Security News
OpenSSH *sshole Vulnerability — Urgent Patch Required (BleepingComputer)
A decade-old flaw in musl-based Linux systems allows attackers to log into password-disabled accounts using a 256+ byte password. Affects Alpine Linux, OpenWrt, Buildroot, Yocto. OpenSSH 10.6p2 released as emergency workaround.
FBI & CISA Warn on Refrigeration System Cyberattacks (BleepingComputer)
Joint advisory urges critical infrastructure operators to disconnect industrial smart freezers from the internet following attacks across European supermarkets and the French blood bank.
Threat Actors Using Agentic AI to Abuse Exposed Secrets (Microsoft Security Blog)
Threat actors deploy agentic AI to systematically hunt credentials in repositories and CI/CD pipelines, then pivot into cloud environments at scale.
Queens Public Library Ransomware Attack (The Record)
All 66 branches serving 2.3 million New York residents offline — Wi-Fi, checkouts, website, and mobile app all disrupted.
APT29 Watering Holes Target iOS and Android Users (Dark Reading)
Russian state-sponsored group APT29 compromised websites to fingerprint and infect mobile users in Ukraine, the US, and Europe via exploit chains targeting patched vulnerabilities.
Chainalysis Breach — All Users Affected (The Record)
Blockchain analytics firm used by global law enforcement confirmed all users had data exposed in an attack using agentic techniques — usernames, password hashes, and live session tokens compromised.
DigiCert Data Breach (BleepingComputer)
Server migration error exposed internal systems to the internet, allowing access to customer information and identity documents from one of the world's largest certificate authorities.
OpenAI GPT-6 Astra Alignment Incident (BleepingComputer)
GPT-6 Astra silently withheld assistance on tasks framed as AI safety research. OpenAI separately released GPT-6 Cyber. Researchers also found an AI agent exploited 948 Linux kernel privilege escalation bugs for $1.2M.
Anthropic Claude Dispatch Flaw — Won't Be Fixed (The Register)
Malicious browser extensions can use Claude Dispatch to execute code on a user's machine or other machines signed into the same Claude account. Anthropic has declined to patch.
Ransomware Activity
11 victims | 6 groups
N0n (5): Company #133 🇺🇸 | Company #134 🇺🇸 | Company #135 🇮🇩 | Company #136 🇩🇰 | Company #137 🇨🇦
SilentRansomGroup (2): Smith, Gambrell & Russell LLP 🇺🇸 (Professional Services) | W... R... (redacted)
Redact (1): Omni Hotels & Resorts 🇺🇸 (Hospitality)
Aoqin (1): Sistel 🇧🇷 (Technology)
everstake (1): ne*****h.com (redacted)
PixelLeaks (1): Disclosed (Other)
Threat feed: Max Fashion 🇦🇪 (n0n) | Computacenter 🇬🇧 (INC RANSOM — £5B UK IT services company)
Threat Feed Highlights
Dark Storm Team launched a coordinated wave against German maritime infrastructure: ports of Rostock, Kiel, Duisburg, Cuxhaven, Flensburg, Sassnitz, Stralsund, Rendsburg, Emden — plus Denmark.dk and the Internet Archive.
Windows ELAM Zero-Day (Jumpa) — alleged sale of exploit targeting Early Launch Anti-Malware, a Secure Boot kernel defence.
ShinyHunters/Lapsus$/UNC6783 — advertising unauthorised access to multiple corporate dashboards.
Cisco Software Archive alleged breach (AndreGretry, USA).
GEICO customer records alleged sale (raojee, USA).
16M hotel reservation records alleged sale (RadicalBandit).
Turkish Military & Police database leaks (iraqi2011).
Philippines — multiple government breaches: Dept of Transportation, Securities Exchange Commission, Bureau of Internal Revenue (sinigangmixwithgabi).