|
🛂 Apps exposed passports without login
LINK
|
- Researchers who scanned nearly 160,000 apps made with the AI coding platform Lovable AI found passport numbers, private chat messages, and payment details sitting in databases that opened without any login.
- German security firm Crissy Field pulled projects from the Common Crawl archive and found that of 34,545 apps using the Supabase storage service, 24,664 handed over records to anyone with no credentials at all.
- Email addresses appeared on 7,403 sites, one provider exposed over 1,000 passport records with nationalities and expiry dates, and the firm said non-technical users building apps from plain-language prompts tend to skip security reviews.
|
🔒 Ransomware gang hit a UK school
LINK
|
- The 3AM ransomware group broke into a UK school network in a mixed human-and-AI attack, encrypting 37 machines over nine days in September and spreading across linked schools, according to an investigation by Bitdefender.
- Bitdefender, which calls this the first such case documented in Europe, said a human set goals while an AI model handled repetitive work like firing off commands 40 to 100 seconds apart and joining three Active Directory domains together.
- The affiliate stole backup credentials, ran Mimikatz, made two backdoor admin accounts, and stole 40 financial files; defenders should keep domain admin accounts separate, guard backups, and put an endpoint agent on every machine.
|
🩸 Hackers set French blood freezers to 110°C
LINK
|
- Hackers broke into the systems of Coolworld, a cooling supplier to the French Blood Establishment (EFS), and raised freezer settings from around −30°C to 110°C overnight on Sunday, threatening frozen plasma kept for transfusions.
- An on-call technician spotted the rising temperatures in time, and France's Health Ministry said staff responded before any operational harm; reports confirm no destroyed plasma, disrupted transfusions, patient harm, or stolen donor data so far.
- No public findings name the attackers or entry method, and a Danfoss flaw cause is unproven; an October 12 CERT-FR alert on compromised refrigeration controllers urges removing internet-facing interfaces, using VPNs, updating firmware, and changing default passwords.
|
🔓 WordPress flaw lets hackers run code
LINK
|
- A high-severity WordPress Core flaw lets unauthenticated hackers run their own code on servers, and U.S. cybersecurity agency CISA confirmed it is being actively exploited after patches arrived late last month.
- The bug, tracked as CVE-2026-119977, is a timing race condition that opens a brief window during a full Core update, letting attackers reach predictable, web-accessible staging paths used by the installer.
- Security firm Wordfence logged over 18,500 requests hitting staged installer paths within 21 hours of disclosure, and federal agencies had until tomorrow, November 06, 2026, to apply the fix.
|
📱 Russia's APT29 hacks phones via fake sites
LINK
|
- Russia's APT29 hacking group ran a wide watering-hole campaign that infected iOS and Android phones through hacked websites, cloned domains, and a tampered analytics service, security firm Sekoia found, using only already-patched flaws.
- Three entry points all loaded a script called "UltimateFingerprinter," hidden behind 2.3 MB of junk code, which collected 394 data fields and served an exploit chain, including the DarkSword iOS kit that steals messages, WhatsApp, Telegram, and Keychain secrets.
- Because the attacks relied on patched n-day bugs like CVE-2026-20700, updated devices stay safe; Sekoia advises patching iOS and Chrome, enabling Lockdown Mode, and blocking the starx-net and related domains used to send stolen data.
|
|
