~/home / radar
IT radar
What is happening in cloud, security and AI today — and what it means for operations. Selected automatically, briefly commented.
Weekly roundups: Patch radar, week 45/2026 · Patch radar, week 44/2026 · Patch radar, week 43/2026
Anthropic Claude Fable 5.2 is cheaper, but tempo costs extra
Anthropic rolled out Claude Fable 5.2 and Claude Mythos 5.2 with a lower base price, but faster response (“tempo”) requires double the fee. Automation teams should evaluate cost vs latency and adjust budgeting accordingly.
Source ↗N‑able takes cloud platform offline after 30+ “zero‑days” published
Following disclosure of 30+ alleged zero‑day flaws, N‑able pulled its hosted N‑central cloud offline and advised on‑prem customers to shut down servers. Check for patches, isolate affected instances and verify integrity of management agents.
Source ↗Hackers Compromise Ethersphere's bee‑js and Swarm Desktop to Deliver Wallet‑Stealing Malware
Attackers abused Ethersphere’s release pipeline to publish malicious bee‑js 13.3.0 and Swarm Desktop 0.56.2 binaries. The code exfiltrates wallet keys, passwords and drops a backdoor. Verify signatures and enforce official package sources.
Source ↗Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts
From Oct 14‑26 attackers leveraged AWS credentials that Qubole’s platform uses for customer access, stealing stored secrets and data. Teams running Qubole data‑lake services should review IAM roles, rotate keys and audit access logs.
Source ↗Hackers pull off $133 million French bank heist via service provider
Attackers compromised the service‑provider chain of Crédit Mutuel Arkéa to forge transactions worth $133 million. Financial institutions and cloud service providers must tighten supply‑chain security and monitor for anomalous transaction patterns.
Source ↗Iris Ohyama data cloud breach exposes info of 7.7 million customers
Unauthorized access to a third‑party cloud service exposed personal data of about 7.7 million customers. Teams running Nextcloud, HiDrive or S3 should review any external cloud integrations and tighten access controls.
Source ↗CISA Flags SonicWall SonicOS MFA Bypass Flaw
A high‑severity MFA bypass in SonicWall SonicOS is now listed in CISA’s KEV catalog. Administrators of SonicWall devices should verify patch availability and audit MFA configurations immediately.
Source ↗Claude Code's “Don’t Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Claude Code’s “Don’t Ask Again” option saved commands with passwords and API keys into a project settings file that ended up public on GitHub. Developers need to scan repos for such files, rotate exposed secrets and disable the auto‑save feature.
Source ↗Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
Applying the WordPress fix may still expose a site, as the installer unpacks files with the old, unpatched code. Site owners should block web access during the update and verify integrity afterward.
Source ↗OpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits
OpenAI unveiled GPT‑6 Cyber, an AI model that discovers and patches vulnerabilities more effectively. Security and DevOps teams should evaluate its use for internal audits, while ensuring any findings are manually validated.
Source ↗SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
SonicWall released patches for seven issues, including an SSL‑VPN MFA bypass currently exploited. Firewall operators must apply the updates immediately and verify MFA configurations.
Source ↗Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
The SSHole flaw lets attackers log in without a password on Linux systems running OpenSSH with musl and PAM disabled. Admins should verify PAM is enabled and apply the latest OpenSSH patches.
Source ↗Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts
Hackers impersonate AI‑related events to phish Microsoft and Google credentials. Support staff should alert users, enforce MFA and filter suspicious invitations.
Source ↗Nearly 1.5 million exposed secrets targeted in new revocation program
Truffle Security’s Secrets Revocation Program lets API‑key issuers revoke publicly exposed credentials. Cloud‑storage and identity admins should audit for leaked keys and revoke them promptly.
Source ↗Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction
A now‑patched vulnerability allowed bypass of ChatGPT’s Lockdown Mode. Teams using AI automation should confirm the patch is applied and that the mode once again blocks silent data exfiltration.
Source ↗OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
A critical flaw allowing key‑only accounts on Alpine Linux to be logged into with long passwords was fixed in OpenSSH 10.6p2. Operators must verify that the updated package is installed on all Alpine servers.
Source ↗DreamHost confirms data breach exposed FTP logins and webmail sessions
DreamHost disclosed a breach where attackers accessed its File Manager for two months, stealing FTP/SFTP usernames and passwords. Affected users must rotate credentials, enable MFA where possible and audit for unauthorized access.
Source ↗Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel released a patch for a zero‑day in GS1900 switches that was used to compromise ~1,000 devices and steal configs and credentials. Admins must apply the firmware update, rotate passwords and audit switch logs for suspicious access.
Source ↗WorkOS says attacker used ARTEX AI to breach internal sales app
WorkOS breach via ARTEX AI accessed sales contacts; teams using SAML/OIDC or internal apps must audit token issuance, enforce least‑privilege, and monitor AI‑driven abuse patterns.
