ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories

The U.K. National Cyber Security Center (NCSC) has warned that the widespread availability of AI-powered cyber tools has "almost certainly" led to a significant increase in the discovery of zero-day vulnerabilities. "Defensive AI-cyber tools have reduced the window of a vulnerability moving from zero-day to an n-day vulnerability, and have made patching a quicker process," NCSC said. "However, without correct and widespread configuring of this technology, many systems are still vulnerable to attackers using AI-cyber tools to identify and exploit system weaknesses. Additionally, an organisation’s internal patching and testing processes will need to evolve to meet the pace of accelerating vulnerability discovery. Attackers have subsequently displayed less caution over losing an access to achieve an objective, as the cost to replace is minimal."

An analysis of roughly 383,000 CVEs disclosed from 1999 through September 2026 has found that the median time to patch a vulnerability exceeds a year for network appliances. About 2,000 CVEs (roughly 0.5%) have been linked to real-world exploitation. "The median vulnerability is patched in about two weeks on Windows workstations but in more than a month on Windows Servers," Microsoft said. "It stretches to 10+ weeks on Linux Servers and for applications running on macOS, and beyond a year on network appliances. That gap is the threat actor's window, widest on the critical systems that stay exposed the longest." The tech giant also said threat actors disproportionately target flaws that maximize impact and exposure and enable system takeover, particularly remote code execution, privilege escalation, and authentication bypass.

Authorities have arrested seven people allegedly involved in an investment fraud scheme that claimed potential victims in more than 50 countries, according to Europol. The operation caused estimated losses of at least $4.5 million. The "crime-as-a-service" offering was run by a company from Cyprus and Israel, and allegedly provided cybercrime groups with an assortment of trading websites and fraudulent call centers tasked with tricking victims into transferring their savings. These call centers operated from Albania, Kosovo, and North Macedonia. "More than 100 servers were seized and seven suspects arrested during coordinated action on 3 November 2026," Europol said. "Authorities searched 17 locations and seized servers, other evidence and assets." Like other fraudulent investment schemes, the operation leveraged deceptive advertisements to funnel people towards fraudulent investment platforms, promising them substantial, quick returns from cryptocurrency trading and foreign currencies. Although victims were encouraged to transfer a small amount, they displayed illusory gains to push them into transferring increasingly large sums. The operators resorted to delaying tactics to block payments when they attempted to withdraw their funds. "Behind seemingly legitimate platforms, supposed brokers used fictitious profits and sustained psychological pressure to persuade victims to invest more," Europol said. "Personal data collected through this process was sold to criminal groups operating call centers. Operators then contacted potential victims with supposed investment opportunities, turning their initial interest into repeated demands for money."

Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws, allowing researchers to earn $250,000 for Root-in-Cloud bugs, including tenant-isolation bypasses and complex cross-service logic flaws that let attackers gain full administrative control over arbitrary Google Cloud organizations. "To earn this premier reward, you must demonstrate full administrative control, the equivalent of 'roles/owner' or complete IAM control, over arbitrary Google Cloud organizations or projects with no prior access or special project setup," Google said. "Additionally, valid vulnerability reports demonstrating remote code execution (RCE) in underlying Google production infrastructure (Borg) or achieving root-in-prod will automatically be evaluated by the Google Cloud VRP panel for root-in-cloud eligibility."

Microsoft has announced that its Edge browser will now automatically disable notifications from sites that push scam or scareware notifications, such as fake virus warnings or security alerts. "As of last month’s rollout of Edge 156, when Microsoft Defender SmartScreen or Scareware blocker detects a scam that was pushed through a notification, Edge will automatically disable notifications from the site that sent it," Microsoft said. "The next time Edge starts, an information bar explains what happened. If you believe a site was blocked incorrectly, you can review sites with blocked notifications and unblock them from Edge Settings, keeping you in control."

Two Canadian men, Ryan James Roach, 35, and Mathiew James Stubbings, 41, have been indicted in the U.S. for hacking multiple U.S. universities and using the access to mine cryptocurrency. Both have been charged with conspiracy to obtain information from a protected computer and to cause damage to a protected computer, obtaining information from a protected computer, and intentional damage to a protected computer, which carry a maximum penalty of 10 years in prison and a $250,000 fine. "Between June 2016, and December 2019, Roach and Stubbings conspired to engage in a scheme to hack into computers, steal login credentials, and secretly mine cryptocurrency for financial gain," the Justice Department said. "They used virtual private servers in multiple countries, which were registered under false names. These servers transmitted malware and mining software to victim computers and stored stolen login credentials. Victims of the scheme included educational institutions in New York, Tennessee, North Carolina, and Massachusetts."

