💥 BREACHES & INCIDENTS
Weak admin password '123456' linked to breach of 8.8M Danish CPR records at IT firm Pays
Hackers used weak passwords, including '123456', at Danish IT firm Pays to access and extract data on about 8.8 million CPR numbers from Denmark's civil registry.- Affects Danish citizens: ~8,749,975 CPR records exposed, covering about 5.5 million living and 3.3 million deceased people, including CPR numbers and addresses.
- Pays ApS, a two-person Odense IT firm with lawful CPR register access, confirmed its access was abused; at least three accounts, including the administrator account, used the password '123456'.
- Access began September 10 and lasted 21 days and 17 hours; the hacker allegedly used a leaked password from a former employee of another small Danish company, then built two custom programs to bulk-retrieve and store CPR data externally.
- The anonymous hacker told Politiken the intrusion was not difficult and claimed no plans to sell or publish the data; the National Special Crime Unit and Data Protection Agency are investigating.
- Danish authorities have warned that CPR numbers can no longer serve as sole identity verification, prompting pharmacies and healthcare providers to require MitID or health-card authentication.
Sources 📄 Source: politiken.dk · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)FBI confirms multiple arrests of ShinyHunters suspects in US, Jordan, and Netherlands
Law enforcement has arrested multiple suspected ShinyHunters members following the group's September hack of the FBI jobs website.- Suspects arrested include Saif al-Din Khader (alias 'Rey'), detained in Jordan on September 29 and reportedly cooperating with the FBI, and 24-year-old Pepijn van der Stap, arrested in Amsterdam by Dutch police on September 15 as an alleged group leader.
- A third suspect, a Canadian citizen, was arrested in Pennsylvania in connection with the breach of the FBI's jobs website, FBI Director Kash Patel said.
- ShinyHunters allegedly breached more than 140 organizations since last year and collected at least $70 million in extortion payments, often targeting third-party vendors and cloud platforms.
- The FBIJobs.gov hack exploited an Oracle PeopleSoft vulnerability; a contractor (reportedly at Accenture) had failed to apply a security patch, and the group claimed to steal 2-3 TB of FBI employee data.
- Khader is described by Krebs as the 'technical operator and public face' of Scattered LAPSUS$ Hunters, the group behind the costly Jaguar Land Rover breach.
The Gentlemen ransomware group claims breach of KFC; claim remains unverified
The Gentlemen ransomware group has listed KFC as a victim on its leak site, but the breach claim remains unverified.- KFC (kfc.com), the U.S.-based fast-food chain owned by Yum! Brands, was listed by The Gentlemen ransomware group on October 10, 2026.
- The listing shows KFC branding and business details but contains no stolen files, technical evidence, ransom demand, or proof of system compromise; Yum! Brands has not confirmed the incident.
- The Gentlemen, tracked by Sophos as GOLD SHERWOOD, is a ransomware-as-a-service operation using double extortion — stealing data before encryption and threatening publication.
- Sophos analysis of 15 intrusions found rapid privilege escalation, abuse of legitimate remote access tools, and disabling of EDR, backups, and Windows Defender, sometimes within 24 hours of initial compromise.
- Yum! Brands previously disclosed a separate ransomware incident in January 2023 that disrupted systems and temporarily closed fewer than 300 restaurants in one market.
Sources 📄 Source: ransomware.live · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
🕵️ RESEARCH & DEEP DIVES
Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read
Researchers found an arbitrary file read in Discourse's image pipeline via a TOCTOU race chained with Ghostscript and ImageMagick, plus a separate cache poisoning flaw enabling JavaScript execution for anonymous visitors.- Affects Discourse forum sites (22,000+ communities) running default configurations; the file read chain required only a Trust Level 0 account.
- The chain used a crafted file with JPEG XL identification bytes and PostScript content, a .pdf extension routing ImageMagick to Ghostscript, and a TOCTOU race replacing the temp file after FastImage's check.
- A padded JPEG slowed jpegoptim to ~25 seconds, widening the race window; ImageMagick's MSVG parser followed an MSL script that read a local file and returned it as a downloadable image.
- A separate flaw reflected the color_scheme_id cookie into HTML and cached it, letting attackers poison the anonymous cache and run JavaScript via a CSP bypass without authentication.