Source ↗Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
cPGuard’s update mechanism was compromised, delivering a backdoor. Administrators must validate update signatures, revert to trusted versions, and scan systems for the implanted script.
Source ↗Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes
Chainstack’s breach exposed customer data and password hashes; teams managing S3‑compatible storage or blockchain nodes should audit access controls, rotate credentials, and review AI‑driven attack detection.
Source ↗mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity
mSecure users must rotate all stored passwords, disable existing 2FA tokens and remove passkeys. Support teams should inform customers, verify app integrity and monitor for further suspicious activity.
Source ↗Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Google dismantled the XCPE botnet spanning >1.3 M Android TV boxes and blocked the manufacturer. TV‑box fleet managers should verify firmware integrity, apply updates, and quarantine compromised units.
Source ↗⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More
This week’s incidents underline that trivial mistakes—no passwords, fake support calls—can cause major breaches. Ensure basic hardening (strong passwords, MFA, up‑to‑date patches) for cloud and Linux services.
Source ↗Chinese hackers use ARTEX AI in automated attacks against 200 orgs
The open‑source ARTEX multi‑agent AI framework was leveraged by Chinese groups in attacks on 200+ organizations across 14 countries. Teams should monitor for AI‑driven scanning behavior and harden endpoints.
Source ↗Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
Missing authentication allows unauthenticated remote code execution on SIMATIC IoT2050 Advanced devices. Operators should verify patch status, apply updates, and isolate any vulnerable gateways.
Source ↗OpenAI says it's doubling Pro usage limits and bringing Work features to Chat
OpenAI is doubling Pro usage limits and adding Work features directly into ChatGPT, merging allowances across ChatGPT and Codex. Users of AI automation should review their quotas, adjust budgeting and explore the new collaboration capabilities.
Source ↗New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value
The new Windows infostealer VOLTA harvests passwords, browser cookies, Outlook and Slack data, and uses an LLM to rank stolen info by monetization value. Security teams should tighten endpoint protection, enforce MFA and monitor for credential‑theft anomalies.
Source ↗Alpine Linux rebuilds GitLab after attempted RCE attack
Alpine Linux rebuilt its GitLab server and reset all passwords after an attempted exploit of a critical GitLab vulnerability. Teams using Alpine packages or GitLab should verify repository integrity, rotate credentials and enable log monitoring for suspicious activity.
Source ↗CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
A critical flaw in LXD and MicroCloud lets an attacker log in as a trusted client using only the client’s public certificate and network access to the HTTPS API. Ops should restrict API exposure, rotate certificates and enforce strong client authentication.
Source ↗France plans Internet tax: 5.5 cents per gigabyte
France’s proposed 5.5 cent per GB internet tax could raise cloud storage and transfer costs. Review traffic to/from France and adjust budgeting or routing accordingly.
Source ↗Northflank security breach leads to abuse of customers' AI API keys
Following the breach, Northflank urges customers to rotate all credentials and secrets. Audit stored API keys, regenerate tokens, and review access logs.
Source ↗Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
CISA added two critical Ivanti Connect Secure flaws to its KEV catalog, noting active exploitation. Verify patches, enforce extra authentication, and audit VPN logs.
Source ↗Cloudflare reports 18.2 million network‑layer DDoS attacks in Q3, up 38 %
Network‑layer DDoS attacks are rising sharply. Operators need to review DDoS protection, including rate limiting and cloud‑scrubbing services.
Source ↗Chinese hackers use AI‑powered ARTEX to target over 200 organizations worldwide
The Go‑based ARTEX framework is used by state‑sponsored actors. Security teams should look for unusual pen‑test tools and audit network logs for related artifacts.
Source ↗A shared ChatGPT link could run attacker code and read private chats
A malicious share link can execute code in a logged‑in ChatGPT session and read chats. Users must avoid unknown links and ensure OpenAI patches are applied.
Source ↗Critical Linux kernel flaw allows remote root attacks on MPTCP servers
The critical kernel bug affects Multipath TCP listeners. Ops should verify if MPTCP is enabled and apply patches or mitigations immediately.
Source ↗Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen
A security incident at Binance impacted about $6.3 billion in assets, with nearly $3 billion frozen. Customers using cloud storage for crypto backups should audit access controls and monitor for abnormal transactions.
Source ↗Hugging Face malware campaign returns to hijack GPUs for crypto mining
Malware abusing Hugging Face models hijacks GPU servers for crypto mining. AI workload operators should verify model sources, monitor GPU usage spikes, and scan for unknown backdoors.
Source ↗ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
ThreatsDay highlights several critical firewall vulnerabilities and active banking trojans. Network and security teams should apply firmware updates, rotate passwords, and intensify log analysis.
