PPHM HACKER NEWS

🔴 Update: Further internet outages have been registered in Florida and Alabama after the landfall of Hurricane Isaias near Destin, now a post-tropical cyclone, causing damage to infrastructure and widespread power outages

🔴 Dread has been down for the majority of the day due to an unknown attacker DDoSing it.

Leaked Criminal Chats Reveal Multimillion-Dollar Cyber Extortion and Bitcoin Laundering Network

Leaked internal communications attributed to the cybercrime operation known as Silent Ransom Group (SRG) suggest its members collected approximately $207 million from 27 law firms between April and September 2026.

🔗 Read More

🚨 complete evacuation of Riyadh airport

🔴 Material Bank Administrator Access Offered for Sale for $90

An actor known as "DaOnlySpark" is selling administrator access to databases belonging to Material Bank's Japanese platform.

The access covers customer records, sales leads, orders, billing information, and inventory data. The seller also claims access to HubSpot contact profiles containing personal and business information, along with internal reporting and analytics systems.

The listing names three databases and offers access for just $90.

🔴 CVE-2026-102489

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

🚨 The Italian Ministry of Defense announced that Saudi Arabia has officially requested assistance in order to strengthen its security and defense of its territory

🔴 One source close to the investigation told KrebsOnSecurity the Canadian person arrested this week was visiting Pennsylvania for a cyber insurance conference, and that the suspect’s company specialized in handling ransomware negotiations with cybercrime groups. Another shared that control over the ShinyHunters investigation has been centralized at an FBI field office in Texas.

An online search reveals the Cyber Risk Summit was held at the Loews Philadelphia Hotel between Oct. 5 and Oct. 7. The conference had several sponsors, but according to the summit’s website its biggest sponsor was a Canadian security company called Cypfer.

According to LinkedIn, Cypher was co-founded by a Canadian man named Edward Dubrovsky, who is now associated with another Canadian security firm and sponsor called CyberSteward. In a post to LinkedIn approximately one month ago, Dubrovsky said he had plans to attend the Cyber Risk Summit with the rest of the CyberSteward team.

🔴 Confirmed: Metrics show a decline in internet connectivity in parts of Florida as Category 3 Hurricane #Isaias nears landfall; the incident corresponds to reports of heavy winds and downed lines, leaving hundreds of thousands without power and telecoms

🔴 Confirmed: Network data show a disruption to internet connectivity in #Panama after a ~7.7 magnitude earthquake, with tsunami alerts being issued for several countries on the southern Pacific coast

🔴 Germany Arrests Suspected Qilin Ransomware Leader After Japan Detention

Germany has arrested a Russian national believed to be a leading figure in the Qilin ransomware group, and Japan’s National Police Agency just put its own role in that arrest on the record. The suspect was detained in Japan back in May, at a hotel in Osaka, while traveling as a tourist.

“In connection with a ransomware incident in Germany, German authorities had obtained an arrest warrant for a Russian national suspected of involvement in the attack. When the suspect arrived in Japan, the Japanese authorities worked with the Ministry of Justice, the Tokyo High Public Prosecutors Office, and German authorities to detain him under a provisional detention warrant, in accordance with Japan’s Act of Extradition.” reads a full NPA statement in Japanese. “The Japanese authorities subsequently handed the suspect over to Germany in accordance with the procedures established by that law. These actions contributed to the case.”

🔴 Danu Robotics’ fight to build a better recycling robot

For Danu Robotics founder Amy Ma, the eureka moment came after years of working as a software developer at a London bank. It was the kind of high-touch office that’s typical in finance — but despite all the perks, Ma was alarmed to realize that the building’s recycling bins were being emptied into the trash.

“Even though they have tons of money, there’s all these different recycling bins that just end up in the same place,” Ma told TechCrunch.

🔴 Man admits to running network of 15,000 money mules for cybercriminals

​A Ukrainian-Russian dual citizen has pleaded guilty to running a massive money laundering operation that laundered millions for cybercriminals worldwide.

42-year-old Oleg Korniev was one of the leaders of Your Mule Cashout (YMCO), a criminal organization that has operated since September 2007 and used more than 15,000 money mules from the United States.

Four other individuals who were involved with YMCO were arrested overseas more than a decade ago, extradited to the Western District of North Carolina, and pleaded guilty to conspiracy to commit money laundering. They received prison sentences ranging from 37 to 63 months and were also ordered to each pay more than $9.1 million in restitution to U.S. victims.

Anthropic Expands Defensive AI Access With Automated Audits for Critical Software

Anthropic has introduced OSS Scanner, an opt-in cybersecurity service that uses its most capable Claude models to identify vulnerabilities in widely used software projects.

🔗 Read More

🔴 Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

Hackers have been exploiting two unpatched vulnerabilities in the AhsayCBS backup solution for remote code execution (RCE), cybersecurity firm Huntress warns.

A centralized cloud backup server management console developed by Ahsay Systems, AhsayCBS provides backup policy, storage, and user management and is popular among MSPs and system integrators.

Tracked as CVE-2026-105133 and CVE-2026-105134, the exploited security defects allow attackers to manipulate arguments in certain functions of the tool to bypass authentication and inject OS commands.

🔴 Microsoft: Outdated Windows devices will stop receiving security updates

Microsoft says devices running unsupported versions of Windows will stop receiving security updates after next year's Windows Update certificate rotation.

To ensure devices keep receiving updates, admins and users must upgrade to a supported version of Windows before the Windows Update certificates expire in May and June 2027.

"As a standard security practice, these certificates have an expiration date. This means that they eventually need to be rotated (that is, replaced by new certificates). A set of these certificates will expire on May 17, 2027 and June 19, 2027," Microsoft said on Thursday.

🔴 French Government Agency ASP Dataset With 31,028 Records Offered for Sale

A partial dataset from France's Agence de Services et de Paiement (ASP), the public agency responsible for administering government aid and payments, is being advertised on a forum.

The 20 MB file contains information on 29,611 people, including 26,871 email addresses and 24,065 social security numbers. Samples also show names, dates of birth, phone numbers, and home addresses.

The seller has published samples and is accepting offers in Monero (XMR).

🔴 Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries

There is a large global market for low-cost Android devices. Bad actors are aware and are servicing the demand through devices built on MediaTek platforms – but with malware preinstalled in the device firmware.

When the recipient of such an affected device switches it on, the malware is present, unseen, and available to any bad actor who can control it remotely from its C2. It is a persistent, pre-installed firmware system app that cannot be removed by normal uninstall procedures.

The campaign, dubbed Midnight Mimosa, was discovered and analyzed by Bitdefender.

🚨 Saudi Arabia Warns Indian Residents Against Filming Yemeni Missiles and Drones

Saudi authorities have reportedly issued a warning in an Indian language to Indian nationals residing in Saudi Arabia, stating that they could face legal prosecution for recording footage of Yemeni missiles, drones, or their impact sites.

🔴 SKIF Belgium Member Dataset With 9,366 Records Offered for Sale

SKIF Belgium, an organization promoting traditional Shotokan karate, has been named in a new data sale on a forum.

The actor "ChimeraZ" is selling a 1.8 MB dataset containing 9,366 records covering 8,840 individuals.

The files include member information, event registrations, external contacts, and administrative logs. Samples have been published across multiple file-hosting services.