|
🎮 Sony reveals breach exposing 2.6 million records
LINK
|
- Sony Network Communications says attackers broke into the So-net member database and stole personal data on more than 2.58 million current and former customers, plus the email passwords of 54,401 users.
- The stolen records cover So-net members and plala subscribers, exposing names, phone numbers, email addresses, birth dates and connection IDs, along with 16 bank account records, though no passwords from membership data or credit card details leaked.
- The breach hit on October 19 and was confirmed on October 23; So-net cut off the attacker's server, reset the exposed email passwords yesterday, and warns customers to watch for scam messages that exploit the leaked details.
|
🤖 Hackers automate attacks with 44 AI agents
LINK
|
- Hackers turned CyberStrikeAI, an open-source penetration-testing platform, against mostly Japanese organizations, running 44 coordinated AI agents that handled network scanning, exploitation, persistence, and data theft without a person steering each individual task.
- Over a short stretch in October 2026 the tool checked weaknesses at 19 organizations, 16 of them in Japan, assigning work to specialized agents, logging findings in a database, and even producing Japanese-language fake login pages.
- TrendAI found the activity in exposed attacker files; no new flaw was used, entry began through an unauthenticated admin interface on a legacy system, and many reports recorded no breach, with deep compromise hitting only a few targets.
|
🔓 Oracle business software flaw is under active attack
LINK
|
- Hackers have started probing a critical Oracle E-Business Suite flaw that lets them run commands without logging in, with threat intelligence firm Defused spotting exploratory attempts against its decoy systems yesterday.
- Tracked as CVE-2026-101767 with a severity score of 9.8, the bug lets a crafted web request trigger SQL injection through the Thin Client Framework servlet, chaining into command execution under the EBS application account.
- Oracle patched the hole on Tuesday last week before the probes appeared, so these are attempts, not confirmed breaches; admins should patch now and meanwhile pull the servlet from the URL firewall allowlist.
|
🪱 Malware hid in oversized GitHub files
LINK
|
- Researchers found a wave of malware hiding inside oversized GitHub files, part of the testmetest npm campaign that turned 42 booby-trapped repositories across 11 real owners into tools for stealing credentials and publishing bad packages.
- The payloads measured about 13 MB each, big enough to slip past GitHub's search and content-retrieval checks, and used a loader mixing character scrambling, AES-128-GCM decryption, and a Bun bootstrap to launch the credential thief.
- SafeDep reported the worm now runs when an app simply imports the package, so turning off install scripts won't stop it; separate workflows attempted CVE-2026-41940 exploitation against cPanel, though JFrog confirmed no successful downstream compromise.
|
💻 UEFI flaw lets attackers run code
LINK
|
- A 16-year-old flaw in TianoCore EDK II, the open-source UEFI firmware that boots most of the world's servers, lets attackers run their own code before the operating system and its security checks load.
- Tracked as CVE-2026-97631 with a severity score of 9.5, the buffer overflow sits in a PXE network-boot driver that copies ICMP error messages past a fixed size limit, letting an attacker on the local network corrupt memory and run code at the CPU's highest privilege level.
- There's no sign it has been exploited or used for initial outside access, but AMI's early fix last month exposed details before January's planned disclosure; firms should patch firmware, turn off network boot where possible, and watch logs, since Secure Boot and TPM don't block it.
|
|
