The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X.
ShinyHunters is the extortion group that said in September it had breached the FBI's jobs portal and stolen sensitive data on almost all FBI agents and job applicants. The FBI has not named the suspect, and no charges have been made public.
The
Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.
"Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure," iVerify said in a new report published Thursday.
The name
Four more U.S. states sued router maker TP-Link Systems on October 6, bringing the total to five, with Texas filing a suit in February. Florida, Iowa, Montana and Nebraska allege the California company misled buyers about how secure its routers are and how separate it is from China. TP-Link denies the claims and says it will fight them in court.
TP-Link Systems is based in
Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root access before anyone approves the connection.
AnyDesk patched the flaw in version 8.0.3 in June, but its changelog described the fix only as "fixed a bug that could lead to a crash," with no CVE assigned and no security
Anthropic on Thursday unveiled OSS Scanner as an opt-in vulnerability scanner to help secure the open-source ecosystem using artificial intelligence (AI).
"It's an opt-in service informed by our experience using Claude to find vulnerabilities during Project Glasswing," Anthropic said. "Projects that join will receive thorough, periodic security scans by our strongest models at no cost."
Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners.
Details of the flaws are below -
CVE-2026-105133 (CVSS v4 score: 5.5) - An improper authentication vulnerability in the checkSysPwd() function in the "com/ahsay/obs/api/ApiStructsAction.java"
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon.
The vulnerabilities in question are listed below -
CVE-2015-3306 (CVSS score: 10.0) - An improper access control vulnerability in ProFTPD that could allow
Citrix is urging customers to patch another critical NetScaler vulnerability after weeks of disclosures involving actively exploited flaws. CVE-2026-107406 affects NetScaler ADC and NetScaler Gateway and can lead to remote code execution (RCE) or denial of service (DoS). It carries a CVSS v4.0 score of 9.5. The affected configurations depend on the software version. Older builds are vulnerable when configured as a SAML (Security Assertion Markup Language) service provider (SP) or identity provider (IdP); some more recent builds are affected only in the identity provider configuration. Citrix's advisory lists the affected builds and required updates. Secure Private Access Hybrid deployments using NetScaler instances also need patching. Citrix classifies the flaw as CWE-119: improper restriction of operations within a memory buffer. Customers must update their own deployments. Citrix says it handles the necessary updates for its managed cloud services and Adaptive Authentication. Citrix did not say whether this vulnerability was already exploited as a zero-day before disclosure, but credited Michael Tucker, Chew Keong Tan, and Alex Bernier at JPMorgan Chase's XOR Team, along with Maxim Suhanov, for the discovery. Google researchers said a campaign exploiting CVE-2026-88772 had been underway since at least early September, with organizations in government, finance, legal, and education across North America and Europe likely affected. Citrix disclosed the flaw weeks later as part of a release that patched eight vulnerabilities. Citrix disclosed another exploited flaw, CVE-2026-88779, last Friday that carries a severity score of 8.7. Both that flaw and the newly disclosed vulnerability involve memory overflows affecting SAML configurations. The latter can also allow remote code execution, carries a higher severity score, and has not been identified by Citrix as exploited. ®
As enterprises race to deploy autonomous AI agents to accelerate business, a new report reveals they are tethered to security architectures built for a different era. The "Horizons of Identity Security" report from SailPoint highlights a critical “velocity paradox,” in which organizations invest in AI-speed business operations while continuing to rely on human-speed security controls, creating a
A bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's .onion address using only public information, and then take that address over.
Searchlight Cyber, which disclosed the flaw on October 8, says an attacker who recovers the key can redirect the site's visitors to a copy of the site they control.
Three research teams broke into Google's Pixel 10 on October 8 at Pwn2Own Ireland, a hacking contest in Cork whose rules require every target to be fully patched. The contest pays researchers to show working exploits and passes the flaws to the vendors. One of the three Pixel exploits earned Ikotas Labs $300,000, the contest's top prize, and made the team the overall winner.
Trend Micro's Zero
Citrix has released patches for yet another critical security flaw impacting NetScaler ADC and NetScaler Gateway that could result in remote code execution or denial-of-service (DoS) under certain conditions.
"CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial-of-service under specific configuration conditions," Citrix said.
The vulnerability
The U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon.
To that end, the agencies seized several domains and blocked access to platforms that were used to scan, and in some cases infiltrate, U.S. critical infrastructure. The list of seized
Brenden Cuni, an ICE supervisor, has been accused of excessive force and tackling a pregnant woman to the ground. Several of his arrests were later found to be unlawful in federal court.
