💥 BREACHES & INCIDENTS
- Hijacked developer GitHub account used to plant stealer in OVHcloud CLI releases
A hacker used a compromised OVHcloud developer's GitHub account to plant a secret-stealing binary in official ovhcloud-cli releases.- Affects users of OVHcloud's official ovhcloud-cli tool; versions v0.11.0 through v0.15.0 are compromised, v0.10.0 and v0.16.0 are clean.
- The attacker added a binary that retrieves secrets from disk, overwriting files of already-published releases for macOS, 64-bit Linux, and Windows x86_64.
- Users who installed via the official install script, Homebrew, or direct GitHub download during the ~94-minute window on October 19 are affected; source builds, Go install, and the official Docker image are not.
- The developer's GitHub account was compromised since at least March 2026, when personal repositories were rewritten to include a hidden loader whose next stage queries the Solana blockchain, a known GlassWorm indicator.
- The release tampering was possible because GitHub's release immutability option was not enabled, allowing direct modification of existing releases without CI/CD checks.
📋 ADVISORIES
CISA and partners issue joint advisory on SafePay ransomware, 600+ victims since 2024
A joint CISA-FBI advisory details SafePay ransomware attacks that have hit at least 600 organizations across multiple critical infrastructure sectors.- SafePay has targeted businesses and critical infrastructure in North America, South America, Europe, and Australia since August 2024, and was among the most active ransomware groups in 2026.
- Initial access uses stolen or brute-forced credentials, phishing, and exploitation of edge devices and internet-exposed systems: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 (Veeam Backup & Replication unauthenticated RCE), and CVE-2024-40766.
- Actors use Mullvad VPN IP addresses and phished account profiles, then move laterally with PsExec, WinRM, and RDP, disable security software, and stop Volume Shadow Copy or reset NAS backups to factory settings.
- Data is exfiltrated with 7-Zip, WinRAR, RClone, WinSCP, FileZilla, OneDrive, or Backblaze before encryption with ChaCha20 and RSA; victims are pressured via a Tor chat portal, phone calls, and leak threats.
- IOCs include IPs such as 88.119.167.239 (soc.dll C2), 5.255.11.134, and 37.10.71.188, plus hashes for 1.exe, locker.dll, soc.dll, and SharpShares.exe listed in advisory AA26-293A.
Meta Muse AI Privacy Flaw Exposes Confidential Business Data Through Shared Chat Links
Meta paused Muse AI's conversation sharing feature after researchers found shared chat links exposing confidential business data via passive DNS records.- Affects users of Meta's Muse AI agent who used the conversation sharing feature; only shared pages were exposed, not all private conversations.
- Shared pages hosted under cf.metaaiusercontent.com combined readable conversation titles with random IDs in hostnames; passive DNS services recorded full hostnames, letting researchers rebuild working links without authentication.
- Claroc researchers, who dubbed the exposed pages 'GhostShares', found over 6,800 share hostnames via passive DNS plus 75+ saved scans on urlscan.io; a minority contained sensitive data like a CEO revenue review, a loan application, and a bank fraud alert.
- Reported to Meta's bug bounty program on October 8, 2026; Meta paused the sharing feature on October 20, though historical DNS records still retain hostnames and titles.
- Relevant domains: muse.ai, metaaiusercontent.com, cf.metaaiusercontent.com; no malware or file-based indicators.
🔓 CVEs & KEV
CVE-2026-86949 — Apple Xcode — CVSS 8.8 — This issue was addressed by enforcing library validation on the affected bina...
CVE-2026-86961 — Apple iOS and iPadOS — CVSS 7.8 — A race condition was addressed with additional validation. This issue is fixe...
CVE-2026-86957 — Apple iOS and iPadOS — CVSS 6.5 — An out-of-bounds read was addressed with improved bounds checking. This issue...