🚨 ACTIVE EXPLOITATION
- INJ3CTOR3 Malware Now Steals SIP Trunk Credentials From FreePBX Servers for Phone Fraud
The INJ3CTOR3 operation has upgraded its FreePBX malware to steal SIP trunk and other credentials, enabling phone fraud even after infected servers are rebuilt.- Targets FreePBX VoIP servers, with related attacks hitting 900+ Sangoma FreePBX instances via CVE-2025-64328 (FreePBX Endpoint Manager v17.0.2.36–v17.0.3), mostly in the US, Brazil, Canada, Germany, and France.
- Steals configuration files containing SIP/PJSIP trunk passwords, Asterisk Manager Interface credentials, database passwords, and Postfix mail relay logins across FreePBX, Issabel, Elastix, Asterisk, and Postfix setups.
- Stolen SIP trunk credentials let attackers register directly with carriers and place fraudulent calls that leave no records on the cleaned PBX.
- Delivered via exploitation of CVE-2025-64328, a post-authentication command injection flaw; deploys JOMANGY, ZenharR, and EncystPHP web shells with six-layer persistence, scheduled tasks running every minute, and log-clearing takeover scripts.
- IOCs include staging servers 45[.]95[.]147[.]178 and 160[.]119[.]69[.]4, webshell watermarks trace_bd42a8a0d23ae16c85dede7d2abaec05 and trace_7544725ebaaadac217dfaa7ca8e8fe7e, and webshell gate MD5 8b3a1d970fda0c17a0b785a990fb7b6a.
📄 https://cyble.com/blog/hijacked-pbx-to-stolen-trunk-inj3ctor3s-campaign/ · 📎 https://cybersecuritynews.com/hackers-attack-freepbx-servers/ · 👁 via https://cybersecuritynews.com/hackers-attack-freepbx-servers/, https://www.cryptika.com/hackers-attack-freepbx-servers-with-malware-to-steal-sip-credentials-for-phone-fraud/
💥 BREACHES & INCIDENTS
42M records with PII exposed in CitySourced GovTech platform database
A publicly exposed, unsecured database belonging to civic engagement platform CitySourced exposed roughly 42 million records containing PII.- Affected: residents and local government agencies using CitySourced, a civic engagement platform serving ~184 locations across 38 U.S. states, Puerto Rico, five Canadian provinces, the Bahamas and Bermuda
- Exposed: ~42 million documents and 450,000 JSON files with plaintext PII — names, addresses, emails, phone numbers, and complaint/code violation images dating 2016–2026
- How: researcher Jeremiah Fowler found the database publicly accessible online with no password or encryption; no specialized tools were needed to view it in a browser
- CitySourced merged into Rock Solid Technologies in 2019 and is now owned by Granicus, which investigated and restricted the database after disclosure
- Unknown: how long the data was exposed and whether unauthorized parties accessed it
📎 https://www.expressvpn.com/research/citysourced-data-exposed · 👁 via https://infosec.exchange/@metacurity/117524585868652726
BAE says no data taken in incident that halted federal bankruptcy court notices for two weeks
BAE Systems restored the Bankruptcy Noticing Center after a cybersecurity incident took it offline for over two weeks, saying no data was extracted.- The incident affected the Bankruptcy Noticing Center (BNC), operated by BAE Systems under contract for the US federal judiciary — all federal bankruptcy courts rely on it to send notices.
- Notices stopped flowing around October 9; affected systems included BNC.uscourts.gov, BankruptcyNotices.uscourts.gov, Notices.uscourts.gov, and the National Creditor Registration Service.
- The Judicial Conference declared a 'Bankruptcy Rules emergency' on October 22, letting bankruptcy judges push back deadlines and pause time periods.
- BAE says the BNC was restored on October 26 and resumed clearing delayed notices oldest first; no other systems were affected, no data extracted, and no PII breached.
- BAE has not disclosed the cause or whether it was a cyberattack, and no ransomware or cybercrime group has claimed responsibility.
📎 https://www.securityweek.com/bae-says-no-data-extracted-in-incident-hitting-bankruptcy-courts/ · 👁 via https://www.securityweek.com/bae-says-no-data-extracted-in-incident-hitting-bankruptcy-courts/
Hackers Claim Wagyu Crypto Swap Platform Breach; Leak Links Monero Transactions to IPs
Hackers claim a breach of crypto swap platform Wagyu.xyz, and researchers found a dataset linking Monero transactions to IP addresses.- Wagyu.xyz users who swapped between Bitcoin and Monero between July 18 and October 26, 2026 are potentially affected.
- The purported leak contains 38,628 order records and 10,139 distinct IP addresses; 4,580 completed cross-chain records connect an incoming transaction hash, an XMR destination, and a client IP.
- WhiteArmor-associated listings naming Wagyu appeared on ransomware-tracking services on October 27-28, claiming hidden swap fees and unfair coin-flip odds; authenticity is unverified.
- Hudson Rock found no evidence infostealer malware caused the incident or infected identified Wagyu customers.
- If authentic, records could enable refund scams, fake support messages, or extortion referencing real trades; some records labeled 'Poloniex Hacker' total $1,025,047.
📄 https://www.infostealers.com/article/38628-crypto-orders-10139-ips-what-wagyus-alleged-leak-means-for-monero-privacy/ · 📎 https://cybersecuritynews.com/wagyu-crypto-platform-breach/ · 👁 via https://cybersecuritynews.com/wagyu-crypto-platform-breach/, https://www.cryptika.com/hackers-claim-wagyu-crypto-platform-breach-as-researchers-find-thousands-of-monero-transaction-records/
🔓 CVEs & KEV
CVE-2026-97229 — Gitlab Gitlab — CVSS 10.0 — Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
CVE-2026-118425 — Red Hat Build of Keycloak — CVSS 6.8 — Keycloak-services: keycloak-services: redirect uri domain allowlist bypass vi...
