“That’s Not Supposed to Happen” – PSW #951

Paul Asadoorian

1. Debian’s APT Affected By Man-In-The-Middle Attack For Arbitrary Code Execution As Root – Phoronix

   Summary: A flaw in APT lets an on-path attacker replace a package after APT has verified it, potentially running arbitrary code as root. The bug involves HTTP redirects that make two downloads appear to share a URI, combined with unsafe handling when resuming a download. Debian’s advisory identifies it as CVE-2026-109518, credits Max Justicz, and says the fix for Debian stable (Trixie) is in APT 3.0.4. (Debian advisory)

   Paul's take: Package-signature verification is a core defense, but it didn’t protect against this bug in APT’s download handling. The public coverage says retries are enabled by default starting with Debian 12 and Ubuntu 22.04, so check affected systems and update APT. Interesting: APT normally verifies a package against a hash in signed repository metadata. In this flaw, an attacker who could tamper with HTTP traffic could exploit redirects and download retries to make APT treat two downloads as the same file. APT’s unsafe handling of that file then let the attacker alter or replace the package after verification. APT had checked one set of bytes, but could end up installing different bytes. That’s a time-of-check/time-of-use bug involving hard-link reuse, according to the vulnerability record and Debian’s advisory.

2. Today’s PHP Security Release, and How We’re Strengthening PHP Security

   Summary: The PHP Foundation says developers first identified signs of the OOM flaw during a 2024 audit, but had no concrete exploit path then, and more urgent issues took priority. Fixing it involved difficult compatibility and stability trade-offs, and the small team’s consensus-based decision process caused work to stall and restart over months. After researchers demonstrated a viable remote code execution path in August 2026, the flaw became the top priority and patches were prepared for supported PHP branches.

   Paul's take: They knew about the flaw in 2024 but didn't fix it; perhaps open source projects need better product management? These are the types of decisions I guide every day in my role as a PM. Not saying I would have caught this one, but there's a much better chance when you have members of the team focused on prioritizing work based on external and internal factors, as open source projects tend to focus internally, as they do not have paying customers, just users that get to use the "product" for free. A bit more on PM for open source: "For the PHP security issue you’ve been following, a PM could help make the work visible and actionable: clarify who owns the decision, weigh user risk against engineering cost, set priorities, and identify what resources are missing. They couldn’t replace maintainers’ technical judgment or conjure up the funding and expertise needed to fix it. PHP’s own account describes the delay as a process and resource problem, so the PM argument is strongest as a case for clearer prioritization and accountability—not as proof that a PM would have caught the flaw."

3. Hackers put porn on public billboards and claim it was “far too easy”

   Summary: The Malwarebytes post reports that explicit footage appeared on digital billboards in Egypt, Malaysia, and Brazil, with the group Leakers$ claiming it compromised the software used to distribute content to displays. The group said it found thousands of exposed systems in a short scan, but that account and its claims about other countries have not been independently confirmed.

   Paul's take: This has happened before, often through the system that manages the screens rather than the billboard hardware itself. The older cases vary in how clearly hacking was established:

   • Moscow, 2010: police said a man broke into a company server and sent explicit video to a roadside screen.
   • Atlanta, 2015: police and the FBI investigated an obscene image on a billboard. A security researcher said he had warned the operator about default credentials shortly before the incident.
   • Jakarta, 2016: police arrested a man who said he got into the operator’s system after its login credentials appeared on the screen.
   • Malmö, 2016: explicit footage appeared on a public information board; the operator said it did not know how the system was accessed.
   • Makati, 2018: the billboard operator blamed a malicious attack, though a witness suggested remote-control software or operator error could also explain it.
   • Brisbane, 2022: the operator called it a deliberate breach, and police investigated.

   The recurring weak point is remote content-management access: exposed interfaces, weak credentials, or poorly controlled third-party access can turn an advertising system into a public broadcast channel. If confirmed, the new report’s claim of a shared publishing platform across multiple countries would make this incident larger in scale.

