A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge’s sandbox, a security researcher has shown.
Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. Microsoft fixed the Edge bugs the day after the contest,
Source: The Hacker News · 2026-10-28
Thanks to the newly proposed WebAI web standard, the company will start shipping local AI models with its flagship browser.
Source: ZDNet Security · 2026-10-28
Attorneys for alleged South American drug trafficker Sebastián Marset have asked a federal judge to halt the search of a potentially pivotal cellular phone until the U.S. government explains how it took control of the device from Bolivia.
Marset, a Uruguayan national and self-proclaimed “King of the South,” was arrested in March in a pre-dawn raid in Santa Cruz, Bolivia. Soon after his arrest, he was expelled to Peru and then whisked to the U.S. where he faces money laundering, drug trafficking and narco terrorism charges.
Law enforcement officers in Bolivia seized three phones from the house where they arrested Marset. However, it has emerged that they seized a fourth phone from an adjacent house.
Defense lawyers say in their motion — dated October 23 — that “it is impossible” for them to “be certain as to the timing of the search and whether it was done at the behest of the DEA [Drug Enforcement Administration] or was otherwise valid under Bolivian law.”
They argue that they weren’t notified about the fourth phone, which was a potential key piece of evidence for months, hampering their efforts and raising questions about the integrity of the operation.
The phone was sent to the DEA in mid-April, but didn’t appear in any court documentation shared with the defense team until late July.
“No contemporaneous report of the chain of custody appears to have been prepared,” Marset’s defense team wrote to U.S. District Judge Rossie Alston Jr., who presides in the Eastern District of Virginia.
The DEA confirmed to the defense team, the filing said, that it had extracted data from the phone without a court order. The agent “theorized that the search did not require a court order because the defendant had previously ‘consented’ to the search of his other devices.”
The lead prosecutor did not respond to a request for comment in time for publication. The DEA said it “does not comment on allegations.”
The prosecution has alleged that the four phones were used by Marset to access cryptocurrency accounts.
Crypto accounts have featured prominently in pre-trial disputes. Marset’s legal team alleges that DEA agents tried to trick his elderly mother into handing over passphrases for accounts that hold his digital currency, and later asked him to “donate” his $4 million in crypto assets.
“A seizure does not require asking the detainee’s mother for a photo of a notebook containing access phrases, which are used to move funds, not to secure them. Such contradictions warrant an explanation, which has yet to be provided,” Santiago Moratorio, Marset’s Uruguayan attorney, told OCCRP.
In a September court proceeding, the lead DEA agent denied the allegation that they had asked for a donation.
The Marset case is being closely watched across South America because of his connections to Colombia, and allegations that he had protection in Paraguay and Bolivia where more than a dozen officials were recently detained under suspicion that they had ties to Marset.
The State Department recently revoked visas for 12 Bolivian government, police, and political figures. It cited the need to defend against corruption and narco-trafficking, and said another unidentified nine Bolivians would be denied visas.
Marset’s lawyers argue that the initial charge of money laundering is invalid because it involved a single wire transfer between Portugal and China that did not involve the servers of a U.S. bank. The lawyers say Marset never trafficked drugs to the U.S. and the narco terror groups cited in court were not designated as such at the time of his dealing with them.
In pre-trial conferences, Marset’s defense team has challenged several elements of the case, trying to get the judge to strike down portions of the indictments and weaken the prosecution. Alston has said he would rule on these motions by November 6.
Source: OCCRP · 2026-10-28
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems.
The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root
Source: The Hacker News · 2026-10-28
Volt Typhoon, a China-government backed hacking group that has infiltrated America’s critical infrastructure networks for years, has consistently built and dismantled ephemeral malicious infrastructure to burrow into hundreds of sensitive systems undetected, Lumen Technologies’ Black Lotus Labs said in a Wednesday report.
The covert access operation that researchers call “Silent Train” isn’t a standalone network, but rather a series of compromised small office home office (SOHO) routers, internet of things (IoT) devices and enterprise infrastructure that Volt Typhoon has rapidly rotated through since late 2023.
The Chinese threat group has used this chain of short-lived compromised infrastructure to exploit additional vulnerabilities, including zero-days, in network edge devices and gain deeper, persistent access into victim networks, researchers said.
“Individual chains are assembled and dismantled every day, with infrastructure continually refreshed,” Michael Horka, principal information security engineer at Black Lotus Labs, told CyberScoop. “Volt Typhoon demonstrated a repeatable capability to rebuild a new chain with different infrastructure in less than two minutes, making the number of nodes at any one moment effectively close to zero.”
Black Lotus Labs has notified hundreds of victims since it first identified Silent Train activity, including telecom providers, government entities, defense contractors, communication services, universities and IT firms. Other victims spanning critical infrastructure include organizations in the water, energy, transportation, maritime, rail, aviation and emergency services sectors.
