Belgium's finance and tax agency has pulled "several" digital services offline after a cyberattack on the organization. FOD Financiën confirmed the attack on Wednesday, saying that MyMinfin, the agency's main online tax portal, as well as other online services, are temporarily unavailable while they start the initial investigations. "This measure helps limit the risks and makes it possible to carry out the necessary technical interventions to ensure the security of our systems," it said in a public announcement. FOD Financiën added that "this has consequences for tax deadlines in the near future," referring to the October 31 extended deadline to submit tax filings for specific types of income, such as sole traders and earnings from foreign companies. The agency confirmed the deadline will be extended to November 16, by which time MyMinfin, the platform through which such filings would normally be submitted, should be back up and running. The detail offered up in the public statement reflects the early stage of the investigation; not much is known, although there is nothing to suggest data was compromised. "Data protection is a top priority for the FOD Financiën," it said. "At present, there are no indications that a data breach has occurred or that data has been compromised. This aspect is also being closely investigated and followed up. "In the meantime, a large part of our other applications remains available with full or partial functionality. We are closely monitoring the situation and doing everything we can to make the affected services available again as soon as possible." Spokesperson Francis Adyns told local news outlets that the attack was thwarted within hours, and that it was unable to gain access to applications or data. "The attack could not be sufficiently expanded within our environment to take over applications or gain access to data," he told Nieuwsblad. "Elements that were potentially infected were isolated. As a result, MyMinfin, Tax-on-web, and Biztax went offline, but the hacking was successfully stopped. "The various services must be restored in an isolated environment. This requires considerable time to realize, with the necessary caution to rule out new risks." ®

The UK’s comms watchdog has put forward four methods of checking netizens aren't kids – dubbed highly effective age assurance (HEAA) – as it prepares for the proposed under-16 social media ban. The regulator says some adults may not need to prove their over-16-ness to social media platforms that will make inferences about their age based on previous activity, but confirmed that "many" are likely to have to undergo the same verification process. Big Brother Watch's (BBW) Director Silkie Carlo said: "This plan for a government 'social media ban' is a national ID system by the back door. Both the government and Ofcom have admitted that children will get around the ban, which means the real effect will be normalizing adults and children alike to handing over their passports just to get online." Ofcom says four methods remain from the seven it initially outlined when the Online Safety Act (OSA) came into force last year. The seven were capable of verifying whether a subject was 18 years old, but there are fewer viable options for determining the age of 16-year-olds, it said today. The methods put forward include: Photo-ID matching: Checking information displayed on identity documents and analyzing the photo against a live image of the subject taken during the verification process Banking checks: An estimated 90 percent of 16-17-year-olds in the UK have a bank account, which they would have provided their identity documents to open. The information processed by the bank can be used to verify whether someone is aged 16 or older Digital ID services: An interesting entry, given how quickly these were circumvented once the OSA age-checking requirements came into force. These third-party services analyze a person’s photo once, and if it matches the age they claim to be, let them verify their age across other services Facial age estimation: A method that even Ofcom admitted isn’t quite reliable enough to be used on its own. The regulator said that online services can use technologies to analyze a subject’s facial features to determine their age. The same technologies also have a margin of error of a few years, so online services may wish to use a second method of HEAA to verify the results of this check. The three reserved for those aged 18 and above include credit card checks (only adults can have a credit card), mobile network checks (MNOs require proof of adulthood to remove content blocks), and email checks – using a subject’s email address to make educated guesses about their age based on the other types of services with which it is registered. Ofcom acknowledged that not every 16-year-old will have a form of photo ID, which is required for all four of its HEAA methods, so they will need to acquire one in order to access online services. It estimates that around 94 percent of 16-17-year-olds in the UK have a form of photo ID, such as a passport, driving licence, or an ID card certified by the Proof of Age Standards Scheme, and that around 150,000 have neither. BBW's Carlo added: "Hundreds of thousands of people without ID, who tend to be poorer people, and many more who don’t want to risk handing their passports over to foreign tech companies will be locked out of huge parts of the internet. "The plan will kill anonymity online, whilst the UK’s culture of speech policing is reaching a crisis point. The policy is painfully misguided, an Orwellian assault on free speech and privacy, and will make children no safer at all." 'Circumvention inevitable' Ofcom admitted that "the risk of circumvention cannot be entirely eliminated," as some children will find ways to bypass these age checks, no matter how fully they are implemented. It cited Australia sporadically in its announcement, a country that introduced an under-16 social media ban in December 2025, but has struggled with a large proportion of children devising ways to circumvent these checks. Ofcom said the UK government intends to adopt, but learn lessons from, Australia’s rollout, committing to implementing more robust measures that promote the ban’s aims. It said it has identified some mitigations that could be taken to counter circumvention, such as making it easier for users to report suspected underage social media users, and “using age inference models.” The regulator said it will closely monitor circumvention for the first 12 months after the ban is enforced to understand possible methods to prevent children from finding ways around the age checks. In May, nearly a year after the OSA’s age verification requirements kicked in, researchers found that the existing age checks proved largely ineffective at keeping under-18s away from adult content online. Some reported beating age checks with just a drawn-on moustache. England's Children's Commissioner, Dame Rachel de Souza, said recently that the OSA "has made absolutely no difference" to children’s ability to access potentially harmful online content. Commenting on today’s announcement, Ofcom chief exec Dame Melanie Dawes said that when the social media ban takes effect, it will take a whole-of-society approach to ensure the ban is upheld. ?This ban will shape the future of children’s lives online, so it’s important to get it right," she said. "It can work if social media firms do highly effective age checks properly, and we’ve set out ways that could be achieved. When it comes into force next year, we’ll be ready to take swift and firm action against any company that fails to comply. "We should expect that motivated children will seek to bypass the restrictions – just like alcohol laws can’t completely eradicate underage drinking – but there’ll be ways for platforms to mitigate this risk. This will be a huge cultural shift for our society, so it’ll take time to adjust, and everyone will have a part to play." The UK government is expected to outline the first set of regulations related to the under-16 social media ban by the end of the year, and Ofcom is in the process of developing draft guidance for platforms. ®

