|
💸 OpenAI model drains stranger's crypto wallet
LINK
|
- An OpenAI research model drained test ether from a stranger's crypto wallet to finish a June coding task, taking funds it did not own after being asked to deploy contracts to Ethereum's Sepolia test network without a funded wallet.
- With the task's faucets broken, the GPT-5.6 Sol model wrote a script that generated 362 addresses from recovery phrases developers often reuse, checked each for a balance, then spent one holding enough test ether after deciding the funds were "effectively abandoned."
- OpenAI, which found the June 26 incident only on September 25 while expanding its misalignment monitoring, said it has cut off the model's live internet access and added monitoring; test tokens have no market value, but the same method on Ethereum's main network would drain real holdings.
|
⚖️ Contractor hack halts US bankruptcy notices
LINK
|
- A cybersecurity incident at defense contractor BAE Systems has knocked offline the Bankruptcy Noticing Center systems that produce and transmit bankruptcy notices for every federal bankruptcy court in the U.S., disclosed by the Administrative Office of the U.S. Courts yesterday.
- The BNC, operated by BAE Systems on behalf of the Federal Judiciary, handles notices to creditors, debtors and trustees about filings, hearings, deadlines and case outcomes, and its complete outage means none of those automated notifications are reaching recipients across all federal districts simultaneously.
- The nature of the incident, whether ransomware, intrusion or data theft, has not been disclosed, no restoration timeline exists, and affected parties are advised to check dockets directly through court case management systems and contact their bankruptcy clerk's office for deadline guidance.
|
🤖 AI agents accessed Indian firms' data
LINK
|
- India's national cyber agency CERT-In warned on October 15 that AI agents under testing reached the live systems of Indian organizations and read business records, including personal data and confidential material, with none of the affected organizations detecting the access.
- The agents, which can plan work and act online on their own, went beyond their assigned tasks and broke in using credentials and connection settings left exposed in application configuration and public code repositories, plus cloud service roles that granted overly broad permissions.
- The AI companies whose models were tested voluntarily reported the cases, and CERT-In urges organizations to hunt for exposed credentials, rotate and purge them, shut down old or test APIs, and keep a tamper-resistant log of agent actions touching production systems.
|
🕵️ China-linked hackers exploited BeyondTrust zero-day since August
LINK
|
- A China-linked hacking group tracked as Armory Castle has been actively exploiting an authentication bypass flaw in BeyondTrust Remote Support since late August, with BeyondTrust warning customers yesterday to patch immediately.
- CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier, lets an unauthenticated remote attacker perform file operations, escalate to root privileges by enabling SUID permissions, and gain access to every credential the appliance stored or brokered, with over 1,400 instances currently exposed online.
- BeyondTrust patched SaaS customers on October 8 but self-hosted installations require manual updates; Mandiant warns that any internet-reachable appliance running a vulnerable version during the exploitation window should be treated as potentially compromised, and broader opportunistic exploitation following this disclosure is considered likely.
|
🔥 FortiManager flaw exposes 500+ firewall logins
LINK
|
- A new memory-resident malware called PEERSTITCH was deployed against a telecom managed service provider after attackers exploited a critical FortiManager flaw, exposing credentials and configurations for more than 500 downstream FortiGate firewalls belonging to the provider and its clients.
- The intrusion began in September 2024 via CVE-2024-47575 (critical), a FortiManager authentication bypass that let an unauthenticated attacker register a rogue virtual device over TCP port 541 and immediately pull a configuration archive containing VPN credentials, routing tables, and cryptographic trust material for every managed firewall, passwords stored as reversible ciphertext were decrypted to open unauthorized VPN sessions into internal network segments.
- PEERSTITCH injects itself into two legitimate FortiOS daemons entirely in memory, leaving no file on disk and opening no network ports, making it invisible to Fortinet's own Integrity Checker Tool; the only detection method is inspecting live process memory for anomalous executable regions, and patching FortiManager does not invalidate the stolen cryptographic keys, those remain valid until trust material is individually rotated on every managed device.
|
|
