“We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet,” Ledger said in an X post. The incident is said to have resulted in losses totaling more than $86 million, according to pseudonymous blockchain investigator Specter . Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devices sold by the reseller.
Installing the fixes for the 10 MarkLogic flaws Progress disclosed in August is not enough. ANSSI’s head, Vincent Strubel, called it urgent to take the two series off the internet or fil… CERT-FR is part of ANSSI, France’s national cybersecurity agency. Les Mousquetaires, which owns the Intermarché chain, said its fridges and freezers were put into defrost and heated to as much as 50°C.
At a recent event for security firm NordVPN, NBA superstar Shaquille https://alabama-news.com/what-are-website-migration-service-and-why-do-you-need-them.html O’Neal revealed that he got hacked—and warned the public about the need to “have control of their own information.” Investigators also sought permission to use an invasive surveillance tool called a cell-site simulators against journalist Georgia Fort and a Minnesota state Senate candidate. Join SANS CEO James Lyne and the FBI on ransomware disruption and intel sharing, during SANS training in D.C. Regardless, the tech world is mesmerized by the capabilities and potential of these services. ⚡ Threat of the Week Atlassian Flaw Exploited in the Wild — Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian… This week’s full recap is worth a read, especially the bits that didn’t make the big headlines.
CIA officer admits to creating fake top secret government program to steal over $190M, including gold bars
Progress published all 31 on October 12 and scored five of them critical. It told operators to disconnect the controllers or filter access to them. Whether other models or firmware versions are affected is not known. A compromised account that looks https://openscience.us/repo/other/capec.html legitimate at first could become the starting point for a much larger attack. The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users’ sensitive data to advertisers. The SDK handles authentication for those services with the application’s client credentials, a client ID and a client secret.
Critical Docker Hub Flaw Lets Attackers Impersonate Users and Push Container Images
The attackers reached them through the controller that runs all of a store’s fridges and freezers, a device made by Danish company Danfoss that maintenance firms can manage remotely. With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate. A flaw in SAP’s Cloud SDK for Python can send an application’s OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. This vulnerability, categorized as an Elevation of Privilege (EoP) issue, allows attackers to gain administrator-level access to affected systems. This exploit allows attackers to achieve remote code execution (RCE) by exploiting an arbitrary file write vulnerability.
The attackers have threatened to release sensitive company data within two days unless their demands… The beloved doughnut chain Krispy Kreme has fallen victim to a significant cybersecurity incident, with the notorious Play ransomware group claiming responsibility for the attack. Two of 31 newly disclosed flaws in Progress Software’s MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Together they let an attacker run code as the appliance’s cgi-server user, and the third flaw, a privilege escalation, raises that to root, Volexity said. Microsoft fixed vulnerabilities across Azure and AI-branded products, with privilege escalation flaws accounting for the majority. A small circuit board hidden under the signers’ screens read user data and transmitted it to the attackers.
- Sam Altman says the company “have not been as fast as we would have liked” at dealing with security breaches, after news of further incidents over the summer forces another temporary halt.
- The SDK handles authentication for those services with the application’s client credentials, a client ID and a client secret.
- The CVE record it published on October 13 gives the flaw a CVSS 4.0 score of 9.4.
- Map cross-domain privilege escalation to sever breach routes at key choke points.
OpenAI cuts ties with 3 safety researchers, WSJ reports
Ivanti has released fixes for two of the flaws and told customers on affected versions to “act immediately.” A fix for the third is still pending, according to Volexity. The CVE record it published on October 13 gives the flaw a CVSS 4.0 score of 9.4. It did not reach the Docker Hub web interface, and it could not be used to change a password, email address, or two-factor settings, or to take over an account. “Such an ‘AI worm’ could carry its model weights with it as it reproduces (or re-download them from a public hub), and then run inference directly on compromised hardware,” Anthropic said .
- The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users’ sensitive data to advertisers.
- Cybersecurity Awareness Month 2026 arrives as online attacks become…
- And some systems turned out to be easier to break into than anyone would like to admit.
- The attackers reached them through the controller that runs all of a store’s fridges and freezers, a device made by Danish company Danfoss that maintenance firms can manage remotely.
- The appliance was fully patched at the time and running version 22.8R2.4.
- This vulnerability, categorized as an Elevation of Privilege (EoP) issue, allows attackers to gain administrator-level access to affected systems.
New: Analyzing 2026’s Most Prevalent Browser Attack Techniques
Tasked with controlling AI, an administrator often resorts to blocking well-known AI websites and taking enforcement action without knowing what is actually running. A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. The attack enters through a service that the TV exposes on port 3001, which is used by the LG ThinQ app for pairing. LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12. The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the “very serious” nature of the breach. The appliance was fully patched at the time and running version 22.8R2.4.
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
Three vulnerabilities in LG’s webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. The data protection authority said its investigation found that Xandr was a joint controller with Grindr, which meant it was responsible for obtaining users’ consent before processing their data. “Xandr acted as an intermediary that relayed the personal data of Grindr users in Norway, including data revealing sexual orientation, to potentially thousands of other companies,” the Data Protection Authority said in a statement. An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Experiments show cheap TV boxes can run capable AI models, and small models may soon be able to spread across such devices on their own.