The FBI announced that it has seized seven web domains linked to hacking tools allegedly operated by a Chinese security firm called Integrity Technology Group and used by Beijing-backed cyber operatives to scan a South Carolina power company's network and other critical infrastructure systems for vulnerabilities. In a subsequent advisory, the FBI and other government agencies in the US, UK, Australia, Canada, Japan, New Zealand, and Spain warned that Chinese government-linked attackers, enabled by Integrity Tech, are using botnets, malware, and other intrusion tools to target organizations worldwide and steal sensitive data, including from US critical infrastructure networks. “These actors exploit vulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and credentials using scripts,” according to the security alert. Based on this activity, the US Cybersecurity and Infrastructure Security Agency (CISA) has added five CVEs to its Known Exploited Vulnerabilities Catalog: CVE-2015-3306 CVE-2015-5477 CVE-2016-3081 CVE-2021-3199 CVE-2023-22894 The court-authorized seizures are the latest in a long series of US law-enforcement attempts to disrupt a Beijing-backed cybercrew called Flax Typhoon and shut down its botnet. From 2021 until its disruption, Flax Typhoon allegedly used a version of this Mirai-based botnet to infect internet-connected devices with malware, scan networks for vulnerabilities, and launch additional cyberattacks, all while hiding the PRC government hackers’ true IP addresses and physical location. The feds allege Integrity Tech developed the botnet and a vulnerability scanner called Microscan, and operated a post-compromise tool called FishHub. The latter allegedly downloaded additional malware to the phishing victims’ networks and stole sensitive data. Court documents, unsealed on Thursday, allege Integrity Tech has contracts with the PRC government, and the feds have long linked Flax Typhoon to the private firm. “Flax Typhoon actors conducted successful computer intrusions against multiple victim entities which had been scanned using the Microscan tool,” according to the court documents. Victims include a university in Hsinchu, Taiwan, that Flax Typhoon compromised in March 2023, and a second university in Puli Township, Taiwan breached in August 2022. “On or about April 26, 2022, and on or about December 29, 2022, Flax Typhoon actors also used the Microscan tool to scan for vulnerabilities on the networks of a U.S. power company based in South Carolina, a multi-national Non-Governmental Organization, Japanese and Polish airports, and at least two Taiwanese critical infrastructure companies in the natural gas and power sectors,” the documents allege. Integrity Tech accessed Microscan through one of the seized domains, c0cc[.]cc. Meanwhile, five of the seized domains, 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net, delivered the FishHub malware as recently as March, and infected about 20 Taiwanese universities. “Based on my training and experience I believe the tool was named FishHub because it facilitated phishing activity,” FBI special agent Adam James said in a seizure warrant affidavit. After FishHub downloaded a file onto victims' computers, that file used the five domains to retrieve additional malicious programs and code. The malware created a file listing, searched for specific files, compressed documents, and then exfiltrated the selected files to an attacker-controlled server. This gave Flax Typhoon remote access to compromised networks. In September 2024, the FBI said Integrity Tech and Flax Typhoon tore down their 260,000-device botnet after the FBI and its international pals went after them. As recently as this year, however, both private sector security researchers and Western governments warned that Chinese hackers continue to turn compromised routers and IoT devices into botnets and break into critical networks. In February, operational technology (OT) security provider Dragos said China’s state-sponsored spies haven't let up on their attempts to compromise America's critical infrastructure, and this includes a group whose activity overlaps with Flax Typhoon. This group focuses on gaining long-term access to OT engineering workstations and exfiltrating operational files, and it targets manufacturing, defense, automotive, electric power, oil and gas, and government organizations across the US, Europe, and the Asia-Pacific region. In April, a 10-country joint advisory warned that basically every Chinese “Typhoon” group is using botnets “strategically, and at scale.” Some of these covert networks are built and maintained by Chinese infosec companies including Integrity Tech, which also controlled and managed the so-called Raptor Train network, the alert said. In late August, the FBI said that it had disrupted a different botnet and seized domains associated with two platforms that Chinese government-backed operatives allegedly used to target NASA, the US Senate, the Department of Energy, and several other government agencies and critical networks. The DOJ subsequently clarified that not all the named organizations had been compromised.®
TL;DR: NVIDIA DCGM Exporter is a widely used monitoring tool that collects GPU metrics like utilization, memory, temperature, and power consumption from AI servers. We discovered that thousands of these monitoring endpoints are exposed to the public internet, allowing anyone to inspect GPU infrastructure. Worse, we found a high-severity vulnerability (CVE-2026-47483, CVSS 8.2) that lets unauthenticated attackers exhaust server resources, crash GPU monitoring, and potentially disrupt AI workloads remotely. A few other interesting findings: 2,100+ exposed GPU servers, revealing telemetry from 12,000+ GPUs worth ~$100M, including H100s, H200s, and Blackwell GPUs. 60% of exposed GPUs reported 0% utilization across our scans. 12,096 additional servers exposed infrastructure details, including OS, firmware, and networking information. NVIDIA fixed the vulnerability following our responsible disclosure. Full research: https://lava.security/research/cve-2026-47483-nvidia-dcgm-exporter-vulnerability
Today, shared Microsoft 365 plans include 1 TB of OneDrive cloud storage for every family member. Microsoft is about to shrink that allotment dramatically.
Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other countries said on October 8.
The company, Integrity Technology Group, has been sanctioned by the U.S. and the UK. The hackers scanned websites for flaws using a tool containing more
Login