- Both issues were reported in June 2026 and patched; Discourse advisory CVE-2026-55420 lists fixed releases 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Sources 📄 Source: slcyber.io · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)Telegram Desktop IPC injection flaw (CVE-2026-107181) enables one-click file theft and account takeover
A public PoC demonstrates a Telegram Desktop flaw that lets a single clicked link steal arbitrary local files, including session files, enabling account takeover.- Affects Telegram Desktop through version 7.2.8 (demonstrated on Windows with 6.9.3); fixed in 7.2.9 via commit db3405699f; tracked as CVE-2026-107181, CVSS 4.0 8.6 / CVSS 3.1 8.1.
- The flaw allows arbitrary local file read and exfiltration to an attacker-controlled chat, including Telegram session files that enable account takeover when no local passcode is set.
- The attack works by injecting an unescaped semicolon record delimiter (CWE-143) into the single-instance IPC channel when a tg:// link is opened from outside the app, e.g. a browser.
- The injected command reaches an internal interpret: URI scheme, a legacy release-publishing helper that reads any file named in an instruction file and sends it to a channel without authorization or confirmation.
- The demonstrated chain depends on automatic group file downloads and permissive group-invite settings; links clicked inside Telegram are not affected, and no in-the-wild exploitation is confirmed as of October 9, 2026.
Google paid $90,000 for Flask session pickle RCE on developers.google.com
A researcher earned a $90,000 Google bounty for an unauthenticated RCE caused by a Flask session cookie signed with a secret embedded in the cookie itself.- Affects Google's shared DevSite platform, including developers.google.com, firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com
- The Flask session cookie contained a pickle holding Google's OAuth client_id and client_secret, and the same secret served as the Flask SECRET_KEY verifying the cookie signature
- With the signing key recovered, an attacker forges a session whose flow entry is passed to pickle.loads on the server, yielding unauthenticated code execution via the pickle REDUCE opcode
- The researcher proved RCE with time.sleep payloads showing response delays matching the requested seconds, using only two GET requests
- Reported Aug 6, 2026, accepted next day, fixed Oct 7, 2026; reward was a $75,000 base plus a 1.2x quality multiplier
HOMARD attack uses Arm SoC power sensors to leak DRAM data without timing
Researchers presented HOMARD, a side-channel attack that uses unprivileged power telemetry on modern Arm SoCs to recover DRAM mappings and data without timers.- Applies to modern Arm SoCs with unprivileged millisecond/milliampere-resolution power sensors, demonstrated on AMD ZCU102, Raspberry Pi 5, and NVIDIA Jetson TX2 (LPDDR4).
- HOMARD-RE reverse-engineers DRAM addressing functions from power alone, succeeding where row-buffer timing methods fail.
- HOMARD-DATA recovers Hamming weight of fetched cache lines via power rail templating; on the Pi 5 it classifies 9 Hamming-weight levels at 81.5% accuracy and recovers secret bytes in minutes.
- Attacks work via an architectural load or a mispredicted Spectre-RSB path where no value is architecturally read.
- Paper accepted at IEEE S&P 2027; artifacts published on Zenodo and GitHub.
Study: 16,977 flagged vulnerable HuggingFace models still used in 5,000+ open-source repos
A new arXiv study finds thousands of known-vulnerable HuggingFace models are actively adopted in open-source projects with no provenance verification or sanitization.- Researchers analyzed 16,977 vulnerable HuggingFace models flagged by InsightDB, including flaws like insecure serialization and architectural backdoors.
- 3,757 flagged models (22.1%) are actively referenced in over 21,000 code locations across more than 5,000 open-source GitHub repositories.
- Vulnerable models propagate through GitHub repos, software packages, fine-tuning chains, and deployed applications despite being publicly flagged.
- Analysis of usage patterns found no evidence of provenance verification or model sanitization; developers bypass security parameters or rely on permissive framework defaults.
- The study used Code Property Graph extraction with frequent subgraph mining to categorize recurring integration patterns.
Safety Graph framework shows ICS safety responses can become attack surfaces
Researchers introduced Safety Graph, a formal framework showing that safety responses in industrial control systems can open new attack surfaces enabling cascading IT-OT attacks.- Applies to industrial control systems (ICS) and operational technology (OT) environments, demonstrated on the Tennessee Eastman chemical process plant benchmark.
- Safety responses designed to mitigate OT failures can open new attack surfaces, expanding lateral movement