cyberattack on UTA continues. First, the university asked everyone to follow official guidance from the Office of Information Technology and the Information Security Office, and to pay close attention to university communications. Second, anyone who notices suspicious activity, such as unusual computer behavior, a suspicious email or anything else that raises cybersecurity concerns, should report it to the Information Security Office at opsec@uta.edu. Third, students and employees were told not to investigate the incident on their own or circulate unverified information. Questions should be directed to a department head or the Office of Information Technology, and people should rely on official updates for confirmed information. If a journalist reaches out, students and employees are asked to refer them to UTA's media relations team. Finally, the notice asked the campus community to follow any additional instructions. If action involving passwords, devices, systems, or work practices becomes necessary, students and employees will receive specific guidance through official university channels. MachForms remains affected for now. Students and employees who need access to the platform for urgent and significant operational needs can contact the Office of Information Technology service desk at uta.edu/help. The University of Texas at Arlington has not said how long the investigation will take or when full service will be restored.
Why Is Kim Yo-jong Suddenly Responding to a Binance Hack?
Why the Binance Hack Targeted Engineers, Not Systems
According to the post-mortem Binance released on Tuesday, the attackers went after people with access to wallet infrastructure. In June, Wallet DevOps Engineer A searched for a popular AI coding tool and downloaded a tampered Homebrew installation. Binance's security team spotted the anomaly, replaced the device and rotated his credentials. But the damage was done in another way: Engineer A's role, and his colleagues on the wallet infrastructure team, were now known to the attacker. In September, the attackers moved to social engineering. Software Engineer B, whose profile on a legitimate job-hunting platform mentioned his Binance experience, was approached by someone posing as a project director. A first-round video interview followed with a supposed HR representative, who shared personal photos and videos on social media to build trust. Binance said this was more advanced than social engineering it had seen before.
In the second round, held on a popular chat app, Engineer B was told to download an "assignment" onto his work computer. It contained malicious code that ran during setup, swapped a legitimate development tool for a malicious version, and connected to an attacker-controlled server. The zero-day malware was not detected by endpoint security tools at the time.
On October 20, the attackers used Engineer B's compromised computer and an internal AI tool to gain control over Engineer A and another wallet engineer, Engineer C. They then found that Engineer A had a container deployment permission token on his machine.
How the Binance Hack Unfolded on October 29
Between 17:15 and 19:56 UTC, the attacker logged onto Engineer C's computer, used Engineer A's stolen credentials, deployed a container and triggered a malicious script. That gave them unauthorized access to an internal wallet signing service, which they used to send transactions outside the normal withdrawal process. Between 20:05 and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address. Hot wallets on Solana and Optimism sent about 970,500 SOL and 44.2 million OP. Binance then received an internal alert about large transfers, and another hot wallet sent 18,270 BTC.Why Binance Couldn't Stop It Faster
Binance suspended withdrawals, but that did not end the outflows. The attacker had used the signing service to exploit Ethereum's EIP-7702 authorization mechanism. By submitting 50 signing transactions, they gave an attacker-controlled smart contract partial execution rights over a Binance hot wallet. Those authorizations lived on-chain and worked independently of Binance's withdrawal systems. And because the wallet used Multi-Party Computation, there was no single private key that could instantly revoke them. Binance had to build a special procedure to do it. The final unauthorized transfer of 2,961.9 ETH was confirmed at 23:56 UTC. At 00:10 UTC on October 30, Binance cleared the malicious delegation.Who Is Behind It
Over the weekend, the FBI and other U.S. agencies blamed the theft on TraderTraitor, a North Korea state-sponsored group that has spent years attacking cryptocurrency platforms. Binance said it had detected and stopped 57 suspected North Korea-linked threats in 2026 alone, many using fake job interviews and malicious developer tools. On Tuesday, Kim Yo-jong rejected the U.S. findings, calling them a "grave political provocation" in a statement carried by the Korean Central News Agency. Observers noted the statement ended by saying Pyongyang had matters to "reconsider," without directly threatening retaliation. South Korea's Unification Ministry called her personal response unprecedented. An official said it suggested the North was taking the allegations seriously and was "increasingly conscious of its international standing."Where Users Stand
Binance says it has set aside more than 100% of the funds needed to cover the loss. As of October 31, 98% of impacted token assets had been replenished, and Binance is buying the remaining, less liquid assets. About $2.85 billion has been frozen or intercepted with help from law enforcement, token issuers and blockchain intelligence firms. Withdrawals have broadly resumed. The exchange says it has rebuilt the affected wallet system and AI tool, replaced devices, revoked credentials tied to the affected engineers and brought in independent security firms. The investigation is ongoing.