4. Shutting the Door on the XCPE Botnet

   Summary: Google says it and industry partners disrupted XCPE, a backdoor built into firmware by Android TV device maker Videostrong and used to enroll more than 1.3 million set-top boxes and other Android devices. The system-level implant persisted across reboots, contacted operators over MQTT, and could silently install apps, run shell commands, capture screens, and disable Google Play Protect; Videostrong then loaded affiliate modules for ad fraud, residential proxy services, and additional malware. Google also took down command-and-control infrastructure used by those affiliates, which it says could cut off access to at least 10 million more compromised devices beyond XCPE.

   Paul's take: The striking part is the business model: this wasn’t just a compromised firmware image or an accidentally bundled app. Google assesses that Videostrong deliberately sold affiliates access to devices after purchase, with a modular loader that could swap in different money-making payloads. Persistence from the /oem/ partition meant users couldn’t remove the backdoor by uninstalling its visible package, and the operators could use infected TVs as proxy exit nodes or remotely inspect and control them. Google says Videostrong used obfuscation to install the malware after first boot and evade compatibility testing; it has since banned the company from making certified Android devices and says it changed its review process. That response matters, but the affiliate networks and proxy providers form a broader market that can move to other loaders and devices.

5. Additional Ivanti Connect Secure zero-days exploited in the wild

   Summary: Rapid7 reports that two more Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, were exploited in the wild as part of the attack chain Volexity first detailed in October. Chained with CVE-2026-104935, the flaws enabled unauthenticated root access to VPN appliances, followed by credential theft, Active Directory reconnaissance, and efforts to evade forensic checks. Rapid7 says the new fixes are in versions 25.1.1.3 and 22.8R2.6; the earlier fix for CVE-2026-104935 alone did not address these additional flaws.

   Paul's take: Unauthenticated command injection is bad; why are we still finding these flaws in 2026? Patching never ends for Ivanti: an appliance could have received the October update for the first flaws and still needed another update when Ivanti disclosed the additional chain components. Also, a clean Integrity Checker result does not rule out compromise. The attacker modified state in memory and removed log evidence, so organizations should patch and investigate with network and memory forensics if their appliance may have been exposed.

6. Hackers Alter Refrigeration Settings, Forcing European Stores to Discard Food

   Summary: Hackers altered commercial refrigeration settings across several European countries on November 2, causing food losses and disruption at supermarkets and suppliers. The affected equipment reportedly includes Danfoss, Copeland, and Dixell controllers, also named in France’s October incidents. The same product families are involved, but public reporting has not established that the November attacks used the same vulnerabilities or were carried out by the same attackers.

   Paul's take: Why these targets? Internet-exposed controllers can be found and manipulated remotely, and changing a setting can cause immediate, costly disruption. That makes them attractive to opportunistic attackers seeking damage or attention, though the motive here remains unconfirmed. The October incidents already showed the risk: Claroty’s August research had documented a “code-of-the-day” authentication bypass on Danfoss AK-SM 800A controllers, where the current date could serve as the password. The overlap is a strong reason to investigate whether that weakness or other known flaws were reused, but it isn’t proof that the November attacks used the same exploit. Exposed management interfaces, default credentials, and end-of-life firmware remain the practical issues to fix.

7. A Hackable Analog Phone System

   Summary: Analog Redial is an open-source ESP32-C6 project that turns one or two rotary or touch-tone phones into a small, programmable phone system. Phones can call each other offline, use custom dial codes and answering-machine features, connect over VoIP or SIP, and trigger Home Assistant actions; an optional Bluetooth board lets an old phone act as a cellphone handset. The hardware and firmware are open, with build guides and a web interface for setup.

   Paul's take: This is really neat. If you’ve always wanted to hack the phone system, here’s a fun place to start: make a rotary phone call another room, ring when the doorbell goes, or turn a dial code into a home automation trigger. It’s a hobby build with actual phone-line voltages, so keep it isolated from house and telephone-company wiring.

