🇨🇭 A software supplier used by Switzerland’s Publica pension fund was hit by a cyberattack in late September. A data leak is confirmed, but authorities are still determining what Publica information was affected. The Attorney General’s Office has opened an investigation, and Publica has informed its members. The AKIRA hacking group has attacked about 200 Swiss companies, causing millions of francs in losses. The authorities say not to pay the ransom and to contact them and file a criminal complaint. Companies can reduce risks by updating systems, securing remote access, and protecting backups.

🇺🇸 🚑 💰 A former Massachusetts ambulance company will pay $1 million to settle allegations of Medicaid billing fraud and data security violations. The 2023 hack exposed sensitive information belonging to more than 750,000 state residents. The settlement also requires the company to securely destroy its stored personal and health data.

🚅 Hackers may have accessed some Railway customers’ secret keys and data. Railway has paused deployments and urged all users to replace their API and cloud keys. The company is investigating but has not said how many users were affected.

🗾 Hackers breached Onamae Desktop Cloud and installed malware on up to 26,739 customer servers. The company shut down the service, and data on affected servers may have been exposed, though no leaks are confirmed. Customers should change saved passwords and watch for phishing; payment card details were not affected.

🇮🇳 State Bank of India found 3,897 customer records in a larger dataset on the dark web — The records may include personal and loan-related details, but the bank has not confirmed their authenticity or source. The bank is investigating; the leak could expose customers to impersonation scams.

🧬 💰 23andMe agreed to pay California $6 million over a 2023 hack that exposed data linked to nearly 7 million people. The proposed settlement lets affected customers request deletion of their data and destruction of their saliva samples. It is one of several settlements and penalties tied to the breach.

🇺🇸 Bullhorn took its staffing platform offline after a cyberattack caused a widespread outage. The company says it has contained the immediate threat and is working with CrowdStrike to restore services. It has not yet determined whether customer data was stolen, and some services remain unavailable or impaired.

🇺🇸 A stolen login let someone copy sensitive records of current and former California public school students from an ETS file-sharing site. The records may include personal, school, disability, and test information, but not Social Security numbers or financial details. ETS shut down the site, and affected students are being offered two years of free identity protection.

💰 Conduent has agreed to an $80 million preliminary settlement over a 2024 cyberattack that exposed data belonging to 62.2 million people. The settlement would provide cash benefits and one year of credit or medical data monitoring. Conduent denies wrongdoing and has agreed to strengthen its cybersecurity.

☁ Hackers exploited ConnectWise’s Cloud Backup service to access Microsoft 365 tenants, with at least 162 tenants reported compromised. They used the app’s existing permissions, and some attacks included attempts to gain administrator access and maintain access. ConnectWise shut down the service while investigating; customers should check for unauthorized app access and credentials.

→ More breaches:

🇷🇺 🇺🇦 UAC-0099 reportedly gained access to a Ukrainian grain company before Sandworm carried out a destructive attack. The attackers used MythicRatatoskr, a new backdoor that hides its control server in the Yggdrasil mesh network. The backdoor could run commands, steal files and screenshots, and likely help deploy a SOCKS5 proxy.

🌍 Interpol-led Operation Serengeti III disrupted nearly 11,000 cybercrime networks across 21 African countries and arrested more than 1,400 people. The operation identified nearly 66,000 victims and recovered over $105 million in illegal funds. Authorities targeted scams, ransomware, fraud, and illegal cryptocurrency mining.

🇨🇳 A China-aligned group called Bronze Sandcastle has targeted organizations in Asia and Africa since mid-2025. It tricks trusted Windows programs into loading malicious code that installs backdoors and steals information. Researchers advise watching for suspicious program behavior, since encrypted attacks can evade file-based detection.

🇵🇭 🇺🇸 ⚖ Robert Wayne Boling Jr. pleaded guilty to a fraud scheme that stole money and benefits from thousands of U.S. service members and veterans. He used stolen personal information and worked with others to move the stolen funds. He could face up to 40 years in prison.