Hackers Exploit WordPress Flaw Within 48 Hours of Security Patch
What WordPress 7.1.4 Fixes Beyond the WordPress Vulnerability
Version 7.1.4, released on October 28, is mainly a security release. Alongside the critical code execution fix, it patches several stored cross-site scripting (XSS) flaws, a denial-of-service issue, and two separate information leaks. The update also refreshes WordPress's bundled root certificates after eMudhra revoked its certificates. Of everything in the release, the code execution bug is the one attackers zeroed in on. Aaron Jorbin, who wrote the release announcement, told users to “update your sites without delay.” A GitHub security advisory published the next day described the issue as a timing weakness in the update system. If an unauthorized user moves quickly enough while an upgrade is running, they may be able to execute their own code on the server. No CVE number has been assigned to it so far.How the Vulnerability in WordPress Works
When WordPress performs a full-package core update, it first extracts the new files into a dedicated directory inside the upgrade folder. According to the advisory, that directory had a predictable name and was reachable from the public web. That combination is the problem. An attacker who requests the right file at the right moment, before WordPress finishes cleaning up, could trick the server into running arbitrary PHP code. Pulling this off is not trivial. The attacker needs four conditions to line up: a full-package update in progress, web access to the temporary folder, a path they can guess, and a short window before the files are deleted. Under controlled conditions, that window may last only a few seconds.Which Sites the WordPress Vulnerability Affects
The advisory lists every WordPress release from 4.7 through 7.1.3 as vulnerable. It also names the fixed version for each branch, including 7.0.8, 6.9.11, 6.8.12 and 5.9.20. The WordPress project said it backported the patch to all branches still receiving security maintenance, reaching as far back as 4.7. It also stressed that only the newest version is actively supported. Not every site can be taken over through this bug. The risk rises sharply, however, if an attacker hits a site while it is running a full-package update. Smaller websites face extra exposure. Many sit on shared servers with default settings, which makes them attractive targets for cybercriminals.How Attackers Are Targeting the Vulnerability in WordPress
Wordfence traced the root cause to full-package upgrades repeatedly using web-accessible paths that are easy to guess. Alex Thomas, a threat analyst at Wordfence, said attackers quickly understood the race condition and turned their attention to it. Two of the biggest attack sources reportedly kept polling small groups of websites for roughly 14.5 hours. Other sources tried out different folder names and version names. The pattern looks like large-scale automated guessing rather than attacks on chosen victims. So far, no confirmed reports have put a number on how many sites have actually been compromised.How Serious Is This WordPress Vulnerability?
Sources disagree on how severe the flaw is. The Hacker News gave it a CVSS score of 8.1, which falls in the high range. The GitHub advisory, by contrast, rates it as low severity. That gap most likely comes down to how hard the bug is to exploit successfully. Even so, the sheer volume of attack attempts and the simplicity of the fix make it sensible to treat this as a serious threat.What Comes Next for This Vulnerability in WordPress
The probing is unlikely to stop soon. Once a vulnerability is patched, the fix itself becomes a detailed roadmap for anyone hunting sites that have not been updated. The WordPress project says backports to older branches are still in progress. The next major release, WordPress 7.2, is scheduled for December 8. The advisory credits researcher Umut Bayram with discovering the flaw and reporting it responsibly. There is currently no alternative workaround, so applying the patch is the only fix available.
Polymarket Users Lost Money Without Clicking Anything. Here’s How
Polymarket users who had the site open during a short window on October 29 watched their positions get sold and their funds leave their wallets without doing anything themselves. The Polymarket hack did not start inside Polymarket.
It came through a small piece of code from an outside company that loaded on every visit to polymarket.com. The cryptocurrency-based prediction market now says it is returning $3.9 million to affected traders.
How the Polymarket Hack Worked
In a post-mortem published on October 31, Polymarket said a third-party vendor whose performance-monitoring script ran on polymarket.com had been compromised. The attacker swapped the vendor’s legitimate code for a compromised script built specifically to target Polymarket users.
The attacker did not need anyone’s password. For users who had the site open at the time, the malicious script used their active session to sell positions and move funds out of their wallets. Anyone logged in and browsing during that window was exposed. The vendor has publicly confirmed the compromise.
Polymarket’s status page first reported “unauthorized activity affecting user wallets” on October 29 and marked the incident as resolved later that day.
Who Was the Vendor Behind the Polymarket Hack?
Performance-monitoring company DebugBear released its own update on the incident. It said its initial findings point to its domain registrar as the point of entry.
“Our DNS records were compromised through our domain registrar,” the company said on X. “We are currently unable to receive emails sent to our domain. Based on our initial investigation this attack targeted the website of a specific customer.”
[caption id="attachment_115172" align="aligncenter" width="538"]
Source- Twitter[/caption]
DebugBear added that it has “not seen any indication of a compromise of our internal systems,” though it is continuing to investigate.
This is the part of the story that should worry other website operators. According to the statements from both companies, the attacker appears to have gone after a vendor’s domain setup rather than Polymarket’s own systems, and used that position to put malicious code in front of Polymarket’s users. DebugBear’s own internal systems, by its account, show no sign of being breached.
How Polymarket Responded
Polymarket listed the steps it took once the attack was identified:
- Removed the vendor’s compromised script and cleared every cache.
- Paused trading and its relayer to stop further drains, then reopened once the site was clean.
- Reset all active login sessions.
- Began redeploying third-party scripts with added integrity controls and continuous monitoring, including a stronger content security policy, explicit version pinning and sandboxing.
- Referred the case to law enforcement while running its own investigation into the threat actor.
The trading pause stopped the bleeding, but it created a second set of losses for traders who were not directly hit by the script.
Where the Polymarket Hack Refunds Stand
Polymarket is returning $3.9 million in total. Of that, $2.7 million covers the initial losses from the attack, and $1.2 million covers losses tied to the hours-long shutdown.
As of its post-mortem, the company said 95% of affected wallets had been refunded in full, through a mix of reimbursements for drained wallets and goodwill payments.
