🚨 ACTIVE EXPLOITATION
- Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Threat actors began exploiting the Plex2Shell chain of four Plex Media Server vulnerabilities within hours of public disclosure.- Applies to organizations and individuals running internet-facing Plex Media Server servers, especially unpatched releases.
- Plex2Shell combines four flaws — CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 — to run arbitrary code on exposed servers without valid credentials, with Plex service privileges.
- The researcher published a write-up and PoC on October 16; in-the-wild exploitation was observed on October 17 using the public exploit, possibly tweaked.
- Attackers dropped an XMRig-based cryptocurrency miner and later 'myawesomeproxy', proxy software that exposes victims' internet traffic.
- Plex was notified July 27, confirmed the bugs August 4, and shipped fixes announced September 1; published IOCs cover only honeypot-observed activity.
💥 BREACHES & INCIDENTS
Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
Malware was injected into some Rank Math PRO 3.0.123 packages distributed in a supply chain attack.- Affects users of the Rank Math PRO WordPress SEO plugin who downloaded or updated to version 3.0.123 between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC.
- The malware can take over websites when the plugin is activated, provide persistent backdoor access, and expose credentials, API keys, and other secrets.
- It recreates a hidden backdoor on each page visit, deploys fake WordPress core files, drops .cache files executed as PHP via modified .htaccess rules, schedules cron jobs, and modifies other plugins and themes.
- Attackers may also make changes outside the WordPress installation, including SSH authorized_keys files and other users' crontabs.
- A clean version, Rank Math PRO v3.0.124, was released; the attacker's domain is rank1cdn[.]com.
ConnectWise Suspends Cloud Backup, SaaS Security, Cloud Management After M365 Tenant Attacks
Attackers used a compromised ConnectWise Cloud Backup (SkyKick) credential to access hundreds of Microsoft 365 tenants, prompting ConnectWise to suspend its cloud services.- Applies to MSPs and customers using ConnectWise Cloud Backup (formerly SkyKick), SaaS Security, and Cloud Management integrated with Microsoft 365 tenants.
- A compromised ConnectWise Cloud Backup application credential (client assertion) was used to authenticate as the app and obtain Microsoft Graph tokens in customer tenants; sign-ins hit nearly 1,000 Entra tenants, with over 300 successful.
- In one tenant, the ConnectWise Cloud Management - MS Teams app (App ID 24205314-2b89-4e07-a2a4-579e898a5640) added itself to Global Administrator and added new client secrets to other applications to establish persistence.
- Activity traced to attacker IP 144.172.64[.]128 on October 15 (06:13-08:34 UTC), moving through tenants in sorted GUID order with a second targeted wave against 16 tenants in policy, national security, trade, and critical minerals sectors.
- ConnectWise disabled seven application identities and suspended services on October 17; Huntress also observed link to password spraying against four law firm tenants from the same IP on October 13-14.
Chinese crime ring hacked Staples to fraudulently issue $5M in gift cards
A Chinese organized crime gang hacked Staples' internal Nexus system to issue over 15,000 gift cards worth more than $5 million and spent them across U.S. retailers.- Staples was hacked in October 2023 via its internal Nexus customer support system, which the company believed was only accessible from internal computers.
- Hackers performed heap dump requests to capture app memory data, then hijacked logged-in customer service representative sessions to issue the gift cards.
- More than 15,000 gift cards worth over $5 million were issued to email accounts the hackers controlled.
- The gang redeemed 4,630 of the hacked cards (~$425,000) at Target, Sephora, and Lowe's, spending $141,000 across 85 Target stores in 18 states in two days.
- The hack ties to a DOJ prosecution in which three Chinese nationals were sentenced in a gift card fraud conspiracy worth over $100 million; stolen goods were shipped back to China.
CenterPoint Energy breach affects over 1 million Texans; hacker claims 7.49M records stolen
CenterPoint Energy disclosed a data breach affecting more than 1 million Texas customers after a threat actor leaked data stolen via an unprotected public API.- CenterPoint Energy customers in Texas and other states are affected; the company serves ~7 million metered customers across Indiana, Minnesota, Ohio, and Texas.
- Stolen data includes names, phone numbers, service and billing addresses, account numbers, billing amounts, partial Social Security numbers, and driver's license numbers.
- A threat actor using the alias '4d722e4d656f77' claims 7.49 million records were taken and leaked the data after the company allegedly ignored their messages.
- The attacker exfiltrated data by iterating through millions of IDs on CenterPoint's public API, which lacked rate limiting, WAF protection, and defenses against automated access.
