SonicWall's maximum-severity SMA1000 flaw is now being exploited in the wild, Ledger is investigating a reported 87 million dollar drain from wallets bought through a reseller, and a credential-stealing GitHub Actions campaign has spread to tens of thousands of repositories.
🔴 CRITICAL (2)
SonicWall SMA1000 flaw CVE-2026-102255 (CVSS 10.0) now exploited in attacks Confirmed
SonicWall patched four flaws in its SMA1000 remote access appliances this week, and the most serious, a pre-authentication server-side request forgery rated 10.0, is now being exploited. The flaw is in the Appliance Work Place interface, where an unintended alternate access path lets an unauthenticated attacker make the appliance issue HTTP requests on their behalf and reach internal services or trigger unauthorised actions. Organisations running SMA1000 appliances, physical or virtual, should move to the fixed hotfix version immediately and review logs for scanning or proxy abuse.
Sources SonicWall PSIRT|BleepingComputer
Ledger probes reported 87 million dollar theft from wallets bought via reseller CryptoBilis Under investigation
Ledger is investigating reports that crypto was drained from hundreds of hardware wallets bought from CryptoBilis, a Southeast Asian reseller, and has asked the reseller to pause sales and shipments. An on-chain investigator put tracked losses at more than 86 million dollars across Bitcoin, Ethereum and Tron addresses, and recent buyers have been told not to set up their devices. The mechanism is unconfirmed: one analysis cautions that the total is an estimate built from flagged addresses rather than a verified figure. Anyone who bought a Ledger through a third-party reseller should avoid using it until Ledger’s guidance is clear.
🟠 HIGH (3)
Citrix patches critical NetScaler flaw CVE-2026-107406 (CVSS 9.5) Confirmed
Citrix released fixes for CVE-2026-107406, a memory overflow rated 9.5 that can lead to remote code execution or denial of service on NetScaler ADC and NetScaler Gateway deployments configured as a SAML service provider or identity provider. CISA updated its NetScaler alert on October 9 to include the new CVE, and NHS England issued a critical alert the same day. Citrix says it is not aware of exploitation, but NetScaler has been a repeat target, so affected instances should move to the fixed builds in the 14.1-73.46 and 13.1-64.29 families, and end-of-life 12.1 and 13.0 deployments should be migrated.
Sources Citrix|CISA|BleepingComputer|SecurityWeek
Unpatched AhsayCBS flaws exploited to plant webshells and XMRig miners Confirmed
Huntress says attackers have been exploiting two flaws in AhsayCBS, a centralised backup platform, since October 7, chaining CVE-2026-105133 to bypass authentication and CVE-2026-105134 to run operating system commands. Observed activity includes web shells and XMRig cryptocurrency miners disguised as Microsoft Edge, with five organisations targeted so far. Reporting says the flaws remain unpatched in the version many customers run, so operators should isolate internet-facing backup servers, hunt for unexpected files and processes, and track the vendor for a fix.
Credential-stealing GitHub Actions workflows planted across tens of thousands of repositories Confirmed
Socket says more than 500 GitHub accounts have committed a malicious workflow file to tens of thousands of repositories since October 7, including accounts belonging to maintainers of widely used open-source projects, with credentials exfiltrated from CI/CD jobs. The activity is a new wave of the GhostAction campaign that GitGuardian first documented in 2025 and observed again in a burst that hit 772 public repositories and thousands of secrets. Development teams should audit recent workflow commits, rotate any secrets exposed to untrusted workflows and restrict workflow token permissions.
Sources The Hacker News|GitGuardian
🟡 MEDIUM (6)
P7 DarkSword iOS exploit kit adds crypto wallet theft and two-way command and control Confirmed
iVerify published research on P7 DarkSword, a previously unseen variant of the DarkSword iOS exploit kit used in targeted attacks. Compared with earlier variants it reduces its on-device footprint, adds theft of keychain data and crypto wallet information, and supports two-way command and control with attacker infrastructure. The report does not attribute the kit to a named group or campaign, and iPhone users should apply iOS updates promptly.
Sources The Hacker News
Working exploit published for pre-authentication AnyDesk Linux flaw that returns root Confirmed
Researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk for Linux that gives attackers root access before a connection is approved. AnyDesk fixed the issue in version 8.0.3 in June, but the changelog described it only as a crash fix, no CVE was assigned and no security advisory was published at the time. Organisations running AnyDesk on Linux should confirm they are on 8.0.3 or later and review how much remote access software is exposed.
Sources The Hacker News
Google Ads and Bing redirects used to push fake Claude installers in ClickFix attacks Confirmed
Attackers are buying Google search ads that use legitimate Bing redirect URLs as their click targets, sending users to fake Claude installer pages as part of ClickFix attacks. The pages instruct victims to paste a command into a terminal or the Windows Run dialog, which then installs malware. Defenders should block known ClickFix lure domains and remind staff that no legitimate AI tool is installed by pasting commands from a web page.
Sources BleepingComputer
FBI arrests another suspected ShinyHunters member over the bureau jobs portal breach Under investigation
FBI Director Kash Patel said on October 9 that the bureau has arrested another suspected co-conspirator of the ShinyHunters extortion group, which claimed in September to have stolen data on almost all FBI agents and job applicants from its jobs portal. No name and no charges have been made public. The arrest is the latest enforcement action against the group, whose campaigns have also targeted other organisations this year.
