💥 BREACHES & INCIDENTS
Meta: Hackers Stole Code and Personal Data of 1,500 People in GitHub Breach
Hackers used an employee's stolen credentials to access Meta's GitHub repositories, stealing source code and personal data of roughly 1,500 people.- Meta is notifying about 1,500 people, mostly US employees, whose personal information was exposed in a breach of its GitHub repositories.
- 99% of the stolen data was business data (software code for Meta products); the remaining 1% was personal data mistakenly stored in repositories, contrary to company policy.
- An outside group gained access using an employee's stolen credentials; Meta detected the intrusion, cut off attacker access, and involved GitHub and law enforcement.
- Meta says it does not believe the hackers were specifically after its data, and some apparent personal data was synthetic or anonymized test data.
- Meta rotated secrets found in the affected repositories and added controls to detect user data uploaded to GitHub by mistake; affected individuals are being offered credit and dark web monitoring.
UK Housing Ombudsman Service hit by third-party cyberattack on case management system
The UK Housing Ombudsman Service is investigating a third-party IT security incident that took its case management system offline.- Affects social housing residents, leaseholders, and landlords in England who use the Housing Ombudsman Service's complaint system
- The incident, at an external supplier, impacted the case management system; residents cannot submit new complaints, view existing ones, or use webchat or webform
- The service says the incident has been contained and it is investigating whether any personal information was affected
- The watchdog has notified the UK Information Commissioner's Office and warned residents to be wary of scams and unsolicited messages
Sources 📄 Source: housing-ombudsman.org.uk · 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputerDanfoss refrigeration hack: 4,980 hosts exposed, over half in France
Thousands of Danfoss refrigeration controllers are internet-exposed following a cyberattack that defrosted French supermarket freezers.- Affects Danfoss AK-SM 800A and AK-SC refrigeration controllers used in supermarkets, cold-storage facilities, and warehouses; CERT-FR confirmed numerous compromises in an October 12 alert.
- Shodan found 4,980 internet-facing hosts with Danfoss web pages: 2,911 in France (58%), 517 in South Africa, 171 in Germany, 158 in Portugal, 141 in the US; roughly 8 in 10 are in Europe.
- Attackers remotely triggered defrost functions at French supermarkets (Intermarché, Coopérative U, Leclerc) overnight October 11-12, spoiling chilled and frozen goods, with reports of temperatures reaching 50°C.
- Claroty Team82 found a hidden 'code-of-the-day' authentication bypass (CVE-2025-41450, fixed in R4.2) generating a daily code from the controller's date, plus command injection (CVE-2025-41451) and Nginx config injection (CVE-2025-41452), both fixed in R4.3.1.
- Thousands of exposed management interfaces were found via Shodan and Censys; Danfoss says affected systems ran outdated firmware, and a claim circulated that affected systems used username 'admin' with a daily date-based password.
Sources 📄 Source: cert.ssi.gouv.fr · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
🔓 CVEs & KEV
CVE-2026-110130 — Finsys dockhand — CVSS 10.0 — Dockhand before 1.0.45 Authentication Bypass via Static-Asset CheckDockhand b...
CVE-2026-94603 — podman-container-tools podman — CVSS 10.0 — Podman Checkpoint Annotation Bypass Enables Container Sandbox Escape
CVE-2026-110112 — Finsys dockhand — CVSS 9.2 — Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Vali...
CVE-2026-110255 — Finsys dockhand — CVSS 8.4 — Dockhand before 1.0.43 SSRF via /api/templates/compose EndpointFinsys Dockhan...
CVE-2026-110111 — vatesfr xen-orchestra — CVSS 7.7 — Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm...
CVE-2026-86063 — anthropics claude-code — CVSS 7.5 — Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningClaude Code ...
CVE-2026-110256 — Finsys dockhand — CVSS 6.3 — Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth...
🕵️ RESEARCH & DEEP DIVES
- French police shut down Reacher/Stryx stolen-data lookup sites, arrest three 17-year-old admins
French authorities have taken down the Reacher/Stryx data lookup platforms and charged three teenage administrators.- French authorities arrested three 17-year-old administrators of the Reacher/Stryx stolen-data lookup platform on October 7, 2026, following an operation by the Paris prosecutor's cybercrime section and OFAC.