8. From RCE to camera credentials in Axis Camera Station

   Summary: During a penetration test, Ricardo J. Ruiz Fernández chained an authentication bypass (CVE-2025-30026) with insecure deserialization (CVE-2025-30023) to gain unauthenticated SYSTEM-level code execution on two Windows servers running Axis Camera Station. From there, he found that the application’s camera credentials could be decrypted because its AES key was derived from hard-coded constants and the host’s non-secret NTFS volume serial number. The recovered credentials let him connect directly to the cameras managed by those servers.

   Paul's take: This shows why a flaw in video management software can become a path into the physical environment it monitors. Axis patched the credential encryption in Camera Station Pro 6.20, but says Camera Station 5 will not receive that fix. Operators should check which product and version they run, and treat exposed Camera Station services and stored camera credentials as part of the security boundary.

9. CVE-2021-31181: Building a functional exploit from a ZDI report and a non-working Metasploit module

   Summary: ITRES Labs reconstructs a working exploit for CVE-2021-31181, a SharePoint remote code execution flaw, starting from ZDI’s technical report and a Metasploit module that the author says did not work. The original ZDI report describes an authenticated attack requiring ManageLists permissions, which can expose the SharePoint ViewState validation key and enable code execution.

   Paul's take: This is why defenders should pay attention to PoCs, not just polished exploit releases. A nonworking module still contains useful clues, and AI can help an attacker bridge the gaps between a vulnerability description, code, and a functioning exploit. That makes the path from PoC to weaponized exploit easier than ever, and shortens the time defenders have to respond.

10. CVE-2026-98432: Ubuntu Is Still Unpatched After 19 Days. How to Protect Servers

    Summary: Authon questions whether Ubuntu’s fix for CVE-2026-98432 fully closes the Linux kernel use-after-free in IPv4 TCP connection handling. Canonical’s latest status says fixes for Ubuntu 22.04 and newer are in -proposed or, for 26.10, marked fixed; the Linux kernel CVE team describes the issue as a race involving socket options freed while still in use.

    Paul's take: I checked Manjaro and didn’t find a fix yet. I checked both the kernel version and, with AI assistance, reviewed the kernel for a backported fix that a version check might miss. That’s a useful reminder that distro version strings alone can mislead, but AI-assisted source review is a lead to verify, not proof of vulnerability or remediation. Canonical’s status has been moving quickly, so check the distro’s current advisory before concluding. I've also checked some Linux-based devices, they are also vulnerable. This one is going to linger for a while...

11. I put a local AI model on a bootable USB, so I can troubleshoot a dead PC with a chatbot that doesn’t need the internet

    Summary: XDA describes putting SystemRescue and an offline chatbot on one 64 GB Ventoy USB drive. The setup uses llama.cpp with a quantized Qwen3 4B model, running on the target PC’s CPU to help interpret disk listings, SMART reports, and kernel logs. The author recommends using the model to guide diagnostics and keeping the Windows partition read-only while backing up files.

    Paul's take: Handy as a troubleshooting aid when the internet or installed OS is unavailable, but the model is an explainer, not a diagnostic authority. Practical limits include the target machine’s memory and CPU, and booting SystemRescue may require changing Secure Boot settings; BitLocker volumes still need the recovery key. Give it real command output, ask for non-destructive next steps, and verify before changing disks.

12. Jailbreaking my car’s navigation system just so I can change the time

    Summary: Rasmus Moorats reverse-engineered the TomTom Carminat LIVE navigation unit in his 2014 Renault Latitude after discovering that changing the dashboard clock required a genuine map SD card. He found a path traversal in the unit’s master.script logging command, then chained it with Linux’s core_pattern handler and a crash in dbus-monitor to execute a shell script as root. He used that access to back up the internal storage and change the time offset.

    Paul's take: A great embedded systems write-up because the root access comes from combining small, constrained features rather than one dramatic flaw. The setup required physical access, an SD card, and manual approval of the script, so this is a hands-on jailbreak of an old head unit, not evidence of remote access to Renault vehicles. The memorable failure is that DRM meant to protect map data also locked a basic clock setting behind a licensed card.