“The ephemeral nature of the framework means our observations should not be interpreted as a complete census of Volt Typhoon activity,” said Horka, who also was the lead researcher on the report.
The nation-state group’s investment in operational security and preserving access is remarkable, according to Black Lotus Labs.
“We observed infrastructure assembled in under two minutes, sessions averaging roughly four hours, extensive cleanup, compartmentalization and continued development of new access vectors,” Horka said. “That is considerable effort devoted not even to get into their end targets, but purely to making important operations difficult to discover and trace.”
Volt Typhoon relied more heavily on Silent Train after the FBI and Justice Department disrupted the KV Botnet in early 2024, researchers said. Earlier this year, U.S. and global authorities warned about a widespread shift in Chinese hacking groups’ use of covert networks riding on compromised common devices.
The reach of those efforts is extensive and ongoing. Volt Typhoon has exploited and abused more than 27 device classes in Silent Train operations, including edge devices, enterprise management tools, identity and access management systems, networking infrastructure and other technologies.
“The diversity matters, but the discipline matters even more,” Horka said. “Specific device types were consistently reserved for particular positions in the chain. It operated less like a collection of randomly compromised devices and more like an organized inventory of capabilities.”
The threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said. Black Lotus Labs also observed confirmed zero-day campaigns targeting Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator.
“The exploitation patterns, victimology, and geographic targeting observed throughout our investigation point to a sustained focus on communications, defense, government, and critical infrastructure environments of enduring strategic value,” Black Lotus Labs researchers wrote in the report. “Through repeated targeting of centralized management platforms and control-plane technologies, Silent Train shows how Volt Typhoon systematically pursues and preserves access to some of the most consequential networks in the United States.”
Silent Train’s ephemerality and operational discipline means it can’t be measured in size. These attributes also make it “fundamentally difficult to disrupt because there isn’t one network to take down,” Horka said.
“What exists today will be completely different tomorrow,” he added. “You can try to remove individual pieces, but removing the actor’s ability to continuously rebuild them is a much harder problem to solve.”
Source: CyberScoop · 2026-10-28
An internal database identifying more than 41,000 employees for the U.S. Department of Homeland Security (DHS). The database, from an Okta single sign-on service used by the DHS, reveals employee…
Source: Distributed Denial of Secrets · 2026-10-28
Ukrainian ransomware crook Artem Stryzhak has been sentenced to 70 months in the slammer by a New York federal court for his role as an affiliate of the Nefilim and Hive ransomware gangs. Prosecutors believe the cybercriminal began working with Nefilim in or around June 2021, while living in Barcelona, Spain. The Nefilim ransomware-as-a-service (RaaS) operation was known for targeting wealthy companies, with its operators encouraging affiliates to pursue businesses capable of paying substantial ransom demands. One of Nefilim’s most high-profile attacks was on Australian logistics giant Toll Group in 2020, encrypting its files roughly three months after it suffered a separate Mailto ransomware attack. Court documents [PDF] state that Stryzhak agreed with alleged Nefilim boss Volodymyr Tymoshchuk, who remains at large, to pay the ransomware crew a 20 percent cut of the ransom proceeds he collected. Tymoshchuk told Stryzhak that his preference was for attacks to target companies based in the US, Canada, and Australia that turn over more than $100 million annually. This guidance was soon tweaked to encourage targeting companies in the same regions with more than $200 million in annual revenue. Prosecutors claim that around the time Stryzhak joined forces with Nefilim, he also signed up to the Hive ransomware operation as “one of its earliest affiliates,” and used its platform to attack approximately seven victims. Hive’s operators claimed they targeted circa 1,500 victims worldwide between June 2021 and January 2023. According to separate court documents [PDF], Hive’s victims included a law firm and an Ohio hospital, which paid approximately $1.7 million in Bitcoin after the gang initially demanded $2 million during the COVID-19 pandemic. Before its infrastructure was seized in an international law enforcement operation in January 2023, Hive was known for attacking healthcare facilities during the COVID-19 pandemic, as well as being one of the ransomware groups that battered Costa Rica in 2022. Brett Leatherman, assistant director at the FBI’s cyber branch, described Stryzhak as a “prolific cybercriminal” who played a role in groups that were responsible for more than $100 million in victim damages. “Today’s sentence reflects the seriousness of Stryzhak’s crimes and demonstrates the FBI’s global reach and extensive network of international partners,” he said. “Multiple field offices contributed to this investigation, and our work does not end here. We will continue to leverage every tool at our disposal to track down Stryzhak’s co-conspirators and hold them accountable, including Volodymyr Viktorovych Tymoshchuk.” Stryzhak was arrested by Spanish police in June 2024 before being extradited to the US in April 2025. In announcing Stryzhak’s sentencing, the Justice Department took the opportunity to remind the public that rewards totaling up to $11 million are available for qualifying information about alleged Nefilim operator Volodymyr Tymoshchuk and other key ransomware suspects. ®