EXCLUSIVE Researchers identified at least 83 attacks against 61 public GitHub repositories, including popular open source projects such as Google LangExtract, Trivy, Brave browser, and MLflow, in what they suspect is a coordinated campaign to execute commands in CI/CD environments and steal credentials and access tokens. It all happened very quickly, the Radware threat hunters said in an exclusive interview with The Register. Most (77) of the malicious items were published during a 43-minute time span on September 1, with the remaining six occurring within the next two minutes. “Our guess is that the final aim was a supply-chain attack in which the attacker gains credentials for the repo, and then he has the power to change the contents – the code – as he wishes” and then push the malicious changes to others, Radware VP and researcher Gabi Nakibly told The Register. Nakibly and fellow Radware researcher Zvika Babo say they suspect a single individual is behind this supply chain campaign. This attacker used 74 different GitHub accounts, many of which had legitimate development histories, meaning they were likely compromised. "Considering that dozens of accounts posted the same type of payload, on the same day, within a narrow time window, and to the same infrastructure, it is reasonable to assess that the activity was coordinated,” the team wrote in research shared ahead of publication with The Register. A novel attack chain They discovered the campaign while investigating prompt injection in GitHub – and they told us the attack chain is part of what makes this supply-chain campaign novel, and extremely stealthy. First, the attacker publishes an issue, pull request, or comment containing malicious commands hidden in HTML comments. This ensures the content is not visible in the rendered page. Plus, a GitHub event – like a pull request or issue – can automatically trigger a workflow if the repository is configured to respond to that event, meaning the attacker can be pretty hands-off at this point. “The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully,” Nakibly said. The workflow incorporates attacker-controlled content directly into shell source code, and the shell executes the hidden, malicious command, which hoovers up environment variables and attempts to exfiltrate those to an attacker-controlled server. While the researchers examined logs from actual runs, and told us they found two cases containing evidence that the malicious command ran inside the automation environment, they can’t definitively say whether the attacker successfully obtained repository write permissions, modified source code, or compromised downstream software. But they're trying. “The big picture is that the attackers are trying to find every possible way to get inside the repos to get credentials,” Nakibly said. Plus, “the attacker doesn't need to compromise the repository or to have access to its codebase” to do this, Babo added. “Basically, every user with a GitHub account can try to run this attack – it's very easy to start this attack.” Which repos were affected? As of October 13, the threat hunters identified 83 GitHub items with a verified payload across 61 different repositories. The repos span AI frameworks, security tools, development infrastructure, databases, and other widely used open source software projects. The Radware report lists agno-agi/agno (42.7K stars), ToolJet/ToolJet (41.1K), google/langextract (38.9K), aquasecurity/trivy (38.4K), CopilotKit/CopilotKit (38K), and podman-container-tools/podman (33K), among the most popular. Other notable targets included QwenLM/qwen-code (28.5K), mlflow/mlflow (28.4K), discordjs/discord.js (26.8K), cilium/cilium (25.6K), brave/brave-browser (23.9K), dotnet/maui (23.3K), Homebrew/homebrew-cask (22.2K), github/docs (21K), apache/doris (16K), and PX4/PX4-Autopilot (12.8K). “These projects are used by thousands of organizations," Babo said. The researchers disclosed their findings to all of the projects’ maintainers, and most of the repositories were closed or fixed, but they can’t confirm that all of them were. This campaign follows several earlier supply chain attacks against open source security and dev tools as attackers increasingly look for new methods to steal credentials and other secrets. “There is no way to stop the attackers from attempting,” Nakibly said. “The only way is to make sure that the workflow code is resilient, and not vulnerable to such attacks." The researchers recommend applying least-privilege access to CI/CD workflows, and separating as much as possible workflows triggered by external events from jobs with elevated permissions. “Developers should treat external content as untrusted, and also limit the secrets and environment variables that are available to the workflow,” Babo said. ®

Welcome back to PWNED, in which The Reg offers cautionary tales from folks who’ve left their doors wide open to attackers and lived to tell the tale. This week’s misadventure involves unpatched older machines and a password that was supposed to send a message to crims. Our story comes courtesy once again of leading red teamer and pen tester Dahvid Schloss of Suzu Labs. A client asked Schloss to visit a factory and check the servers there for security holes. The company had been hacked six months prior, made some adjustments, and wanted to make sure that they were bulletproof now. Schloss' mission, which he chose to accept, was to get domain admin rights. Schloss drove over to the factory where he noticed a number of Windows 7 servers were connected to the CNC milling machines, even though Windows 10 was by then Microsoft's supported desktop OS. This was to be expected, as companies with proprietary software often use legacy OSes for fear of breaking apps. At first, Schloss had a hard time breaking in because most of the servers were not connected to the domain. So there was no point in his running the EternalBlue zero-day that would have let him in. “So I've been looking through these and most of them had been disconnected from the domain, so it's the right move,” he said. “Like, yeah, you could run EternalBlue on the network, but you really weren't going to be able to get anywhere with it, cuz you get on the device and what you find: you dump LSASS [the Windows Local Security Authority Subsystem Service], you’re like ‘All right, there’s local admin creds, but the local admin creds on those devices were different from the local admin creds on the majority of workstations.” Finally, Schloss went onto one of the servers that was connected to milling machines and found that it was connected to the network and on the domain. It was vulnerable to EternalBlue and he went and dumped LSASS and found a pair of creds from WDigest, one of which looked like an admin account. But Schloss thought that it must not be a legitimate admin account when he read the password : “heyhackergof***yourself,” but written in leet speak [l337 5p34k]. The resulting string was a strong password, but Schloss assumed that the admins were playing a game with him and left this credential there for him to find. Schloss assumed it wouldn't work and sat on it for a week. During a briefing he had with the IT crew, he presented his findings and then asked who set up the admin account with this funny password. “You could see everyone kind of looking at the senior manager of IT like ‘that was you, wasn’t it,’” Schloss explained. “He’s kind of got this face. I’m like ‘oh shit, like what?’ Turns out that ‘heyhackergof***yourself’ was the actual password for his admin account." On Monday, Schloss tried the username and password combo and, lo and behold, it gave him complete control of the entire network. He was then able to get access to other passwords and many of them were also insults directed at potential hackers. Schloss understood that the team was still angry about a breach they had suffered six months prior and, should they be breached again, wanted to give the finger to the hacker who did it. Unfortunately, their system was still vulnerable because of the outdated machine that was hooked up to the domain and he was able to gain control. The lesson here is really to patch your systems and avoid using insecure legacy OSes whenever possible, because it was an old machine that let Schloss in, not a weak password. Indeed, “hackergof***yourself” in leet speak isn’t a terrible password, just an embarrassing one if it's exposed. ®

Attackers are probing a critical Oracle E-Business Suite vulnerability that can lead to remote code execution (RCE), despite Oracle issuing a patch earlier this month. Meanwhile, new analysis indicates that an Oracle PeopleSoft zero-day exploited by ShinyHunters as early as May involves three distinct vulnerabilities that can be combined to achieve RCE. Patching alone may not remove attackers from already compromised systems, particularly if they've installed web shells. First up: CVE-2026-101767, a critical, unauthenticated SQL injection bug in Oracle EBS that can lead to RCE. “Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27,” Defused Cyber said in an X post. Horizon3 researchers found and disclosed the bug to Oracle, and the vendor patched the issue in its October release. “An attacker can send a crafted request to the vulnerable servlet to execute SQL with the privileges of the APPS database user,” Horizon3 explained at the time. “The attack chain also enables operating system command execution with the privileges of the EBS application account.” This means an unauthorized user can modify application data accessible to APPS, and execute commands. “Depending on the deployment, affected data may include financial, payroll, HR, and procurement records,” the bug hunters said. The Register reached out to Oracle with multiple questions for this story - including whether it has documented any successful exploitation of CVE-2026-101767 - and did not receive an immediate response. Moving on to the PeopleSoft-ShinyHunters fiasco: TrendAI’s Zero Day Initiative (ZDI) found and reported the PeopleSoft issues on June 10, and Oracle issued a patch under one vulnerability identifier: CVE-2026-35273. In early June, ShinyHunters told The Reg that the group hacked more than 100 organizations via an Oracle PeopleSoft zero-day, CVE-2026-35273. Google’s consulting and incident response biz, Mandiant, later confirmed the data theft and extortion crew exploited CVE-2026-35273 as a zero-day, mostly against schools and the education sector. By late September, however, Mandiant said ShinyHunters massively expanded its targeting, “deploying web shells on dozens of systems globally, spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government.” According to ZDI bug hunter Bobby Gould, there are actually three distinct vulnerabilities across multiple PeopleSoft components, and each should receive its own CVE identifier rather than being grouped under CVE-2026-35273. Gould, along with TrendAI researchers Minh Giang and Lucas Miller, originally found and reported three distinct bugs to Oracle in June. “We are coordinating with Oracle to assign separate CVEs for each issue,” he said in a Tuesday blog. The first issue is a Server-Side Request Forgery (SSRF) vulnerability in the PeopleSoft Integration Gateway (PSIGW), which gives attackers a foothold in the PeopleSoft application. In June, Oracle introduced a “validateClient” method to allow PeopleSoft system administrators to restrict access to certain functionality. The SSRF bug, however, allows crims to make requests that satisfy the validation requirement to access endpoints vulnerable to RCE, Gould wrote. “While this solution does restrict access, an attacker on any trusted host can still reach PSEMHUB,” he said, referring to PeopleSoft Environment Management Hub (PSEMHUB). “Because Oracle allows localhost by default, the PSIGW SSRF provides exactly that access.” The second bug is an external control of file path vulnerability in PSEMHUB’s ExecuteProcessActivityCommand handler. This message handler is designed to allow remote clients to write log entries to the PeopleSoft server’s filesystem - but it doesn’t properly validate requests, which allows an attacker to write a web shell into a file path and achieve RCE. The third vulnerability, also in PSEMHUB, is a deserialization of untrusted data flaw. An attacker can use a file-write vulnerability to plant a malicious XML file inside a PeopleSoft directory that stores environment configuration data, then wait for PSEMHUB to initialize, such as after a service or system restart. This triggers deserialization of the malicious XML file, potentially allowing the attacker to achieve RCE. “Attackers can combine these vulnerabilities to compromise affected instances of PeopleSoft,” Gould warned.®

