💥 BREACHES & INCIDENTS
- Applebee's Android app exposed hardcoded database password, leaking customer personal data
Applebee's fixed a hardcoded database credential in its Android app that exposed registered customers' personal data.- Applebee's customers with rewards accounts were affected; the company has at least 8.5 million rewards members, though the number exposed is unknown.
- The exposed database contained names, email addresses, email verification status, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates, and recent login IP addresses.
- Researcher Robert Wiggins of What Security used AI to find a hardcoded credential in the Android app's source code (1M+ downloads on Google Play); TechCrunch verified by decompiling the app and retrieving dummy account data.
- The credential allowed anyone to access the customer database as an authorized user and could have permitted modification of customer data.
- Dine Brands said its investigation found no evidence of unauthorized access; neither company had a channel for reporting security issues.
🕵️ RESEARCH & DEEP DIVES
Critical Linux kernel TCP use-after-free (CVE-2026-98432) enables remote root attacks on MPTCP servers
Anthropic researchers used an AI-developed exploit to achieve unauthenticated remote root code execution via a 9.8-CVSS use-after-free in the Linux kernel's IPv4 TCP handshake code.- Affects Linux kernels since version 4.4, including Ubuntu, RHEL, Rocky Linux, Debian, Oracle, Amazon Linux, and SUSE; IPv6 child-socket creation is not affected.
- CVE-2026-98432 is a race condition in the IPv4 TCP handshake: tcp_v4_syn_recv_sock() transfers ireq->ireq_opt to the child socket without copying, allowing a concurrent retransmitted-SYN path to read freed IP options memory.
- Anthropic's Claude AI model wrote a two-stage exploit: the race leaks a kernel address to defeat KASLR, then overwrites a callback pointer to execute arbitrary commands as root on servers with an MPTCP listener; the demo took about 53 minutes (48 min to leak, 5 min to execute).
- Go 1.24 enables MPTCP by default for TCP listeners on Linux, so some Go-based network services may expose MPTCP listeners without administrators knowing.
- Upstream fix (commit e3f33b0a1d89, using kfree_rcu) is merged and backported; Debian, Oracle, Amazon, and SUSE have shipped fixes, but Ubuntu and RHEL had none as of October 30; no in-the-wild exploitation confirmed.
FBI's Operation Blackout Dismantles Global Scam Compounds With Industry Partners
A coordinated FBI-led operation dismantled international scam compounds behind pig-butchering, romance, and cryptocurrency fraud schemes.- Targets are Americans, especially senior citizens, victimized via social media, phone calls, texts, and Telegram-driven pig-butchering, romance, and cryptocurrency investment scams.
- Operation Blackout seized roughly $17 billion, demolished 20+ scam compounds, rescued trafficked workers, and removed 3.7 million fake Facebook and Instagram accounts via Meta.
- The operation combined the UK NCA, DOJ, FBI, Nigerian and Ghanaian cybercrime agencies with private partners Meta, Microsoft, OpenAI, Starlink, and Silent Push.
- Silent Push contributed 35,000 domains, 70+ detection rules, and fingerprinting; scams reported to the FBI's IC3 and UK NCSC formed the initial dataset.
- Arrests included 28 in Ghana and Nigeria, and 13 Chinese-run scam centers taken down in Madagascar after a Cambodia raid seized 113 hard drives and 15 computers.
🔓 CVEs & KEV
- CVE-2026-63182 — litesaml lightsaml — CVSS 8.1 — LightSAML: Signature reference wrapping permits unsigned assertion claimsLigh...