🚨 ACTIVE EXPLOITATION
Cyber incident at FLC halts construction of Fehmarn Belt tunnel between Denmark and Germany
A cyber incident at main contractor FLC has disabled central systems and halted construction of the Fehmarn Belt tunnel.- Femern (Sund & Bælt) confirmed on Oct 13, 2026 a cyber incident at Femern Link Contractors (FLC), main contractor on the ~18 km Denmark–Germany undersea tunnel
- The attack disabled employees' electronic access cards, vessels, cranes and offshore platforms, leaving thousands of workers unable to work
- FLC employs ~2,800 people from companies in Denmark, Germany, France, Belgium and the Netherlands
- No attacker, ransomware claim, or data theft has been confirmed; Danish officials have not ruled out hybrid warfare amid raised Russian cyber threat levels
Silent Lynx exploits WinRAR CVE-2025-8088 to deploy reverse shells in CIS government attacks
The Kazakhstan-nexus threat actor Silent Lynx has been running four evolving infection chains against CIS government organizations, including a first-ever exploit of WinRAR CVE-2025-8088.- Targets government ministries, embassies, diplomatic missions, and civil society organizations across nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.
- Activity observed June 2025 through August 2026 deploys custom reverse shells FoalShell, Chvost, Laplas, and PickleShell for interactive remote access.
- Four infection chains: macro-enabled Word documents (June 2025), PS2EXE downloaders with scheduled-task persistence (July 2025), LNK-in-RAR launching GitHub-hosted PowerShell (October 2025), and RAR archives exploiting WinRAR CVE-2025-8088 to drop PickleShell into the Windows Startup folder (April 2026).
- Spear-phishing emails sent from compromised government accounts use lures themed on diplomacy, trade, energy, and aviation, such as a diplomatic letter to Armenia's MFA and a Turkmenistan airspace form.
- Exposed staging directories host Linux tooling and a PoC exploit for FortiWeb SQL injection flaw CVE-2025-25257, suggesting expanding capabilities; the group overlaps with YoroTrooper, ShadowSilk, Cavalry Werewolf, and Tomiris.
💥 BREACHES & INCIDENTS
Burger King Japan breach exposes 11.18M app member records
Burger King Japan has confirmed a data breach exposing about 11.18 million records of its official app members.- Affects members of the official Burger King Japan app operated by BK Japan; incident disclosed October 15, 2026.
- Unauthorized access to the server managing app member data occurred between October 2 and October 7; the leak was confirmed on October 13.
- Exposed fields include member IDs, names (kanji/kana), email addresses, phone numbers, dates of birth, gender, prefecture, registration type, mobile ordering usage, and email verification status.
- Credit card numbers were not held or leaked, and no login password leak has been confirmed so far; no secondary misuse confirmed to date.
- The initial access method remains under investigation with outside experts; BK Japan blocked the access and notified Japan's Personal Information Protection Commission.
Sources 📄 Source: burgerking.co.jp · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)Cyberattack heats supermarket fridges to 50C across France, spoiling food and sparking fires
Hackers remotely raised supermarket refrigeration temperatures across France, spoiling millions of euros of food.- Hundreds of French supermarkets hit, including Coopérative U (100+ stores), Intermarché/Netto (180 stores), Carrefour (80), Monoprix and E.Leclerc; attacks also reported in Spain, Portugal, Poland, Germany and Belgium.
- The attack targeted remote refrigeration management software from Danish firm Danfoss, forcing fridges and freezers to heat to 50C (122F) for hours overnight.
- Affected units were older Danfoss models whose security software could not be updated; some stores reported smoke and small fires.
- Food losses could reach millions of euros; two Alsace stores alone reported €270,000 in losses; French prosecutors opened a cyber-crime investigation.
- About 400 of France's roughly 15,000 supermarkets were affected; Intermarché disconnected another 100 stores from the internet as a precaution.
🔓 CVEs & KEV
CVE-2026-57155 — opnsense core — CVSS 9.9 — OPNsense Firewall Alias GeoIP Traversal Enables Root Compromise
CVE-2026-84731 — Nutanix Acropolis Operating System (AOS) — CVSS 9.3 — Nutanix Prism Element Critical Flaw Allows Unauthenticated Remote Root Command Execution
🕵️ RESEARCH & DEEP DIVES
ChatGPT GitHub Connector flaw may let attackers steal private repo secrets via prompt injection
A researcher reports an indirect prompt injection in ChatGPT's GitHub connector that can exfiltrate secrets from private repositories.- Affects users who connect GitHub to ChatGPT with broad repository access; researcher Sunil Tripathy rates it CVSS 4.0 9.3 (self-assessed, not vendor-confirmed).
- Hidden instructions in an attacker-controlled public repo cause the AI agent to commit a GitHub Actions workflow to a different private repo, which exfiltrates a test secret (AUDIT_CANARY) to an external server.
- Instructions framed as deployment requirements bypassed refusals; a custom action contained the theft logic, with reported private repo discovery and attacker-written commits.
- Reported September 4, demonstrated September 28, closed as 'out of scope' October 14, and still reproducible October 15; OpenAI docs describe the standard GitHub app as read-only, leaving the affected integration path unresolved.
- Findings are researcher-reported and not independently verified; no CVE assigned.
Sources 📄 Source: sunilawesome.in · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)Fake Arch Linux AUR packages impersonate yay and paru to run malware with root privileges
Malicious typosquatted AUR packages impersonating yay and paru executed a remote script with root privileges on Arch Linux systems.- Affects Arch Linux users who install packages from the AUR, particularly users of the yay and paru AUR helpers
- Typosquatted packages like 'yyay' contained legitimate upstream code plus a malicious install scriptlet that fetched and ran a remote shell script with root privileges
- Uploaded by AUR user 'marchos1as'; payload was fetched via a Wayback Machine URL pointing to a 'hellscripter/install-scripts' repository on GitFlic
- Possible links to the 'DirtyBlanket' npm campaign, which used the same repository name and delivered a Linux worm deploying the CHAOS RAT, though no confirmed connection
- The AUR team banned the account and removed the malicious packages after the campaign was detected on October 13
📋 ADVISORIES
- ThreatsDay roundup: Qilin exploits PAN-OS flaw, Noir wallet drainer, KGB RAT and BotHelper RAT emerge
The Hacker News' ThreatsDay bulletin covers ransomware exploitation of a PAN-OS bypass, DNS-based crypto wallet theft, new RATs, and other weekly threats.- Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026.
- Infoblox analyzed Noir, a crypto wallet drainer that uses DNS TXT records via public DoH services to locate its backend pool hosted on Cloudflare Pages, and obtains spending permissions instead of seed phrases.
- Darktrace found CikaBika Bot, a Rust-based RAT delivered via LNK and PDF lures that uses a Nim loader, UAC bypass, and Discord for C2 and ngrok for exfiltration.
- Group-IB reports KGB RAT, a Windows RAT sold on underground forums since late 2025, combines credential theft, HVNC, ransomware, and psychological harassment features like jump scares and forced blue screens.
- Point Wild documented BotHelper RAT, a .NET RAT with live screen surveillance delivered via a stager contacting easyllms.xyz, persisting via scheduled task and patching AMSI.
📋 ADVISORIES
- 📄 Source for Proxyjacking campaign hijacks D-Link, Ubiquiti devices in 34 countries to resell bandwidth — greynoise.io