The refunds cover more than drained wallets. Polymarket said it also made goodwill payments in two cases:
- Positions taken during the attack. If the script moved or force-sold a user’s positions, Polymarket will pay what they were worth when they were taken, including any slippage from the sale.
- Losses during the trading pause. If a user held a position when trading paused and it lost value because the market ended during the pause, or the user sold right after trading reopened, Polymarket covered the difference from its value at the pause.
Users do not need to file claims or tickets. Polymarket said it identified eligible wallets using on-chain and trading data. Anyone who thinks their amount is wrong, or believes they should have received a payment, can submit a form for the company to recheck.
What Remains Unanswered
Some questions are still open. Neither company has named the threat actor. DebugBear has said the attack targeted a single customer, but its investigation is ongoing, and it still cannot receive email sent to its domain. Polymarket has also not said exactly how many wallets were affected, only that 95% have been made whole.
The incident shows how much trust a website places in every outside script it loads. Polymarket’s own systems were not the entry point, yet its users still lost money, and it took a trading halt, a session reset and a removal of the vendor’s code to stop it.
South Korea President Eyes Cybersecurity Task Force After North Korea-Linked Crypto Heist
Cybersecurity Task Force and North Korea's Binance Heist
The directive follows a string of attacks on domestic financial companies that exposed customer data. The most recent targets were Mirae Asset Global Investments, cryptocurrency exchange Bithumb, and Daishin Securities. It also comes after the hacking of Binance, the world's largest crypto exchange, in which more than US$6 billion in cryptocurrency was stolen. The U.S. Federal Bureau of Investigation (FBI) has since attributed the theft to North Korea, which gives the incident a national security dimension beyond financial crime. Lee said cyber threats have grown severe enough to endanger the national economy, national security and the daily lives of ordinary citizens. He called for "a comprehensive prevention system" to address them. According to the president, hacking methods are becoming more sophisticated and widespread, driven partly by advances in artificial intelligence (AI). He said this trend is exposing clear limits in the systems currently used to maintain security.A Possible "Czar Agency" Amid North Korea Threats
Lee's plans go further than a single task force. He stressed the need for talks on setting up a pan-government agency responsible for cybersecurity across both the public and private sectors. He specifically told officials to "proactively consider the formation of a cybersecurity czar agency" that could act as a strong and effective control tower for security management. The president also ordered officials to thoroughly fix security weaknesses at major state institutions and key national infrastructure, naming information communications, energy, and finance. Because hackers tied to North Korea have repeatedly targeted financial assets, the finance sector is a particularly pressing concern.Social Media Limits for Teens Also on the Agenda
Cybersecurity was not the only digital issue raised at the meeting. Lee also called for quick discussions on the government's plan to restrict adolescents' use of social media. "The harmful effects (of social media on teenagers) appear to be greater than what we think," Lee said. The government is pursuing measures to limit social media sign-ups by young teens and to restrict their use of certain services, including algorithm-based ones. The goal is to shield adolescents from the harms of social media. Lee told Kim Jong-cheol, chairman of the Korea Media and Communications Commission, to "conduct relevant discussions thoroughly and promptly." He pointed to similar efforts already under way in Europe, Australia and Canada. Kim replied that the plan should be pursued on the basis of social consensus. He said the commission intends to gather public input and finalize the measures in the first half of next year. Officials will now weigh whether to form a cybersecurity task force and a broader czar agency. Their decisions will shape how South Korea responds to escalating digital threats, including attacks attributed to North Korea.
Why Would Anyone Hack a Supermarket Freezer? Europe Is Finding Out
How the Supermarket Cyberattack Unfolded Across Europe
Sweden saw some of the clearest signs of tampering. ICA Group spokesperson Gustaf Nilsson told the TT news agency that "a limited number" of stores were affected overnight by an incident involving refrigeration systems. One ICA Kvantum store in Sjöbo, in southern Sweden, was more direct. In a Facebook post, it said its fridges and freezers had been hacked and set to 50 degrees Celsius, and that staff were discarding affected products. The Coop chain also reported problems with fridges and freezers at six stores in central Sweden, according to TT, though it did not immediately share details. In Belgium, Delhaize said an "IT incident" had affected refrigeration in several dozen stores, mostly in Belgium and a few in neighbouring Luxembourg. "In the affected stores, the range of fresh and frozen products is temporarily somewhat limited. Our distribution centers are operating normally, and there has been no disruption to deliveries to our stores," spokesperson Sarah De Meester said. Carrefour said a cyberattack targeting refrigeration had affected 15 of its more than 700 Belgian stores, and described the impact as "extremely limited.
In Ireland, Musgrave Group said refrigeration systems in 13 SuperValu stores were affected by the "cyber incident." Chilled and frozen products were removed from sale as a precaution. By Monday afternoon, the company said the incident had been "fully resolved" and that restocking of chilled and frozen ranges was "well under way."
In Estonia, refrigeration technology company Kitman Coldtech said attackers had accessed a computer controlling a client's refrigeration system and raised the temperature to 50 degrees Celsius, public broadcaster ERR reported. Chief executive Jann Mutso declined to name the store but said the attack was addressed within minutes and caused no significant damage. The Selver supermarket chain confirmed that one of its outlets was affected.