- The breach reportedly occurred between August 17 and September 1, 2026, was discovered in September, and has prompted multiple proposed class-action lawsuits in federal courts.
🕵️ RESEARCH & DEEP DIVES
Feds suspect ransomware negotiator ran ShinyHunters extortion site
The FBI has arrested ransomware negotiator Edward Dubrovsky and suspects executives at two negotiation firms had close ties to ShinyHunters, including helping run its extortion website.- Canadian cybersecurity executive Edward Dubrovsky, 54, was arrested in Pennsylvania and charged with threatening to disclose stolen data and extortion-related interference with interstate commerce.
- Investigators identified executives at two ransomware negotiation firms with unusually close ties to ShinyHunters, which has extorted more than $70 million from victims this year.
- FBI investigators believe an executive at a large U.S.-based consulting firm helped operate the ShinyHunters victim extortion site shinywire[.]com, active May 3 to October 16, 2026, listing nearly 100 hacked organizations.
- Shinywire pages displayed stolen file samples and gave victims seven days to engage before data was published on ShinyHunters' Tor-hosted shaming blog.
- The probe stems from the September 2026 arrest of ShinyHunters suspect Pepijn van der Stap in the Netherlands, whose Signal messages allegedly showed Dubrovsky knew of the FBI data breach but never informed the bureau.
- ShinyHunters hacked the FBI recruitment site fbijobs.gov in late September, threatening to publish employee records including Social Security numbers and medical information.
Sources 📄 Source: courtlistener.com · 📎 Coverage: krebsonsecurity.com · 👁 via Krebs on Security, @briankrebs@infosec.exchange16-Year-Old Broadcom WPS Flaw Lets Nearby Attackers Run Root Code on Routers, No Patch or CVE
A 16-year-old flaw in Broadcom's Wi-Fi Protected Setup software lets attackers in radio range run code as root on affected routers without knowing the Wi-Fi password.- Affects Broadcom-based routers and gateways using Broadcom's proprietary WPS implementation, with code dating back to at least 2010; no CVE assigned and no patch deployed.
- Vulnerable chip families: older eCos-based BCM3380, BCM3383, BCM33834 (unfixable 'forever day') and newer Linux-based BCM3390, BCM65xx, BCM68xx.
- The flaw is in Broadcom's reassembly of fragmented WPS EAP messages; weak length checks let crafted over-the-air frames overflow a buffer, leak memory, and redirect execution to attacker code.
- Researcher Quentin Kaiser demonstrated stealing the Wi-Fi PSK from an Orange Belgium Askey TCG3000 and opening an over-the-air reverse shell on a Proximus BBOX3V+, with no cloud server needed.
- Confirmed exploitable on gateways from three Belgian ISPs (Proximus, Orange, VOO), with an estimated ~1.56 million affected gateways in Belgium and potentially millions of devices worldwide; no real-world attacks reported.
Underground market sells forged IDs, deepfakes, and live help to bypass KYC checks
Flare researchers detail an underground market selling forged identity documents, deepfakes, and live verification services that let criminals bypass KYC checks.- Targets financial institutions, banks, and cryptocurrency exchanges relying on KYC identity verification.
- OnlyFake's operator pleaded guilty in February 2026 for generating over 10,000 fake passports, driver's licenses, and Social Security cards used to evade identity checks and launder money.
- Sellers offer complete KYC packages with consistent identity data, documents, photos, and prepared device/browser sessions tailored to each platform.
- Live checks are bypassed with altered photos, AI-generated deepfake videos, real-time face-swap tools, and 'human KYC' operators who complete verification for buyers.
- Sellers also provide post-sale support, including help with re-verification and account recovery after handoff.
16-year-old Broadcom Wi-Fi flaw lets attackers hijack routers without knowing passwords
A 16-year-old flaw in Broadcom's Wi-Fi software lets in-range attackers take control of routers without the network password.- Affects routers using Broadcom's proprietary WPS implementation, present in its SDK since at least 2010; affected chips include eCos-based BCM3380/BCM3383/BCM33834 and Linux-based BCM3390, BCM65xx, BCM68xx
- Weak length checks in code reassembling fragmented EAP messages let crafted WPS frames overflow a buffer, enabling memory leaks and attacker-controlled code execution before WPS enrollment completes
- Researcher Quentin Kaiser (dubbed 'WPSplinter', disclosed at Hexacon on Oct 16, 2026) stole a saved Wi-Fi password from an Orange Belgium ASKEY TCG3000 over the air and got a