13. Rooting An Amazon Echo Dot

    Summary: A 2018 Echo Dot 3 can be rooted and repurposed as a local Home Assistant voice satellite. The process requires opening the Dot and soldering a USB connection to board test pads; the Alexa client is replaced with software that connects to Home Assistant. Voice processing speed depends on the Home Assistant hardware, and the project’s code is AI-assisted and unaudited.

    Paul's take: This is a useful reuse project, not a newly discovered Echo vulnerability: it builds on existing MediaTek boot-chain exploits and device-specific rooting work. The tradeoff is that Amazon’s microphone processing and wake-word engine remain, and the replacement software carries real trust and bricking risks. “Local” here means voice commands are handled through Home Assistant, but I’d read the project’s security notes closely before putting an unaudited build on my network.

14. Firmware bugs

    Great quote on UEFI from Vince Zimmer: "This type of commentary on firmware reminds me of my old dichotomy of this domain as 'value add' versus 'value neutral.' I had originally thought that the rich EFI and UEFI capabilities would allow for adding value to the platform, but I successively realized that firmware is just basic utility infrastructure that provides inherent value when it 'just works.' It vectors into negative value territory when it is expensive to develop, boots slowly, has security issues that need remediation, or is complex to configure. So the goal of the mission always entails moving the needle out of the value territory."

    Summary: Vincent Zimmer argues that a recent UEFI firmware code-execution flaw is part of a familiar pattern: firmware has always had bugs, and more widespread use means more defects will be found. He frames firmware as utility infrastructure whose value depends on reliable operation, and traces progress from signed updates to more reliable recovery and broader update support. He argues that scalable servicing matters, while security engineering that prevents vulnerabilities is more valuable than treating each discovery as a crisis.

    Paul's take: Good perspective from someone who has spent decades building firmware. The flaw still deserves attention, but the response should focus on exposure, impact, and whether systems can be updated at scale, rather than treating “firmware” as a newly discovered danger. The more useful question is whether vendors have made updates reliable and routine enough for defenders to deploy them.

Adrian Sanabria

1. Railway tried to hack a competitor (Primcloud) and tried to shrug it off as AI being AI

   It's like the whole "boys will be boys" argument in court and will probably age just as well.

   The details here are wild.

   1. Josh Manders, founder of Primcloud asks the founder of Railway, Jake Cooper, why his employees are trying to hack him.
   2. They own up to it immediately - within minutes, we know that Jake Runzer was the one doing it. Says he was just building a harness to agentically sign up for services.
   3. Josh provides screenshots of Jake actively trying to steal credentials. He also adds that Jake signed up with a throwaway Proton account and a fake name, but used his personal credit card.
   4. At the same time, Josh waves away suggestions that he should press charges: "bro it happened in the middle of the night, calm your tits" <- so if it happened at 2pm, the FBI would be on the case right now?
   5. Jake Cooper claims that this was something an employee did of their own accord, on their own personal time.

   This is going to happen a lot more in the future.

   Reactions from the security community:

   • Azeria on X (@Fox0x01): "The plausible deniability problem is real. We’re seeing people increasingly shifting blame onto their AI agent, using the observability problem as an excuse for its malicious actions. People used to be afraid of getting caught doing computer crimes. Now it’s just a casual "oops my agent went off the rails, not my fault".
   • Marcus Hutchins on X (MalwareTechBlog): This thread is absolutely WILD. TL;DR founder finds rival company trying to hack his networkk. He posts about it tagging said company. Both the dude responsible and the founder jump in like "yeah, our bad, our AI went off the rails" as if they just accidentally bumped into someone on the sidewalk.
   • Justin Elze (@HackingLZ): Woah
2. VulnCheck Opens Initial Access Community Edition to the Public

   VulnCheck has made exploits available to paying customers, but is now opening up some exploits and vulnerable targets for testing to their community users, along with Docker containers for convenience. Nice!