Is This Supermarket Cyberattack Linked to France?
None of the companies has publicly linked Monday's incidents to France, but the pattern is hard to miss. Last month, attackers remotely took control of refrigeration systems in hundreds of supermarkets and independent stores across France. They pushed fridge and freezer temperatures as high as 50 degrees Celsius. French TV channel BFM reported that the attackers appeared to trigger a forced defrost option, which kept units heating instead of cooling. By morning, tonnes of food had perished. Some equipment had melted, and in some stores the heat had sparked fires. Five of France's major retail groups were hit: E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores were affected. Coopérative U reported more than 100 stores, Carrefour said 80, and Monoprix said about 5% of its roughly 490 stores were targeted. Bruce Hallas, CEO at Re-thinking the Human Factor, who lives in France, noted on LinkedIn that current estimates sit around 400 stores. He added that some individual branches reported losses of about €250,000. Retailers say millions of euros' worth of food was spoiled, which makes food losses the most visible cost of the attack.Why the Supermarket Cyberattack Targeted Fridges
The French case offers the strongest clue. The attack did not rely on a new exploit. It targeted ageing systems: internet-connected devices that were still online years after their manufacturer stopped supporting them. Experts say this weakness is common across retail and industry. The cyberattacks in France appeared to target old systems in particular. Timing made the damage worse. In France, the attackers struck while shops were closed, so temperatures kept rising for hours with no one in the store to notice. Monday's incidents in Sweden also happened overnight. Estonia shows the other side of the picture. There, the intrusion was caught within minutes and caused no significant damage. The difference between tonnes of ruined stock and almost no loss came down to how quickly someone noticed.What We Still Don't Know
Key questions remain open. The reports do not say who is behind the attacks or what they want. The full scale is also unclear. Estimates for France range from around 400 to more than 500 stores, and ICA has not said how many of its Swedish stores were hit. The chains affected on Monday have not confirmed whether their equipment shares the ageing, unsupported setup seen in France. What is clear is that the same tactic has now reached at least five European countries, with fridge temperatures set to 50 degrees Celsius each time.
Russia and Ukraine Emergency Apps Hacked With Fake Threat Alerts
Emergency Alert App Cyberattacks Trigger False Warnings
Ukraine was the first to report problems with its emergency alert application, which is supported by the country's Ministry of Digital Transformation and provides notifications about the beginning and end of air defence alerts. Following the incident, the Ukrainian Air Force said the application had probably experienced hostile interference. It specifically denied that Kyiv faced the radiation threat indicated by the false alerts and asked residents to remain calm and follow official updates. Ukraine's Centre for Strategic Communications also urged users to disregard strange messages appearing in the application. The centre blamed Russia for the incident in a post on X and highlighted an alert containing a message in Russian about the Oreshnik missile system. The supplied reporting does not establish how the attackers gained access to the application or how the false messages were inserted into the alert system.Russia's Emergency App Issues False Nuclear Warning
Several hours after Ukraine reported the incident, Russian authorities said their emergency alert application had suffered what they described as a massive cyberattack. One false message reportedly warned Russian residents that nuclear warheads mounted on P1-Suns, identified in the message as a Ukrainian attack drone, had been launched towards all regions of Russia. The alert also instructed people to stock up on food for three weeks and hide. A Ukrainian espionage group claimed that fake nuclear strike warnings had been sent to users in Russia. However, the available reporting did not independently establish who was responsible for the Russian application incident. Russia's emergencies ministry said the mobile application was an additional information service and that the wider public warning system continued to operate normally. The ministry said emergency information was also distributed through sirens, loudspeakers, text messages, television and radio broadcasts. It added that specialists were working to restore the application and described the situation as under control.Cybersecurity Expert Warns of Further Attacks
Herbert Lin, a senior research scholar specialising in cyber policy and security at Stanford University, described the reported compromise of Ukraine's air raid warning application as concerning. Speaking to the BBC's Newsday programme, Lin said he believed it was the first time an official Ukrainian information application had experienced such an incident. He warned that similar attacks could occur again but stressed that the method used to compromise the application was not yet known. The incident highlights the potential consequences of interference with emergency alert systems, which are designed to deliver time-sensitive information to people facing security threats. False warnings can create uncertainty about whether a reported threat is genuine, particularly when residents rely on mobile applications for immediate updates during military attacks. However, the supplied reporting does not establish the wider impact of the incidents on public behaviour or emergency response operations.False Alerts Coincide With End of Kherson Ceasefire
The false warnings in Ukraine appeared just minutes before the scheduled end of a localised ceasefire in the frontline Kherson region, according to BBC reporting. The six-day ceasefire involving the area around Oleshky, which has been under Russian occupation since 2022, had enabled hundreds of people to evacuate. The arrangement was brokered with assistance from US First Lady Melania Trump and Pope Leo XIV. Both sides had accused each other of using the ceasefire period to strengthen their frontline positions. Ukrainian officials said the humanitarian operation could provide a basis for further solutions, although the Kremlin viewed such operations as separate from the wider peace process. The timing of the false alerts was reported, but the available information does not establish that the cyber incidents were connected to the ceasefire or its conclusion.Russia and Ukraine Continue Exchanging Energy Strikes
The reported cyberattacks on Russia and Ukraine occurred amid continued strikes against energy infrastructure on both sides. Russian authorities reported drone strikes against an industrial enterprise east of Moscow, identified by Ukrainian media as the Kstovo oil refinery. Nizhny Novgorod regional governor Gleb Nikitin reported significant damage, possible power outages and reduced hot water supplies. One woman was reportedly injured by falling drone debris. Ukrainian President Volodymyr Zelensky also said Russian strikes had hit energy infrastructure in four Ukrainian regions, leaving hundreds of thousands of homes without power. The emergency application incidents add another layer of concern to the conflict, where digital information services are used to communicate immediate threats to civilians. Investigations into the reported attacks, including who was responsible and how the applications were compromised, remain unresolved in the supplied reporting.