Ukrainian ransomware crook Artem Stryzhak has been sentenced to 70 months in the slammer by a New York federal court for his role as an affiliate of the Nefilim and Hive ransomware gangs. Prosecutors believe the cybercriminal began working with Nefilim in or around June 2021, while living in Barcelona, Spain. The Nefilim ransomware-as-a-service (RaaS) operation was known for targeting wealthy companies, with its operators encouraging affiliates to pursue businesses capable of paying substantial ransom demands. One of Nefilim's most high-profile attacks was on Australian logistics giant Toll Group in 2020, encrypting its files roughly three months after it suffered a separate Mailto ransomware attack. Court documents [PDF] state that Stryzhak agreed with alleged Nefilim boss Volodymyr Tymoshchuk, who remains at large, to pay the ransomware crew a 20 percent cut of the ransom proceeds he collected. Tymoshchuk told Stryzhak that his preference was for attacks to target companies based in the US, Canada, and Australia that turn over more than $100 million annually. This guidance was soon tweaked to encourage targeting companies in the same regions with more than $200 million in annual revenue. Prosecutors claim that around the time Stryzhak joined forces with Nefilim, he also signed up to the Hive ransomware operation as "one of its earliest affiliates," and used its platform to attack approximately seven victims. Hive's operators claimed they targeted circa 1,500 victims worldwide between June 2021 and January 2023. According to separate court documents [PDF], Hive's victims included a law firm and an Ohio hospital, which paid approximately $1.7 million in Bitcoin after the gang initially demanded $2 million during the COVID-19 pandemic. Before its infrastructure was seized in an international law enforcement operation in January 2023, Hive was known for attacking healthcare facilities during the COVID-19 pandemic, as well as being one of the ransomware groups that battered Costa Rica in 2022. Brett Leatherman, assistant director at the FBI’s cyber branch, described Stryzhak as a “prolific cybercriminal” who played a role in groups that were responsible for more than $100 million in victim damages. “Today’s sentence reflects the seriousness of Stryzhak’s crimes and demonstrates the FBI’s global reach and extensive network of international partners,” he said. “Multiple field offices contributed to this investigation, and our work does not end here. We will continue to leverage every tool at our disposal to track down Stryzhak’s co-conspirators and hold them accountable, including Volodymyr Viktorovych Tymoshchuk.” Stryzhak was arrested by Spanish police in June 2024 before being extradited to the US in April 2025. In announcing Stryzhak's sentencing, the Justice Department took the opportunity to remind the public that rewards totaling up to $11 million are available for qualifying information about alleged Nefilim operator Volodymyr Tymoshchuk and other key ransomware suspects. ®

Cisco has open sourced a behavior detection engine that watches AI agents, to help security teams prevent rogue agents from going off the rails like they did with the Hugging Face hack – or worse. It’s called Project Quarry, and it aims to provide a “shared language” for evaluating agent behavior, along the lines of what Snort, which Cisco also maintains, did for detecting malicious network traffic and what YARA did for rule-based malware identification. Most detection tools rely on specific interactions with an AI model or agent. Did it attempt prompt injection? Or did the agent call an attack tool? “But what is missing is the entire context under which something may occur,” Amy Chang, head of AI threat and security research at Cisco, said in an exclusive interview with The Register. She likened this to credit card fraud detection. Without context, individual transactions such as a small test charge or a single purchase in a location far away from a card-holder's usual location may not raise any flags. “And then you try again,” making another fraudulent purchase, “and that went through, too. So now I’m gonna buy the PS5,” Chang said. “Those are the things that Quarry addresses by taking into consideration the entire agent session,” she explained. “One tool call may seem in-scope until you realize that that next step is taking that information and sending it to an attacker-controlled inbox or server.” Even data theft is a sequence and not a single agentic action. Agentic AI security firm Invariant Labs demonstrated this with a proof-of-concept attack against GitHub's MCP server that hijacked a user's agent via a malicious GitHub Issue, and coerced it into leaking data from private repositories. Simply reading a configuration file, or sending a request to an external endpoint may be legitimate agentic actions. However, combining the two can lead to data exfiltration – and shows “why action relationships matter,” wrote Chang and fellow Cisco researchers Adam Swanda, Ravikumar Balakrishnan, and Konstantin Berlin in a blog post about Quarry shared with The Register ahead of publication “A policy can produce a finding when the trace shows a sensitive file read followed within a defined window by an external send,” they wrote. “The risk comes from the relationship between the two actions, so the finding should preserve evidence from both." Quarry covers single- and multi-turn large language model conversations, agents, tool use, Model Context Protocol (MCP) interactions, and multimodal inputs. In addition to the open source code itself, the project’s GitHub repository includes installation instructions, supported Python versions, plugins for Claude Code, Codex and other MCP-compatible agents, configuration examples, rule-writing guidance, and a rule starter pack. For instance, with the rule pack, “If a base-64 encoded malware is somewhere in the tool call, that would result in a block,” Chang said. The rule format looks similar to a YARA or Snort rule, with a header that details the traffic to examine, content to match, and metadata for tracking the rule. Here’s a Quarry rule that flags an agent that reads a credentials file: While the Cisco Ai researchers have not run Quarry against data describing the OpenAI-Hugging Face incident, they suggest that if the intrusion had been read as a complete, step-by-step record of a single session, there were several points where the AI agents’ steps would have given a Quarry rule something to act on and flag for humans. For example, Quarry would probably have flagged internet access from a sandbox. “The rule can flag specific tool calls that reach an external server asset that wasn’t in the task’s allow list,” Chang said. “Another one would be credentials found and used somewhere else.” According to OpenAI’s technical report about the Hugging Face intrusion, this is exactly what happened on July 10, when an agent validated 14 exposed Hugging Face tokens with write access and shared them. “The rule would flag that there was a credential in the tool result that then called an outside service, which is likely not within the parameters of what you would want to do in this case,” Chang said. “We don't want you to go and search for credentials that may have been leaked or inadvertently exposed and then utilize them to conduct a task.” The Cisco team is quick to say that rules along are not a substitute for chain-of-thought monitors, or other forms of human oversight – but they do help record a pattern that other teams can then “review, test, and apply to their own agents,” they wrote. Herein also lies the benefit of open source, and a collective approach to defending against adversarial use of AI, Chang said. “Do we have all the answers? No,” Chang said. “We all see slices of the problem, and it’s important for us to share what we see.”®

