💥 BREACHES & INCIDENTS
- Advantest confirms personal data stolen in February ransomware attack
Advantest has confirmed that a February 2026 ransomware attack resulted in the theft of personally identifiable information.- Affects individuals notified by Advantest America, Inc., the US arm of the Japanese semiconductor test equipment maker; whether victims are customers, employees, or partners is unclear.
- Exposed data includes contact information, dates of birth, SSNs, national ID and driver's license numbers, passport numbers, medical and financial information; no passwords were exposed.
- Attackers breached Advantest's network on February 15, 2026 (California AG filing lists January 23, 2026) and deployed ransomware, extracting data from servers; initial access vector undisclosed.
- No ransomware group has publicly claimed the attack, and Advantest says it has no evidence the data has been leaked or misused; notification letters dated October 6, 2026, roughly eight months after detection.
- Affected individuals are offered 18 months of Kroll identity theft, credit, and web monitoring, with enrollment open until January 4, 2027.
🕵️ RESEARCH & DEEP DIVES
Dutch researchers find 8,547 European wind and solar systems exposed online
Dutch researchers identified thousands of internet-exposed wind and solar power systems across Europe.- Applies to wind farm and solar park operators across 35 European countries.
- Modat and NCSC-NL found 8,547 internet-exposed systems: 7,942 linked to solar parks and 605 to wind farms.
- Exposed systems include administrative pages, login interfaces, and operational panels showing production data or equipment controls.
- Researchers estimated around 181 sites could potentially be fully remotely controlled, with one example showing live turbine data and Start/Stop/Reset controls.
- Spain had the most exposed solar systems (2,766), followed by Greece (1,860); Germany led wind exposure (212), then Italy (192).
Sources 📄 Source: reuters.com · 📎 Coverage: analyticsinsight.net · 👁 via @metacurity@infosec.exchangeCERT-UA: 100+ compromised websites push LunexStealer via fake Cloudflare checks
Ukraine's CERT-UA has identified over 100 compromised websites serving the LunexStealer infostealer via fake Cloudflare verification pages.- Affects Windows users visiting 100+ compromised websites, mostly in Ukraine; campaign attributed to threat cluster UAC-0277 and observed in September 2026.
- Injected JavaScript shows a fake Cloudflare 'I'm not a robot' page prompting users to run a command (ClickFix), which downloads and installs a malicious MSI package.
- Scripts use EtherHiding, reading the payload domain and operating mode from a smart contract on the Polygon or Ethereum blockchain; the fake page targets search-engine referrals and appears at most twice per 12 hours.
- Three MSI variants exist: direct install, BYOVD abuse of the vulnerable AMD driver PDFWKRNL.sys (CVE-2023-20598) to bypass UAC and add Defender exclusions, and DLL sideloading via FnHotkeyUtility.exe loading spkvol.dll.
- LunexStealer steals credentials, cookies, and crypto wallets, and installs the LUNARAXE browser extension (disguised as 'Microsoft Office Word Editor') plus the NAIVEMESS PowerShell helper for file system access.
Partisan Zmiy Hides Vasilek Backdoor in VMware Tools to Spy on Medical Organization
Solar 4RAYS found the Partisan Zmiy group hid the Telegram-controlled Vasilek backdoor inside a medical organization's VMware Tools directory for about two years.- Targets: a medical organization with two-way trust relationships to subsidiary medical institutions; earliest compromise evidence dates to early 2024, with access maintained until discovery in December 2025.
- What was used: Vasilek v1.5.8, a 32-bit Windows backdoor with 59 commands (shell execution, file transfers, keylogging, screenshots, clipboard collection, mouse control), plus GOST tunnels, DNSCat2, PartisanDNS, and a GOST-3proxy chain.
- How it hid: attackers abused a legitimately installed but unused VMware Tools directory, replacing the signed vmtools.dll with an unsigned Vasilek library (original kept as vmtoolsd.dll) and running an undocumented loader, authd.exe, as the 'VMware Auth Adapter' service.
- How it worked: commands arrived via Telegram group messages through the public Bot API; payloads ran on tight schedules (one GOST tunnel Saturdays 22:00-23:00, others eight hours after service start), and Vasilek checked a salted SHA-256 hostname hash before activating.
- Attribution to Partisan Zmiy (Cyber Partisans) rests on Vasilek malware, overlapping infrastructure, and known tactics; observed domains included c0ce[.]org, p7cp[.]org, w3a01[.]net, f91j[.]org, and gov-by[.]com.
California OES reports uptick in cybersecurity activity after Trump's Iran remarks
California's Office of Emergency Services detected an uptick in concerning cybersecurity activity and threat intelligence following Trump's comments suggesting Iran could 'take out' Los Angeles and San Diego.- Applies to California state infrastructure and residents of Los Angeles, San Diego, and surrounding areas.