Cybersecurity researchers have detailed an encryptionless extortion attack involving PAYLOAD ransomware targeting a manufacturing organization in the Middle East. "The threat actor obtained domain admin-equivalent control of the organization’s Active Directory environment and authored a malicious Group Policy Object (GPO) named PAYLOAD, linking it at the domain root," Kaspersky said. "Through that single object, the actor delivered ransom notes, hijacked the desktop wallpaper and lock screen, enforced a logon banner, and disabled the local administrator account across every domain-joined Windows workstation — all without dropping a ransomware binary or encrypting any data. The only ransomware we found in this incident was a PAYLOAD sample targeting ESXi on Linux servers." The attack represents a convergence of two trends: Living-off-the-land abuse of trusted AD infrastructure and a surge in extortion-only incidents.

A vulnerability impacting Docker Sandboxes (CVE-2026-103916) could have been exploited to bypass file access restrictions, potentially exposing cloud credentials and other sensitive files on a developer's machine through a routine copy command. "The command used to copy files between a sandbox and the developer's computer (sbx cp) does not enforce these access restrictions," Endor Labs said. "An agent can exploit this weakness using what is known as a symbolic link, essentially a shortcut that points to another file or folder. By placing a malicious shortcut inside an approved workspace, the agent can trick a subsequent copy command into accessing files outside the sandbox's approved boundaries." The issue has been addressed in Docker Sandboxes version 0.51.0.

A new study has revealed that smart TVs running operating systems from Samsung, Vizio, and Roku continue to transmit data to automatic content recognition (ACR) endpoints even after users opt out of tracking in the devices' settings. "Opting out fully worked on only four operating systems. On Samsung and Vizio, traffic consistent with ACR kept flowing, and Roku's opt-out doesn't cover its own streaming service," according to a group of academics from Northeastern University. "VIDAA OS sends ACR data to servers run by Unruly over MQTT without encryption, so anyone on the network path between the TV and those servers can read it."

Anthropic has revealed that it's working on an open-source system called FlashProve to cryptographically verify an AI response came from a given model. "FlashProve is a system for provable inference of large Mixture-of-Experts (MoE) language models," Anthropic said. "FlashProve involves two parties: the model provider (the prover) and a user (the verifier). It is split into two phases: In the offline phase, the prover publishes a commitment to the model weights, which is a short fingerprint to pin down one exact choice of weights while the weights themselves remain hidden. The later inference claims will be checked against that commitment, i.e., the weight model committed to in this phase. In the online phase, upon requests from the verifier (i.e., prompts and the corresponding output tokens), the prover produces a proof file proving the following statement: The committed model produces these output tokens when evaluated. Anyone who holds the commitment, the prompt, and the reply can check it, without the weights and with limited compute power, and be convinced that the committed weights, run on this prompt, produce exactly these tokens."

DreamHost has warned of a data breach after an unauthorized third party gained access to the server that runs its web-based File Manager at files.dreamhost.com between August and October 23, 2026. "The unauthorized third party exploited a vulnerability in that software and was able to access the FTP/SFTP usernames and passwords of individuals who logged into this File Manager between approximately August 2026 and October 23, 2026," the company said. "The unauthorized third party was also able to reach certain webmail systems, which may have exposed the session information (the data that keeps a user signed in, including session credentials) of a limited number of webmail users. We believe this was a deliberate attack, and our team worked around the clock to contain it." DreamHost said the attacker may have accessed the credentials used to access the File Manager or webmail, along with the contents of emails and files in the FTP/SFTP server. There is no evidence that the attacker accessed control panel login information or customer billing details.

The maintainers of Apache OFBiz have addressed 46 security flaws, including CVE-2026-68524, which could result in pre-authentication remote code execution, and CVE-2026-109928, which enables full account takeover due to an incorrect authentication algorithm implementation. The issues have been patched in Apache OFBiz 24.09.08.

Cybersecurity researchers have uncovered encryption weaknesses in the updated HYFLOCK ransomware builds. The ransomware operation began to publicly name victims in October 2026, although evidence indicates that the group first appeared in underground forums in March 2026. As of writing, the group has listed 13 victims. "The October 17 build successfully encrypted files, registered a scheduled task, accessed network-share resources, and attempted to interfere with system recovery," Check Point said. "In an earlier October version, researchers identified a processing defect that could permanently discard portions of a file, potentially preventing complete recovery even with the correct decryption key. The October 17 build exhibited another issue. Larger files had only their first 4,096 bytes encrypted, leaving additional content accessible beyond that initial section."