UK domain registrar 123 Reg (no relation – Ed) says it was the victim of an “AI-driven cyberattack” that exposed customer data. Customers began receiving their notification emails this week, informing them that their contact information, "related customer relationship data," company VAT numbers, and "product information from an application programming interface (API)" were compromised. A company spokesperson elaborated, saying this means that names, phone numbers, countries, language and currency preferences, account creation dates, the products on the account, and marketing preferences were affected. 123 Reg described the September 18 intrusion as "the first known AI-driven cyberattack against our company," and told The Register that early signs point toward a China-nexus attacker. "Our investigation identified IP addresses that we assessed to be the core attacker infrastructure, which were hosted in China and Singapore, indicating a strong Chinese nexus," the spokesperson said.  "Our investigation further identified AI cyberattack 'skills' hosted on Chinese infrastructure, including copies of skills open sourced by Anthropic and several other AI exploitation frameworks and scripts." They went on to say that many of the artefacts left behind led 123 Reg to suspect that a Chinese state-sponsored group, known for abusing Claude Code in attacks against at least 30 organizations, could be behind the break-in. There is also a suspicion that the same group that hit a number of South Korea’s financial institutions using open-source Chinese AI tool ARTEX, was behind the attack on 123 Reg too. "The TA's mirror of 'anthropic_skills,' and the account naming conventions found on the Chinese servers are consistent with preparation of this class of AI-augmented operation," the spokesperson told us.  "In addition, on October 7, 2026, CrowdStrike published CSA-261162, describing an unknown, likely Chinese-speaking actor that targeted several South Korean financial organizations starting in late September 2026, which is the same period during which we were attacked. "That actor used ARTEX, an open-source Chinese-developed agentic penetration-testing tool released in July 2026, which was also observed to be used in the attack that targeted us." The GoDaddy-owned registrar reported the attack to law enforcement agencies, brought in outside cybersecurity support, and notified the FTC, as well as the data protection authorities in the UK and EU. The company spokesperson added that it worked with Singapore-based ISPs to shut down the attacker's servers in the region, which helped disrupt the attack, in addition to "other actions by us and industry partners." 123 Reg's email to customers stated the attacker's activity "was limited to reading" customer data, although the spokesperson told us "it's possible they created copies of the information," and that this is what prompted the notification. The registrar urged customers to stay alert to the potential misuse of their data, and to treat communications appearing to come from the company with caution. "If you receive a message or call and aren't sure it's from 123 Reg, go directly to our website and log in," the email said. "We will never contact you to request your password, payment details, or verification codes by email, text, or phone. "We also strongly recommend turning on two-step verification (2SV), which helps keep your account protected even if someone tricks you into sharing your password. You can find instructions for setting up 2SV in your 123 Reg account. "We apologize for any inconvenience this may have caused." ®

An autonomous AI agent discovered four vulnerabilities in the decades-old, widely used EPICS (Experimental Physics and Industrial Control System) open source software toolkit, including a critical flaw that could allow remote attackers to execute code on systems used to control particle accelerators and fusion experiments. The bugs include a critical, 9.8-rated under CVSS v3.1 integer overflow vulnerability (CVE-2026-114595), leading to an attacker-controlled out-of-bounds heap write and potentially remote code execution; an 8.2-rated, high-severity, improper message-length validation flaw (CVE-2026-114596), causing an out-of-bounds memory write and controller-process crash; a 7.5-rated, high-severity insufficient bounds checking bug (CVE-2026-114597) that allows out-of-bounds memory reads and process crashes; and a 7.5-rated, high-severity type confusion flaw (CVE-2026-114598) that can lead to denial of service and could expose adjacent memory contents. All four affect EPICS Base, which is used to operate some of the world's largest scientific research projects and facilities, and organizations should update to version 7.0.11, which includes the fixes. “Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code,” the US Cybersecurity and Infrastructure Security Agency (CISA) warned in a Tuesday advisory. An AI agent called Cipher independently found all four previously unknown security holes - investigating and testing the unfamiliar EPICS system, and validating the four exploits - in three hours and 49 minutes, Causal Security co-founder Shubham Raj told The Register. “The initial investigation required no human intervention, followed by one instruction authorizing deeper exploitability testing in a secure environment,” Raj said. Earlier this year, Causal Security’s Cipher, which Raj described as “a fully autonomous super hacker that can reason across the technology stack,” found multiple critical attack paths in power-grid systems used across North America and Europe, prompting an October 8 security advisory from CISA. EPICS, originally developed by Los Alamos National Laboratory and Argonne National Laboratory, is used to build and remotely control distributed Supervisory Control and Data Acquisition (SCADA) systems, connecting operators to physical devices. It’s used in around 90 major scientific, university, and industrial projects and facilities globally including Argonne National Laboratory's Advanced Photon Source and ITER's fusion reactor control system. All four of these flaws illustrate how AI agents are really good at finding vulnerabilities in industrial and operational technologies - systems and equipment that used to be able to rely on obscurity to protect them from hackers - and add to defenders' concerns that it's only a matter of time until an autonomous cyberattack shuts down critical services, like power grids or water systems. These are the types of digital intrusions that can cause physical harm. Raj points to CVE-2026-114595, the critical integer-overflow vulnerability, as an example. “It allows attacker-controlled network data to cause an out-of-bounds heap memory write, with potential for remote code execution,” he told us. “EPICS controllers sit between operators and physical equipment, handling measurements, commands, and control functions,” he continued. “Operationally: Imagine a particle accelerator in the middle of an expensive experiment. An attacker could potentially crash a controller, interrupt critical measurements or control functions, and force operators to halt the experiment. That could mean lost experimental work, significant downtime, and expensive recovery.” Plus, if an attacker was able to develop an RCE exploit, this could allow them to “take control of the affected process, manipulate readings, interfere with control functions, or disrupt the equipment connected to it,” Raj said. The prerequisite for exploiting these vulns in a real scientific facility is being able to reach the vulnerable EPICS services on a facility's control network. But this could occur if the networks weren’t sufficiently segmented, or another system had access to the vulnerable EPICS network. “Once an attacker is able to find a network, which is either misconfigured or they are able to reach, it’s pretty easy to carry out the attacks,” Raj said, adding that exploitation wouldn’t require deep OT knowledge, or understanding of how particle accelerators or fusion reactors work. “Someone with conventional exploitation skills could investigate them, and increasingly capable AI systems could help develop exploits without requiring specialized OT expertise.” Manipulating specific physical processes does require additional knowledge, he added. “But an attacker doesn't need to understand the physics of a particle accelerator to disrupt the software controlling it. Crashing critical processes or interrupting monitoring and control can already have serious operational consequences. What's changing is that attackers may no longer need years of specialized expertise just to discover these weaknesses.” ®