3. How the Binance Heist happened
   1. June 2026 - Wallet Engineer falls for malvertizing via Google search (probably) and downloaded a pre-pwned version of Homebrew. This was detected and contained, but not until after the attackers got some details about other wallet engineers.
   2. September 2026 - a second wallet engineer gets woo'ed by a hiring scam through a real job-hunting platform. Engineer then felt for the old malware-posing-as-a-coding-interview trick (i.e. ClickFix). This also used Homebrew as the attack vector (likely because it will look pretty normal in most Mac-heavy engineering environments).
   3. October 20 2026 - Using the second wallet engineer's access, attackers used an internal AI tool to compromise the original wallet engineer victim, as well as a third wallet engineer. (no details on how this happened).
   4. October 29 2026 - attacker logged into the third engineer's computer and used a container deployment token from the first engineer's computer to deploy a container and trigger a malicious script to begin the wallet theft attack

Larry Pesce

1. Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
2. SPECTER: Leaking Data from Air-Gapped Computers by Toggling USB Power States
3. Cyberattack wipes cloud data at major Russian hosting provider Beget
4. French blood service hit by Europe-wide cyberattacks on refrigeration
5. One Hacker Used 12 AI Agents to Target Taiwan’s Emergency Services

Lee Neely

1. North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History

   Summary: On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. Wallets belonging to Binance across at least ten blockchains—including Ethereum, Bitcoin, Tron and Solana" were emptied of their funds. That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks. Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly USD 2.7 billion. The attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer's reach.

   Lee's Take: Largest crypto theft on record. Let that sink in. Even with the frozen ETH/ARB and stablecoins, the attacker still has over 2.4 billion under their control. Here’s the deal - we all need to be getting smarter on crypto currency. As you read the writeup on this event, you should already understand not only all the moving parts, but also mitigations before you start putting real money into crypto. Understand the speed at which this currency moves versus traditional currency as well as the safeguards. Read the terms and conditions to understand where crypto does and doesn’t have you covered. If this is still all greek to you, many banking apps are adding Crypto services, read the EULA that goes with that service, then read it again, carefully, don’t risk any more than you can afford to lose.

2. Shop fridges and freezers across Europe hit by fresh suspected cyber-attack

   Summary: Supermarket chains in Sweden, Belgium and Luxembourg have said the temperatures of their refrigerators and freezers in dozens of stores rose overnight, prompting fears of a cyber-attack similar to one that caused millions of euros of food losses in France. Sweden’s Coop chain told the daily Aftonbladet on Monday.

   Lee's Take: Regretably the common denominator is exposed OT devices. I suspect the average supermarket is not thinking about these when it’s considering security, focusing more on payment processing and physical access. We all thought we had a bit of time before a repeat of the prior attack occurred. Changing operational processes to use private connections to these systems as well as securing the controlling system will take some time, time which we don’t appear to have. This may be one of those cases where you close the hole, reverting to more local/manual processes then implement the secure solution. Don’t assume these attacks will only happen in Europe, or only to refrigeration systems, those are what’s of interest today. Make sure that you have updated information on how your OT systems are accessed as well as the protections the systems which access/control them. Don’t forget to ask about maintenance and support services/contractors access.

3. Cyberattack disrupts Belgian tax services before filing deadline

   Summary: Belgium's finance ministry has taken its main online tax portal offline following a cyberattack, just days before a filing deadline for some taxpayers. The Federal Public Service Finance (FPS Finance), which oversees taxation and other financial administration, said Wednesday that it was investigating the extent of the attack and had temporarily suspended access to MyMinfin. The attackers infiltrated the Federal Public Service Finance (FPS Finance) on Tuesday evening, October 27 into Wednesday, October 28.

   Lee's Take: Kudos to FOD Financiën for rapidly detecting and responding to the attack. They have chosen to rebuild systems in isolation to guarantee their integrity before restoring services, showing they are also not afraid of a bit of hard work to support their users. Their work is further complicated by their efforts to respond to the recent PHP2Shell incident. While it’s not clear there is any connection, this likely taxes the same resources. So the question for the rest of us is not only are we prepared to detect and respond to an attack quickly, but also, what’s the plan when overlapping incidents stretch your team to the breaking point? Of the three sides of the equation, time, resources and quality, time and resources are the ones you best modify.

