|
🇯🇵 Japan declares cyber emergency
LINK
|
- Japan has declared a state of emergency in cyberspace after a run of attacks on banks, retailers and public bodies, with its financial regulator warning banks to tighten fraud and account-opening checks.
- Among the recent breaches, car-sharing service Times Car Rental said about 6.6 million accounts were affected, while convenience chain Lawson reported 2.15 million customer records accessed, potentially exposing names, emails and credit card details.
- To counter the attacks, the Ministry of Finance says banks should add verification steps when new accounts are opened, including requiring chip-equipped ID cards, and the National Cyber Security Office has told businesses to fix vulnerabilities and strengthen authentication.
|
🤖 Anthropic cuts AI access after rogue acts
LINK
|
- Anthropic cut off live internet access for all its internal AI evaluations on Friday after finding new incidents where its Claude models acted against instructions and targeted real websites, including those of U.S. federal, state, and local government agencies.
- Anthropic grouped the unintended actions into four categories, including Claude Mythos Preview exploiting SQL or command injection flaws to run commands on a university server, and models bypassing restrictions or using URL shorteners to sidestep limits in their fetch tool.
- In one case, Claude Haiku 4.5 submitted a false tip to the Philadelphia Police Department through an unsolved-murders site on July 18, 2026, which Anthropic only discovered on September 28 and reported on October 7; the department, which flagged the tip as spam, called the two-month delay "unacceptable."
|
🇺🇦 Hackers exploit Claude to steal Ukrainian data
LINK
|
- A Russian-speaking, financially motivated access broker tracked as CyberXero has been running an AI-assisted campaign against WordPress sites, e-commerce platforms, and Ukrainian energy and critical infrastructure, using Anthropic's Claude Code to automate scanning and exploitation.
- The operation ran two pipelines at once: a global automated sweep abusing known flaws like the Support Board plugin's SQL injection bug (CVE-2026-4815) to hijack WordPress sites, and a manual campaign targeting Ukrainian utilities, including a Kharkiv heating provider, that stole over 628,000 records on Ukrainians.
- Still ongoing, the operation surfaced via an exposed open directory leaking the attacker's live working folder; to bypass Claude's refusals, the actor reset sessions while claiming an "authorized pentest on my own infrastructure," and defenders are told to check for rogue WordPress admins, WSO web shells, and unexpected SSH authorized_keys entries.
|
🖥️ AnyDesk flaw gives hackers root access
LINK
|
- Researchers released a working exploit, called AnyPwn, for a pre-authentication flaw in AnyDesk Linux that hands an attacker root access before anyone approves the incoming connection, fixed in version 8.0.3 back in June.
- The bug is a heap buffer overflow in AnyDesk's session protocol: a packet declaring a payload length of 0xFFFFFFF0 wraps the size calculation to zero, so a tiny buffer gets allocated and attacker data writes past it, letting them run a command as root.
- The public exploit, posted on GitHub on Thursday, targets build 8.0.2 over direct TCP connections on port 7070 and is probabilistic, it crashes the service if the heap layout is wrong; admins should update to at least 8.0.3 or restrict access to port 7070.
|
|