- The service, launched in March 2026 as Reacher and rebranded Stryx in June, aggregated personal data from various breaches and offered it free or via paid subscriptions.
- Users could search by name, date of birth, phone number, IBAN, or vehicle registration; the site claimed 730 million indexed rows and 3.1 million queries.
- The three suspects face charges of fraudulent data extraction and possession/transmission of stolen data as an organized group, with trial set for January 14, 2027, and up to 10 years in prison.
- The investigation opened in May 2026 after a report by the e-enfance association; it is the second 'lookup' site case prosecuted by the Paris cybercrime section this year.
Sources 📄 Source: tribunal-de-paris.justice.fr · 📎 Coverage: mastodon.social · 👁 via @campuscodi@mastodon.social
📋 ADVISORIES
Adobe Patches 140 Vulnerabilities Across 10 Products Including ColdFusion, Photoshop and Commerce
Adobe has patched roughly 140 vulnerabilities across 10 products in its October 2026 updates.- Affects Adobe Commerce, Photoshop, ColdFusion, Substance 3D, Dimension, FrameMaker, Bridge and Content Credentials SDK users.
- ColdFusion updates fix 32 vulnerabilities including critical code execution and privilege escalation bugs; Content Credentials SDK received 30 fixes, many for security feature bypass.
- Photoshop got 18 fixes (nearly all arbitrary code execution), Substance 3D Stager 16 fixes, and Commerce 11 fixes including several critical unauthenticated code execution and privilege escalation flaws.
- Adobe says it is not aware of any in-the-wild exploitation; Commerce is the only product rated priority 2, as threat actors have historically targeted it.
- Adobe credits frontier AI models used to hunt flaws in its own code for the higher fix volume, and has moved to a twice-monthly patch schedule (second and fourth Tuesdays).
Docker Fixes Critical Two-Year-Old Docker Hub Flaw (CVE-2026-105445) That Let Tokens Act as Other Users
Docker fixed a critical Docker Hub flaw, dubbed GhostPat, in which converting a personal account to an organization transferred its personal access tokens to the named owner, letting another user act as that owner at the registry.- Affects Docker Hub users who converted personal accounts into organizations between August 26, 2024 and the September 30, 2026 fix; tracked as CVE-2026-105445 with CVSS 4.0 score of 9.4.
- Account conversion changed the owner recorded for each personal access token without notifying the named owner, so a token created by an attacker worked at the registry as that owner.
- Within the token's permission level, a transferred token could pull, push, or delete images in the owner's repositories and organizations, including publishing images under a legitimate name.
- Docker reviewed ~304,000 pushes made with transferred tokens and found no evidence of exploitation; it deactivated identified transferred tokens on October 8 and emailed affected users on October 2.
- Discovered by Peter Molnar and Krisztian Hozak of mptrdev.com; Docker deployed the fix less than four hours after their report.
CERT/CC: Shopware 6.7 media upload XSS (CVE-2026-104937) enables admin token theft and RCE
CERT/CC published a vulnerability note describing a stored XSS in Shopware 6.7's media upload that can lead to admin token theft and remote code execution.- Affects Shopware 6.7 (CVE-2026-104937, VU#157374); no patch is available and the vendor could not be reached for coordination.
- The media upload API accepts HTML files that are served as text/html without effective Content-Security-Policy or X-Content-Type-Options headers.
- An attacker with media upload access embeds JavaScript in an uploaded HTML file; when an admin opens the media URL, the script exfiltrates the admin authentication token.
- Stolen tokens grant privileged access to the Shopware Administration API; with extension-management privileges, attackers can install malicious plugins for arbitrary PHP code execution as the Shopware process.
- Reported by Deflask13; published 2026-10-13.
⚠️ 5 | *Microsoft's October 2026 Patch Tuesday fixes 1,118 vulnerabilities and debuts 'risk cohorts'