The Cyber Express Weekly Roundup: Binance Hit by $6.3 Billion Security Incident, South Korea Busts AI-Powered Hacking Ring and More
The Cyber Express Weekly Roundup
Binance Hit by $6.3 Billion Security Incident, Nearly $3 Billion Frozen
Binance says a security incident affected about $6.3 billion in crypto assets, making it one of the largest in the industry’s history. Close to $3 billion has already been frozen on-chain, including 1.567 billion USDT frozen by Tether and 800 million USDC frozen by Circle. Read more...South Korean Police Bust AI-Powered Hacking Ring That Targeted 90 Companies
Seoul police have arrested seven people accused of using generative AI to hack about 90 companies and steal 8.2 million personal records, then demanding payment to keep the data private. The group’s 32-year-old ringleader, who taught himself to hack, used AI tools in roughly 60 of the attacks. Read more...Columbia University Settles $16.1 Million Lawsuit Over 2025 Data Breach
Columbia University will pay $16.1 million to settle a class action over its June 2025 cyberattack. The breach exposed Social Security numbers, health information and financial aid data belonging to about 870,000 applicants and affiliates. An internal investigation concluded the attack was politically motivated, with the hacker looking for evidence of affirmative action in admissions, and found no sign that the data was sold. Read more...Ukrainian Ransomware Affiliate Sentenced to 70 Months for Attacks on Hospitals and Businesses
Artem Stryzhak, 36, has been sentenced in the U.S. to 70 months in prison for his part in the Nefilim and Hive ransomware operations, which caused more than $100 million in losses. Working as an affiliate, he attacked companies, law firms and healthcare providers, including during the COVID-19 pandemic. Stryzhak was arrested in Spain in 2024, extradited in 2025, and pleaded guilty to two conspiracy counts. Read more...Discord to Let Google Index Public Server Messages, Raising Privacy Concerns
Discord will allow search engines to index content from its Discoverable Servers, the more than 63,000 public communities with at least 1,000 members. Server web pages and discussion summaries go live on November 16, and individual messages follow from mid-December. Usernames and avatars will be hidden, and older messages are excluded. Read more...Weekly Cybersecurity Takeaway
Several incidents this week show how far a single foothold can reach. At Binance, one engineer’s compromised laptop was enough to push through unauthorized withdrawals worth billions. In South Korea, generative AI helped a self-taught attacker run dozens of intrusions that would once have needed a larger, more skilled team. The other common thread is that the consequences of a breach outlast the breach. Columbia is paying $16.1 million more than a year after its attack, Stryzhak was sentenced years after the Nefilim and Hive campaigns, and the U.S. is still chasing his alleged partner with an $11 million bounty. Discord’s change is a reminder that exposure doesn’t always come from attackers: a default-on setting can make years of casual conversation searchable going forward. Organizations should treat the devices of privileged staff as high-value targets and require multi-party approval for sensitive actions such as large withdrawals. They should assume AI is lowering the cost of attacks and keep basic defenses tight, minimize how much sensitive data they keep and for how long, and review default privacy settings on the platforms their teams and communities use.
Binance Security Incident Affects $6.3 Billion in Crypto Assets, $3 Billion Frozen
How the Binance Data Breach Happened
According to the exchange, early findings point to a compromised employee device. Initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," Binance said in an update. The statement, titled "Security Incident Update," was published on October 30, 2026, at 07:53. It said the company had found no evidence that any wallet private key was leaked. Binance added that it would release a detailed technical post-mortem once the investigation is complete and the facts are fully verified.Who Will Cover the Losses
Binance said it will cover all losses from the cyberattack on Binance using its Secure Asset Fund for Users (SAFU) and the company's own funds. "User funds are safe," the exchange stated. It also said it had worked with blockchain partners to freeze the affected assets. Once remediation is complete, it plans to publish an updated Proof of Reserves.Immediate Steps Following the Binance Data Breach
As an immediate precaution, the exchange said it has:- Temporarily suspended deposits and withdrawals while security checks are completed;
- Revoked the affected address authorization;
- Engaged law enforcement and blockchain intelligence partners to trace and recover the funds.
Withdrawals Expected to Resume Within 48 Hours
In a later update, Binance said it expects withdrawals to resume in 48 hours, after its team "completes a security revamp of the withdrawal service and its related addresses." Until then, users cannot move funds on or off the platform. Binance has not yet said how the attacker gained access to the engineer's laptop. The company has said those technical details will be in its upcoming post-mortem on the Binance data breach.