🇳🇬 ⚖ A Nigerian hacker was sentenced to eight years in prison for helping steal tax and personal data from at least 800 people. The group used the stolen information to get fraudulent tax refunds and loans. He must also repay $3.6 million and forfeit nearly $11 million.

🇷🇺 🐀 APT28 breached a NATO-country naval shipbuilder and other military-related targets, stealing credentials and creating a hidden route into the network. It used its HOOKEDGE backdoor and a newly discovered tool to run malware in memory. Russian-linked hackers are also targeting Ukrainian organizations and mobile devices with spyware and other malware.

🗓️ {Cyber,Info}Sec Events — A community-maintained list of infosec conferences worldwide. Subscribe to the ICS calendar feed to get events straight into your calendar, or follow @[email protected] on Mastodon for weekly digests. Contributions and ⭐ welcome!

🇺🇸 💰 😱 A New Mexico judge ordered Meta to pay $25 billion after a jury found it misled users about Facebook privacy — Meta denies wrongdoing and plans to appeal. The case stems from Facebook user data being shared with Cambridge Analytica.

🇺🇸 🗳 Federal officials arrested 28 California residents accused of illegally registering to vote — The administration says thousands more voters may be noncitizens, but past checks have found few confirmed cases and no evidence of widespread fraud. The raids intensify a broader fight over whether federal or state officials control elections.

🐛 🤔 WhatsApp help pages contained hidden instructions telling its AI chatbot not to suggest privacy regulators or cite privacy laws in some situations. The company said the text appeared because of a bug and removed it after reporters asked about it. It is unclear whether the chatbot followed the instructions.

🇺🇸 ❌ 🇨🇳 DHS is banning federal civilian agencies from buying or using DeepSeek products. Officials cite risks to privacy and national security, including data stored in China. Agencies must remove existing versions, though they can request exceptions.

→ China Defends DeepSeek After US Ban of Its AI From Government Systems

→ DeepSeek reportedly raises $15B days after US restrictions

👀 🇷🇸 Researchers found Pegasus spyware on a phone used by Serbian university leader Vladan Đokić, a supporter of anti-corruption protests. A lawyer investigating a corruption case also received an Apple warning about possible spyware targeting. The cases raise concerns about surveillance of critics as Serbia prepares for elections.

🧅 Attackers hijacked over 300 Tor relays and redirected some SSH connections to servers that stole passwords. Only people who accepted an unfamiliar host key and logged in with a password between October 1 and 5 were at risk. The relays were removed, and operators should check for compromise and change any exposed passwords.

🤖 LiteLLM version 1.107.0 was compromised and distributed with malware that steals credentials and installs a backdoor. The attackers appear to have used stolen GitHub access tokens, and the investigation is ongoing. Users should replace exposed credentials from a clean device and use version 1.106.2.

🇧🇾 🇷🇺 A Belarus-aligned group spent nearly two years spying on a Russian healthcare organization. It hid the Vasilek backdoor in VMware Tools to steal data and control infected computers. The attackers focused on staying hidden and avoided disrupting the organization’s systems.

🇰🇵 North Korean Lazarus hackers used a complex malware campaign to target South Korean organizations. They used post-quantum encryption to hide malware from security tools. The attacks deployed tools that could steal data, run commands, and install more malware.

☁ An attacker hijacked a contributor’s GitHub account and replaced files in five OVHcloud CLI releases with malware designed to steal secrets. The files were available for 94 minutes, and some users may have installed them without a hash check. Anyone who may have run a compromised version should rotate all secrets from another device, then install the clean v0.16.0 release.

⏱ Hackers briefly altered Aomei’s update servers to send malware to users of Backupper and AnyViewer. The attacks installed tools that gave the hackers remote access while trying to evade detection. Aomei secured its servers, but affected computers may still be infected.

🏴‍☠ OpenAI said two coding agents weakened or removed safety monitoring after misreading routine instructions. Their actions stopped alerts or hid changes from the security team. OpenAI has updated its checks and plans to require safety reviews for each type of workload.

🇨🇳 🇺🇸 A study found Alibaba’s coding AI made more vulnerable apps for a US defense contractor than for a Chinese one. Removing the model’s political bias eliminated the gap without reducing how often it built working apps. The researchers urge organizations to test AI-generated code before using it.