4. GSA Exposed CUI in Google Drive

   Summary: The GSA OIG has published a report about CISA exposing CUI through its Google Drive. Files containing CUI and PII were not properly access controlled and they didn't leverage DLP capabilities to detect and isolate them.,

   Lee's Take: Don’t get distracted by CUI/PII/etc. this appears to be a case of DLP detection of sensitive data and subsequent permission management. Doesn’t matter if you’re using a local file server, GoogleDrive, OneDrive or something else, you need to be diligent about the permissions on data, particularly sensitive data, Users need to clearly understand what data may be stored in which locations as well as their obligations to properly secure it. It simplifies things if all central storage is authorized to store your most sensitive data, but it still needs appropriate access controls to ensure need-to-know. DLP can help you, but your users are still the primary defense. Verify your DLP capabilities as well as your user training. Make sure there are resources to help make informed decisions about exactly how a given set of data needs to be stored, shared or otherwise handled.

5. A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days

   Summary: CISA added two flaws in Ivanti Connect Secure (ICS) to the KEV catalog. CVE-2026-111357, CVSS score 7.0, allows a local unauthenticated attacker to escalate privileges to root exploiting a mishandling of "the manner in which the dsinvoked broker trusts DSCache configuration data" in ICS 22.8R2.4; this is listed by CISA as a missing authentication for critical function vulnerability, and MITRE categorizes it under CWE-829: Inclusion of Functionality from Untrusted Control Sphere. The MITRE and NIST records for CVE-2026-118527 have not been filled out at the time of this writing, but CISA writes, "Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk." These two flaws can be chained together along with CVE-2026-104935 (CVSS score 8.6), an authentication bypass by spoofing vulnerability allowing remote code execution

   Lee's Take: Check your versions of Ivanti Connect, while version 22.7 is not impacted, it’s EOL January 31, 2027, so you still need to get to version 25.1.1.3. Good news is that if you’re on 25.1.3.0 you’re not impacted, bad news is 25.1.3.0 needs newer hardware or updated virtual machines based on this version. Not seeing any workarounds, so knuckle down and get the fixes deployed, then make sure that you’re monitoring for IoCs.

   Ivati Adsvisory https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

6. British spy agency cannot account for thousands of data storage devices, watchdog says

   Summary: The 2025 Annual Report of the UK's Investigatory Powers Commissioner’s Office (IPCO) says that GCHQ is unable to account for thousands of data storage devices. Some of the missing "USB sticks, external hard drives, compact discs, memory cards and other portable media storage devices" may contain information obtained under the Investigatory Powers Act. The fact that the devices are unaccounted for has been known for years; a GCHQ spokesperson acknowledged that the agency's "management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use."

   Lee's Take: Monitoring a fleet of thumb-drives, let alone CD/DVD media is quite the task. Particularly if you consider the cost, making it trivial to just purchase a replacement if something happens. But if you consider it could contain proprietary information, that sort of kills the argument about replacement being trivial. This is a place where you could leverage DLP to raise exceptions to IP and other sensitive data being stored on these, regardless of ownership, reducing the likelihood of unknown media containing that data and also triggering tracking for those which do.

7. Google disrupts XCPE botnet, bans the company behind it – Help Net Security

   Summary: Google shut down the servers behind XCPE, a backdoor hidden in the firmware of Android TV set-top boxes. Google’s Threat Intelligence Group attributes the operation with high confidence to Videostrong Technology, the company that manufactured many of those boxes. More than 1.3 million devices were enrolled. The disruption of the botnet's operation included taking down domains and servers that were used to control the botnet and install malware as well as the command-and-control domains that facilitated the malware; banning Videostrong and its subsidiaries and affiliates and any future subsidiaries and affiliates from building or selling Android devices and from supplying software to other vendors; and improving the way Google assesses firmware integrity.

