Ukraine Air Alert app hacked with false nuclear threat warnings

🚨 ACTIVE EXPLOITATION

• Synology warns of renewed C3RB3R ransomware attacks hitting NAS devices on outdated DSM
  Synology has identified renewed C3RB3R ransomware attacks against NAS devices running outdated DSM versions.
  • Affects Synology NAS devices running outdated versions of DiskStation Manager (DSM), including unpatched 7.x releases
  • Attackers exploit a vulnerability patched in December 2024 (Synology-SA-24:20) to encrypt data and extort ransom
  • Samples analyzed by 360 identified the ransomware as C3RB3R, a variant of the Cerber family; encrypted files use the .L0CK3D extension
  • The campaign has been active again in late October 2026, with victim discussion on the Synology subreddit and a community rescue tool on GitHub
  Sources 📄 Source: synology.com · 📎 Coverage: nascompares.com · 👁 via @campuscodi@mastodon.social

💥 BREACHES & INCIDENTS

• Ukraine's Air Alert app hacked, sending false nuclear, chemical threat warnings in Kyiv
  Ukraine's Air Alert app was hacked, sending false radiation, chemical, and street-fighting warnings, and Russia reported a similar hack hours later.
  • Applies to users of Ukraine's Air Alert app, the national air raid warning system supported by the Ministry of Digital Transformation, and to Russia's emergencies ministry alert app.
  • The app sent false nationwide red-level air raid alerts starting ~22:47, including a radiation threat in Kyiv, a chemical attack warning, and a street-fighting alert; all-clear messages followed at 23:53.
  • One fake message was written in Russian: "There will be a nuclear alert across Ukraine. Don't worry, it's Oreshnik flying."
  • Vinnytsia regional officials warned the fake alert contained a link that could be a phishing attempt; the radiation signal was also triggered on sirens in the Lviv region.
  • Ukraine's Centre for Strategic Communications blamed Russia; hours later Russia's emergencies ministry said its app was hit by a massive cyberattack, with Ukrainian partisan group Atesh claiming it sent fake nuclear strike warnings inside Russia.
  Sources 📄 Source: pravda.com.ua · 📎 Coverage: bbc.com · 👁 via @campuscodi@mastodon.social

🔓 CVEs & KEV

• CVE-2026-120338 — PrefectHQ prefab-ui — CVSS 10.0 — Prefab UI Pyodide sandbox escape to host RCEPrefab UI's Generative UI sandbox...

• CVE-2026-120308 — beam-cloud Beta9 gateway — CVSS 9.9 — Beta9 host filesystem exposure via volume path traversalA Beta9 tenant can at...

• CVE-2026-62048 — Liquid Web / StellarWP BookIt — CVSS 9.3 — WordPress BookIt plugin through 2.6.0.6 - SQL Injection vulnerabilityImproper Neut...

• CVE-2026-120281 — WAVLINK WN536AX6-A — CVSS 9.3 — WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflowA vulnerab...

• CVE-2026-120280 — WAVLINK WN536AX6-A — CVSS 9.3 — WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os comm...

• CVE-2026-120279 — WAVLINK WN536AX6-A — CVSS 9.3 — WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injectionA flaw has be...

• CVE-2026-120282 — WAVLINK WN536AX6-A — CVSS 8.6 — WAVLINK WN536AX6-A protocol.csp host_black os command injectionA vulnerabilit...

• CVE-2026-119480 — Crocoblock JetFormBuilder — CVSS 6.5 — WordPress JetFormBuilder plugin through 3.6.7.1 - Attachment Deletion Via Media-Fi...

• CVE-2026-120309 — nuxt — CVSS 6.3 — Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParamNuxt from 4.6...