- Cal OES detected an increase in concerning cybersecurity activity and threat intelligence the morning after Trump's rally remarks.
- Gov. Newsom directed the State Threat Assessment Center to shift to real-time geopolitical intelligence monitoring, scanning for Iranian state-sponsored propaganda, foreign intelligence chatter, and extremist communications.
- The state operations center was activated; Cal OES says there are currently no confirmed threats.
- White House communications director Steven Cheung says the president's comments were misinterpreted by the media.
Sources 📄 Source: news.caloes.ca.gov · 📎 Coverage: washingtonsun.com · 👁 via @metacurity@infosec.exchange
📋 ADVISORIES
OpenSSH 10.6 fixes plaintext recovery, file write and shell injection flaws, adds post-quantum signatures
OpenSSH 10.6, released October 6, 2026, fixes multiple security flaws and disables LZ77 compression to mitigate a plaintext recovery side-channel attack.- Applies to administrators and users of OpenSSH ssh, sshd, sftp, ssh-keygen and ssh-agent for remote access and file transfers.
- Fixes a chosen-plaintext side-channel (arXiv paper by Fabian Bäumer and Marcus Brinkmann) where LZ77's shared compression dictionary across SSH channels lets an attacker recover secrets from one channel via ciphertext length changes; an 8-character secret was recoverable in at most 276 guesses in tests.
- Disables the LZ77 dictionary coder in ssh and sshd, making the Compression option less effective; also fixes SFTP path validation (malicious server could write outside target directory via recursive copy) and blocks '$' and '' in command-line usernames to prevent shell injection via ProxyCommand or Match exec.
- Other fixes: GSSAPI credentials now stored only after successful authentication, oversized decompressed packets blocked, ssh-keygen DST handling corrected, and GatewayPorts/StreamLocalForwarding disabled on platforms like QNX 6 and SCO OpenServer 5 where root is retained post-auth.
- Enables hybrid post-quantum signature algorithm ssh-mldsa44-ed25519 (experimental keys must be regenerated), increases default KDF rounds from 24 to 32, begins deprecating scp -R, and moves to more frequent releases due to AI-assisted bug reports.
Veeam patches critical RCE flaw CVE-2025-64393 and three other bugs in Backup & Replication 12.3.2 P4
Veeam has released Backup & Replication 12.3.2 P4 (build 12.3.2.4934) fixing four vulnerabilities including a critical 9.4 CVSS RCE flaw.- Affects Veeam Backup & Replication 12.3.2 P3 (build 12.3.2.4854) and all earlier version 12 builds; version 13 is not affected (except CVE-2026-58069, which affects some version 13 builds).
- CVE-2025-64393 (CVSS 4.0: 9.4, critical): a low-privileged user with the Backup Viewer role can achieve remote code execution on the Veeam Backup Server via insecure deserialization of untrusted data received through the Mount Service; no user interaction required.
- CVE-2025-64392 (CVSS 4.8): reflected XSS in Veeam Backup Enterprise Manager executes script in the browser of an authenticated portal user who opens a crafted link.
- CVE-2026-93026 (CVSS 6.1): an authenticated Backup Viewer user can modify or delete the Enterprise Manager master key and read or overwrite stored antivirus update credentials.
- CVE-2026-58069 (CVSS 8.3): an authenticated Veeam Cloud Connect tenant can read arbitrary files on the service provider host; all flaws were reported via HackerOne, with no confirmed exploitation in the wild.
OpenSSH 10.6 fixes compression side-channel, SFTP path and username injection flaws
OpenSSH 10.6, released October 6, 2026, patches multiple security flaws including the first compression side-channel attack against SSH.- Applies to OpenSSH client and server (ssh, sshd, sftp, scp) users; OpenSSH before 10.6 is affected.
- LZ77 compression shares a dictionary across multiplexed SSH channels, enabling the 'Crossing the Streams' chosen-plaintext attack to recover secrets from ciphertext length leaks; 10.6 disables the LZ77 dictionary coder in ssh and sshd.
- SFTP client now strictly validates server-returned paths, blocking malicious servers from steering recursive copies to write outside the target directory.
- ssh(1) now rejects '$' and '' in command-line usernames to prevent shell injection via ProxyCommand or Match exec; config-file usernames are exempt.
- Other fixes: GSSAPI credentials stored only after successful auth, compressed payload length cap enforcement, authorized_keys restrict applied to tunnel forwarding, and scp -R deprecation begun.
🔓 CVEs & KEV
- <https://www.thehackerwire.com/cve-2026-79798