🚨 ACTIVE EXPLOITATION
Ledger confirms spy chip implant in wallets sold via reseller CryptoBilis behind crypto thefts
Ledger has confirmed that some of its hardware wallets sold through reseller CryptoBilis contained a hardware spy implant that stole users' seed phrases and drained their crypto.- Affects Ledger Nano X (and reportedly Ledger Flex) devices bought from unauthorized resellers, primarily Malaysia-based CryptoBilis in Southeast Asia; all confirmed losses trace to CryptoBilis devices, with roughly $90 million in crypto stolen.
- The implant captures the device's display output and button presses to read the 24-word recovery phrase during setup, without touching the secure element or altering transactions.
- Stolen seed phrases are transmitted to attackers over LTE via a tiny 2x2 mm eSIM and shielded LTE module; one variant used an ST STM32G431KBU6 Arm Cortex-M4 microcontroller with part markings scraped off.
- Implants were factory-grade flex PCBs hidden behind the screen or under the battery, with a smaller replacement battery making room; a visible antenna wire was the telltale sign.
- Ledger's 'Genuine Check' cannot detect added implants when the original Secure Element is intact; tampered devices were also reported at German retailer MediaMarkt, which pulled Ledger products.
Microsoft patches actively exploited Windows Shell zero-day CVE-2026-96951 bypassing Mark of the Web
CVE-2026-96951
Microsoft patched an actively exploited Windows Shell zero-day (CVE-2026-96951) that lets attackers bypass Mark of the Web protections.- Applies to Windows users; the flaw was fixed in the October 2026 Patch Tuesday updates.
- CVE-2026-96951 is a command injection flaw in Windows Shell with a CVSS score of 8.8, rated Important by Microsoft.
- Successful exploitation is a security feature bypass that lets downloaded files evade Mark of the Web protections, not standalone remote code execution.
- Attackers deliver a specially crafted file via email or instant messaging and rely on social engineering to persuade the user to open it, so user interaction is required.
- Microsoft's Exploitability Index rates it 'Exploitation Detected' and advises giving the update highest priority; researchers credited include Riku Bamba and Yuya Chudo of Fujitsu, Benoit Sevens with Anthropic, and yhw.
Collabora Online built-in CODE Server RCE flaw CVE-2026-110447 exploited in the wild
CVE-2026-110447
The Collabora Online built-in CODE Server Nextcloud app has an actively exploited OS command injection flaw allowing remote code execution.- Affects the Collabora Online built-in CODE Server (richdocumentscode) Nextcloud app, all versions before 26.4.303; standalone Collabora Online servers are not affected.
- CVE-2026-110447 is an OS command injection (CWE-78) in proxy.php, rated critical at CVSS 9.2.
- The flaw is exploitable when the CODE server isn't running, e.g. shortly after a restart.
- Exploited in the wild in September and October 2026; fixed in version 26.4.303.
- Distinct from CVE-2025-66208.
🕵️ RESEARCH & DEEP DIVES
- Vghost (CVE-2026-74580): Linux vhost stale IOTLB cache enables LPE and VM escape
CVE-2026-74580
Tencent researchers disclosed a Linux kernel vhost stale IOTLB metadata-cache flaw (CVE-2026-74580) enabling local root and guest-to-host escape.- Affects Linux kernel vhost subsystem with device IOTLB support; local users with access to /dev/vhost-* devices (vhost-net, vhost-vsock, vhost-scsi, vhost-vdpa) can gain arbitrary kernel read/write and root.
- Guests with vIOMMU + iommu_platform + VIRTIO_F_RING_RESET can overwrite QEMU heap and hijack control flow.
- VHOST_SET_VRING_ADDR and VHOST_SET_VRING_NUM reconfigure the vring without clearing vq->meta_iotlb[], so a cache hit skips validation and translates new addresses through the old mapping into unchecked raw_copy_to_user/from_user.
- Exploit chain: leak 8 bytes via IOTLB_MISS, recover KASLR from IDT[0], overwrite modprobe_path, and execute a memfd payload as root; PoC verified on Ubuntu 26.04, RHEL 9.8, Amazon Linux, Azure Linux, and Oracle Linux.
- Fixed upstream in commit de845981da67a6b049080c87e605130b0c30adc5; first fixed stable releases include 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2. CVSS 8.8.
🔓 CVEs & KEV
CVE-2026-97657 — Tyche Softwares Abandoned Cart Pro for WooCommerce — CVSS 9.8 — Abandoned Cart Pro for WooCommerce through 10.8.0 - Unauthenticated Authentication...
CVE-2026-97668 — Tyche Softwares Abandoned Cart Pro for WooCommerce — CVSS 9.8 — Abandoned Cart Pro for WooCommerce through 10.8.0 - Unauthenticated SQL Injection ...
CVE-2026-110002 — snazzyplugins Snazzy Social Media Feed — CVSS 9.8 — Snazzy Social Media Feed through 2.5 - Unauthenticated Arbitrary File Upload via '...
CVE-2026-93388 — Printcart Store – Web to Print Product Designer for WooCommerce — CVSS 9.8 — Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) ...
CVE-2026-90530 — Adobe ColdFusion 2025 — CVSS 9.3 — ColdFusion RDS Path Traversal Exposes Arbitrary File System Read (CVE-2026-90530)
CVE-2026-104995 — dontdream BP Profile Search — CVSS 8.1 — BP Profile Search through 5.9 - Unauthenticated Local File Inclusion to Remote Cod...
CVE-2026-102251 — Tyche Softwares Abandoned Cart Pro for WooCommerce — CVSS 7.5 — Abandoned Cart Pro for WooCommerce through 10.8.0 - Unauthenticated SQL Injection ...
CVE-2026-104767 — davefx Membership & User Roles for WooCommerce (Automatic Role Changer) — CVSS 7.5 — Membership & User Roles for WooCommerce (Automatic Role Changer) through 20260828 ...
CVE-2026-104749 — bitpressadmin Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation — CVSS 7.5 — Bit integrations through 2.10.6 - Unauthenticated Privilege Escalation via Identit...