🚨 ACTIVE EXPLOITATION
- (no items)
💥 BREACHES & INCIDENTS
Attackers hijack .gh, .sl, .as ccTLD registries to mint unauthorized TLS certificates for Google domains
Attackers hijacked the .gh, .sl and .as country-code domain registries and used DNS control to obtain unauthorized HTTPS certificates for Google and other major organizations.- Any domain under .gh (Ghana), .sl (Sierra Leone) or .as (American Samoa) was at risk; Google's own systems were not breached and the issuing CAs did nothing wrong.
- Attackers modified authoritative DNS records to pass domain control validation and obtain certificates for google.com.gh, google.sl, google.as and other Google/YouTube names, plus domains of other large global brands.
- Certificate Transparency logs show at least 12 domain-validated certificates issued September 22-27, 2026 — 11 by Let's Encrypt, one by ZeroSSL — all since revoked.
- Chrome blocked the unauthorized certificates automatically via CRLSets; Google also worked with CAs to revoke them for non-Chrome users.
- Google says it cannot guarantee every affected domain was identified, and Chrome's blocks do not reliably protect users of other browsers.
Sources 📄 Source: blog.google · 📎 Coverage: thehackernews.com · 👁 via The Hacker News, Cyber Security NewsDiscord bot Double Counter breach exposes data on ~28M users via Metabase flaw
Discord security bot Double Counter disclosed an October 4, 2026 breach that exposed data on roughly 28 million Discord users after attackers exploited a Metabase flaw on an old server.- Affects users of Double Counter, a Discord security bot used in more than 600,000 communities; Discord itself was not compromised.
- Exposed data includes ~28 million Discord IDs and usernames, ~27 million IP-address and location records, ~25 million user-agent hashes, and ~1 million unique email addresses; passwords and card numbers were not exposed.
- The attacker entered through a disconnected OVH server still running a publicly reachable Metabase analytics tool, forging an admin session to steal cloud service-account keys and an administrator's saved CLI session.
- Using valid identities, the attacker exported ~12 GB of database records, stole the Discord bot token via a container shell, and posted unwanted invitations across roughly 50 large servers; a stolen Stripe key enabled $7,316 in fraudulent charges.
- Have I Been Pwned lists ~275,000 unique email addresses in the publicly released data; the attack was contained and service restored at 19:19 the same day.
Sources 📄 Source: doublecounter.gg · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)FBI and French authorities seize NudeLeaksTeens, NLTVIDS deepfake CSAM websites, arrest alleged admin
The FBI and French authorities have seized two websites selling child sexual abuse material and AI deepfakes and arrested a suspected administrator.- The seized sites, NudeLeaksTeens and NLTVIDS, advertised hacked, leaked and stolen CSAM of young girls along with AI-generated deepfake content
- A 25-year-old French resident suspected of being the primary administrator was arrested by the French Paris Prosecutor's Office cybercrime division
- Material was recorded or stolen from victims' Snapchat, TikTok, Instagram and Facebook accounts, with several victims reporting their accounts were hacked
- One site had its own currency; a 189GB collection covering 315 girls sold for $64.90, and administrators encouraged cryptocurrency payments
- The seizure warrant was filed Oct. 2 in the Eastern District of Virginia, and the FBI executed a search warrant on domain registry VeriSign
🔓 CVEs & KEV
CVE-2026-102255 — SonicWall SMA1000 — CVSS 10.0 — Pre-authentication SSRF in SMA1000 Appliance Enables Internal Network Access
CVE-2026-95606 — Liquid Web / StellarWP The Events Calendar — CVSS 9.8 — WordPress The Events Calendar plugin through 6.17.4 - PHP Object Injection vulnera...
CVE-2026-76486 — Cisco NX-OS Software — CVSS 9.8 — Cisco NX-OS NGOAM RCE/DoS via Crafted VXLAN OAM Packets
CVE-2026-76485 — Cisco NX-OS Software — CVSS 9.8 — Cisco NX-OS NGOAM RCE: Unauthenticated Remote Root Code Execution or DoS
CVE-2026-76501 — Cisco NX-OS Software — CVSS 9.8 — Cisco NX-OS NGOAM SRv6 RCE: Unauthenticated Remote Root Exploit
CVE-2026-95605 — Passionate Programmer Peter WP Data Access — CVSS 9.3 — WordPress WP Data Access plugin through 5.5.82 - SQL Injection vulnerabilityImprop...
