Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
67 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
intelligence_src_f9879f264b7a8ec1d7Recent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Alongside the NCA, DOJ, FBI, Meta, and partners across 10 countries, Silent Push mapped adversary infrastructure behind West African scam centers during Joint Disruption Week in London. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Every scam center requires digital infrastructure to operate: domains, hosting, and a steady stream of fresh accounts to scam new victims in various ways. Such operations can quickly go dark when a massive-scale, collaborative law enforcement effort disrupts those components. That principle drove Silent Push’s role in Joint Disruption Week, a coordinated international operation called Operation Blackout, aimed at criminal scam networks operating out of West Africa. Hosted by the UK’s National Crime Agency (NCA) in London, the effort brought law enforcement and private industry together to share intelligence in real time and act on it. This operation led to a significant number of positive results, including the complete disruption of multiple fraud and scam centers, assets identified to freeze, identification of the operators across multiple African countries with subsequent arrests, and most importantly, the rescue of over 100 people trafficked against their will to work in fraud and scam centers successfully identified and located. How Silent Push Contributed to Operation Blackout: Infrastructure Identification and Mapping We supported the operation with what we do best: infrastructure identification, tracking changes to that infrastructure, and correlating across specific activity and linkages observed for a complete picture of the digital infrastructure that keeps fraud and scam center operations running. Our team mapped the domains, hosting, and even the communication channels these networks depend on, then paired that mapping with attribution analysis to trace activity back to physical locations and the people operating them. We shared certain findings exclusively with law enforcement. Our additional results included: Silent Push identified and verified 37,041 financial crime domains detected over the past year The team built 70+ detection rules and mapped them to this criminal network’s patterns and processes. The recon work performed exposed 173 very high-risk critical infrastructure nodes. Silent Push identified 679 operator handles used across a variety of scam tactics. The team also shared 11 intelligence reports with partners involved in the operation. This is what Indicators of Future Attack (IOFA®) demonstrate. Instead of waiting for a scam domain to show up in a victim complaint, we fingerprint the infrastructure patterns criminals rely on and flag new assets as they stand up. This gives law enforcement a map of where a network is going, not just where it has been. A Global Coalition Built for Speed The NCA hosted the operation in partnership with the U.S. Department of Justice, the FBI, and several U.S. federal agencies. Those included the DOJ’s Scam Center Strike Force, the U.S. Secret Service, the Department of the Treasury, Homeland Security Investigations, and the Homeland Security Task Force. The group worked with Nigerian and Ghanaian authorities, INTERPOL, and law enforcement from Australia, Canada, India, and New Zealand. On the industry side, Silent Push joined Meta, Adobe, Binance, Chainalysis, Coinbase, Cyjax, Elliptic, Flashpoint, Google, Microsoft, OpenAI, Starlink, and TRM Labs. Meta played a central role in coordinating private sector participation. The disruption culminated in a week of joint work in London, building on months of investigation that continues. Investigators and industry partners traded intelligence across platforms, jurisdictions, and financial systems, then moved against scam centers in Nigeria,
First reported Oct 15, 2026 17:25 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. <div> <div> <div><p><strong>Serial number: </strong>AV26-1048<br /><strong>Date: </strong>October 15, 2026</p> As of October 14, 2026, SonicWall is affected by vulnerabilities in the following product: Network Security Manager (NSM) On-Prem (VMWare, Hyper-V, Azure and KVM) Version 4.3.1 and prior The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. SonicWall NSM On-Prem Affected By Multiple Vulnerabilities SonicWall Security Advisory </div> Article Link: SonicWall security advisory (AV26-1048) - Canadian Centre for Cyber Security 1 post - 1 participant Read full topic