Three Cyberattack Campaigns Target Japan, Exposing AI’s Growing Role
Case A: Automated Cyberattacks on Japan
In a short burst in October 2026, Case A abused CyberStrikeAI, an open-source agent-based penetration-testing tool with a Simplified Chinese console. Entries like "credential-search agent 8/44" show 44 agents dividing up reconnaissance, exploitation, command and control, persistence, exfiltration, and reporting. The platform produced Japanese forms and fake login pages. It also throttled traffic to each target to avoid detection. At least 19 organizations received identical reports, including at least 16 in Japan and others in Taiwan and Hong Kong. Most were smaller businesses and local public bodies. Yet many entries read "no session, no web shell, no exfiltration." The deepest intrusion began at an unauthenticated administration interface on a legacy system.Case B: Human-Led, AI-Assisted
Over about 24 days in August and September, a human operator used an LLM for planning and tooling. The operator scanned at least 6,000 Japanese IP addresses and also probed AI assets in South Korea. One LLM-written plan targeted AI and GPU services. To get it, the operator framed the request as an authorized assessment to bypass the model's guardrails. Other tools sought to hijack and pool access to other people's AI services, likely to get cheap inference capacity. One company suffered full control through FTP, a database, administrator rights, a web shell, and SSH, and the attacker repeatedly restored backdoors after cleanup. At another, a GIS server left on default credentials exposed several hundred thousand cadastral and commercial records, Windows credentials, and email. Several hundred attempts on one cluster failed.Case C: Limited AI Role
From January to October, a seasoned operator ran at least six campaigns, several in parallel from September onward. They targeted at least 1,300 WebLogic candidates and 35 VPN entry points, mainly in Japan and South Korea. The target lists also included the UK, France, Italy, Qatar, and Colombia. Devices included Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, and Yamaha RTX1210. On the RTX1210, leftover credentials in configuration files opened direct access to corporate networks. Section headings such as echo '=== ... ===' in the command history and emoji status markers in scripts point, with high confidence, to AI-written tools. A skilled human mimicking that style cannot be excluded.Lessons Beyond ARTEX
All three operations worked in Simplified Chinese and sorted results under names like jp_success, jp_attack, and jp_cve_attack. Each picked targets opportunistically, and most of their activity came before the ARTEX reports. Whether they share an operator is unconfirmed, and their language is only a weak clue to origin. AI increased scale, speed, localization, and reporting. It did not change the types of vulnerabilities exploited, the entry points, or how many targets were deeply compromised. The AI also logged planned steps as finished and overstated success. LLMs can also invent vulnerability IDs. These flaws can help with detection and honeypots. Defenders found the PHP2Shell flaws, disclosed in October 2026, through an AI-assisted audit, but no AI-found zero-day was exploited in these cases.Defending Against Cyberattacks on Japan
Recommended steps:- Inventory public-facing systems and update or isolate legacy ones.
- Remove exposed default credentials and admin interfaces.
- Secure VPN and edge-device configurations against credential reuse.
- Check internal AI and GPU services for exposure.
- Monitor for low-frequency, distributed attempts.
- Prepare for LLM misuse through requests built on false premises.
Ransomware Attacks on Hospitals and Businesses Lead to 70-Month Sentence
A Ukrainian ransomware affiliate has been sentenced to 70 months in prison for participating in cyberattacks against hospitals, businesses, law firms and government entities across multiple countries. Artem Stryzhak, 36, was sentenced in the United States for his role in ransomware conspiracies linked to more than $100 million in losses, according to the U.S. Department of Justice (DOJ).
Stryzhak worked with the Nefilim ransomware and Hive ransomware groups, targeting computer networks and disrupting operations across different sectors. The attacks included incidents affecting healthcare providers during the COVID-19 pandemic, when hospitals faced disruptions to their ability to access digital systems and treat patients.
Ukrainian Ransomware Affiliate Linked to Two Groups
According to court documents, Stryzhak joined the Nefilim ransomware operation around June 2021 as an affiliate. He received access to the group's ransomware under an arrangement with administrator Volodymyr Tymoshchuk and agreed to pay the administrators 20% of the ransom proceeds collected from victims. One documented attack took place in June 2021, when Stryzhak stole data from a company operating in the oil and gas transportation industry. About a week later, he created email addresses that were incorporated into a ransom note sent to the company. The attackers used ransomware to encrypt victims' files and demanded payment. If a victim paid, the perpetrators provided a decryption key to restore access to the locked data. Stryzhak remained involved in the Nefilim conspiracy until at least October 2021, court records state. He separately joined the Hive ransomware group as one of its earliest affiliates. Between June 2021 and January 2023, Hive conspirators attacked approximately 1,500 victims worldwide, including government entities, hospitals and businesses.Hive Ransomware Attacks Disrupted Hospital Operations
The Hive ransomware operation caused significant disruption to organizations, including healthcare facilities responding to the COVID-19 pandemic. According to the DOJ, one hospital targeted by the group had to stop relying on digital technology to treat existing patients and was temporarily unable to accept new patients immediately following the attack. As a Hive affiliate, Stryzhak and his co-conspirators deployed ransomware against seven victims. These included law firms, a dental office and a healthcare provider during the pandemic. The attacks left victims unable to access encrypted data, affecting their day-to-day operations. The FBI had previously conducted a months-long disruption campaign against Hive. During that effort, investigators obtained a decryption key and provided it to one of Stryzhak's victims, enabling the organization to recover its encrypted data without paying a ransom.FBI Investigation Spanned Multiple Countries
