🕵️ RESEARCH & DEEP DIVES
Norway fines Microsoft's Xandr $9.6M for unlawfully sharing Grindr user data
Norway's Data Protection Authority fined Microsoft-owned adtech firm Xandr NOK 92 million ($9.6M) for unlawfully sharing sensitive Grindr user data with advertisers.- Applies to Grindr users in Norway and other countries whose data was processed via Xandr's real-time ad auctions between July 2018 and April 2020.
- Sensitive data, including information revealing sexual orientation, was relayed to potentially thousands of advertisers without explicit user consent.
- Xandr ran real-time advertising auctions inside Grindr, passing profiling data to advertisers who bid to show targeted ads hidden from users.
- Xandr assumed Grindr had obtained valid consent but never verified it or ensured a legal basis for its own processing; it was a joint controller with Grindr at the time.
- The record fine — Datatilsynet's largest ever — stemmed from a January 2020 complaint by noyb and the Norwegian Consumer Council; Xandr has three weeks to appeal.
Max-severity SSRF flaw CVE-2026-102255 in SonicWall SMA1000 appliances now exploited in attacks
Attackers are actively exploiting a maximum-severity SSRF vulnerability (CVE-2026-102255) in SonicWall SMA1000 appliances just days after it was patched.- Affects the Appliance WorkPlace interface on SonicWall SMA1000 6210, 7210, and 8200v models; SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected.
- CVE-2026-102255 is a CVSS 10 server-side request forgery flaw caused by an unintended alternate access path, exploitable by remote unauthenticated attackers in low-complexity attacks.
- Exploitation lets attackers make the appliance issue requests on their behalf, reaching internal services not normally internet-accessible; successful exploitation gives control of the WorkPlace interface.
- Previdian and Defused observed unauthenticated SSRF exploitation attempts on honeypots starting Oct 8-9, three days after SonicWall's Oct 6 advisory and hotfix; observed payloads used crafted OPTIONS requests targeting the internal CouchDB service at 127.0.0.1:5984 with admin:admin credentials.
- Shadowserver tracks over 400 internet-exposed SMA1000 appliances; the devices are widely used by government agencies, MSSPs, and large corporations for VPN access.
Flock authorized by CISA as CVE Numbering Authority for its own surveillance products
Flock has been authorized by CISA as a CVE Numbering Authority, letting it assign CVE IDs to vulnerabilities in its own products, drawing criticism from security experts.- Applies to Flock-branded hardware and software, including license plate readers, AI cameras, and gunshot detection, used by 5,000+ law enforcement agencies and 6,000+ communities.
- As a CNA, Flock can now assign CVE IDs and publish CVE records for vulnerabilities in its own products, joining more than 550 CNAs.
- Critics including Katie Moussouris warn Flock's policy reserves the right to withhold publication if disclosure is deemed a safety risk, raising conflict-of-interest concerns.
- Flock previously downplayed researcher-reported defects in its license-plate reader and gunshot detection system as requiring physical access, and its advisories page still shows no published advisories.
- Flock's disclosure policy bans testing against live customer deployments, physical attacks, DoS testing, and social engineering, and it runs no paid bug bounty.
CVE-2026-108938: code-projects Matrimonial System 1.0 exposes db/matrimony.sql file remotely
A medium-severity flaw in code-projects Matrimonial System 1.0 allows remote access to the db/matrimony.sql file, and a public exploit exists.- Affects code-projects Matrimonial System version 1.0, a PHP/MySQL web application
- Processing of the file db/matrimony.sql makes files or directories directly accessible (CWE-552, CWE-425)
- The attack can be initiated remotely without privileges or user interaction; CVSS 4.0 score 6.9 (medium), low confidentiality impact
- A public exploit has been published on GitHub and may be used; no fix is reported
- CVE-2026-108938 was published 2026-10-12 by VulDB; related SQL injection flaws CVE-2026-92926 and CVE-2026-101105 affect the same product
🕵️ RESEARCH & DEEP DIVES
• IBM Aspera Enterprise Webapps Information DisclosureIBM Aspera Enterprise Web... (5) — CVE ThreatInt
• IBM Aspera Enterprise Webapps Denial of ServiceIBM Aspera Enterprise WebApps ... (5) — CVE ThreatInt
• IBM Aspera Enterprise Webapps Execution with Unnecessary PrivilegesIBM Aspera... (5) — CVE ThreatInt
• IBM Aspera Enterprise Webapps Untrusted Search PathIBM Aspera Enterprise WebA... (5) — CVE ThreatInt
• Security Vulnerability identified in IBM TRIRIGA - XXEIBM TRIRIGA Application... (5) — CVE ThreatInt
• Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in ... (5) — CVE ThreatInt
• Security Vulnerability identified in IBM TRIRIGA - Zip SlipIBM TRIRIGA Applic... (5) — CVE ThreatInt
• code-projects Online Ticket Reservation System medallion.sql file information... (5) — CVE ThreatInt
• IBM Planning Analytics Local is affected by security vulnerabilitiesIBM Plann... (5) — CVE ThreatInt
• Edimax BR-6208AC QoS Page formQoS cross site scriptingA security vulnerabilit... (5) — CVE ThreatInt
• GuardDuty Extended Threat Detection has added five new indicators to surface attack sequences (5) — AWS Security Blog
• Quantum-resistant signing on AWS, Part 2: Enforce your ML-DSA algorithm policy with SCPs and IAM (5) — AWS Security Blog
• Quantum-resistant signing on AWS, Part 1: Build a software supply chain with ML-DSA (5) — AWS Security Blog
• 117430352051581601 (5) — @GossiTheDog@cyberplace.social
• RE: https:// techhub.social/@Techmeme/11743 0147242479675 Anthropic’s claims here have absolutely no basis in reality. (5) — @GossiTheDog@cyberplace.social
• I’m going to have to do a thread about this ‘AI cyber attack’ on Japan, aren’t I. (5) — @GossiTheDog@cyberplace.social
• LinkedIn’s absolutely awash with security vendors posting brain-dead takes on the fridge thing as they have no idea, at... (5) — @GossiTheDog@cyberplace.social
• CVE-2025-71429: GPT-SoVITS OS Command Injection: Unauthenticated Remote Code Execution via UVR5 WebUI (5) — thehackerwire.com (discovered)
• CVE-2026-87744: Quarkus REST Data Panache Flaw Permits Unauthenticated Security Bypass (5) — thehackerwire.com (discovered)
📋 ADVISORIES
- 📄 Source for IBM DataStage on Cloud Pak for Data hit by multiple path traversal flaws, some CVSS 9.6 — ibm.com