🕵️ RESEARCH & DEEP DIVES
26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories
A researcher found 26,400 still-valid credentials, mostly for cloud and AI services, exposed in public Gitee repositories.- Affects developers and organizations who committed secrets to any of Gitee's 7.25 million public repositories, China's largest code-hosting platform chosen in 2020 for a national open-source hosting base.
- Exposed credentials include 9,473 Alibaba Cloud AccessKey pairs, 3,805 YouTube API keys, 3,170 DeepSeek keys, 1,489 Zhipu BigModel keys, and 1,348 OpenAI keys, plus smaller numbers for GitHub, AWS, Google Cloud and Gemini.
- Independent researcher Ben Zimmermann scanned all 7.25 million public repositories with TruffleHog and Kingfisher, testing each credential against its issuing service and reading full commit histories; keys deleted from code remained recoverable in history.
- TruffleHog found 12,737 working credentials and Kingfisher 14,664, with only 1,001 overlap; nearly half (12,242) of the valid credentials were committed in 2025, some dating to the late 2000s.
- Gitee's leak rate of 3.64 working credentials per 1,000 repositories scanned exceeds earlier GitLab (3.11) and Bitbucket (2.39) scans.
📄 https://www.mongodb.com/company/blog/technical/scanning-7-point-25-million-public-repositories-chinas-largest-git-platform-for-secrets · 📎 https://thehackernews.com/2026/10/26400-valid-cloud-and-ai-credentials.html · 👁 via https://thehackernews.com/2026/10/26400-valid-cloud-and-ai-credentials.html
Cisco Talos IR Q3 2026: vishing IT help desk impersonation rises as ransomware climbs to 27%
Cisco Talos reports ransomware and pre-ransomware incidents rose to 27% of Q3 2026 IR engagements, with phishing still the top initial access vector.- Applies to organizations tracked in Cisco Talos IR engagements; finance and public administration tied as the most-targeted industries in Q3 2026.
- Phishing remained the leading initial access vector, appearing in just over one-third of engagements, down from over 50% in Q2.
- Actors used voice phishing (vishing) impersonating IT help desks to socially engineer victims into granting remote access via legitimate RMM tools.
- Public-facing application exploitation accounted for one-third of engagements, predominantly targeting edge devices like security gateways and remote management interfaces.
- Ransomware/pre-ransomware hit 27% of engagements (up from ~20%), involving RaaS groups The Gentlemen, Qilin, Rhysida, Interlock, and the emerging VYPR variant; attackers disabled EDR via vulnerable drivers or WDAC.
- Salt Typhoon-affiliated Chinese actors targeted telecoms, exploiting CVE-2023-20198 in web-based management interfaces and deploying the BadCandy web shell with LOTL tactics.
- AI featured as both tool and target: a fraudulent insider installed AI dev tools (GitHub Copilot CLI, Claude Code), and a macOS attack scraped keychain credentials for Claude Code.
📎 https://blog.talosintelligence.com/ir-trends-q3-2026/ · 👁 via https://blog.talosintelligence.com/ir-trends-q3-2026/
Cloudflare Q3 2026 DDoS report: 8,200+ attacks per hour as attackers shift to short, high-frequency strikes
Cloudflare mitigated over 8,200 DDoS attacks per hour in Q3 2026 as attackers shifted to shorter, high-frequency strikes.- Cloudflare's Q3 2026 DDoS Threat Report covers attack trends across its global network, published October 29, 2026.
- Cloudflare mitigated over 8,200 DDoS attacks per hour in Q3 2026, with attackers favoring shorter, high-frequency attacks ('more swarms, fewer giants').
- The report highlights the collapse of CLDAP attack vectors and the impact of recent botnet takedowns.
📎 https://blog.cloudflare.com/ddos-threat-report-2026-q3/ · 👁 via https://blog.cloudflare.com/ddos-threat-report-2026-q3/
Zero-Click 'SMS of Death' Flaw Crashes Android Telephony via Malformed WAP Push SMS
A researcher disclosed a zero-click Android flaw that lets a single malformed SMS crash the phone service, which Google marked Won't Fix.- Applies to Android devices including Pixel 9 (April 2026 firmware) and Samsung Galaxy/A-series phones, all reproduced with 100% success rate
- WapPushOverSms.decodeWapPdu() casts an unchecked WAP Push header length to int, producing -2147483648 and an uncaught NegativeArraySizeException that kills com.android.phone
- Delivered as a silent, zero-click data SMS on port 2948; nothing appears in the inbox and the sender's number is never shown
- Calls drop (including emergency calls) with CS_DEATH; carrier redelivery caused outages for up to a week from one message, and ~30 rapid messages corrupt the SQLite SMS store, crashing the phone on every boot
- Reported 5 May 2026 via Android VRP (issue 509520497); Google classified it non-security and Won't Fix; no CVE issued; disclosed 29 Oct 2026
📄 https://smsofdeath.com/ · 📎 https://cybersecuritynews.com/zero-click-android-vulnerability/ · 👁 via https://cybersecuritynews.com/zero-click-android-vulnerability/
📋 ADVISORIES
- CISA warns of SAML assertion replay auth bypass in Siemens Mendix SAML module (CVE-2026-89209)
Siemens' Mendix SAML module fails to protect against SAML assertion replay, letting unauthenticated attackers gain unauthorized access in IdP-initiated SSO flows.- Affects Mendix SAML module: Mendix 10 and 11 compatible versions before V4.2.4 and Mendix 9 compatible versions before V3.6.29 (CVE-2026-89209, CVSS 3.1 base 6.8, CWE-294)
- Vulnerability is an