First reported Oct 15, 2026 18:05 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Ralph Losey discusses the evolving relationship between information, knowledge, and wisdom, emphasizing that wisdom is an ongoing process involving learning from actions and consequences. He advocates for a collaborative human-machine approach to enhance understanding, warning against the dangers of misinformation and the need for accountability in AI systems. A focus on reversibility and contestability is vital to developing a wisdom-based infrastructure that improves decision-making and fosters cooperation. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Article Link: The Wisdom Spiral: Evolving Knowledge in a Changing World 1 post - 1 participant Read full topic
First reported Oct 15, 2026 19:36 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. <div> <div> <div><p><strong>Serial number: </strong>AV26-1049<br /><strong>Date: </strong>October 15, 2026</p> As of October 14, 2026, F5 is affected by vulnerabilities in the following products: NGINX Gateway Fabric Prior to 2.8.0 NGINX Ingress Controller Prior to 5.7.0 NGINX JavaScript Prior to 1.0.2 NGINX Open Source Prior to 1.30.6 Prior to 1.31.7 NGINX Plus Prior to 37.0.5.1 Prior to 37.1.0.1 Versions R33 to R36 NGINX Instance Manager Prior to 2.24.0 F5 WAF for NGINX Prior to 5.16.0 Prior to 5.14.2 F5 DoS for NGINX Prior to 4.11.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. K000162615: NGINX ngx_http_js_module vulnerability CVE-2026-101019 K000162617: NGINX Ingress Controller vulnerability CVE-2026-104939 K000162416: NGINX ngx_http_core_module vulnerability CVE-2026-15176 MyF5 New and Updated Articles </div> Article Link: F5 security advisory (AV26-1049) - Canadian Centre for Cyber Security 1 post - 1 participant Read full topic
First reported Oct 15, 2026 18:25 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. <div> <div> <div><p><strong>Serial number: </strong>AV26-1045<br /><strong>Date: </strong>October 15, 2026</p> As of October 13, 2026, Google is affected by vulnerabilities in the following product: Stable Channel Chrome for Desktop Versions prior to 155.0.8059.79/.80 (Windows/Mac), and 155.0.8059.79 to (Linux) The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Stable Channel Update for Desktop </div> Article Link: Google security advisory (AV26-1045) - Canadian Centre for Cyber Security 1 post - 1 participant Read full topic
First reported Oct 15, 2026 14:55 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. <div> <div> <div><p><strong>Serial number: </strong>AV26-1044<br /><strong>Date: </strong>October 15, 2026</p> As of October 14, 2026, n8n is affected by vulnerabilities in the following product: n8n Prior to 1.123.83 Prior to 2.41.4 Prior to 2.42.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. SQL Injection in the Microsoft SQL Node via Expression Interpolation into the Query Field Advisory Shared-Workflow Credential Check Misses Nested and Tool Inline Sub-Workflows Overview - n8n-io/n8n </div> Article Link: n8n security advisory (AV26-1044) - Canadian Centre for Cyber Security 1 post - 1 participant Read full topic
First reported Oct 15, 2026 14:45 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Debra Ahmed reports: An unprotected database linked to India-based AI software development and IT services company Vibetech exposed 13.7 million records containing credentials and other sensitive information from previous data breaches. The repository was accessible online without security authentication or a password, according to cybersecurity researcher Jeremiah Fowler, whose findings were published by ExpressVPN and… Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Source Article Link: https://databreaches.net/2026/10/15/vibetech-database-exposes-13-7m-records-including-assortment-of-old-breaches/ 1 post - 1 participant Read full topic
First reported Oct 15, 2026 16:40 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Explore the threats, security gaps, and priorities facing enterprise networks. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. The post What 200 Security Leaders Told Us About Network Device Security appeared first on Eclypsium. Article Link: state of network infrastructure security 1 post - 1 participant Read full topic
First reported Oct 15, 2026 16:35 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. <div> <div> <div><p><strong>Serial number: </strong>AV26-1050<br /><strong>Date: </strong>October 15, 2026</p> As of October 15, 2026, JetBrains is affected by vulnerabilities in the following products: Datalore Prior to 2026.2.1 Junie CLI Prior to 26.8.3 TeamCity Prior to 2026.2 Prior to 2026.1.4 Prior to 2025.11.8 YouTrack Prior to 2026.2.19575 Piror to 2026.3.16075 Prior to 2026.3.16397 Prior to 2026.3.16402 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Fixed security issues Security - The JetBrains Blog </div> Article Link: JetBrains security advisory (AV26-1050) - Canadian Centre for Cyber Security 1 post - 1 participant Read full topic
