View Ridge Security
Back to Cyber Hose

DHS Okta leak exposes 41,000 employees including undercover ICE agents

DHS Okta leak exposes 41,000 employees including undercover agents, plus Linux kernel LPE in KEV and GhostAction's GitHub credential theft campaign.

🚨 ACTIVE EXPLOITATION

  • CISA adds VMware ESX insufficient logging flaw CVE-2026-41709 to KEV catalog CVE-2026-41709
    CISA has added the VMware ESX insufficient logging vulnerability CVE-2026-41709 to its KEV catalog.

    • Applies to organizations running VMware ESX, part of Broadcom's VMSA-2026-0006 advisory covering ESX, vCenter, Workstation, and Fusion
    • A malicious administrator with admin access can perform certain operations without them being logged
    • Broadcom rates the flaw Low severity with a maximum CVSSv3 base score of 2.7
    • KEV due date for federal remediation is 2026-11-11
    Sources 📎 Coverage: support.broadcom.com · 👁 via CISA KEV

  • Fragnesia (CVE-2026-46300): Linux kernel ESP-in-TCP flaw grants root, added to CISA KEV CVE-2026-46300
    A newly disclosed Linux kernel local privilege escalation flaw in the XFRM ESP-in-TCP subsystem, CVE-2026-46300 (Fragnesia), has been added to CISA's KEV catalog with a public PoC available.

    • Affects Linux distributions running kernels released before the May 13, 2026 patch: Ubuntu, RHEL, Debian, openSUSE, CentOS Stream, Gentoo, and CloudLinux confirmed vulnerable; AlmaLinux and Fedora patched; Amazon Linux unaffected (no espintcp module).
    • The flaw lets an unprivileged local user write attacker-controlled data into the page cache of read-only files (e.g. /usr/bin/su) via in-place AES-GCM decryption of spliced file pages, yielding root without a race condition.
    • skb_try_coalesce() fails to propagate the SKBFL_SHARED_FRAG marker during socket buffer coalescing, so ESP input processing decrypts page-cache-backed fragments in place (192-byte XOR via AES-GCM keystream).
    • A public proof-of-concept by William Bowling of V12 Security is on GitHub; CISA notes it can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
    • KEV remediation deadline is 2026-10-31; no in-the-wild exploitation reported as of disclosure. Module blacklist of esp4/esp6/rxrpc is a temporary workaround. PoC targets Ubuntu 6.8.0-111-generic.
    Sources 📎 Coverage: nvd.nist.gov · 👁 via CISA KEV

💥 BREACHES & INCIDENTS

  • Leak of DHS Okta data exposes 41,000 employees, including undercover ICE agents
    A hacker called Department of Peace stole personnel data on 41,000+ DHS employees from DHS's Okta sign-on system, and DDoSecrets has published it as "Icepick".
    • Affects DHS and its component agencies: ~21,000 CBP records, ~10,000 ICE/HSI records, ~6,200 USCIS, ~1,000 CISA, plus DHS leadership — about one-fifth of DHS's 220,000-person workforce.
    • Stolen data includes names, job titles, email addresses, cell phone numbers, office locations, and Active Directory permission-group memberships revealing access to internal systems.
    • Records were exfiltrated around mid-August 2026 from DHS's Okta single sign-on system; Okta says it has no evidence its own systems were compromised.
    • Permission groups expose ties to surveillance tools (Palantir Falcon, PenLink, Mobile Fortify), wiretap programs, certified undercover operations, Signal, and AI tools like ChatGPT and Grok.
    • Hacker group Department of Peace shared the data with researcher maia arson crimew, who built a searchable site; DDoSecrets published the archive as "Icepick".
    • Hackers' note: "They have our information, so it's only fair that we have theirs."
    Sources 📄 Source: ddosecrets.org · 📎 Coverage: wired.com · 👁 via CyberScoop, @zackwhittaker@mastodon.social (+3)

🔓 CVEs & KEV

  • CVE-2026-61567 — WWBN AVideo-Encoder — CVSS 10.0 — AVideo-Encoder: unauthenticated command execution through streamer login trus...

  • CVE-2026-61564 — WWBN AVideo-Encoder — CVSS 10.0 — AVideo-Encoder: unauthenticated installer PHP code injectionAVideo is a video...

  • CVE-2026-61572 — WWBN AVideo-Encoder — CVSS 8.6 — AVideo-Encoder: unauthenticated full-response server-side request forgeryAVid...

  • CVE-2026-61571 — WWBN AVideo-Encoder — CVSS 7.3 — AVideo-Encoder: missing authentication on control and status endpointsAVideo ...

  • CVE-2026-61573 — WWBN AVideo-Encoder — CVSS 6.1 — AVideo-Encoder: reflected cross-site scripting in the login interfaceAVideo i...

🕵️ RESEARCH & DEEP DIVES

  • Atredis Partners details RCE and LPE vulnerabilities in Valve's Steam platform
    Atredis Partners discovered multiple local privilege escalation and remote code execution vulnerabilities in Valve's Steam platform.

    • Affects Steam on Windows, a platform with ~75% market share and 35-40 million daily active users.
    • Steam's architecture pairs an unprivileged client (steam.exe) with a SYSTEM-privileged service (steamservice.exe) communicating via named pipes and shared memory.
    • Researchers found 4 local privilege escalation vulnerabilities, including LPE via IClientInstallUtils, IClientModuleManager, Secure Desktop Capture, and BYOVD.
    • The service's shared memory section DACLs allow any process from any integrity level to connect and issue requests.
    • All bugs were reported to Valve via HackerOne and are patched or past disclosure timeline; PoCs and BSides PDX 2026 slides are on Atredis's GitHub.
    Sources 📄 Source: github.com · 📎 Coverage: atredis.com · 👁 via r/netsec

  • GhostAction returns: compromised GitHub accounts push credential-stealing workflows across 30,000+ repos
    The GhostAction campaign has resumed, injecting malicious GitHub Actions workflows into tens of thousands of repositories to steal CI/CD and cloud credentials.

    • Targets GitHub repositories and maintainers, including high-profile accounts kitao (pyxel, 18,400 stars) and henrywoo (Uber's athenadriver); 772 repos hit Aug 31–Sept 30, 2026, then 30,000+ repos across ~1,900 compromised accounts Oct 8–12
    • Steals named GitHub Actions secrets, cloud/AI/SaaS credentials in working trees and full git history, package publishing tokens, and personal access tokens; attempted extraction of 3,174 secrets in the October wave
    • Attackers use compromised personal access tokens from infostealer logs to push fake 'security-audit.yml' or 'github_actions_security.yml' workflows directly to default branches, bypassing PR review
    • Payloads exfiltrate secrets via curl over plain HTTP to 193.32.204.199 (endpoints /?c=bling, /?c=blingnew, and 193.32.204.199:3000/api/workflow/receive); newer variants scan git history with 11 secret-detection regexes
    • A later Oct 13–21 wave pushed 72,000 commits to 23,000 repos with five payload variants, including a PolinRider-style font-stealer for developer machines; GitHub blocked execution from Oct 9 onward
    Sources 📎 Coverage: darkreading.com · 👁 via Dark Reading

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check