🚨 ACTIVE EXPLOITATION
- PitScaler under mass exploitation; fewer than 10% of devices patched
PitScaler is under mass exploitation with spray-and-pray attacks, and fewer than 10% of devices are patched.- Applies to organizations running PitScaler devices/appliances.
- PitScaler is under active mass exploitation, with attackers using spray-and-pray techniques.
- Firmware version scanning by Kevin Beaumont found fewer than 10% of boxes patched as of the observation.
💥 BREACHES & INCIDENTS
- Pentagon DMDC breach exposed sensitive data of over 3 million people
The Pentagon confirmed a breach of a Defense Manpower Data Center system exposing sensitive personal data of more than three million people.- Affected individuals include active-duty and reserve service members, civilians, contractors, retirees, veterans, and family members — 2.76 million living people plus roughly 294,000 deceased.
- Exposed unencrypted records included names, Social Security numbers, dates of birth, contact details, sex, race, and military occupational specialties.
- A small number of unauthorized users exploited a vulnerability in a file-sharing system to access files on an affected server between October 2025 and July 2026 — roughly nine months before DMDC detected and patched the flaw on July 16.
- The Pentagon has not identified the intruders or their motive, and says there is currently no evidence the data has been misused.
- Notifications via breach letters dated September 18 offer one year of free credit monitoring and identity-restoration services through contractor IDX.
🕵️ RESEARCH & DEEP DIVES
- 31 Fake Russian-Language VPN Chrome Extensions With 356K Installs Hijack Browser Traffic
Researchers disclosed a cluster of 31 fake Russian-language VPN Chrome extensions routing user browser traffic through operator-controlled proxy servers.- Targets Chrome users seeking access to blocked services like RuTracker, YouTube, Telegram, ChatGPT, Netflix, Discord and Spotify; ~356,000 total installs, with RuTracker VPN alone at ~200,000.
- All 31 extensions share one codebase across three publisher accounts and request Chrome proxy permissions, webRequest handlers, and host access to all URLs.
- Extensions generate PAC scripts whose proxy target lists are downloaded remotely from GitHub Pages, Blogspot, a Google Doc, and a Telegram channel, letting operators reroute traffic without updates.
- Server lists are obfuscated with a Caesar shift over Base64; shared proxy credentials expire monthly, and a 299-rouble VIP service is sold via api.hhos.ru and mainapi.
- The 'Total VPN' variant routes all browser traffic, exposing connection metadata and unencrypted HTTP content; fallback hostnames de8.staticvaultcdn.org, de4.servefaststatic.work, and de34.rapidstaticserve.cc resemble Browsec premium server names.
Sources 📄 Source: riskyplugins.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
🔓 CVEs & KEV
CVE-2026-102422 — harborist shell-quote — CVSS 9.2 — shell-quote
quote()command injection via a line terminator in a token afte...CVE-2026-97024 — Red Hat Enterprise Linux 10 — CVSS 7.1 — Flatpak: flatpak: arbitrary write in root context via path traversal in deplo...