🕵️ RESEARCH & DEEP DIVES
Five suspected Black Axe leaders extradited to US to face wire fraud, money laundering charges
Five alleged leaders of the Black Axe cybercrime syndicate have been extradited to the United States to face wire fraud and money laundering charges.- Defendants Perry Osagiede, Franklyn Osagiede, Osariemen Clement, Collins Otughwor, and Musa Mudashiru were arrested in South Africa in 2021 and extradited to the US on September 11, 2026.
- Prosecutors allege they coordinated internet fraud from Cape Town from 2011 to 2021, using advance fee schemes and romance scams targeting US victims.
- The group allegedly used aliases, social media, online dating sites, and VoIP numbers to build fake romantic relationships and trick victims into sending money, coercing refusers with threats to publish sensitive photos.
- Charges carry up to 20 years for wire fraud, 20 years for money laundering, and two additional years for aggravated identity theft.
- Black Axe, founded in Nigeria in 1977, is believed to have roughly 30,000 registered members; recent Operation Jackal IV action across 22 countries led to 58 arrests tied to the network.
Japan's Digital Agency Breach Exposes Data of 240,000 via Exploited VPN Flaw
Japan's Digital Agency disclosed a breach affecting roughly 240,000 people after attackers exploited a VPN vulnerability to access its Government Solution Service.- Affects users, public officials, administrative staff, and businesses and individuals working with the Government Solution Service (GSS).
- Over 246,000 records were compromised, including ~236,000 names, ~231,000 email addresses, ~94,000 phone numbers, and ~1,000 addresses.
- Attackers accessed GSS files in late June using a maintenance and operations employee's account; the investigation in July determined a vulnerability in a VPN product had been exploited.
- The targeted VPN vulnerability had been publicly disclosed before the attack; the agency did not name the product.
- Individual identification numbers and financial account information were not affected, and no other systems were compromised.
Schneier and Cohn: 25 Years After 9/11, Mass Surveillance Has Outgrown Its Terrorism Justification
Bruce Schneier and Cindy Cohn argue in a Lawfare essay that the mass surveillance architecture built after 9/11 has expanded far beyond counterterrorism into routine law enforcement and private use.- Applies to Americans' privacy and civil liberties: NSA programs, ICE, local law enforcement, FBI, and private surveillance vendors are all part of the ecosystem the authors critique.
- What has changed: a post-9/11 shift from targeted surveillance (wiretaps, pen registers) to mass collection — telephone metadata under a novel Section 215 interpretation, and NSA's Upstream program intercepting internet content under FISA Section 702.
- The Second Circuit rejected the Section 215 mass phone-records interpretation in 2015, and Congress passed the USA Freedom Act; Section 702 was allowed to expire in 2026 but mass collection continues until at least Spring 2027.
- How it reaches government: agencies primarily obtain mass surveillance data through private companies — telecom and internet firms, data brokers (FBI Director Kash Patel confirmed purchasing Americans' data), cellphone location data, and privately run Flock and Vigilant license plate reader networks.
- Domestic uses now include ICE facial recognition against immigrants and protesters, TSA airport face scans, tracking abortion-seekers across state lines via ALPR networks, and venue systems like Madison Square Garden's, with AI expected to amplify the problem.
Sources 📎 Coverage: lawfaremedia.org · 👁 via Schneier on Security, securityboulevard.com (discovered)IBM's Harvest: the secret 1960s supercomputer that powered NSA code breaking
IEEE Spectrum details Harvest, the ultra-secret IBM-built supercomputer that served as the NSA's main code-breaking machine from 1962 through the mid-1970s.- Harvest (IBM 7950) was designed and built by IBM for the NSA and ran as the agency's main cryptographic processor from the Cuban Missile Crisis in 1962 for 14 years.
- The machine ran jobs up to 200 times as fast as any other computer of its era and processed the NSA's most sensitive signals-intelligence intercepts.
- Harvest was one of the first add-on coprocessors, bolted onto IBM's Stretch mainframe to accelerate cipher and code analysis on large data streams, analogous to modern GPU designs.
- It pioneered the world's first automated tape library, robotically retrieving cassettes from racks of magnetic tape.
- IBM created a custom programming language called Alpha so code breakers could formally describe cryptographic problems; the account is pieced together from declassified documents and technical manuals.
glibc iconv EUC_JISX0213 decoding flaw (CVE-2026-80489) can hang applications on crafted input
The GNU C Library's EUC_JISX0213 iconv converter can hang applications when decoding crafted input.- Affects applications using GNU C Library (glibc) versions 2.3 through 2.44 to convert text with iconv.
- Only the EUC_JISX0213 character set is affected, which is not commonly used; the related SHIFT_JISX0213 defect is tracked separately as CVE-2026-77117.
- Some EUC_JISX0213 sequences decode to two code points; if the output buffer fits only the first, the converter stores the second as pending state but never clears it after emitting it, causing the converter to emit it forever without consuming input.
- The flaw requires attacker-controlled input and an output buffer small enough to split the two code points, resulting in an infinite loop (CWE-835) and denial of service.
- Tracked as CVE-2026-80489 with CVSS 3.1 score 5.9, found by AISLE in partnership with Red Hat.
Kimai 2FA bypass (CVE-2026-52827) lets attackers hit API without second factor; fixed in 2.59.0
A two-factor authentication bypass in Kimai allows attackers with a valid password to access the REST API without completing TOTP.- Affects Kimai, an open-source time tracking application, all versions prior to 2.59.0
- The KIMAI_SESSION cookie issued after password verification but before TOTP completion is accepted by every /api route (CWE-287, Improper Authentication)
- security.yaml protects the API only with IS_AUTHENTICATED, and ApiRequestMatcher routes existing sessions through the main firewall, so a Scheb TwoFactorToken satisfies the access rule
- An attacker with a valid account password can use authenticated REST API operations without entering the second factor, even though web routes remain blocked
- CVSS 4.0 score 7.1 (High); fixed in Kimai 2.59.0
Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases
SecurityWeekImproper handling of insufficient permissions or privileges vulnerability in ...
CVE ThreatIntSession FixationSession fixation vulnerability in Secomea GateManager (webser...
CVE ThreatIntSHIFT_JISX0213 decoding may hang on crafted inputConverting crafted SHIFT_JIS...
CVE ThreatIntKimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows...
CVE ThreatIntKimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TE...
CVE ThreatIntKimai: Improper Authorization in Kimai Project, Customer, and Activity Rate E...
CVE ThreatIntKimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Un...
CVE ThreatIntfast-uri vulnerable to mailto header injection via percent-encoded field-name...
CVE ThreatIntKimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account ...
CVE ThreatIntKimai: Improper Authorization in Kimai Team Member and Team Activity Assignme...
CVE ThreatIntKimai: Improper Authorization in Kimai Activity Creation with Preset Project ...
CVE ThreatIntKimai: Timesheet PATCH/POST allows assigning to project outside user's team v...
CVE ThreatIntKimai: Teamlead authorization bypass in GET /api/timesheets allows reading ot...
<https://cve.threatint.com/CVE/CVE-2026-52819?utm