Source: The Register Security · 2026-10-28
Ukrainian ransomware crook Artem Stryzhak has been sentenced to 70 months in the slammer by a New York federal court for his role as an affiliate of the Nefilim and Hive ransomware gangs. Prosecutors believe the cybercriminal began working with Nefilim in or around June 2021, while living in Barcelona, Spain. The Nefilim ransomware-as-a-service (RaaS) operation was known for targeting wealthy companies, with its operators encouraging affiliates to pursue businesses capable of paying substantial ransom demands. One of Nefilim’s most high-profile attacks was on Australian logistics giant Toll Group in 2020, encrypting its files roughly three months after it suffered a separate Mailto ransomware attack. Court documents [PDF] state that Stryzhak agreed with alleged Nefilim boss Volodymyr Tymoshchuk, who remains at large, to pay the ransomware crew a 20 percent cut of the ransom proceeds he collected. Tymoshchuk told Stryzhak that his preference was for attacks to target companies based in the US, Canada, and Australia that turn over more than $100 million annually. This guidance was soon tweaked to encourage targeting companies in the same regions with more than $200 million in annual revenue. Prosecutors claim that around the time Stryzhak joined forces with Nefilim, he also signed up to the Hive ransomware operation as “one of its earliest affiliates,” and used its platform to attack approximately seven victims. Hive’s operators claimed they targeted circa 1,500 victims worldwide between June 2021 and January 2023. According to separate court documents [PDF], Hive’s victims included a law firm and an Ohio hospital, which paid approximately $1.7 million in Bitcoin after the gang initially demanded $2 million during the COVID-19 pandemic. Before its infrastructure was seized in an international law enforcement operation in January 2023, Hive was known for attacking healthcare facilities during the COVID-19 pandemic, as well as being one of the ransomware groups that battered Costa Rica in 2022. Brett Leatherman, assistant director at the FBI’s cyber branch, described Stryzhak as a “prolific cybercriminal” who played a role in groups that were responsible for more than $100 million in victim damages. “Today’s sentence reflects the seriousness of Stryzhak’s crimes and demonstrates the FBI’s global reach and extensive network of international partners,” he said. “Multiple field offices contributed to this investigation, and our work does not end here. We will continue to leverage every tool at our disposal to track down Stryzhak’s co-conspirators and hold them accountable, including Volodymyr Viktorovych Tymoshchuk.” Stryzhak was arrested by Spanish police in June 2024 before being extradited to the US in April 2025. In announcing Stryzhak’s sentencing, the Justice Department took the opportunity to remind the public that rewards totaling up to $11 million are available for qualifying information about alleged Nefilim operator Volodymyr Tymoshchuk and other key ransomware suspects. ®
Source: The Register — Security · 2026-10-28
GMO Internet has told customers to unplug their PCs in advance of a possible ransomware attack
Source: Infosecurity Magazine · 2026-10-28
Egypt 
An actor using the handle “GoreTerminal” claims to have leaked a Capiter dataset containing approximately 208,206 user accounts. The post describes Capiter as an Egyptian B2B startup founded in Cairo that permanently shut down in 2023.
The actor states the breach occurred on October 28, 2026 at 10:11 AM EDT and characterizes the release as a leak rather than a ransom event. The archive is described as JSON Lines, with an uncompressed file named CAPITER_UNIQUE.JSONL at 150 MB and a compressed archive at 34 MB. The visible schema includes phone numbers, international phone numbers, customer IDs, country, carrier, city, district, area, order and product metadata, payment type, inventory data and profile timestamps. The dataset, its source, the stated counts and current availability have not been independently verified.
EgyptThe sample shown in the source material contains structured customer and transaction-related records. Individual phone numbers, customer identifiers and other personal values visible in the sample are not transcribed in this report.
Identifiers directly visible or supported by the supplied material. These support correlation and do not independently verify the breach claim.
| Type | Identifier | Source |
|---|---|---|
| Actor handle | GoreTerminal |
Screenshots 1–2 |
| Named organization | Capiter |
Screenshots 1–2 |
No organization domain, malware hash, Tox ID, Session ID, Telegram handle or attacker-controlled IP address is visible in the supplied screenshots. Personal identifiers shown in the sample are not included in this table.
Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.
If authentic, the claimed dataset could expose mobile phone numbers, customer identifiers, location information and transaction-related metadata for more than 200,000 accounts. The combination could support targeted phishing, SMS abuse, impersonation, profiling or other customer-focused social engineering.
Dark Web Informer has not independently verified the dataset’s authenticity, source, completeness, 208,206-account count, archive sizes, sample contents or the actor’s claimed October 28 breach time. The supplied screenshots document the listing and visible sample records, not independent confirmation of the underlying data.
Source: Dark Web Informer · 2026-10-28