First reported Oct 15, 2026 19:00 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. <div> <div> <div><p><strong>Serial number: </strong>AV26-1047<br /><strong>Date: </strong>October 15, 2026</p> As of October 14, 2026, Drupal is affected by vulnerabilities in the following product: Drupal core Prior to 11.4.10 Prior to 11.3.19 Prior to 10.6.19 The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates or perform the suggested mitigations. Drupal core Critical - Remote code execution SA-CORE-2026-014 Drupal Security Advisories </div> Article Link: Drupal security advisory (AV26-1047) - Canadian Centre for Cyber Security 1 post - 1 participant Read full topic
First reported Oct 15, 2026 15:25 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
2026.10.12 기준 러시아 클라우드 서비스 제공업체 얀덱스(Yandex)는 우크라이나 드론 공격으로 자사 데이터 센터 3곳이 손해를 입어 시설 2곳을 폐쇄하고 나머지 1곳은 부분적으로 가동을 중단할 수밖에 없었다고 발표.. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Article Link: 얀덱스 사용자들이 클라우드 파일에 접근할 수 없게 된 서비스 중단 사태 1 post - 1 participant Read full topic
First reported Oct 15, 2026 15:06 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. The post Endpoint Security and Network Monitoring News for the Week of September 11th: Zscaler, Hexnode, Zayo, and More appeared first on Silent Push. Article Link: https://solutionsreview.com/endpoint-security/endpoint-security-and-network-monitoring-news-for-the-week-of-september-11th/#new_tab?utm_source=rss&utm_medium=rss&utm_campaign=endpoint-security-and-network-monitoring-news-for-the-week-of-september-11th-zscaler-hexnode-zayo-and-more 1 post - 1 participant Read full topic
First reported Oct 15, 2026 14:20 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. <div> <div> <div><p><strong>Serial number: </strong>AV26-1053<br /><strong>Date: </strong>October 15, 2026</p> As of October 15, 2026, SUSE is affected by vulnerabilities in the following products: Rancher Prior to 2.10.5 Prior to 2.11.1 Prior to 2.9.9 Steve Prior to 0.2.1 Prior to 0.3.3 Prior to 0.4.4 Prior to 0.5.13 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Users who can create Projects can gain access to arbitrary projects Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks SUSE Update Advisories </div> Article Link: SUSE Linux security advisory (AV26-1053) - Canadian Centre for Cyber Security 1 post - 1 participant Read full topic
First reported Oct 15, 2026 19:45 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Purpose and Scope APT cases disclosed in September 2026 demonstrate that attacks have evolved to exploit the developer ecosystem, cloud services, and network management infrastructure as trust layers. Legitimate software installers, GitHub repositories, Microsoft 365, OneDrive, Telegram, Nostr, routers, and authentication servers were all included in the attack chain. Key Trends Supply chain attacks have […] Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Article Link: September 2026 Threat Trend Report on APT Groups - ASEC 1 post - 1 participant Read full topic
First reported Oct 16, 2026 02:36 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. <div> <div> <div><p><strong>Serial number: </strong>AV26-1051<br /><strong>Date: </strong>October 15, 2026</p> As of October 13, 2026, Schneider Electric is affected by a vulnerability in the following products: Sage RTU 1410/1430/1450 Versions prior to C3414-500-S02L0 Sage RTU 2400 Versions prior to C3414-500-S02L0 Sage RTU 3030 Magnum Versions prior to C3414-500-S02L0 Sage RTU 4400 Versions prior to C3414-500-S02L0 The Cyber Centre encourages users and administrators to review the provided web link perform the suggested mitigations and apply the necessary updates. Insufficient Verification of Data Authenticity vulnerability on SAGE RTU Products Schneider Electric Security Notifications </div> Article Link: [Control systems] Schneider Electric security advisory (AV26-1051) - Canadian Centre for Cyber Security 1 post - 1 participant Read full topic
First reported Oct 15, 2026 19:20 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
