Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. […]
Source: BleepingComputer · 2026-10-30
Neat video:
The sighting, announced September 2, marks the first time anyone has spotted a live bigfin squid, which belongs to the Magnapinna genus, in the northeastern Pacific Ocean.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Source: Schneier on Security · 2026-10-30
The DOJ’s Executive Office for U.S. Trustees said a consumer privacy ombudsman is needed to advise the court on how to regulate what data from Character.AI can be sold and under what terms.
Source: The Record · 2026-10-30
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:
Below are the flaws added to the catalog:
CVE-2026-97229 is a critical security flaw that could let attackers run code on its servers without logging in.
The flaw affects Community Edition (CE) and Enterprise Edition (EE), it is an integer overflow bug caused by weak validation of regular expressions in CI/CD configurations. The issue affects GitLab versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Users should upgrade to a patched version to protect their systems. GitLab advisory
“GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.” reads the advisory.
The researchers joaxcar reported this vulnerability through the company’s HackerOne bug bounty program.
Alpine Linux recently reported that an unknown attacker tried to exploit the vulnerability against Alpine Linux on October 20 and 21, 2026, but the attempts failed.
CVE-2026-76418 is a NULL pointer dereference vulnerability affecting Cisco Secure Firewall ASA and FTD Software. It could allow an unauthenticated remote attacker to force a device to reload, causing a denial-of-service (DoS) condition.
Cisco said it became aware of active exploitation earlier this month. The company has not disclosed who is behind the attacks, how many organizations have been targeted, or what attackers may have done after gaining access.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the two vulnerabilities by November 1st, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Source: Security Affairs · 2026-10-30
Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs).
Source: Dark Reading · 2026-10-30
A recent law enforcement operation to dismantle harmful scam centers was a big success. A threat intelligence expert walks us through what happened and why he wants more of the same.
Source: Dark Reading · 2026-10-30
A n0n ransomware operator tried to break into 23 organizations across 14 countries, but couldn’t secure its own front door, leaving its server exposed with all of its methods on view. The criminals used a mix of new (AI) and old (stolen credentials) tooling during their data-theft spree, and in some cases not only stole and encrypted files, but also deleted data and backups, eliminating victims’ ability to recover their information. And despite the fear and hype around the breachpocalypse, with AI finding and developing exploits for critical vulnerabilities affecting most organizations across the globe, these crooks did not exploit a single bug to gain entry into any of their victims’ IT environments. “In every documented compromise in this investigation, access relied on weak or stolen credentials,” said Ensar Seker, chief information security officer of threat intelligence firm SOCRadar. “What stands out is the combination of AI-assisted development and very conventional entry points,” Seker told The Register. “We found no evidence of vulnerability exploitation in the cases examined.” The gang breaks into organizations at scale using widespread Remote Desktop Protocol (RDP) scanning and automated FortiGate SSL-VPN credential stuffing. To access US-based IT managed services provider ChiBiTek, the crew used a 15-thread residential SOCKS5 proxy pool to test credentials (ip:port:user:password) against FortiGate portals (GET /remote/login). The operators also gained entry using exposed cloud credentials and reused hosting portal sessions. In one case linked to e-commerce site Fanatics, SOCRadar found that n0n used an exposed AWS access key with permissions to list, read, and delete objects in S3 buckets. The criminals then used this key to pull data from 40 S3 buckets, with up to 110 GB per bucket, and ultimately deleted data, including bank-transaction archives, and purged keys across 12 sensitive buckets. AI-assisted extortion While the threat hunters didn’t find any evidence of a fully autonomous attack system, the ransomware operator did use AI to assist with these intrusions, incurring more than $7,216 in AI usage costs by October 22. Specifically: the criminal or criminals used OpenCode, an open-source AI coding agent, configured with 154 model entries across seven providers. Models included Gemini, Mistral, Nemotron, Llama, Claude, GPT-5.x, Grok, Kimi, GLM, DeepSeek, MiniMax, Qwen, and many, many others, some with safety training removed and others marketed as “uncensored” models. “The operator used AI to write and debug hundreds of scripts. That shows how AI can help an attacker turn basic access into a broader, tailored operation,” Seker said. “The destructive behavior is equally significant,” he added. “The operator did more than steal and encrypt files: in some cases, it deleted data and backups, and in one case changed firewall policies to block traffic. That creates a recovery problem that a decryption key alone cannot solve.” SOCRadar’s threat hunters found the operator’s workspace – a publicly accessible Python HTTP file server hosted in Sweden at 185.157.161[.]148 on port 8877 – last month, and documented the exposed directory in snapshots on September 25 and 26. “Across