Germany arrests alleged core Qilin ransomware member after extradition from Japan Under investigation
German authorities have arrested a Russian national suspected of being a leading member of the Qilin ransomware group following his extradition from Japan earlier this month. German prosecutors have not published full details of the charges or any trial date. Qilin has been one of the more active ransomware operations of the past two years, so the arrest is a notable disruption of its leadership.
Sources BleepingComputer
GoBalance flaw lets attackers recover Tor keys and hijack .onion addresses Confirmed
Searchlight Cyber disclosed a flaw in GoBalance, a tool used by dark web sites to stay reachable during traffic surges, that lets an attacker derive the secret key controlling a site’s .onion address from public information. Taking the address lets the attacker redirect visitors to a copy of the site they control. Operators using the tool should regenerate onion keys and check for unexpected redirects or traffic patterns.
Sources The Hacker News
⚪ WATCH (9)
CISA publishes three industrial advisories covering switches, grid software and interfaces Confirmed
CISA released ICS advisories for Red Lion Controls N-Tron 700 series switches, Grid Protection Alliance openPDC and openHistorian, and Satel Netco Design interfaces. The Red Lion issues could let an attacker gain administrative access to a switch and alter its configuration, while the openPDC advisories cover several CVEs in a grid telemetry platform. No exploitation has been reported; operators should apply the vendor mitigations listed in each advisory.
Pwn2Own Ireland ends with 1,262,000 dollars paid for 98 zero-days Confirmed
The Pwn2Own Ireland contest concluded with researchers earning 1,262,000 dollars for 98 previously unknown vulnerabilities in phones, printers, smart speakers, home hubs and AI infrastructure. Three teams broke into fully patched Google Pixel 10 devices remotely, with a 300,000 dollar prize going to the overall winner, Ikotas Labs. All findings were handed to the vendors, so these are research results rather than exploitation in the wild.
Anthropic launches free vulnerability scanner for open-source projects Confirmed
Anthropic introduced OSS Scanner, an opt-in service that runs periodic scans of open-source projects with its strongest models and sends findings to maintainers at no cost, based on its Project Glasswing work. Maintainers receive unreviewed, model-generated reports, so triage sits with them. Anthropic also named 11 partner firms to work on operational technology security. The programme adds AI-generated vulnerability reports to open-source maintenance workflows.
Sources The Hacker News|SecurityWeek
Microsoft: unsupported Windows devices will lose security updates after certificate rotation Confirmed
Microsoft says devices running unsupported Windows versions will stop receiving security updates after next year’s Windows Update certificate rotation, because their update clients will no longer be trusted. The change effectively ends update delivery to machines left on older builds. Organisations with long-lived, offline or embedded endpoints should inventory them now and plan upgrades before the rotation lands.
Sources BleepingComputer
UK sanctions crypto payment platforms Cryptomus, Heleket and TokenSpot over Russia links Confirmed
The UK designated crypto payment processors Cryptomus, Heleket and TokenSpot plus two payment services in a new Russia sanctions package, saying they may have helped Moscow evade financial restrictions, with two handling transactions linked to the Kremlin-backed A7 network. Chainalysis notes the designations widen the sanctioned infrastructure supporting Russia’s wartime economy. Exchanges and compliance teams should screen customers and counterparties against the updated lists.
Sources Chainalysis|CoinDesk|Decrypt
Kaspersky: ransomware crews increasingly skip encryption and sell stolen data Confirmed
Kaspersky reports that ransomware operators are shifting toward pure data theft and extortion, stealing corporate information and threatening to leak or sell it instead of encrypting systems. The approach avoids the noisy, recovery-heavy work of encrypting large estates while still pressuring victims to pay. The defensive advice is unchanged: know where sensitive data lives, limit lateral movement and rehearse breach response.
Sources Kaspersky
Dark Reading: social engineering AI agents is the emerging BEC pattern Confirmed
As organisations give AI agents authority to act inside business systems, attackers can manipulate those agents much as they manipulate people in business email compromise, according to a Dark Reading analysis. Agent instruction handling, tool access and approval flows become the attack surface. Teams deploying agents should scope permissions narrowly, log agent actions and require human approval for money movement or data export.
Sources DarkReading
OpenAI dismisses three safety researchers over handling of sensitive information Confirmed
OpenAI said it fired three safety researchers for violating its policies on handling sensitive information, according to reports. The departures add to the debate over how AI labs balance internal safety advocacy with information controls. No security incident was disclosed as the trigger for the dismissals.
Sources SecurityWeek
Dual national admits running a 15,000 strong money mule network for cybercriminals Confirmed
A Ukrainian-Russian dual citizen has pleaded guilty to running a money laundering operation that used roughly 15,000 mules to move millions of dollars for cybercriminals worldwide. Prosecutors say the network took payments from ransomware, fraud and other criminal groups. The case shows cash-out infrastructure increasingly being run as a dedicated service rather than by individual crews.
Sources BleepingComputer
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.