The investigation involved several FBI field offices and international law enforcement partners. The FBI Springfield Field Office investigated the Nefilim ransomware case, while the FBI Tampa Field Office investigated the Hive operation. The FBI's New York Field Office, the Justice Department's Office of International Affairs and Spanish law enforcement authorities also assisted in locating, arresting and extraditing Stryzhak. He was arrested in Spain in June 2024 and extradited to the United States in April 2025. In December 2025, he pleaded guilty to two counts of conspiracy involving fraud, extortion and related activity connected to computers. The sentence follows a broader effort by U.S. authorities to pursue ransomware affiliates and their associates, including individuals operating outside the country.$11 Million Reward Offered for Co-Conspirator
Authorities are continuing to seek Volodymyr Viktorovych Tymoshchuk, identified by prosecutors as Stryzhak's co-conspirator and a ransomware developer. The U.S. Department of State's Transnational Organized Crime Rewards Program is offering up to $11 million for information leading to Tymoshchuk's arrest and/or conviction or location. Individuals with information can contact the FBI at +1-917-242-1407, email TymoTips@fbi.gov, contact a local FBI field office in the United States or approach the nearest U.S. Embassy overseas. The DOJ's Computer Crime and Intellectual Property Section, which investigates and prosecutes cybercrime in coordination with domestic and international partners, has secured more than 180 convictions involving cybercrime and intellectual property offenses since 2020. The department also reports obtaining court orders for the return of more than $350 million in victim funds during that period. Stryzhak's sentence highlights the consequences for individuals who participate in ransomware operations that target critical services and businesses. The investigation into his alleged co-conspirators remains ongoing.
Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public
Body-parser vulnerability CVE-2026-111181 (CVSS 7.5) enables Express denial of service with one request. Upgrade to body-parser 2.4.0 or 1.20.9.
Related Posts:
- Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline
- Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0
- Adobe Patches Nine Critical Vulnerabilities in Campaign Classic and Connect
The post Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public appeared first on Daily CyberSecurity.
Australian Data Breach Incidents Up 66% as AI Sharpens Scams
Australians filed a cybercrime report about every six minutes over the past year, and artificial intelligence is making the attacks behind those reports faster and more convincing. That is the main finding of the ASD Cyber Threat Report 2025-26. It is the seventh annual assessment from the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC).
In FY2025-26, the agency received more than 82,000 cybercrime reports through ReportCyber. It responded to over 1,500 cyber security incidents, up more than 20% on the previous year and 36% over five years. It also notified Australian entities of potentially malicious activity more than 4,400 times, almost 80% more than in FY2024-25.
What the ASD Cyber Threat Report Says About AI
The report calls AI the defining force in the threat environment this year. In his foreword, Deputy Prime Minister and Defence Minister Richard Marles wrote that AI is helping malicious actors find vulnerabilities faster and exploit them at greater scale, speed and sophistication. He also noted that new threats have emerged in recent weeks from the unintended actions of AI agents and from model testing.
ASD’s ACSC makes one clear distinction. AI has not created new kinds of threats. It has amplified and sped up existing ones. AI-enabled cyber threats are most visible in social engineering. Attackers are using AI to write phishing emails with no spelling or grammar errors and to automate targeted spearphishing. The Australian Securities and Investments Commission has also seen a sharp rise in scams that use deepfake videos of celebrities and politicians.
The time defenders have to respond is also shrinking. The agency has previously observed that most vulnerabilities are exploited within two weeks, and some within 48 hours of a patch being released. It expects AI-driven tools to shorten that window further over the next 12 months. Publicly reported vulnerabilities (CVEs) rose 30%. Old flaws are still a problem too: ASD’s ACSC recorded the successful exploitation of a vulnerability first identified in 2008.
Incident Severity Grows in ASD Cyber Threat Report Data
Only one Category 2 incident was recorded this year. However, extensive compromises rose from 26 to 40. ASD’s ACSC identified 362 incidents after proactively notifying organisations. A single notification about cPanel vulnerabilities, sent to 340 entities in May 2026, led to more than 60 confirmed incidents.
The number of ransomware incidents held steady at 139, but extensive ransomware incidents rose from 16 to 24. Health Care, Professional, Scientific and Technical Services, and Manufacturing remained the most affected sectors. Data breaches made up 98 incidents, a 66% increase on the previous year. Separately, the Office of the Australian Information Commissioner received 1,205 breach notifications in 2025. That is the highest yearly total since its Notifiable Data Breaches scheme began in 2018.
The financial impact is rising for businesses. The average self-reported cost of cybercrime per business report rose 16% to $93,500. For medium-sized businesses, it rose 45% to $141,300. The average cost for individuals stayed at $33,000. Identity fraud remained the most reported cybercrime, although reports fell 18%.
Stolen access is now a major entry point. Compromised accounts and credentials were among the most frequently reported incident categories, and phishing appeared in 39% of incidents. Government survey research cited in the report found that 55% of Australians reuse passwords across multiple accounts.
State Actors and Critical Infrastructure in the ASD Cyber Threat Report
State-sponsored actors continued to target Australian government, business and individuals to gain sensitive information. The report says these actors are increasingly pre-positioning inside networks to enable future disruption. Marles wrote that the line separating state-sponsored espionage from sabotage and cybercrime is becoming increasingly blurred.