Source ↗Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
A critical Linux kernel TCP flaw (CVE‑2026‑98432) allows unauthenticated remote code execution. Admins of Ubuntu, RHEL and other distros must apply patches immediately and monitor network logs for suspicious activity.
Source ↗Sony ISP Subsidiary Data Breach Exposes 2.5 Million Customer Records
After the leak, mail and DNS admins should audit passwords, enforce MFA and alert users to phishing. Increase log monitoring for abnormal logins.
Source ↗Police Seize Virtualine Bulletproof Service Tied to Ransomware, Cybercrime
Hosting providers should check if customers still reference Virtualine domains and block them. Run log analysis for traffic to the seized domains.
Source ↗Google to Allow One‑Tap Android App Installs From Approved Third‑Party Stores Outside U.S.
Third‑party store operators must pass identity checks and submit full catalogs for Google’s malware scanning. Support should verify scanning is active and background updates are enabled.
Source ↗Volt Typhoon Used Covert Silent Train Network in Four Zero‑Day Exploitation Campaigns
Ops should verify whether internal SOHO, IoT or enterprise devices are part of rotating compromised chains. Monitor network traffic for Silent‑Train links and patch affected devices.
Source ↗CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets
CyberStrikeAI employs 44 AI agents to automate attacks on Japanese targets, showing AI can be weaponized in cyber campaigns. Security ops should update detection rules for automated behavior and scrutinize logs for anomalies.
Source ↗Storage shortage due to AI hype: Fujifilm multiplies magnetic‑tape production
Fujifilm is dramatically increasing magnetic tape production to meet the AI‑driven storage shortage. Backup teams should watch tape availability and pricing and reassess long‑term archiving strategies.
Source ↗GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption
The GoAhead embedded web server loads a CRL but never enables revocation checking, allowing revoked client certificates and possible session decryption. Users of GoAhead with mutual TLS must turn on revocation checks or apply patches.
Source ↗HPE unifies network and security management with AI
HPE consolidates LAN, WLAN and SASE network‑and security data into Mist and Aruba Central, adding the AI agent Marvis for faster fault analysis. Operations should verify the integration, monitor data pipelines and adjust alerts accordingly.
Source ↗OpenAI launches GPT-6.1 Terra with 3x faster AI agents, 50% lower pricing
OpenAI released GPT‑6.1 Terra, a faster, cheaper model aimed at coding, visual reasoning and automation. Teams using AI automation should evaluate the model for performance gains, pricing impact and integration requirements.
Source ↗Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
A campaign has injected malicious JavaScript into 953 online stores, mainly Magento. Magento admins should audit CMS blocks, remove unknown scripts, and ensure the platform is up‑to‑date.
Source ↗PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP released rebuilt Windows packages for 8.2‑8.5 fixing a Brotli compression flaw. Ops should deploy the updated builds and verify cURL settings to avoid accidental exploitation.
Source ↗CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
CISA added two PHP2Shell flaws to its KEV list after confirming active exploitation. Anyone running vulnerable PHP versions should verify they are patched and review logs for suspicious activity.
Source ↗AI coding agents hijacked using AGENTS.md file in Downloads folder
A malicious AGENTS.md in the Downloads folder fooled AI coding agents into installing a rogue npm package. Teams using AI code assistants should restrict file access and verify npm installations.
Source ↗PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
Exploitation attempts still target vulnerable PHP apps using PHP2Shell‑like flaws. Operators of PHP services should patch applications, harden inputs and monitor for scanning activity.
Source ↗Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
Unpatched Tailscale SSH flaws let a compromised device use port‑forwarding to gain root on reachable servers. Admins using Tailscale SSH should verify patches, review access rules and disable port‑forwarding if not required.
Source ↗Microsoft Teams to get AI-powered, context-aware phishing detection
Microsoft will add AI‑driven, context‑aware phishing detection to Teams messages. Support teams should pilot the feature, brief users on new warnings, and ensure existing mail filters still apply to Teams traffic.
Source ↗BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
The BlackX UEFI bootkit exploits the Baton‑Drop flaw to bypass Secure Boot and load malicious drivers. Administrators should verify firmware updates, re‑enable Secure Boot policies, and monitor for unauthorized drivers.
Source ↗Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
An accidentally published LiteLLM master key allowed theft of GitHub tokens and injection of malicious packages. AI pipeline owners should purge secrets from repos, rotate keys and audit their release workflows.
Source ↗Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory‑corruption bug in the Brotli decoder impacts Node.js, Bun, Python Brotli packages and Envoy proxies. Operators of web services and CI pipelines should upgrade the affected libraries and validate any Brotli‑compressed input.
Source ↗Selected automatically and commented with AI. Please report mistakes — I withdraw entries when needed.