DigiCert said it has identified an event involving unauthorized access to one of its business systems that stores information shared by customer representatives to validate their identity. The company said its certificate operations were not impacted. "Most of the data was limited to business contact information for customers: names, business email addresses, phone numbers, and business addresses," DigiCert said. "A small minority of customer accounts included additional personal data in the form of a customer-provided document such as a driver's license, passport, utility bill, or other document with name and address. The access could not write records, act as a validation approver, or issue certificates."

Threat actors have hijacked a little over a dozen DeFi websites registered with Name.com, including Flap, Kintsu, Pickle Finance and Origami Finance, ultimately stealing about $138,000 in assets. The sites have been found to be rigged with a malware kit that tricks visitors into approving transfers out of their wallets once they connect them to the compromised site. Vercel said it's aware of nine domains associated with the platform that were impacted. "Over about 45 minutes on Oct 31 (UTC), an account within an associated support team made changes to the nameservers associated with 15 domains registered with name.com," Name.com said in a post-mortem. "The domains were directed to a malicious page hosting Step Drainer malware."

Todyl has disclosed that an unknown threat actor has been abusing stolen Microsoft Entra ID application credentials and Azure DevOps identities to access MSPs' Microsoft 365 and Azure environments, reaching at least 27 organizations. "About 45 app registrations at roughly 18 organizations were targeted, and more than 33 of them authenticated successfully," Todyl said. "Through those apps the actor has reached 27 organizations so far, including the MSPs' downstream clients in government, energy, food and agriculture, transportation, construction and engineering, legal, education and nonprofits. It has run searches across about 25 tenants, downloaded 81 files and accessed around 2,279 mailbox items." The sign-in activity has originated from the IP address 199.19.77[.]84.

Ahmad Umar Agha (aka Th3Pr0), a Syrian national tied to the Syrian Electronic Army (SEA), has been sentenced to 42 months in prison in the U.S. for his involvement in an expansive hacking conspiracy organized and led by members of former Syrian President Bashar Al-Assad regime between Aug 2011 and January 2014. "To spread the former Syrian government's propaganda, Agha hacked approximately 47 Western media entities, businesses, non-governmental organizations (NGOs), and U.S. and allied government entities," the Justice Department said. "In one instance, Agha’s actions caused a flash crash in the U.S. stock market, resulting in a temporary $136 billion loss in the value of stocks making up the Dow Jones Industrial Average." Agha and his alleged accomplice, Firas Dardar, were first charged in June 2014. Dardar remains at large.

A new piece of malware has been observed targeting AI agents creating cryptocurrency wallets. "A GitHub repository posing as a Solana starter kit, which ranks as the top result when an agent searches for one, contains malware that gives an attacker remote control of the victim's machine, including the crypto wallets on it," AIR Security said. The activity has been codenamed SolanaCry. The attack builds upon the foundation of Web Hole, where an AI agent, in its quest for finding answers to a problem, can inadvertently run a command suggested by an attacker and perform malicious actions. "To get a payload into search results, an attacker has two options," AIR said. "The first is to build a site of their own and grow its reputation with SEO, backlinks, content, time, until the search engine treats it as relevant and trusted. Once it ranks, they change the content and drop in the payload. The second is easier: find dead sites that still show up as ranked results, and use those to deliver it."

Thousands of Android phones belonging to retail banking customers in the Middle East, Turkey, and Africa (META) region have been compromised with the Mirax trojan between March and September 2026, leading to estimated losses worth millions of U.S. dollars. "Where unauthorized international transfers were reported, funds were sent to accounts abroad, some of which are suspected to be mule accounts," Group-IB said. "The campaign uses dynamically generated package names and impersonates 'Google Play Services' to evade user suspicion and signature-based detection." Like most Android malware, Mirax is used to facilitate device takeover (DTO) fraud by abusing Android's accessibility services. "With it, the attacker is able to see and control the compromised device in real time: reading credentials, intercepting one-time codes, capturing the PIN to unlock the device later, opening a banking app and moving money out to newly added beneficiaries and mule accounts abroad," Group-IB said. Campaigns using Mirax have been attributed to Aquafina, a threat actor known to be active since March 16, 2026.

Irregular's evaluation of Zhipu AI's open-weight model GLM-5.3 across 13 offensive cyber scenarios using CyScenarioBench has found that the model "did not refuse any of the tested offensive tasks" and "repeatedly reached correct answers while violating explicit task instructions." The AI security company said these violations can be interpreted as a form of reward hacking. "Crediting the answer alone could mislead capability assessments and deployment decisions, while rewarding it during training could reinforce these instruction violations," it added.