|
🔗 ChatGPT bug let shared links steal chats
LINK
|
- Researchers found a serious ChatGPT bug that let a malicious shared conversation run attacker-controlled code inside another signed-in user's session, reading private chats and sending stolen data to an outside server through a single crafted link.
- The attack chained ChatGPT's HTML Preview frame with the MathLive math library, which accepted messages without checking their origin, then used a YouTube endpoint to run code as the trusted ChatGPT site about 4.5 seconds after opening.
- Parameter reported the flaw on October 18, OpenAI fixed it on October 26 by rejecting the risky MathLive messages, rated it P1, and paid a $5,000 bounty; no exploitation in the wild was mentioned.
|
💰 Bitcoin wallets hit by thefts
LINK
|
- BTCPay Server urged everyone running its self-hosted payment software to take their instances offline yesterday after reports that attackers were accessing and draining hot wallets, the Bitcoin stores that keep signing keys on the server.
- The project told administrators to run the shutdown command while it investigates, but has not revealed the cause, how many servers were hit, or how much Bitcoin was stolen from affected merchants.
- The theft follows two recent problems: an emergency update (v.2.4.7) released on October 29 to patch a flaw, and an August exploit that drained Lightning Network keys from several nodes, including one run by Foundation.
|
🕵️ New malware ranks victims by wealth
LINK
|
- A newly found Windows data-stealer called VOLTA-AUTODOXER grabs everything from an infected PC, then asks an AI model to rank the victim's valuables by how much cash they could fetch, Cisco's Talos researchers report.
- The malware steals browser passwords, cookies, cards, email profiles, crypto wallets, and Wi-Fi passwords, then builds a dossier with home address and employer before sending it to OpenRouter using Anthropic's Claude by default, switching models if one refuses.
- Much of its token theft bypasses Chrome's App-Bound Encryption by launching Chrome without a window; blocking that process stops the Chrome theft, and victims should rotate all keys, passwords, and move funds to a fresh wallet.
|
🔓 Hackers exploit Ivanti VPN flaws
LINK
|
- Hackers are actively exploiting two flaws in Ivanti Connect Secure VPN software, prompting CISA to add both bugs to its Known Exploited Vulnerabilities list on Friday after attacks were spotted in the wild.
- A threat group called UTA0576 chained the flaws, including privilege escalation bug CVE-2026-111357, with an earlier authentication bypass to gain root access, then stole credentials, Active Directory data, administrator passwords, and BitLocker recovery keys rather than planting malware.
- Ivanti has released patches in its latest supported versions, and federal agencies were ordered to fix the privilege escalation flaw by today, with the second bug, CVE-2026-118527, due by November 13, 2026.
|
💻 Linux flaw lets attackers hijack clusters
LINK
|
- A critical certificate flaw in the Linux container tools LXD and Incus lets remote attackers skip login checks and seize control of clusters and the virtual machines they manage, without needing a password or key.
- The service proves a client owns the first certificate in a TLS handshake but never checks the rest of the chain, so an attacker can attach a trusted public certificate and be accepted as its owner despite lacking the private key.
- Incus rates it a maximum score and Canonical tracks it as CVE-2026-112816; neither advisory reports exploitation, and the fix is updating to a patched release since no configuration workaround exists, only limiting listener access.
|
|