🇺🇸 🗒 U.S. security agencies issued voluntary guidance for preventing and handling rogue AI agents — It recommends monitoring agents, limiting their access, and quickly containing risky behavior. The guidance focuses on AI developers and leaves out adversarial attacks, a key concern for businesses.

🔑 A breach at OpenCode may have exposed some users’ OpenAI, Anthropic, or Google API keys saved in its Console service. Affected users should revoke those keys, replace them, and check for unexpected charges. OpenCode says the breach is ongoing, but has not confirmed that any keys were copied or used.

➝ From the Patching Department:

🩹 🚨 PHP has released emergency updates for two critical flaws that could let attackers run code or read sensitive memory on vulnerable servers. The flaws affect many PHP versions and server setups, so updating PHP and restarting its services is the only complete fix. Early attack attempts have been reported, but no successful break-ins have been confirmed.

→ How PHP's Coordinated Disclosure Process Went Belly Up

→ PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

→ Widespread PHP Flaw May Cause Many Site Outages Today

→ PHP armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet

→ Amazon says PHP2Shell exploitation began 4 days before patches

🦠 Attackers are trying to use the critical PHP2Shell flaws to spread Mirai malware, but no successful breaches have been confirmed. Researchers have found ways to overcome security protections, though current exploits often need unusual server settings. Many PHP systems remain unpatched, including millions running outdated versions.

🐛 Researchers showed that crafted Brotli data can run malicious code in some Node.js builds — The flaw affects apps that decode untrusted Brotli data, though no real-world attacks have been reported. Update Node.js to a patched release; temporary traffic controls do not replace the fix.

🐧 Two serious, publicly disclosed flaws could let attackers run code on Linux servers using KSMBD, and neither has a mainline kernel fix yet. One flaw needs no login; the other requires SMB Direct and specific network hardware or software. Admins can check whether KSMBD is active and should watch for fixes.

🔑 🔓 Eight eMudhra intermediate certificate keys were compromised because they were generated with weak randomness. Attackers could use them to create fake certificates and intercept or impersonate secure connections. eMudhra revoked the certificates, and organizations should replace affected certificates, update trust stores, and check for suspicious activity.

⚠ 🩹 GitLab fixed a critical flaw that could let attackers run code on self-managed servers without logging in. It affects versions dating back to 2014, so administrators should upgrade to a fixed release. GitLab reports no known attacks, and GitLab.com is already protected.

→ Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws

⚠ 💬 Signal fixed a serious flaw that could let callers keep a victim’s microphone or camera active after hang-up. The bug affected RingRTC and was fixed in version 2.72.0. Users should update Signal and check that calls have fully ended.

⚠ 💥 Qilin and INC ransomware groups are exploiting a patched Palo Alto Networks flaw to bypass MFA and access company networks. They use this access to steal credentials and data, spread through networks, and deploy ransomware. Organizations should install the fixes and investigate suspicious VPN activity.

⚠ 💥 Hackers are exploiting a critical SiteGuard flaw to run commands with root or SYSTEM privileges. The flaw affects certain versions when the statistics feature is enabled. Administrators should save diagnostic evidence, then update or apply the vendor’s patch.

🦠 Attackers exploited a Siemens Software Center flaw to load malware through malicious DLL files. Siemens released a fix in version 4.0.9.8 and says its own systems and update channels were not breached. The attacks appear linked to Romulus, a ClickFix campaign that tricks users into running harmful commands.

🛜 🚨 A flaw in Broadcom Wi-Fi software lets nearby attackers take control of some routers without a password. Millions of devices may be affected, and many have no available fix. Owners should check their routers and replace devices that cannot be patched.

Follow me on Mastodon for quick daily updates and bite-sized content.

Prefer using an RSS feed? Add Infosec MASHUP to your feed here.

Enjoying our newsletter? Forward it to a colleague—
it’s one of the best ways to support us.

Thanks for reading today’s newsletter, and if you're enjoying it and want to support my work, you can buy me a coffee ☕ over at https://www.buymeacoffee.com/0x58

See you next time!

-X.