CVE-2026-107204 — LMCache — CVSS 9.3 — Critical LMCache RCE Exposes Systems to Unauthenticated Python Code Execution
CVE-2026-107206 — LMCache — CVSS 8.8 — LMCache Unauthenticated Access Exposes Credentials and Enables Cache Manipulation
CVE-2026-92543 — Docker Engine — CVSS 7.6 — Docker Engine insecure-registry fallback via malicious DNS responsesDocker En...
🕵️ RESEARCH & DEEP DIVES
MALFEX npm supply-chain campaign: 8 malicious packages with 40,767 downloads deliver Overlord RAT and stealer
Researchers disclosed MALFEX, a three-year npm supply-chain campaign by a single operator whose eight malicious packages, downloaded 40,767 times, deliver the Overlord RAT and credential stealers to Windows systems.- Applies to Windows developers and users of npm packages; three malicious packages — function-flag, function-color, and cdn-img-fetch — remained live and installable as of late September 2026.
- Malware delivered via three paths: an Overlord Go RAT loader, the movinlike Node.js stealer targeting Discord, browsers, Telegram, and crypto wallets, and a downloader hidden in function-flag.
- Attack runs through npm preinstall/postinstall lifecycle hooks, fetching payloads from hosts like api.imghippo.com and cdnzona.discloud.app; Overlord uses a Solana blockchain C2 resolver, and stolen data is exfiltrated via a Discord webhook.
- function-flag has been malicious since July 2025 with no advisory, accounting for 37,419 of 40,767 downloads; the operator self-identifies via the 'malfexteam2027' key and Portuguese-language artifacts.
- Twelve packages published since August 2023 under handles like malfexkkj and malfex_user; five carry OSV advisories (MAL-2026-16383/16384/16385, 17216, 17218, 17320), but coverage is incomplete.
Hackers used open-source AI tool ARTEX to breach 7 South Korean financial firms, exposing 68,000 people's data
An unknown, likely financially motivated Chinese-speaking threat actor used the open-source agentic pentesting tool ARTEX to breach at least seven South Korean financial firms and steal personal data of 68,000 people.- Targets included Shinhan Bank (25,000 customers affected), Kookmin Bank (119,000 clients' credit card data exposed), and Hana Bank, whose sales-support system was compromised.
- Stolen data included customer and employee personal information such as annual income figures and personal-loan limits.
- ARTEX is a free open-source agentic penetration-testing tool developed by Chinese engineer Li Puhua (alias Autumn); it calls external AI models including Anthropic Opus, OpenAI GPT, and DeepSeek to autonomously run reconnaissance, find vulnerable login endpoints, and launch attacks.
- CrowdStrike found Claude Code session histories, ARTEX configuration files, and Claude memory files on threat actor-controlled open directories; activity ran late September to early October 2026.
- Attacks targeted externally exposed auxiliary services (employee systems, loan recruiter sites, query services) rather than core banking, routing through ~20-25 IP addresses across 10+ countries including the US, Japan, and Germany; South Korea's National Police Agency has opened an investigation.
Microsoft FORGE Lab: AI-driven research found 140 Windows CVEs and 155 open-source vulns since May
Microsoft's FORGE Lab detailed how its agentic AI vulnerability research scaled across Windows, the Linux kernel, and open-source projects.- Applies to Windows, the Linux kernel, and 23 widely used open-source projects; findings flow through MSRC and the Linux Foundation's Akrites initiative.
- From May to September 2026, FORGE's agentic discovery produced 140 Windows CVEs (52 in September's Patch Tuesday alone) and 155 internally validated open-source reports.
- One Linux report became the first Akrites submission to result in a patch merged into the Linux kernel.
- Work is orchestrated by MDASH, a multi-model agentic scanning harness; project-specific PoV/PoC generators and AST-based deduplication cut duplicate findings by about 45%.
- Key lesson: the bottleneck shifts from discovery to validation and remediation — reports arriving faster than reviewers can resolve them create growing queues rather than more shipped fixes.
📋 ADVISORIES
- 📌 4 | *Outlook to block .msix and .msix