those snapshots, we identified 1,719 files, including attack scripts, ransomware source code, extortion infrastructure, and an AI coding agent environment,” Seker said. “This gave us visibility into the operation behind the victim listings, including how the operator prepared attacks and handled stolen data.” Meet n0n It also provided a close look at n0n, a newcomer to the data-theft and extortion game that has claimed 108 victims since it emerged last month. On October 12, the group added 38 maritime, port and logistics organizations across 18 countries to its leak site in a single batch. Researchers have linked at least 21 of them to customers of South Korean maritime software provider CyberLogitec, although the software provider has not confirmed an intrusion. The crooks set an October 19 deadline for the maritime firms, with ransom demands ranging from $400,000 to $28 million, payable in Bitcoin. After the deadline, however, none of the 38 listings were marked “settled” and none of their payment addresses showed any transaction. All affected organizations’ stolen data was published. While a handful of the gang’s claimed victims have been marked “honored – data destroyed” on n0n’s leak site, indicating the victim orgs paid the ransom demand, SOCRadar hasn’t validated any transactions on-chain. In its profile details, the security shop rates the gang a 10 out of 10 for “aggressiveness” and a zero out of 10 for “lethality.” The group is believed to be based in Russia, although the server uncovered by SOCRadar, which it attributed to a single operator or small team, didn’t provide any definitive geographic or national attribution. Every case that the exposed server documented followed the same lifecycle, moving from initial access to establishing persistence and credential collection via hidden admin accounts disguised as services, covert proxies, credential and session-token theft, mailboxes and emailed multi-factor authentication codes. The crooks then collected sensitive data and sent everything to the operator’s central storage with the attack impact shifting between data-theft, encryption, destruction, and network disruption, depending on the targeted organization. After breaking into Transcom, a Netherlands-based financial services provider, the crims sent a secondary ransom alert directly to PayPal’s security team, even though the compromised data was only on Transcom’s network. Stupid mistakes and n0n security basics Finally, the crims send ransom notes, post a countdown clock on the leak site, establish negotiation rooms and emails for victims – and then leak the stolen files or destroy backups when the organizations don’t pay up. In some cases, and to apply increased pressure on victimized companies, n0n also broadcasts automated countdown warnings to businesses’ service providers, clients, and media outlets. Despite its aggressive tactics, the operator in this case – as with other stupid criminals The Register has gleefully documented in earlier stories – still struggles with basic security hygiene. “There is a striking gap between operational ambition and security discipline,” Seker said. “The operator invested thousands of dollars in AI services while leaving its own workspace exposed. The locker also contained hardcoded encryption keys, with evidence suggesting reuse across victims. An operation can have serious destructive capability while still making fundamental mistakes.”®
Source: The Register — Security · 2026-10-30
To be announced…
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
Source: RansomLook — Recent Posts · 2026-10-30
The company, billing itself as “the next-generation fashion retailer for Millennial and Generation Z consumers,” said a recent hack exposed customer payment card numbers.
Source: The Record · 2026-10-30
In the wake of fanfiction repository Archive of Our Own (AO3) announcing a weeks-long security incident outage, readers and writers are reflecting on why the site is important to the fanfiction community, and how they’re coping with the downtime.
On Thursday, the Organization for Transformative Works (OTW), the non-profit organization that runs AO3, posted that the site was down for maintenance, eventually updating to say the site restoration will take around two weeks, but could take up to a month. OTW confirmed in an updated status report Friday morning that this outage is due to a security incident.
Some have speculated that the outage is a result of the PHP scramble this week that led to several sites going down to update their security, but AO3 doesn’t use PHP. An OTW representative told CNET: “I can let you know that this is not related to the PHP security issue as the Archive uses Ruby on Rails.”
A lot of people are grieving the loss of Kinktober, AO3’s annual group writing exercise where writers upload a chapter or fic every day throughout October based on a prompt of the day. (The prompts are horny, if that’s not clear.) Several of the writers and readers who reached out to me following the outage brought up the poor timing around Kinktober.
One writer I spoke to who posts her writing and reads others’ writing on AO3, told me that she was in the middle of racing to finish a work that was deliberately timed to Kinktober and Halloween when the outage happened. She was hitting “next chapter” while reading a fic on Wednesday night when she got the message that the site was down for maintenance, “which I initially took as a sign from the universe to go to bed,” she said.
“The outage hasn’t derailed my desire to write. If anything, I want to have more chapters ready to go so my readers can eat good once it’s over,” she said.