On October 13 and 14, Google issued several Chrome updates.Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 for Linux. The update includes 37 security fixes, including seven rated Critical.On the same day, Google released version 155.0.8059.79 for Android. It may not be available on Google Play for everyone yet but keep an eye out for it. Google says it also includes stability and performance improvements.Updates will roll out over the coming days and weeks.How to update ChromeThe easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update.If you don’t want to wait for the rollout to reach you, manually updating is easy. Open About Google Chrome from Chrome’s settings or Help menu. Chrome will check for updates. If one is available, click Relaunch to apply it.Chrome 155.0.8059.80 is up to dateYou can find an explanation of the version numbering system and step-by-step instructions in our guide: How to update Chrome on every operating system.Technical detailsSome of the security fixes deserve a closer look.Mobile protection, anywhere, anytime..wp-block-kadence-advancedbtn.kb-btns400740_ab89fd-c4{gap:var(--global-kb-gap-xs, 0.5rem );justify-content:center;align-items:center;}.kt-btns400740_ab89fd-c4 .kt-button{font-weight:normal;font-style:normal;}.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0{margin-right:5px;}.wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button{color:#555555;border-color:#555555;}.wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button:focus{color:#ffffff;border-color:#444444;}.wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button::before{display:none;}.wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns400740_ab89fd-c4 .kt-btn-wrap-0 .kt-button:focus{background:#444444;}ul.menu .wp-block-kadence-advancedbtn .kb-btn400740_68fb6a-2d.kb-button{width:initial;}.wp-block-kadence-advancedbtn .kb-btn400740_68fb6a-2d.kb-button{color:var(--color-neutral-10);background:var(--color-brand-blue-60);border-top-left-radius:40px;border-top-right-radius:40px;border-bottom-right-radius:40px;border-bottom-left-radius:40px;box-shadow:1px 1px 2px 0px rgba(0, 0, 0, 0.2);}.wp-block-kadence-advancedbtn .kb-btn400740_68fb6a-2d.kb-button:hover, .wp-block-kadence-advancedbtn .kb-btn400740_68fb6a-2d.kb-button:focus{box-shadow:0px 4px 0px 0px var(--color-brand-blue-90);}Try it nowThe first is tracked as CVE-2026-110152, a buffer overflow in ANGLE in Google Chrome on Android. It could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.ANGLE is Chrome’s graphics-translation layer. A buffer overflow occurs when a program puts more data into an area of memory than it can hold, overwriting data in adjoining memory. An attacker can exploit this to make the vulnerable process run malicious code.Chrome vulnerabilities that enable remote code execution outside the browser sandbox are particularly valuable to attackers because they can turn a visit to a malicious or compromised website into direct code running on the underlying operating system, often without requiring additional exploitation steps.Then I spotted two use-after-free vulnerabilities in the PDF component. CVE-2026-110136, rated Critical, could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. CVE-2026-110147, rated High, could allow an attacker to execute arbitrary code inside the sandbox via a crafted HTML page.A use-after-free vulnerability occurs when a program attempts to acces
First reported Oct 15, 2026 14:20 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. <div> <div> <div><p><strong>Serial number: </strong>AV26-1043<br /><strong>Date: </strong>October 15, 2026</p> As of October 14, 2026, Juniper Networks is affected by vulnerabilities in the following products: Junos OS Versions prior to 23.2R2-S7.7 Version 23.4 prior to 23.4R2-S8.13 Version 24.2 prior to 24.2R2-S5.5 Version 24.4 prior to 24.4R2-S5 Version 25.2 prior to 25.2R2-S2 Version 25.4 prior to 25.4R1-S3 Version 26.2 prior to 26.2R1-S2 Junos OS Evolved Versions prior to 23.2R2-S7.7-EVO Version 23.4 prior to 23.4R2-S8.11-EVO Version 24.2 prior to 24.2R2-S5.6-EVO Version 24.4 prior to 24.4R2-S5-EVO Version 25.2 prior to 25.2R2-S2-EVO Version 25.4 prior to 25.4R1-S3-EVO Version 26.2 prior to 26.2R1-S2-EVO Version 23.4X100-EVO Version 25.2X100 prior to 25.2X100-D35-EVO Version 25.4X300 prior to 25.4X300-D40-EVO The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. CEC Juniper Community CEC Juniper Community </div> Article Link: Juniper Networks security advisory (AV26-1043) - Canadian Centre for Cyber Security 1 post - 1 participant Read full topic
First reported Oct 15, 2026 13:55 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access and above to store a malicious SQL payload that is executed when an administrator later restores a database backup, ultimately allowing the attacker to escalate their privileges to administrator and take over the site. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Props to daroo who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $1,352.00 for this discovery. Our mission is to secure WordPress through defense in depth, which is why we are investing in quality vulnerability research and collaborating with researchers of this caliber through our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element to the multi-layered approach to security. Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in Backuply, hosted on WordPress.org, on September 24, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on October 24, 2026. We disclosed this vulnerability to the Backuply team on September 28, 2026, and the developer released the fully patched version on October 1, 2026. We would like to commend the Backuply team for their prompt response and timely patch. We urge users to update their sites to the latest patched version of Backuply, version 1.5.9 at the time of this publication, as soon as possible. Vulnerability Summary from Wordfence Intelligence Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation 8.0 CVSS Rating 8.0 (High) <div> CVE-ID<br /> <strong> <a href="https://www.cve.org/CVERecord?id=CVE-2026-93953" rel="noreferrer" target="_blank"> CVE-2026-93953 </a> </strong> </div> <div> Affected Version(s)<br /> <strong>&lt;= 1.5.8</strong> </div> <div> Patched Version<br /> <strong>1.5.9</strong> </div> <div> Bounty<br /> <strong>$1,352.00</strong> </div> </div> <div> <div> <strong>Affected Software</strong><br /> <div><a href="https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/backuply" rel="noreferrer" target="_blank">Backuply – Backup, Restore, Migrate and Clone</a> [backuply]</div> </div> <div> <strong>Researcher</strong><br /> <div> <div><a href="https://www.wordfence.com/threat-intel/vulnerabilities/researchers/daroo-2" rel="noreferrer" target="_blank"><img alt="" src="https://www.gravatar.com/avatar/7965cd13376a540548ec7009cd66b05b.jpg?s=32&amp;d=mp&amp;r=g" /></a><a href="https://www.wordfence.com/threat-intel/vulnerabilities/researchers/daroo-2" rel="noreferrer" target="_blank">daroo</a></div> </div> </div> </div> <div> The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up
First reported Oct 15, 2026 15:25 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Since then, at least one leader of the rival factions claiming the brand, Saif Al-Din Khader, also known as “Rey,” has been arrested. Together, these developments have caused a degree of chaos and a surge in impersonators claiming to represent the well-known cybercrime group. These criminals claim to have breached companies and demand ransom payments to delete data, even though they have not actually compromised their targets. Rival groups also accuse each other of being impostors. [2] Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. The cyber extortion scene has always attracted scavengers who attempt to extort money without conducting any breaches. In January 2026, a fake ransomware group calling itself “0apt” posted more than 70 alleged breaches on its data leak site. Upon closer inspection, all these claimed breaches appeared to be fake. Other scavenger groups buy or collect data stolen in previous breaches and try to reuse it in further extortion attempts. Assessment Some of the more proficient cybercrime groups have moved from ransomware and double extortion to data-leak-only extortion. This creates opportunities for scavenger groups to claim that they have breached organizations without having done so, hoping that victims will pay without demanding proof of a breach. The English-language cybercrime ecosystem known as “Hacker Com” has always been far more fluid and disorganized than the Russian cybercrime community. Arrests of key figures have historically disrupted groups, but powerful brands are often resurrected. One of the few ways to verify that someone was genuinely linked to a particular brand, such as ShinyHunters, was through the private PGP key used by the group. All claimed cyber breaches should be verified, especially if the victim has experienced previous breaches and the threat actor may simply be reposting older data stolen during an earlier incident. References [1] https://databreaches.net/2025/08/21/cleanup-in-aisle-4-telegram-is-a-mess-of-fake-shinyhunters-channels/[2] https://arkemcyber.com/research/who-gets-to-be-shinyhunters/ The post Group Claiming to be ShinyHunters Posts Fake Breaches appeared first on Truesec. Article Link: Group Claiming to be ShinyHunters Posts Fake Breaches - Truesec 1 post - 1 participant Read full topic
First reported Oct 16, 2026 07:10 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. <div> <div> <div><p><strong>Serial number: </strong>AV26-1052<br /><strong>Date: </strong>October 15, 2026</p> As of October 7, 2026, Johnson Controls is affected by a vulnerability in the following product: ADVMS Prior to 3.10 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Vulnerability impacting American Dynamics VMS - JCI-PSA-2026-17 Johnson Controls Product Security Advisories </div> Article Link: [Control systems] Johnson Controls security advisory (AV26-1052) - Canadian Centre for Cyber Security 1 post - 1 participant Read full topic
