💥 BREACHES & INCIDENTS
Hackers breach third cargo ship; LNG tanker loaded in Louisiana diverts to Spain
Hackers breached a third cargo ship, an LNG tanker that loaded in New Orleans and was traveling to Italy, now docked in Spain.- The Liberian-flagged LNG tanker Vivit Africa loaded at Cameron LNG's Louisiana terminal in late August and abandoned its Italian delivery after a system malfunction, diverting to Algeciras, Spain.
- Hackers compromised systems involving tank pressure, safety valves and boil-off gas management, which could have caused catastrophic failures.
- Federal agencies are monitoring nearly 20 commercial vessels globally following the attack.
- The FBI and U.S. Coast Guard boarded two foreign-flagged ships in the Gulf, including the crude oil tanker VL Prosperity, which suffered a 30-hour communications blackout and engine-room malfunction.
FBI investigating ShinyHunters' claim it stole data on all 38,000 bureau staff
The FBI is investigating ShinyHunters' claim that it stole personal data on all 38,000 bureau agents and staff.- Applies to FBI personnel — around 38,000 agents and staff whose names, roles, badge numbers, home addresses, phone numbers and spouse details are claimed stolen.
- ShinyHunters claims it exploited a vulnerability in the Oracle cloud storage system used by the FBI to breach FBIJOBS, FBI BEAST (background checks), FBI MedLink (medical records) and FBI BICS (investigation information).
- Some stolen data reportedly includes job assignments involving work against Chinese spies, Russian intelligence and drug cartels; the BBC says a sample appears genuine.
- The group says the breach was retaliation for the FBI's May advisory describing ShinyHunters as extortionist threat actors, and is demanding the advisory be retracted within one week or it will publish the databases.
- The FBI says it is investigating whether its systems or a third-party provider supporting FBIJobs.gov was breached.
DOJ arrests Oxygen Forensics leaders for hiding Russian ownership to win US agency contracts
The DOJ has arrested two leaders of phone-forensics firm Oxygen Forensics for allegedly concealing its Russian ownership to win U.S. government contracts.- Oxygen Forensics sold phone-hacking software to the Secret Service, Homeland Security Investigations, the DHS inspector general and DOD.
- CEO Lee Reiber was arrested in Idaho; Russian national Oleg Davydov was arrested in London; both face conspiracy to commit wire fraud charges.
- After 2022 sanctions on Russia, the company installed Reiber as CEO and removed Russian owners from filings, winning over $2 million in Secret Service contracts.
- Procurement officials said they would not have awarded contracts had they known Oxygen US was Russian-owned; Oxygen Russia's customers included the FSB.
- DOJ says the complaint does not allege the software contained malicious code or was used for unauthorized access.
🔓 CVEs & KEV
CVE-2026-93425 — dokploy — CVSS 9.9 — Dokploy PaaS Critical RCE Leads to Container Root and Host Compromise
CVE-2026-96276 — Red Hat Enterprise Linux 10 — CVSS 9.8 — Flatpak: flatpak: arbitrary write in host context via flatpak build-initIf a ...
CVE-2026-18872 — IBM Financial Transaction Manager (FTM) for RedHat OpenShift — CVSS 9.3 — IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabiliti...
CVE-2026-18490 — IBM Financial Transaction Manager (FTM) for RedHat OpenShift — CVSS 8.8 — IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabiliti...
CVE-2026-94609 — goauthentik authentik — CVSS 8.8 — authentik: Privilege Escalation to Superuser via Group Hierarchyauthentik is ...
CVE-2026-68490 — WebPros cPanel — CVSS 8.2 — New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts
CVE-2026-18181 — IBM Financial Transaction Manager (FTM) for RedHat OpenShift — CVSS 8.1 — IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabiliti...
CVE-2026-94611 — goauthentik authentik — CVSS 8.1 — authentik: Stored credentials are readable with view permission aloneauthenti...