The University of New Mexico is canceling classes across the medicine, nursing, and pharmacy faculties for a second day amid continued efforts to recover from a "cybersecurity event." The attack targeted the Health Sciences Center on Monday, the Uni revealed, forcing it to shut down systems, cancel appointments and clinics at UNM Health hospitals, and divert ambulances to healthcare facilities in nearby Albuquerque and Santa Fe. Hospital appointments and clinics return to normal today, although nonessential UNM Health Sciences Center staff are being asked to remain at home. "The University of New Mexico Health Sciences Center (HSC), which includes the UNM Health clinical delivery system, experienced a cybersecurity event Monday, Oct. 26, 2026," the university said in a statement on Monday evening. "HSC information technology security teams immediately took steps to contain the event and protect the network. They also notified state and federal law enforcement and engaged external partners to assist with the investigation. "Leadership activated an Emergency Operations Center to coordinate the response and provide guidance to HSC employees, students, and UNM Health system frontline providers." The university announced the attack at 1430 local time, immediately cancelling all remaining clinics and classes, dismissing everyone other than critical and clinical staff, and urging patients not to attend HSC facilities. It has not commented on the nature of the cyberattack, although that hasn’t stopped researchers from speculating about ransomware’s involvement. Rumors were fuelled by the newly assembled BYOD ransomware group claiming responsibility for the attack on Monday afternoon. It's important to note that just because a purported ransomware group took credit for the attack, it does not mean they actually were responsible, nor does it mean they deployed a ransomware/locker payload as part of the attack. However, the group's take on the digital raid is that it compromised 36,000 machines, "both [Active Directory] forests," two Oracle databases, the personal data belonging to every student and employee, as well as internal emails and data from other systems. As Reg readers know, a cybercriminal's word is never one to be trusted. Yet BYOD's claims about breaching Trump Mobile's customer database appear to have held up It was a bold debut, even for a ransomware crew: BYOD’s first named victim was the US president's smartphone biz, with data allegedly leaked for all 3,615 customers. A rival group, EndZone, claimed a similar breach a week earlier, and some experts suggested the two could be one and the same. In May, the Trump Mobile was found leaking thousands of people's data via a poorly secured website. The Trump Organization did not respond to our requests for more information in either of these cases. A UNM spokesperson declined to answer our additional questions, directing us back to its public statement. ®

The US government's cybersecurity watchdog has confirmed attackers are exploiting both critical PHP2Shell vulnerabilities, giving federal agencies three days to patch the bugs that have wreaked havoc across the web over the past week. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on Monday, setting an October 29 deadline for federal civilian agencies to address the flaws. The move marks a shift from last week, when the agency warned of the danger posed by PHP2Shell but said it had not yet observed successful exploitation in the wild. Both bugs are rated 9.2 on the CVSS scale and can be exploited without authentication to run code on vulnerable PHP servers. That's bad news given how much of the web still relies on PHP, and just how many sites could be left exposed. Patches landed on October 21, but attackers had already beaten the maintainers to it. AWS spotted attempts to exploit the flaws as early as October 17, four days before the bugs were publicly disclosed. CISA's confirmation comes amid growing evidence that attackers are doing more than simply knocking on the door. On October 24, Perplexity security researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php. The attacks came from two IP addresses and used memory exhaustion and disclosure to achieve remote code execution. The attackers then tried to contact external servers using PHP, curl, and wget, although no additional malware was successfully downloaded. Karimi's findings were consistent with exploitation of CVE-2026-109618, but he found no evidence that the second PHP2Shell flaw was involved. He also warned that the honeypots used a favorable single-worker configuration, so the results don't necessarily reflect how reliably the exploit works against production servers. Still, attackers appear to be giving it a good go. Delft University's Threat Intelligence Lab has tracked more than 50,000 PHP2Shell exploitation requests from over 600 IP addresses across 70 countries. Of those, 171 addresses went beyond probing for vulnerable servers and started sending exploit code or malware droppers. CISA's confirmation also comes after some of the earlier reports of successful PHP2Shell attacks turned out to be rather premature. Sophos walked back its initial assessment after determining that the activity it observed amounted to scanning and failed attempts, while Palo Alto Networks withdrew claims linking the vulnerabilities to an intrusion at a European government agency. CISA has not disclosed which organizations have been compromised or provided details of the attacks behind its decision to add the flaws to KEV. The listing confirms that the agency considers both vulnerabilities actively exploited, but it does not confirm how many production systems have been successfully breached. For federal agencies, the clock is now ticking. CISA is also urging organizations outside the federal government to prioritize the fixes, although the deadline does not apply to them. Admins should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch. Those running older, unsupported versions face the added headache of upgrading or obtaining vendor-supported fixes, while systems that cannot be secured should be taken offline until the risk is addressed. And with CISA now officially acknowledging exploitation, anyone still waiting for more proof before patching may be waiting a little too long. ®

Microsoft has released another out-of-band update for Windows, but this one isn't an emergency fix for the latest breakages. This time, it's all about certificates. The non-security out-of-band release applies to supported OSes ranging from Windows 11 and Windows Server 2025, to Windows 10. It's all about updating the current certificate trust list (CTL) of devices that cannot access Microsoft's certificate-update service, or where automatic CTL updates are disabled. It also contains everything in the October 13 update, including the ongoing VPN issues and the change that could break on-premises Exchange Servers. There might also be oddities with Smart App Control, audio, and Remote Desktop connections for non-admin users, all of which are known issues in the October 13 update. These problems are not resolved in this patch, so be aware of this when installing it. It is also worth remembering that many devices will not need this version since the current certificate list updates usually come down through the update service. However, if that service isn't available or being used, it might be a good idea to get this out-of-band fix (while keeping the known issues in mind), since problems can occur when verifying certificates used by applications or websites. The OOB update came after Microsoft laid out its response to the compromised eMudhra certificate keys. The Indian certification authority's private keys were compromised earlier this month, requiring a massive cleanup effort. According to Microsoft, "they could potentially be used to create certificates or sign content that appeared to come from a trusted CA [certificate authority]." Like many other organizations, Microsoft moved swiftly to block the affected certificate authorities. It did so by updating its Windows Disallowed Certificate Trust List to block the affected certificates. There was also a separate CRLSet release for Edge and WebView2. According to the Windows behemoth, "On October 26, Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies: six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list." Microsoft's out-of-band patches are usually released after the company breaks a product and needs to issue an emergency fix. This time, the revision is due to Somebody Else's Problem and a need to get a CTL update out to devices that are disconnected from CTL updates. ®

The cyberattack on Alternative for Germany (AfD), the country’s most prominent far-right political party, exposed hundreds of thousands of confidential emails and attachments, as well as more than 345,000 unique email addresses. Have I Been Pwned confirmed the scale of the breach for the first time today, after AfD officially disclosed the September attack on its hosting provider last week. AfD said in its statement that “only a few email accounts were illegally copied,” but admitted a large amount of the data was taken from them, resulting in an extensive data breach. The emails were added to what the party described as “an activist website,” which summarised the email chains into searchable topics and has led to the publication of various revelations, such as a party co-leader’s opinions on colleagues’ “deeply problematic” racial discourse. Per a report from investigative journalist Lilith Wittmann, citing conversations with the cybercriminals responsible for the hack-and-leak job and party sources, the attack was first spotted on September 9 and started with a compromise of a poorly protected WordPress site. The same report claimed the criminals gained persistent access to the servers operated by the hosting provider, identified as AfD-owned Alternita Dienstleistungs GmbH, and exfiltrated more than a terabyte of data. No official sources have verified the hackers’ claims about how the attack unfolded. The Register contacted Alternita Dienstleistungs for its take. AfD said the owners of the affected email accounts have been notified, and that it reported the attack to security authorities. “We are deeply concerned by what has happened,” the party said in an October 20 statement. “Such a digital attack is illegal and a criminal offense. Furthermore, it is an attack on the German party system and thus on democracy. “We are extremely worried that, apparently, the content of the stolen documents was analyzed using a very rudimentary AI. This analysis focused on keywords, not the context. The alleged scandals published so far do not stand up to scrutiny – a fact that, thankfully, is being confirmed by a growing number of commentators on social media.” Among the AI-generated summaries compiled by the “activist site” are chains supposedly expressing views related to Holocaust denial, racist and antisemitic rants, the 9/11 disaster, forged documents, and more. Der Spiegel sifted through the raw files and reported that party leader Alice Weidel seemingly knew about illegal donations related to the 2017 federal elections weeks before she previously said she did. The AfD's position is that the AI summaries of the emails are not to be trusted, but it has not specifically commented on the veracity of the raw email files available for download via torrent. It did not immediately respond to our request for input, but has told reporters previously that it will not comment on whether the emails, or the stories that have been written based on them, are to be trusted. ®