First reported Oct 15, 2026 19:35 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. The post Silent Push 6.1 Enhances Brand and Infrastructure Impersonation appeared first on Silent Push. Article Link: Silent Push 6.1 Enhances Brand and Infrastructure Impersonation | Digital IT News 1 post - 1 participant Read full topic
First reported Oct 15, 2026 13:50 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Article Link: ISC Stormcast For Friday, October 16th, 2026 https://isc.sans.edu/podcastdetail/10140 1 post - 1 participant Read full topic
First reported Oct 16, 2026 02:05 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
Executive Summary Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. <p>Since mid-2025, the Kremlin has intensified restrictions on digital communications and infrastructure, very likely to suppress the organization of domestic political dissent and conduct digital surveillance within Russia. Increasingly strict measures targeting virtual private networks (VPNs), state-managed internet shutdowns, limitations on civilian communications platforms, and monitoring of domestic and foreign entities&nbsp;very likely represent an escalation from the approaches to censorship and surveillance pursued prior to 2024.</p> <p>However, despite intensifying internet restrictions, technical and political limitations will likely prevent the Kremlin from achieving its long-held objective of a fully “sovereign internet” in the near term. The most likely scenario is that Moscow exerts extensive censorship and monitoring of online activity with increasingly strict –– though not absolute ––&nbsp;controls on circumvention and anonymizing tools.</p> <p>Insikt Group assesses that the Kremlin’s primary objectives regarding internet restrictions are twofold: facilitating extensive surveillance of online activity to support control over the domestic information space while maintaining connectivity to the global internet, and developing national internet infrastructure under Kremlin control, enabling isolation from the global internet if the Kremlin so chooses. Efforts in support of these objectives have almost certainly provided the Kremlin with enhanced ability to control and monitor domestic online discourse.</p> <p>In this environment, individuals and organizations operating in Russia are subject to increasing operational risks, including surveillance and exposure of sensitive data, challenges in conducting emergency communications, disruptions to corporate tools and digital applications, and legal risks. Entities with indirect exposure to Russia face an increased likelihood of supply-chain disruptions and sanctions violations and, over the longer term, face challenges in assessing the political and economic situation in Russia, as restrictions limit the availability of high-quality open sources.</p> <h2>Key Findings</h2> <ul> <li>The Kremlin is very likely using managed internet shutdowns across Russia to test and improve its ability to isolate the Russian internet, though technical and political limitations make it unlikely that it will achieve its objective of establishing a fully “sovereign internet” in the near term.</li> <li>In the near- to medium-term, a combination of falling approval ratings for Russian President Vladimir Putin, declining public opinion amid economic strain, and ongoing Ukrainian drone strikes very likely incentivize Moscow to impose further internet restrictions, regardless of reported public dissatisfaction with some of these measures.</li> <li>The Kremlin will very likely continue to pursue strategies to deter VPN use by forcing platforms to support VPN blocks and making VPN use more expensive and inconvenient, though likely avoiding direct punitive measures against individual users.</li> </ul> <h2>Kremlin Systematically Tightening Internet Restrictions</h2> <p>Since July 2025, the Kremlin has systematically tightened access to widely used civilian communications applications and VPNs, caused regular mobile internet outages across Russia, and instituted requirements that place Russian and foreign individuals and firms under increased government surveillance. The Kremlin likely views these measu
First reported Oct 15, 2026 14:06 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
I believe the cybersecurity industry may be approaching AI security the wrong way. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Article Link: Small Agents, Smaller Blast Radius: Controlling What AI Can Do 1 post - 1 participant Read full topic
First reported Oct 16, 2026 00:50 UTCCatalog metadata updated Oct 16, 2026 08:09 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.