|
🏛️ Traffic routed through White House network
LINK
|
- Security researchers found that residential proxy services routed internet traffic through the White House network, known as AS2650 and registered to the Executive Office of the President, meaning anyone could send requests that appeared to come from it.
- The team's probes exited through the White House network 236 times from a handful of addresses on most days of the month, with 28 separate proxy services able to use it, confirmed independently by detection firms Spur and Synthient.
- Most activity happened on weekday evenings Eastern time, hinting at a person whose device runs an infected proxy SDK; such flawed SDKs have spread botnets like Kimwolf, which reached about 2 million devices.
|
❄️ Hackers overheat supermarket freezers
LINK
|
- The U.S. government is warning of an ongoing threat after hackers raised temperatures on internet-connected supermarket freezers, cold storage units, military fridges, and a blood bank, spoiling food and threatening critical infrastructure worldwide.
- CISA, the FBI, and other agencies said two waves of attacks hit refrigeration units across at least a dozen countries, including remote-controlled freezers made by Danish firm Danfoss, which had stopped sending its customers security updates.
- Officials urged affected industries to disconnect remote control systems from the internet, strengthen passwords, apply patches, and retire unsupported equipment; the U.S. hasn't named a culprit, but researchers broadly blame Iran.
|
🔓 Anthropic won't fix Claude code flaw
LINK
|
- Anthropic will not patch a design flaw in its Claude Dispatch feature, instead choosing to retire the tool by the end of October 2026, leaving the problem open to attack until that shutdown date.
- Dubbed ThisBash by Forever Security, the attack lets a malicious browser extension send commands through a logged-in Claude session to Claude Desktop, even on a separate machine, with a timer auto-clicking every "Allow" prompt.
- The proof of concept needed no browser exploit and quietly opened Calculator, but a real payload could steal files or plant backdoors; researchers say Claude Code Remote Control and Cowork sessions remain open to the same trick.
|
📌 OpenSSH flaw lets intruders bypass login
LINK
|
- Attackers are already abusing an OpenSSH bug (CVE-2026-123158), nicknamed "sshole," that lets remote intruders log into passwordless accounts on Alpine Linux and other musl-based systems without knowing any password at all.
- Security firm Previdian saw the first attack less than nine hours after the flaw went public, confirmed root access on an Alpine honeypot, and counted eight attempts from one Japan-based address using oversized passwords.
- OpenSSH 10.6p2, released yesterday, fixes it, and Alpine patched all branches the same day; admins should restart sshd or set PasswordAuthentication=no, since unverified proof-of-concept exploits are already on GitHub.
|
🐧 Backdoor runs Linux commands silently
LINK
|
- Researchers at QiAnXin's XLab found a backdoor called cwpdoor hiding inside the web server for Control Web Panel, which runs Linux commands sent through web requests that never show up in the server's access logs.
- The backdoor is a rebuilt version of the cwpsrv program that acts normally until a request arrives with a valid signature in custom headers starting with X-Ngx-Integrity, and it then runs the attached command.
- XLab says real victims already exist, after an infected copy was uploaded from Brazil on September 30, and it recommends restoring the original cwpsrv, upgrading, and changing all control panel passwords since it had zero detections.
|
|