Japanese ISP GMO Internet has warned customers the cloudy desktop service it offers as an ideal foreign exchange trading environment was compromised by an attacker, and that it had been slow to improve the service's security. GMO runs a service called Onamae.com Desktop Cloud and last week admitted “a third party had installed malicious programs in the server environments of some customers.” That’s never welcome news but is an especially poor outcome because the servers host cloudy Windows desktops that GMO recommends customers use to host foreign exchange trading applications. In later updates the company revealed that some customers reported “unauthorized operations were performed on their trading accounts” and advised that third parties had probably seen users’ passwords for trading services. The next day, the company advised users to immediately change passwords for their trading accounts, and to do so using a device that they don’t use for trading. The company has since admitted that its Onamae.com Desktop Cloud service’s “systems had security vulnerabilities, that its environment was accessed without authorization, and that customer information was taken outside the Company.” “Some customers have also reported transactions in their trading accounts that they do not recognize.” Those transactions have GMO sufficiently worried that it contacted major trading services, asked them to forcibly terminate all active sessions, monitor for unauthorized transactions, and to block trade requests coming from the Onamae.com Desktop Cloud. Not paying, or complaining GMO said it has “received a demand for money from a person believed to be the attacker. We have also been told that, if we refuse, the attacker will take actions such as publishing information about the Company and our customers.” The attacker wants $50 million. The company won’t pay because it feels “complying would not guarantee that the obtained information is deleted or that its misuse is prevented.” Investigations into the incident continue, with GMO warning that 26,739 VDI servers may have been hit by the attack, and that users’ personal devices may be at risk. The company is offering all users a ¥5,000 ($32) condolence payment and promised to make good on any trading losses caused by the attack. This incident may have quite a blast radius, as GMO has warned that some trading apps may keep sessions alive even after passwords change. “Check your securities or FX company's guidance or your account page, and either disconnect all active sessions or ask the company's support desk to disconnect them,” GMO advised. That ¥5,000 isn’t going to get anywhere near paying for the work customers will do to sort this out. GMO CEO Masatoshi Kumagai acknowledged that in a blog post in which he described the payment as “a token of our initial sincerity towards our customers who have experienced inconvenience and worry.” “We will dedicate the full resources of our group to providing a free alternative environment for six months, fundamentally overhauling our system infrastructure, and conducting a thorough investigation into the cause and preventing recurrence with the help of external experts,” he added. But he also admitted that GMO knew the service’s security could be improved. “Our in-house white-hat hackers had previously pointed out areas for improvement to the team,” he wrote. “The team took these points to heart and was working on countermeasures.” “However, while we proceeded cautiously, considering the impact on service availability and prioritizing other issues, our response lacked sufficient depth and speed, allowing the attackers to exploit the vulnerability. I deeply regret that, despite having professionals on staff, we failed to fully translate their expertise into effective defenses as an organization.” The CEO also said GMO can’t secure itself without government help. “I've been involved in this world for 31 years, since the dawn of the internet industry,” he wrote. “The cyberspace that I built with my colleagues, believing it would bring smiles to people's faces, is now on the verge of being completely destroyed by malicious actors.” “The ease with which open weight AI models can be combined and spread into countless attack tools has transformed cyberattacks, which once required advanced skills, into an era where anyone can easily carry them out,” he added, before claiming that GMO Group’s cybersecurity operation “has confirmed that the source of an unauthorized access attack targeting approximately 20 Japanese companies was the misuse of ‘ARTEX,’ an autonomous AI penetration testing tool originally intended for defense.” Kumagai thinks public/private partnerships are needed to improve infosec across Japan. “Yesterday, we submitted a proposal to the government to ‘apply proactive cyber defense,’” he wrote. “We are by no means trying to shift the blame for our company's actions onto the government and beg for a bailout,” he wrote, but argued that unless Japan implements national-level defenses, more such incidents are unavoidable. ®

A new Miasma-family npm worm, originally believed to be just a test with no victims, secretly armed 42 real GitHub repositories from 11 owners, hijacking accounts as early as July and using a stealthy payload built to stay hidden from GitHub and automated scanners, according to JFrog researchers. Threat hunters at SafeDep, an open source supply chain security firm, first spotted the “testmetest” npm campaign last week, identifying 18 packages linked to the same operator between October 19 and October 25, including releases containing credential-stealing malware. As with earlier npm worms, the malware is self-replicating, steals credentials, and installs a wiper that deletes the home directory when the victim revokes the stolen GitHub token, the security researchers noted. The new npm worm shares code with June’s Miasma Phantom Gyp worm, and adds Mini Shai-Hulud’s token-revocation wiper. As of October 22, however, SafeDep had found no compromised third-party packages or victims. “All observed activity belongs to the operator’s own test accounts,” the team wrote. As with most happy-ending security stories, that proved too good to be true. In a Monday report, supply chain security company JFrog said its analysis proved otherwise, and found the testmetest campaign operator “had already armed real repositories belonging to established developers and organizations.” This isn’t just about timing, either, according to JFrog researchers Guy Korolevski and Yair Benamou. “The payload blobs were large enough to evade the GitHub search and API paths normally used to find this kind of compromise,” they wrote. How the attacks worked The attackers planted execution hooks for AI coding assistants and development tools, including Claude, Gemini, Cursor, and VS Code, alongside polymorphic wrappers measuring 12.9 to 13.7 MB that decode a hidden CI-publisher payload. Separately, the npm worm steals credentials, modifies repositories and CI configurations, and spreads through npm packages. The malware also uses a compiled native add-on to decrypt and launch a separate payload. Before executing, the loader checks for CI runners, containers, sandboxes, debuggers, and other signs of automated analysis, exiting silently when it detects them to reduce the likelihood of detection by security scanners. The researchers also found a second build that skips the encrypted file. “It forks, detaches and runs a hard-coded command that pulls a loader from a repository on the operator's own GitHub account,” they wrote. That account – CementBeetleSteeple – hosted 17 campaign repositories in total. JFrog connected this account to a shellpanel scanner, previously documented by Socket in a large-scale campaign that abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 and steal server credentials. CVE-2026-41940 is an authentication bypass affecting cPanel and WHM. CISA added it to its Known Exploited Vulnerabilities catalog in April, and cPanel has since published patched versions. “C2 infrastructure were previously reported by Socket; our findings connect them to the testmetest GitHub victim cluster through artifacts and workflows on the same hijacked owners,” the JFrog researchers wrote. They added that while they found 42 armed GitHub repositories and attempted internet-wide exploitation, they did not confirm any downstream cPanel compromises.®

