💥 BREACHES & INCIDENTS
- Leaked chats claim Silent Ransom Group extorted $206.95M from 27 firms without encryption
Leaked internal chat logs suggest Silent Ransom Group collected $206.95 million from 27 firms in about six months using data-theft-only extortion.- Leaked chats (5,692 messages, Aug 2025–Sep 2026) attribute $206.95M in 'GOLD' deals to Silent Ransom Group (Luna Moth/UNC3753), with payments ranging from $100,000 to $30 million; White & Case listed at the largest amount
- Law firms are the primary target — 42 of the group's 50 most recent victims were law firms — because they hold confidential client data
- The group skips encryption entirely: it poses as internal IT support by phone, tricks employees into granting remote access, then steals files using legitimate tools like WinSCP and Rclone
- The FBI has reported the gang recruiting 'agents' via Telegram to physically infiltrate victims' offices when remote attempts fail
- Payment figures are unverified; blockchain analysis found ~344 BTC (~$27M) through one collection wallet, supporting substantial money movement but not proving the headline total
Sources 📄 Source: databreaches.net · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
🕵️ RESEARCH & DEEP DIVES
GoBalance Flaw Lets Attackers Recover Tor Keys and Hijack Dark-Web .onion Addresses
A GoBalance bug lets attackers recover a dark-web site's .onion private key from public data and take over the address.- Affects GoBalance, a Go rewrite of Tor's Onionbalance shipped with the EndGame toolkit used by dark-web sites; original Onionbalance and Tor are not affected
- Only sites whose master key is stored in Tor's own key format are exposed; GoBalance's setup tool writes a safer format
- GoBalance passes only the first 32 bytes of the 64-byte Tor private key to the descriptor signer, making the signature nonce a fixed computable value; one published descriptor suffices to recover the long-term master key
- Dread forum's two .onion addresses were taken over October 5-7 and redirected to rival site Conclave; Omega market also confirmed takeover and moved to a new address
- No CVE or official fix as of October 9; an independent researcher published a patch and proof-of-concept key recovery
anatsa-google-play-pdf-reader — Cyber Security News
📋 ADVISORIES
Microsoft: outdated Windows devices will lose Windows Update access after 2027 certificate rotation
Microsoft says devices running unsupported Windows versions will stop receiving updates after Windows Update certificates expire in May and June 2027.- Applies to all Windows client and Server devices; devices on unsupported versions will lose access to Windows Update services and receive no updates.
- Certificates used to establish trusted connections to Windows Update expire on May 17, 2027 and June 19, 2027; replacement certificates are already delivered via security updates.
- Windows 11 25H2+ requires no action; Windows 11 24H2 and Server 2025 need the September 2025 update or later before June 19, 2027.
- Other supported Windows 11/10 and Server 2022 need the July 2026 update or later before June 19, 2027; Windows 10 Enterprise 2019 LTSC, Server 2019, and Server 2016 need it before May 17, 2027.
- The change does not apply to devices receiving updates via WSUS.
Sources 📄 Source: techcommunity.microsoft.com · 📎 Coverage: windowsforum.com · 👁 via BleepingComputerMicrosoft urges PKI, HSM and appliance testing ahead of post-quantum authentication
Microsoft is urging organizations to begin testing their certificate ecosystems now for the shift to post-quantum authentication.- Applies to organizations relying on PKI, certificates, trust anchors, HSMs, security appliances, embedded/OT devices, and third-party services that issue, validate, or depend on certificates.
- New post-quantum algorithms and larger certificate chains can affect handshake size, performance, storage, transmission, and network inspection limits; no vulnerability or attack is involved — this is an infrastructure readiness challenge.
- Microsoft's PQC TLS Pilot Program (launched August 27, 2026) lets approved CAs test ML-DSA-87 certificate roots in closed environments; pilot roots come from ComSign, DigiCert, HARICA, IdenTrust Services, Sectigo, Shanghai Electronic Certification Authority, and SSL.com.
- Pilot certificates are not publicly trusted and are excluded from production trust, public-facing websites, the Common CA Database, and Certificate Transparency logs.
- On Windows 11, testing begins with July 28, 2026 updates: KB5101681 (26H1, Build 28000.2608) and KB5101684 (25H2, Builds 26200.8973/26100.8973), with ML-DSA support via Schannel in supported scenarios.
VirusTotal adds daily public IPv4 internet scanning to expose C2 servers and malware infrastructure
VirusTotal has added daily scanning of the public IPv4 space to help security teams find C2 servers and track malware infrastructure.- Applies to VirusTotal users, with port data available via API records and history endpoints but not yet IP Livehunt rules
- New data records exposed services, port activity, banners, SSH host keys, RDP fingerprints, HTTP headers, and inferred OS details alongside existing threat intelligence
- A new Ports tab lists open, closed, and recently closed ports with service names, software versions, and timestamps, and historical records show when a suspected C2 service was last online
- Searches via web interface and API, e.g. entity:ip open_port:22, with bracket syntax tying conditions to specific ports
- Case studies include APT28/Havoc-linked hosts sharing the b4ck.my certificate, a NOX/BOMBAY Stealer panel at 5.175.221[.]206:8443, and over 1.5 million hosts answering on Cobalt Strike's default team server port
Sources 📄 Source: blog.virustotal.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)Microsoft urges testing PKI, HSMs and appliances for post-quantum authentication readiness
Microsoft has published guidance urging organizations to start testing their certificate ecosystems for post-quantum authentication now.- Applies to enterprises relying on PKI, certificate authorities, HSMs, security appliances, embedded devices, OT, and custom applications that validate certificates.
- Post-quantum certificates and larger certificate chains can affect handshake size, performance, storage, transmission, and network inspection limits.
- Older PKI deployments and hardware-backed trust systems may have fixed cryptographic assumptions that only surface during testing.
- Microsoft launched its PQC TLS Pilot Program on August 27, 2026, letting approved CAs in the Microsoft Trusted Root Program test PQC TLS roots and certificate issuance.
- Microsoft recommends inventorying certificate dependencies, assessing vendor roadmaps, identifying long-lived infrastructure, and building non-production test environments.
🔓 CVEs & KEV
CVE-2026-103692 — WPScan Frontend Dashboard — CVSS 9.8 — Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via A...
CVE-2026-103646 — WPScan Ultimate Multisite — CVSS 9.8 — Ultimate Multisite before 2.17.0 - Unauthenticated Authentication Bypass via 'emai...
CVE-2026-23870 — Facebook React-Server-Dom-Parcel — CVSS 7.5 — React Server Components Flaw Lets Attackers Freeze Next.js Servers With a Single POST Request
CVE-2026-86828 — WPScan BackWPup — CVSS 6.6 — BackWPup before 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip FallbackTh...
ONE-LINERS
📄 Source for Unpatched AhsayCBS Flaws CVE-2026-105133, CVE-2026-105134 Exploited in the Wild — securityweek.com
📄 Source for PoC released for Telegram Desktop flaw CVE-2026-107181 enabling one-click file theft and account takeover — beaksec.github.io
📄 Source for Public PoC for Telegram Desktop flaw CVE-2026-107181 enables one-click file theft and account takeover — beaksec.github.io
📄 Source for Kubio AI Page Builder plugin <= 2.9.3 vulnerable to reflected XSS (CVE-2026-94167) — patchstack.com
📄 Source for Anthropic Launches OSS Scanner, Free AI Vulnerability Scans for Opt-in Open Source Projects — anthropic.com