In April 2026, ASD’s ACSC and international partners highlighted a shift by China-nexus actors. These actors are moving towards large covert networks built from compromised home and small office routers, Internet of Things devices and smart devices.
Critical infrastructure accounted for 154 incidents, or 10% of the total, a decrease of almost 7%. Phishing was the leading initial access technique at 36%, and Financial and Insurance Services was the most affected critical infrastructure division at 30%.
What the Threat Report Asks Organisations to Do
In October 2026, ASD’s ACSC released the Essentials series. It evolves the Essential Eight into a principles-based framework with three chapters: Enterprise IT, Operational Technology and Cloud.
Under its Cyber Action Year, the agency is pushing five priorities:
- Replacing or mitigating legacy technology.
- Implementing best-practice event logging.
- Managing supply chain risk.
- Preparing for AI-enabled threats.
- Preparing for post-quantum cryptography, including ceasing the use of traditional asymmetric cryptography by the end of 2030 or sooner.
The report also urges organisations to patch faster. For individuals, it recommends reviewing privacy settings and enabling multi-factor authentication or passkeys.
Suspicious activity, incidents and vulnerabilities can be reported at cyber.gov.au or through the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).
INJ3CTOR3 Malware Steals FreePBX Credentials, Enabling Toll Fraud After Cleanup
The INJ3CTOR3 toll-fraud operation has given its FreePBX implant a dangerous new capability. Cyble Research & Intelligence Labs (CRIL) documented the JOMANGY PHP webshell in May.
It has since analyzed artifacts collected from the operator’s staging servers on 9 September 2026 and found that the implant now sends victims’ SIP trunk, AMI, database, and mail-relay credentials off the server. As a result, wiping an infected host no longer ends the fraud.
INJ3CTOR3 has targeted Asterisk-based phone systems since at least 2020. That November, Check Point Research named the group for exploiting CVE-2019-19006 in FreePBX. Unit 42 linked it to attacks on Elastix in 2022, and Fortinet documented its EncystPHP webshell in January 2026.
How JOMANGY Now Exfiltrates FreePBX Secrets
The September version of the k.php script ends with two new base64-encoded lines. Each line holds 17 curl commands that upload configuration files from FreePBX, Issabel, and Elastix systems to /hima_data/index.php.
Cron beacons rerun k.php every minute, so the theft repeats constantly. If a victim changes passwords while the system is still infected, the new passwords leak within minutes. With a stolen trunk secret, attackers can register with the carrier from anywhere and place calls that never touch the victim’s PBX. The only exception is when the carrier limits the trunk to the victim’s IP addresses.
The “hima” name matches a backdoor account the malware creates. It also matches a Telegram user Check Point spotted in 2020 sharing a tool that scanned and cracked SIP ranges.
Plain-text commands now point to 160[.]119[.]69[.]4, while base64-encoded commands still reach 45[.]95[.]147[.]178. The credential upload targets both hosts. Both hosts stopped responding in late September. CRIL is urging law enforcement agencies and national CERTs to work with hosting providers to preserve the server data and sinkhole the addresses.
INJ3CTOR3 Rotates the Indicators Defenders Relied On
The core JOMANGY code is largely unchanged, but the identifiers defenders were told to hunt for have changed:
- Watermark: The single April watermark (trace_e1ebf9066a951be519a24140711839ea) has been replaced by per-build values: trace_bd42a8a0d23ae16c85dede7d2abaec05 and trace_7544725ebaaadac217dfaa7ca8e8fe7e.
- Gate hash: The MD5 gate hash shared by JOMANGY and ZenharR moved from a2f6863413c4192a4abfa360577b9961 to 8b3a1d970fda0c17a0b785a990fb7b6a.
- Takeover script: The /x script grew from 367 to 620 lines, mostly to remove rival actors’ implants and SSH keys.
The panel can also forge a FreePBX admin session through the ampuser class and setAdmin(). This means changing the admin password does not lock the attacker out.
Hidden Doors in Compromised FreePBX Systems
The malware plants an .htaccess file in /var/www/html/admin/views/. It routes any request containing an encoded space or tab, such as %20 or %09, to config.php. Access logs record only the requested path, never the webshell’s filename, so searching logs for the shell by name can come up empty.
Trunks written directly to /etc/asterisk files such as pjsip_custom.conf also stay invisible in the FreePBX console. Administrators should audit through Asterisk CLI commands such as pjsip show endpoints and compare the results with what the console lists.
Cleaning Up After INJ3CTOR3
Shadowserver counted more than 900 compromised FreePBX instances in February 2026, and over 700 were still infected in May. Sangoma’s patch for CVE-2025-57819 blocks new exploitation but does not clean systems that are already compromised.
CRIL recommends this order:
- Isolate the host from the internet.
- Preserve crontabs, logs, and the ampusers table.
- Remove the cron entries and the zen2 watchdog.
- Delete the eight crontab backups and the login stagers.
- Remove extra UID-0 accounts and accounts with $1$nRz1Cbtk$ password hashes.
- Delete the 12 webshell copies and the freepbxusers row.
- Only then, rotate credentials across all 17 files.
CRIL’s report-only beagle.sh script can help with triage. Because the operator keeps rotating hashes and hosts, detection based on behavior and file origin will outlast hunting for specific hashes.