Open-weight models from China have become very popular, but they've also raised some security suspicions. Cohere, a Canada-based biz that offers AI models to enterprises, says that when it was testing Alibaba's Qwen3.8-Flash-Next in its evaluation sandbox, the model attempted to send data to China. "Asked to write a defensive detection rule, Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing," the biz said in a blog post on Monday. Cohere was running the model through CTI-REALM, Microsoft's security analyst benchmark, and gave Qwen the task of writing a detection rule to look for malicious file downloading and execution by watching for invocations of curl processing bash scripts to the /tmp directory that were accompanied by bash execution. The model's "reasoning" output invented a prior conversation and asserted that no tools were used, output that a guardrail system reading chain-of-thought would accept. Nonetheless, the model issued a curl command to an Alibaba Cloud (aliyuncs.com) server. "The model listed everything in /tmp, checked which transfer tools were installed, read the machine's DNS settings, then tried to upload a test string to an Alibaba Cloud storage bucket in Beijing and checked whether it worked," Cohere said. "Our sandbox had no route out, so the request died at the container wall." The Cohere team wonders aloud whether that behavior was intended, but has no answer. "The first issue is that it made a network call at all," Ivan Zhang, co-founder of Cohere, told The Register via email. "The model was asked to write a detection rule, which doesn't require external communication, and its reasoning trace said it wouldn't use tools. The destination raises additional questions because the attempted upload was to an Alibaba Cloud storage endpoint that wasn't part of the task. We don't know why it appeared, and we don't know the root cause." Alibaba, the maker of the model, did not respond to a request to address Cohere's concerns. Asked whether Cohere ran similar tests against US-made open-weight models, Zhang said, "We evaluate a broad range of models using the same framework our customers use in production: agents with access to real tools operating inside controlled environments. "The key point isn't a comparison between providers. What made this noteworthy was that the model took actions unrelated to the task and those actions weren't reflected in its reasoning trace. The behavior appeared in fewer than one in 100,000 calls, which is exactly why large-scale testing and monitoring matter." There have been other unsubstantiated claims made about similar behavior from open-weight models, and such reports have suggested that "hallucination" - errors made by these models - may be the cause. Cohere has doubts that this behavior simply reflects memorized training data. "Every public sighting so far has involved fetching a file, while the one we caught was an attempted upload to a different bucket, this time in Beijing," the biz said. Cohere described efforts to reproduce the suspect behavior and found that using a technique called prefilling – feeding the model its own reasoning output alongside the opening characters of the bash command so the model would complete the command – they could get it to reference watchlisted hosts up to 23 percent of the time. This still doesn't clarify intent, and Cohere allows that there's a case to be made that the behavior is just bad training data sanitization – logs from development that got swept into the model's training data set. At the same time, the company argues that isolating a suspect model so it can't exfiltrate data doesn't entirely fix everything because these models can still write vulnerable code – accidentally or as a result of model poisoning. Cohere points to research from other organizations that suggests Chinese AI models can produce vulnerable code. The biz, for example, cites a report from Booz Allen (which does a lot of business with the US defense industry) that found "three of four Chinese coding models wrote more vulnerable code for a government customer, with Qwen3-Coder roughly 130 percent worse." "From the outside, it's very difficult to determine the root cause with confidence. We don't have evidence that would allow us to conclude this was deliberate, and we're not making that claim," said Zhang. "For security teams, though, intent doesn't fundamentally change the response. Whether it's a training artifact, a mistake, or something else, the controls are largely the same: restrict unnecessary egress, monitor tool use, and don't treat a reasoning trace as a security boundary. "We strongly support open-weight models and release many of our own. The lesson here is really about trust. Sovereign AI is about more than where a model runs. It's about understanding how it was built, how it was tested, and having confidence in how it behaves inside your environment." ®

LiteLLM has traced last week’s supply chain attack to a master key it accidentally committed to a public GitHub repository in May. The cloud and AI model secret-stealing part of the incident began when someone uploaded a poisoned version (1.107.0) of the popular open source AI gateway to PyPI and its container registries last Wednesday. This compromised version contained an infostealer and a remote access trojan capable of executing arbitrary code on infected machines. While the trojanized package was available on PyPI for less than two hours before being quarantined, it received about 49,000 downloads during that time, according to Wiz. On Friday, LiteLLM detailed the attack chain behind the compromised release and traced it back to May 27, when a configuration file containing a master key was committed to the public LiteLLM-Labs/lite-harness repository. The key belonged to an open source tool used internally by LiteLLM to orchestrate AI agents. The project's developers quickly spotted the error and removed the exposed commit, but failed to revoke the master key. “On October 10th, the threat actor used this key to gain access to our LiteLLM Agent Platform and extracted this GitHub CLI OAuth token,” according to Friday’s postmortem. “From this point onwards, the threat actor had owner-level access to all repositories in our GitHub.” This is especially serious because GitHub CLI tokens are “post-2fa,” meaning that they don’t trigger GitHub's sudo mode authentication flows typically required to perform high-impact repository actions. The token allowed the attacker to author malicious commits into branches on other internal repos - including workflows designed to steal any tokens and secrets configured to be available during the continuous integration development process. And this allowed them to steal other GitHub CLI OAuth tokens linked to two engineers with maintainer privileges. Plus, they acquired tokens for several other internal systems, we’re told. “Reviewing the actor's activity on these other systems shows attempts to identify and exfiltrate additional keys and tokens, with a primary focus on upstream inference API tokens,” LiteLLM noted. Having now stolen several privileged identities, the miscreant could make changes to GitHub repositories without raising any suspicion because the actions and approvals all appeared to come from legitimate, credentialed engineers. In response, LiteLLM’s developers are revoking every token associated with every internal system and vendor platform. “This incident has provided a strong illustration of the risks associated with failing to rotate a potentially exposed key,” they wrote. The infostealers hidden inside the compromised package were designed to hoover up a ton of sensitive information, including browser credentials and cookies from Chrome, Firefox, Edge, and Safari, along with AWS credentials, Google Cloud Platform service account keys and application default credentials, and Microsoft Azure tokens. It also swiped API keys for OpenAI, Anthropic, Cohere, and other LLM providers. So if you installed and ran version 1.107.0, assume any credentials accessible to the affected system may have been stolen. Investigate affected systems, change passwords, and rotate exposed keys. A quick prayer to the patron saint of supply chains wouldn't hurt, either. ®

To address a vulnerability in Google's Brotli compression technology that could allow attackers to corrupt process memory, Microsoft is urging .NET users to update "as soon as possible" after releasing an out-of-band (OOB) security update. It released new versions for .NET 8, 9, 10, and .NET 11 to patch against the Brotli bug, following similar updates from Node.js, Python, and other projects. Senior program manager Rahul Bhandari said in the October 25 release that the buffer overflow vulnerability in Brotli, tracked as CVE-2026-111497 and rated 8.1 under CVSS v3.1 in Microsoft's advisory, could allow an unauthenticated attacker to read or corrupt process memory, potentially resulting in information disclosure, denial of service, or elevation of privilege. Microsoft’s own advisory for the vulnerability, which some are referring to as Broccoli2Shell or Node2Shell, confirms that while experts have cobbled working exploits together, there is nothing to suggest that criminals are using them in successful attacks. However, its exploitability assessment reads: “Exploitation More Likely.” Broccoli2Shell was first disclosed on October 21 by the Node.js team, which released fixes for ten vulnerabilities, the most serious of which was CVE-2026-111497. Node.js credited Khai Tran and Sylvie Mayer of OpenAI’s Codex Security with the discovery, but failed to mention why it was only recognized as a security flaw and disclosed properly in October, despite the underlying bug having been fixed in Brotli's source code in February. OpenAI filled in the gap with a Xeet: “This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability, and there was no more recent release of Brotli. “Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software.” Attackers can exploit vulnerable systems by providing them with malicious Brotli-compressed data via a specially crafted request. The vulnerability went slightly under the radar due to the disclosure timing closely aligning with that of PHP2Shell, although fixing the critical flaw should be a priority due to the range of technologies that are affected. In addition to .NET, Node.js, and Python, Bun, Envoy, and Istio have all released patches, and JFrog has worked up an exploit affecting FFmpeg using a specially crafted JPEG XL image, extending the exploit path beyond HTTP. It said that FFmpeg reaches Brotli through libjxl, which it uses to decompress metadata stored in brob boxes within the image format. The same researchers said the vulnerability affects Apache Arrow too, with attackers able to cause a denial of service. Merav Bar, threat researcher at Wiz, added that cloud users are exposed extensively, noting that 91 percent of cloud environments rely on components vulnerable to the Brotli flaw and that 82 percent of cloud environments have publicly exposed Node.js instances. She said: “Cloud environments are particularly exposed due to the widespread use of Brotli-enabled components across containerized applications, Kubernetes clusters, API gateways, reverse proxies, serverless workloads, and cloud-hosted web services.” “Successful exploitation could enable attackers to compromise application workloads, access sensitive information, disrupt service availability, or execute malicious code within affected containers or runtime environments,” Bar added. In an advisory published through its Patch the Planet initiative, OpenAI recommended blocking untrusted Brotli-compressed data where practical until patches can be applied. It also advised maintainers to rebuild affected deployments and restart services to ensure the fixes take effect. ®