Some writers are considering posting elsewhere while they wait for AO3 to return, but it’s not an ideal workaround. AO3 author who goes by Selkie Myth told me they’re moving to Space Battles, another fanfiction site, during the outage. “I’m shrugging and just posting on SB [Space Battles] while the site’s down. Hopefully I’ll remember to post the chapters over on AO3 once it’s back up — the story is projected to end during the outage. I anticipate the same is true for a lot of other authors,” they said.
Some people have said they’ll try fanfiction.net in the meantime, but it’s a much more bare-bones website. Fanfiction site Sufficient Velocity added a banner to its homepage welcoming AO3 refugees: “We’ve had a big influx of guests due to the AO3 outage. If you’ve been affected by the outage we’re sorry to hear that and hope that they’re able to get that fixed soon.” Wattpad, which many fanfiction writers and readers really, really hate for reasons I won’t get into here, posted on X: “we’re here to support you during this difficult time.” Overwhelmingly, the replies are from people telling Wattpad to go away.
Another AO3 writer who goes by Ren told me she has two long works in progress right now with nowhere to post them. Posting elsewhere poses continuity and discovery problems, as some of these fanfiction works span chapters and hundreds of thousands of words of character and worldbuilding. “I could technically keep posting updates on sites like tumblr through the downtime, but both of these fics are quite long and I haven’t been posting them anywhere other than AO3 — if I drop a new chapter for my 130k Pokemon Black and White fanfic on Tumblr completely out of context, people just now finding my work aren’t going to be able to read the rest for a while :(“ she told me in an email. “I have seen other authors posting their gdocs and Ellipsus reader links in the meantime, but my draft files aren’t exactly presentable… I will keep marinating but what will probably happen is my wips [works in progress] will just be on hiatus for a bit. My readers are used to hiatuses at least.”
Another writer said she’s not considering posting elsewhere. “Wattpad can piss off,” she said. “But I may go back to fanfiction.net to save and physically print some of my favorite fics from way back in the day (the ancient/sacred texts, if you will) to ensure I have copies of those somewhere. This outage is a good reminder that things can vanish in the blink of an eye, whether a website crashes or is hacked or an author decides to suddenly delete their fic. If you love something, smash the kudos button, comment on it, bookmark it, subscribe, and consider downloading it. You never know.”
A reader who emailed me following the outage said they’ve been enjoying getting into AO3 as a new fan. “I was a big fanfic skeptic, but that’s changed lately. I’ve found some truly excellent writers, and real creativity. The free nature of it in this increasingly horrifying stage of capitalism is refreshing,” they said.
AO3 has said in status updates and to journalists that they don’t expect any data loss. Losing works would be devastating for writers and readers, but AO3 is more than just a repository for writing; it’s a community of people commenting and reacting to those stories. Selkie mentioned the rigorous tagging habits of AO3 members, where stories are tagged with sometimes dozens of fanfiction tropes, character names, content hints and warnings, and can constitute a language specific to the platform and its readers; “Crack Treated Seriously,” for example, means writing a silly premise with a straight face, while “Idiots in Love” is self explanatory.
“To me, the more devastating thing would be to lose the comments and kudos on my fic. Technically I have them saved elsewhere because I get AO3 email alerts, but seeing them threaded in one place at the end of a chapter hits different,” a writer said. “Comments can turn an author’s entire day around and restore their will to live. I often reread them if I have writer’s block or a bad bout of imposter syndrome. They also turn the otherwise solitary act of writing into something communal. Seeing someone experience your story chapter by chapter is incredibly motivating and makes the writing process feel less isolating.”
OTW is entirely volunteer-run, and people on social media and in speaking to them directly have said they hope AO3 users go easy on staff during this time. “So many people rely on AO3 as an outlet for creativity and escapism as the real world burns, myself included. It’s also important to remember that the site is run by volunteers,” that writer said. “The work they do to protect writers, fight censorship and safeguard freedom of expression is extremely important and necessary, especially right now. They deserve all the respect and patience in the world as they work to get the archive back up and running. Be kind.”
Ren, echoing those sentiments, sent me a meme:
“An additional sentiment I’ve seen is ‘ok so when AO3 comes back we’re all going to tell our favorite authors how much we missed their work, right?’ which I hope catches on — I’m writing for niche fandoms and had to disable guest comments due to bot spam, so comments are few and far between as it is,” Ren said. “I do kind of hope that the extended outage serves as a sort of wake-up call to anyone who’s been taking ao3 for granted lately. It certainly was for me.”
Source: 404 Media · 2026-10-30