Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX.
The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments.
ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs
Despite Illinois’ sanctuary laws, local police in and around Chicago helped ICE investigative agents track activists engaged in First Amendment–protected activities.
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections.Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor.
Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes.
The activity is being tracked by
The October 2026 Windows security update may break networking for some customers who are still clinging to long-deprecated NTLMv1 security. A seemingly minor change in the update could have major implications for administrators and enterprises that haven't fully moved away from the legacy technology. Before the October 2026 update, Windows permitted NTLMv1-derived credentials for Single Sign-On and generated warning events. After the update, requests to use NTLMv1-derived credentials are blocked. It comes down to the BlockNtlmSSO registry value. If it hasn't been set, Windows will now use Enforce mode (1) instead of Audit mode (0), thus blocking requests and potentially impacting Wi-Fi, Ethernet, and VPN authentication, and therefore connections. The update does not set the value of BlockNtlmSSO, and administrators can set it to 0 to temporarily allow NTLMv1-derived Single Sign-On credentials. However, Microsoft noted, "Using Audit mode reduces the protection provided by Enforce mode and should only be considered as a scoped, temporary security exception." To be clear, this is not a bug and is by design. The addition of NTLM to the deprecation list occurred in 2024, and Microsoft added audit logs for NTLMv1 usage in late August 2025. The Windows giant has made no secret of its desire to ditch the legacy technology, stating in 2023, "Our end goal is eliminating the need to use NTLM at all." The problem is NTLM's longevity. It appeared in 1993 with Windows NT 3.1, and removing it from enterprise environments has proven tricky, even though it is somewhat insecure by modern standards. Microsoft removed it from Windows 11 24H2 and Windows Server 2025, but some remnants can still be found, notably when using MS-CHAPv2-based connections, including PEAP-MSCHAPv2, and EAP-MSCHAPv2, in a domain-joined environment. Hence the introduction of the audit mode in 2025, to help administrators spot where the technology was still being used. It is now 2026, and Microsoft has taken the next step. If Credential Guard is not enabled and BlockNtlmSSO is not set to Audit mode (0), the use of NTLMv1-derived credentials will be blocked as Microsoft works "to finalize the disablement of NTLMv1." There is no indication of how long the BlockNtlmSSO workaround (setting the value to Audit mode) will work - most likely until the next major Windows release. In September, Microsoft said, "In-market versions of Windows client and Windows Server will continue to support NTLM." However, it also stated, "Our long-term objective is a Windows platform that doesn't need NTLM at all." As such, if the message wasn't already clear, the move to enforce it by default makes it impossible to miss. The technology still exists in the operating system, but it is on its way out and will be removed in a future Windows release. Problems with networking after the October 2026 Windows security update could therefore signal that migration plans are not as far along, or as complete, as administrators might have thought. ®
Author here, I work at IPinfo. some security-relevant highlights part of the post:
The August 28 Virtualizor update attack used a forged-origin /24 inside Hetzner’s space. From what we saw, it was RPKI-valid because Hetzner’s ROA covered the /16 and allowed announcements down to /24, and no real /24 existed to compete with it.
We also measured how common that setup is. In this case, of 855,217 RPKI-covered IPv4 routes, 138,698 (16.2%) have a ROA looser than the route announced and no more-specific route of their own filling the gap. For IPv6 it’s 20.9%. That’s roughly 18 million more-specifics someone could announce today and come out RPKI-valid and uncontested.
Hosting providers also differ a lot: Contabo leaves 540 of 553 covered routes open, DigitalOcean 780 of 863, OVH 11.5%.
Invalid routes are being dropped now: a typical valid route is seen by 596 vantage points, an invalid one by 2. So the remaining risk is routes that pass the check, not ones that fail it.
There's also the fix in RFC 9319: leave maxLength unset, so a ROA only matches the block you actually announce.
Method is at the end of the post. Happy to answer questions
If you run Laravel (or anything on Symfony), read this. CVE-2026-108082: one unauthenticated GET, seconds of backend CPU, ~100 requests and the app times out. A dumb ReDoS that common config turns into a real DoS. 👀⤵️
OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test cryptocurrency from a third-party's wallet without authorization to complete a coding task.
The incident, the AI company said, involved an internal research model part
The US' bankruptcy courts are currently down owing to what officials are calling a “cybersecurity incident.” The Administrative Office of the US Courts said the websites and systems that support the Bankruptcy Noticing Center (BNC), which manages electronic comms related to bankruptcy cases, were pulled offline while the vendor investigates. BAE Systems runs the affected systems and websites on behalf of the Federal Judiciary, and is “working to restore operations,” according to an announcement by the US Courts on Thursday. “As a result of the incident, all access to the BNC systems and websites that BAE operates on behalf of the judiciary and the related bankruptcy noticing process are unavailable at this time, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service," it said. “The incident has also halted the BNC’s production and distribution of bankruptcy notices for bankruptcy courts.” While the public notice was published on Thursday, the issues affecting the BNC systems began a few days earlier, on October 9, according to the Bankruptcy Court of the Eastern District of Texas. Alongside its own announcement, the same court published a general order indicating that for any case filed on or after September 14 with an active motion to stay, that delay would be extended by an additional 30 days. The court said it will continue to accept filings, open cases, and process documents, but said there may be a delay in the entry and service of notices and orders until the issues are resolved. The courts' ability to process electronic and paper bankruptcy notices is affected, and it applies to federal bankruptcy courts across the country. A spokesperson at BAE told The Register: "BAE Systems, Inc. operates the Bankruptcy Noticing Center (BNC) on behalf of the Administrative Office of the U.S. Courts (AOUSC). We are aware of a security incident that is isolated to the BNC system and have taken immediate steps to address it. We are coordinating closely with AOUSC on the response." The disruption comes at a difficult time for the US public sector, which has struggled with multiple recent cyberattacks. ShinyHunters' attack on the FBI in September is doubtless the most high-profile of these, although the Arizona Judicial Branch confirmed an attack on the state’s court systems at around the same time. Officials said the “criminal hackers or their bots” were responsible for stealing personal data and backup court files. The US Courts also said in August 2025 that it was stepping up its cybersecurity measures in response to increased targeting of its case management system. ®
Login