A UK-based developer and pentester has claimed a $2,000 Bitcoin prize for demonstrating the exploitability of the PHP2Shell vulnerabilities that melted the internet last week. Jaydip Modhwadia, 26, otherwise known as “Killa,” claimed the prize set by James Pavur, who launched the "Steal My Bitcoin" site on October 24. Pavur launched the CTF (capture the flag) challenge to prove that the PHP2Shell exploit was not as easy as those in the cybersecurity community claimed it to be, promising to award $2,000 in Bitcoin to anyone who could achieve Remote Code Execution (RCE) on his website. "My Bitcoin was stolen after 19.28 hours," the website now says, after Modhwadia claimed the prize, although the real time taken is thought to be less than three hours. Soon after Pavur launched the CTF on Saturday, prospective flag-catchers complained that the website he set up, which served only static HTML, was not built in a way that allowed the PHP2Shell exploit to achieve RCE. The web page was running a vulnerable version of PHP, but the exploit path required a vulnerable website to serve a PHP file for flag-catchers to use as a hook – something that Pavur seemingly updated at around 1300 UTC on October 25. Modhwadia achieved RCE on the website, exposing a PHP endpoint, at 1547 UTC. After an error from Pavur placing the wrong wallet key on the server, the CTF creator sent Modhwadia his award, which the community upped to $2,000 from Pavur’s initial $500. The pentester published a write-up of his method, a single-file Python script he says requires 20 HTTP requests "at most" to fully execute. Speaking to The Register, Modhwadia also confirmed that he got the flag in "around three or so hours in total." He said he followed the news about the competition, "but didn't attempt it until it gained significant notice." If he had attempted it before Pavur introduced the endpoint, he may have struggled. For hours, bug bounty hunters were trying to access the website to attempt the challenge, as news of the CTF had exploded across tech circles. "The fact that it took 19 hours was because after it went popular, the entire site became basically unusable for anyone at all," Modhwadia added. The challenge saw a huge number of attempts, despite Pavur's decision to introduce a prohibitive 1MB request limit on Nginx. Alon Gal, co-founder and CTO at Hudson Rock, commended Modhwadia's work, but added that his success achieved in just a few hours should not be taken to mean that the same attack could be automated at scale. He said: "Does this mean autonomous AI agents can now compromise arbitrary PHP servers at scale? No. This was a sophisticated, target-specific exploit. "But it does demonstrate that PHP2Shell can be weaponized against a live target, even with meaningful technical constraints." Modhwadia's proof of concept is not the first to prove PHP2Shell is exploitable, but it falls under the more advanced category. Early signs suggested that Address Space Layout Randomization (ASLR) on a vulnerable server would prove a significant barrier to real-world exploitation, and the pentester’s solution bypasses it, along with the others that were disclosed recently. Spencer McIntyre, director of exploit development at VulnCheck, told The Register last week that attackers are finding new ways to exploit PHP2Shell, and "are clearly spending time (and tokens) on this bug." Initially, experts said exploit code was being found online hours, or even days, before the vulnerabilities were disclosed publicly, which led to millions of exploit attempts, although it was too early to determine the efficacy of these on real-world systems. Scores of websites were taken down for maintenance last week as organizations raced to protect themselves from the attacks, which may or may not have proved successful. Modhwadia said he donated a portion of the prize he received to the Lupus Foundation to raise awareness about the condition, from which he also suffers. ®

Anthropic has filed for an IPO that could rank among Wall Street's biggest ever, revealing an $80.7 billion half-year loss, a startlingly complex governance structure, and warnings that its AI models could blackmail humans, resist shutdown, or create "existential risks" to society. The Claude maker filed its S-1 registration statement with the US Securities and Exchange Commission on Monday as it prepares to list on Nasdaq under the ticker ANT. The company has not yet disclosed its proposed share price or how many shares it plans to sell. Of the filing's 614 pages, 94 are devoted to risk factors. But it's Anthropic's financial figures that are likely to raise eyebrows first. The Claude maker reported $16.3 billion in revenue for the first six months of 2026, up from $1.2 billion a year earlier. It also posted a whopping $80.7 billion net loss, although $72.4 billion of that was an accounting adjustment tied to the company's soaring valuation, not money it actually spent. Anthropic's operating loss was considerably smaller at $693 million, down from $2.1 billion a year earlier. By its own adjusted accounting, the company made a $1.6 billion operating profit in the first half of 2026, for a margin of around 10 percent. Whether it can keep making money on those terms is another matter. Training and running Claude requires an eye-watering amount of computing power, and Anthropic will need much more to keep pace with its rivals. A $1.6 billion adjusted profit won't count for much if the infrastructure bills keep growing faster than the business. Susannah Streeter, chief investment strategist at Wealth Club, told The Register that Anthropic's IPO could leave ordinary investors paying a premium for growth that has yet to translate into sustained profits. "A huge pool of private capital has allowed AI businesses to scale up and command extraordinary valuations long before they reach the stock market," she said, adding that investors buying in at the IPO will face a price with "a hefty dose of future success baked in." The financial risks are fairly conventional by Silicon Valley standards, but the warnings about what Claude might get up to are perhaps less so. Anthropic claims that models, including its own, have exhibited unexpected or self-preserving behavior, including attempts to resist shutdown, conceal information, and produce outputs resembling blackmail. It also warns that sufficiently advanced AI systems could pose “catastrophic or existential risks to society” if deployed without adequate safeguards. That's not to say Claude is currently blackmailing customers. Anthropic has observed some of this behavior in testing, but it also identifies more immediate security concerns as it gives its models access to external tools, code repositories, and corporate systems. Anthropic warns that attackers could hide malicious instructions in websites, documents, or API responses that its AI agents can access. If an agent follows those instructions, it could use a customer's permissions to steal data, tamper with code, or make unauthorized transactions. Even testing whether the models will behave themselves is proving tricky. Anthropic reckons some models behave differently when they detect or suspect they're being evaluated, making it harder to predict what they will do outside the testing environment. Keeping its models on a short leash could also cost Anthropic business. The company acknowledges that holding back more capable systems could give competitors an advantage, something it has already risked by restricting access to its Mythos model through Project Glasswing because of its ability to uncover security vulnerabilities. The founders aren't promising to put shareholders first, either. In a letter accompanying the filing, Dario and Daniela Amodei and their fellow co-founders tell prospective investors "not to think of your purchase in purely transactional terms." Anthropic may pass up lucrative business if it considers the risks too great, and investors won't have much say if they disagree. Under the proposed structure, governance structure includes five different classes of stock. By comparison, Google has three. The seven co-founders will retain 50.1 percent of the voting power on shareholder matters, while a separate Long-Term Benefit Trust will get to appoint a majority of the board. In other words, Wall Street is being invited to bankroll Anthropic's AI ambitions, but not necessarily to call the shots. Anthropic wants Wall Street's money to build ever more powerful AI, but is warning investors that it might turn down profits to keep that AI under control. Judging by those 94 pages of risk factors, keeping it under control is far from guaranteed.®