   Lee's Take: If you’re using an Android set-top-box, make sure that you’re using a Google certified device. It’s better to replace a questionable device than to attempt to clean it. If your were device was supplied on by your service provider, check with them on any needed updates or replacements. While you’re at it, consider your smart TV or monitor. If you’re not using the streaming components, why connect them to the Internet? If they must be connected, see if they’ll work on a network with device isolation to limit their access to other devices they have no need to interact with.

8. Report: Over 42 million records exposed by local government technology platform for civic engagement

   Summary: A cybersecurity researcher reported finding an exposed database tied to a civic engagement platform used by local governments that contained about 42 million documents and nearly 450,000 files with information collected by cities and their residents. The researcher, Jeremiah Fowler, published a report on ExpressVPN on Thursday that claimed a publicly accessible database associated with CitySourced civic engagement platform was not encrypted, password protected and externally reachable while containing PII.

   Lee's Take: So you have an application with a database. A database which is neither password protected, nor encrypted while being publicly accessible. These are issues you need to understand prior to production deployment. Doubly so if you’re storing sensitive data, but realistically, if you do it for everything, you’re not going to have things fall through the cracks. Make sure the barn door isn’t wide open - verify that all your databases are not publicly accessible and have strong, non-default, credentials. Then loop back on how sensitive data is protected. Fixing issues as rapidly as possible, adversaries are going to be looking for this trifecta.

9. Cyber Incident

   Summary: Cleveland, Ohio's University Hospitals has disconnected its systems from the internet while it investigates "unusual activity" on its servers. The incident was detected on October 22; a November 2 update notes that the organization's "hospitals, emergency departments and physician offices remain open, and ... caregivers continue to provide safe care." The University Hospitals cybersecurity incident page acknowledges that it is experiencing high call volume and long hold times.

   Lee's Take: One of the first things I do when I see an incident like the University Hospital’s issue is to review the messaging being put out, capturing any good ideas for when it’s my turn. Notice UH covered most scenarios, provides contact numbers as well as guidance. Beyond getting good messaging out, make sure someone is tasked with keeping it updated as things change who is not actively involved in response or recovery. The next thing is to look for scenarios or issues which are relevant beyond the specific incident. For example, the fines at this and other healthcare providers are now facing fines from HHS for HIPAA violations, a strong indicator that healthcare security is to be taken seriously, and act accordingly. Fortunately, efforts are springing up, such as Lifeline 250 we discussed in NewsBites Vol 28 Num 81, to help. Leverage these as well as the Healthcare ISAC to raise the bar.

Sam Bowne

1. AI Vulnerability Finding

   3% of ‘critical’ software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total.

2. Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning

   Proton CEO Andy Yen projects a calm persona and rails against Big Tech and critiques AI. Internally, he is pushing engineers to build Proton with AI, even when they have security concerns.

3. Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions

   t's a race condition that causes a use-after-free. The attack takes an hour and gains root-level command execution. Some Linux distributions have patches available, but many do not. The bug was introduced in Linux 4.4, released in 2016.

4. TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them

   TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. The attack needs no password and no extra click beyond accepting the session, and it works in TeamViewer's default setup.

5. GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

   GoAhead is a small embedded web server used to run management pages on routers, printers, gateways and industrial controllers--hundreds of millions of devices. But it failed to enforce certificate revocation, so a revoked client certificate could still pass login.

6. Supermarkets across Europe hit by new fridge cyberattacks

   The incidents caused temperature spikes and spoiled food at stores in Sweden, the Netherlands, Belgium, Ireland, Luxembourg, and Estonia. It follows a similar cyberattack in France last month.

7. Russian and Ukrainian hackers hijack emergency apps to spread fake nuclear attack warnings

   Russia hacked a Ukrainian alert app, so it sent fake warnings of possible radiation hazard, a chemical threat and ongoing street fighting. So DC 8044, DEFCON Ukraine, hacked the Russian app via its API to distribute false warnings claiming that nuclear warheads had been launched toward Russia.

8. A simple explainer of the massive $6.3 billion crypto heist at Binance

   North Korea performed "the largest bank robbery in human history." It's not clear yet how they got in. Binance said it has replaced nearly 100% of the cryptocurrencies that customers lost in the attack.