CVE-2026-94613 — goauthentik authentik — CVSS 7.5 — authentik: Denial of Service via Document Type Declarations in SAML Messagesa...
CVE-2026-18184 — IBM Financial Transaction Manager (FTM) for RedHat OpenShift — CVSS 7.4 — IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabiliti...
CVE-2026-94612 — goauthentik authentik — CVSS 7.4 — authentik: Authentication bypass via assertion confusion in SAML sourcesauthe...
CVE-2026-18875 — IBM Financial Transaction Manager (FTM) for RedHat OpenShift — CVSS 7.3 — IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabiliti...
CVE-2026-18185 — IBM Financial Transaction Manager (FTM) for RedHat OpenShift — CVSS 7.3 — IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabiliti...
CVE-2026-18180 — IBM Financial Transaction Manager (FTM) for RedHat OpenShift — CVSS 6.5 — IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabiliti...
🕵️ RESEARCH & DEEP DIVES
Placeholder domain third-party.com, cited in 1,700+ GitHub repos, now serves ClickFix malware
The documentation placeholder domain third-party.com has been registered by an attacker and now serves a ClickFix clipboard-hijacking lure to Windows visitors.- Affects developers and AI agent users: third-party.com is referenced as an example endpoint in over 1,700 public GitHub repositories, including AI agent skills and MCP-server docs
- The domain is not IANA-reserved (unlike example.com), so anyone could register it; it now serves a ClickFix lure and is flagged malicious on VirusTotal and Google Safe Browsing
- Windows visitors get a fake Cloudflare check that poisons the clipboard and instructs pasting a command into the Windows Run dialog, which fetches and runs a remote PowerShell payload
- macOS visitors see a decoy error claiming the site requires a Windows PC; the lure has been active since at least June 2026
- Manifold Security identified 13 more non-reserved placeholder domains; yoursite.com and your-domain.com serve scareware and investment scams to macOS users and appear in hundreds of thousands of GitHub files
Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
Compromised Ukrainian business websites are serving fake Cloudflare verification pages that deliver a previously undocumented stealer called Psychedelic.- Targets: Ukrainian users via compromised Ukrainian business websites (clinics, retailers, publishers) injecting an iframe loading fsputnik[.]com/tds/tracker[.]js
- ClickFix lure mimics a Cloudflare verification screen with Ukrainian-language instructions, copying an msiexec command to the clipboard for pasting into Windows Run
- The command fetches MSI installers (elita.msi, miks.msi, astra.msi, harbor.msi, neon.msi, sova.msi, vyse.msi) from uasputnik[.]com, registered September 9, 2026
- MSI retrieves psychedeliclove.exe from 107.175.82[.]242:9000; Psychedelic Stealer harvests Chromium browser passwords, account tokens, and crypto wallets (MetaMask, Exodus, Electrum, etc.), sets scheduled-task persistence, and installs a malicious browser extension via native messaging
- C2 at 193.178.159[.]128:8080 can task EXE, COM, BAT, CMD, MSI, and PowerShell payloads; a linked Rublevka TDS lure panel logged 557 views across 32 countries, mostly Ukraine; artifacts suggest Russian operators
Cloudflare fixes cross-tenant data exposure vulnerability in Containers
External researchers found a Cloudflare Containers vulnerability that could expose residual disk data from previous tenants' workloads, which Cloudflare has remediated.- Affects Cloudflare Containers customers on the multi-tenant developer platform
- Vulnerability could expose residual disk data left by previous workloads to other tenants
- Identified by external security researchers at Accomplish and investigated and fixed by Cloudflare
Doyensec details Chrome for iOS Shortcuts bypass enabling one-tap tel: calls (CVE-2026-13795)
Doyensec discovered that Chrome for iOS opened Shortcuts URLs without a confirmation prompt, letting a single webpage tap trigger tel: or facetime: calls via Shortcuts x-callback URLs.- Affects Chrome for i