|
🇨🇳 FBI seizes Chinese state hacking tools
LINK
|
- The FBI has seized seven domains used by the Chinese state-sponsored hacking group Flax Typhoon to run two tools, MicroScan and FishHub, operated by China-based Integrity Technology Group in attacks that breached critical infrastructure worldwide.
- MicroScan is a Python-based scanner with more than 1,300 penetration-testing scripts that probed software like Oracle WebLogic, Apache Struts, and WordPress, paired with a Mirai-infected botnet; FishHub then used spear-phishing to plant malware giving attackers remote access and letting them steal files.
- Investigators found stolen data from more than 20 organizations on a FishHub server, and a joint FBI, CISA, and NSA advisory urges organizations to review the published indicators of compromise, patch vulnerable systems, disable exposed services, and enforce multifactor authentication.
|
🔓 Telegram Desktop flaw enables account takeover
LINK
|
- A public proof-of-concept shows how a flaw in Telegram Desktop lets attackers steal local files and hijack accounts after a victim clicks a crafted link opened outside the app, such as from a browser.
- The bug (CVE-2026-107181, high severity at CVSS 8.6) affects versions before 7.2.9: when a link is passed to a running Telegram through its local communication channel, a record-separator character is not escaped, so an attacker can smuggle in a second command.
- That injected command reaches an outdated internal helper that reads local files and sends them to a chat without consent, exposing session files for account takeover; Telegram fixed it in version 7.2.9, and as of today the reporting shows no known exploitation.
|
🐛 Hackers exploit backup server flaws
LINK
|
- Hackers are chaining two flaws in Ahsay's AhsayCBS cloud backup console, software used by managed service providers to centralize backup operations, to break in and run code on exposed servers, Huntress reports.
- They first abuse a medium-severity authentication flaw, then a critical bug (CVE-2026-105134) in the Replication Receiver whose API accepts a random token in place of valid credentials, letting them run code as SYSTEM, drop a JSP webshell, and install the XMRig Monero miner.
- Exploitation has been active since October 7; all AhsayCBS versions through 10.3.4 are affected with no patch yet, so Huntress says to restrict management-interface access to trusted IPs or VPN and, if compromised, fully re-image from a trusted backup because attackers hid secondary backdoors.
|
👾 LMCache flaw lets hackers run code
LINK
|
- A critical flaw in LMCache lets attackers with no login run their own code against instances reachable over the network, by sending data that the caching system unpacks unsafely.
- The bug (CVE-2026-105192, CVSS 9.8, critical) hits LMCache's multiprocess mode, which opens an unauthenticated ZeroMQ socket on port 5555; a crafted message slips a malicious pickle object that runs an operating system command while the data is being decoded, before any checks run.
- JFrog published an advisory and working proof-of-concept exploit on October 7, 2026 with no fixed release available then; the vulnerable path exists across current releases, and operators are urged to keep localhost binding, avoid routable `--host` settings, and firewall off cluster access until a fix ships.
|
|
