PPHM HACKER NEWS

🔴 Adobe Patches Critical Flaws in Connect, AEM Forms

Adobe on Tuesday rolled out patches for 36 vulnerabilities across its products, including critical-severity flaws in Connect and Experience Manager (AEM) Forms.

The Adobe Connect update resolves nine security defects, including six critical issues that could be exploited for arbitrary code execution and privilege escalation.

Tracked as CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, and CVE-2026-75698, they are described as SQL injection, cross-site scripting (XSS), and improper input validation flaws.

🔴 MEDUSALOCKER CLAIMS CZECH INTERNET GIANT SEZNAM.CZ

MedusaLocker has newly listed Seznam.cz, one of the Czech Republic’s largest domestic internet platforms, on its ransomware leak site.

• The fresh listing was detected September 23
• Seznam describes itself as the Czech internet leader and operates more than 30 online services
• Its portfolio includes Seznam.cz, Email.cz, search, Mapy.com, news/media, advertising and other consumer/business platforms
• Seznam says its services reach roughly 90% of the Czech internet population and its homepage receives nearly four million visitors per day
• The company operates its own data centers and employs more than 1,900 people
• Current leak-site-derived telemetry does not establish the amount or type of stolen data, encryption impact, ransom demand, or initial-access vector

🔴 Chrome 154 Patches 108 Vulnerabilities

Google on Tuesday announced the release of Chrome 154 to the stable channel with patches for 108 vulnerabilities, including 11 critical-severity bugs.

The critical security defects include buffer overflows (three in ANGLE and one in WebGL), out-of-bounds writes (two in GPU and one in WebGL), and use-after-free bugs in ServiceWorker, Fullscreen, WindowDialog, and AdFilter.

Nine of the critical issues were reported by external researchers. In total, 32 of the newly patched flaws were reported externally, while the rest were discovered by Google.

🔴 Outerlimit Raises $16 Million to Stop Rogue AI Agents From Causing Harm

Autonomous agentic AI has a habit of going destructively rogue. It is unlikely we can stop this. Outerlimit has a solution focused on preventing any harm from rogue agents.

New York-based Outerlimit has emerged from stealth with $16 million pre-seed funding raised from AlbionVC, Evolution Equity Partners, Crane Venture Partners and a number of individual angel investors. Founded by Tony Pepper, Neil Larkins, and Peter Vincent, the firm offers a decentralized security and authorization layer to secure autonomous agentic AI.

🔴 UAE, Saudi Arabia Face Onslaught of Increasingly Complex Cyberattacks

The Middle East continues to see an uptick in cyberattacks, with a surge in finacially-motivated threats despite the focus on the widening military conflict in the region.

The United Arab Emirates, Iran, and the Kingdom of Saudi Arabia accounted for about two-thirds of all attacks (67%) discovered through open source methods, which scan for attack information on Dark Web forums and on threat actors' Telegram channels, according to threat intelligence firm Positive Technologies. The UAE and Saudi Arabia have both aggressively pursued digital transformation of their public and private sectors, leading to larger attack surface areas and more targets of interest to cybercriminals. Meanwhile, Iran's media organizations and telecom infrastructure are typically popular targets of attack, says Darya Lavrova, lead analyst at Positive Technologies.

🔴 The Malware Hiding in Developer Tools That Turned Terraform Providers Into Attack Paths

Malware has moved into tools developers use to build and manage cloud infrastructure. A campaign linked to Graphalgo planted a remote access program in Terraform providers and Go software packages, turning routine development work into a possible route onto valuable machines.

The packages did not behave like obvious malicious downloads. Some waited for particular inputs before running hidden code, making casual testing less likely to reveal them.

The danger echoes earlier attacks using fake Terraform job tests, although this campaign used its own malicious packages and methods. Aikido analysts identified the Terraform and Go variants.

🔴 Fake LastPass on GitHub Led to an Infostealer That Killed 145 Security Tools

Attackers spoofed LastPass on GitHub, used a Microsoft-signed driver to disable 145 security products, then deployed an infostealer.

Someone impersonated LastPass on GitHub, got users to download a fake authenticator, and ended up killing 145 different antivirus and EDR products using a driver that Microsoft itself had signed. That last part is the one worth sitting with.

LastPass’s Threat Intelligence, Mitigation, and Escalation team spotted the fake GitHub organization on August 13, 2026. It appeared high in search results for “LastPass Authenticator download” and used real LastPass logos and branding to look legitimate. The download page also displayed fake trust badges, including “VirusTotal Approved.” The badges were meaningless and were simply there to make users feel safe enough to download the file.

🔴 AI is scary: Anthropic Claude factorizes RSA-896

Anthropic engineer Stephen A. Weis announced on September 19 that he had factored RSA-896, an 896-bit number from the historic RSA Factoring Challenge, into two prime factors using Claude and a fleet of 2048 GPUs. The result raises the public threshold for factoring RSA-like numbers from 862 to 896 bits, just 16 days after the previous record, but does not imply breaking modern RSA-2048 keys.

🔴 Ryuk ransomware member sentenced to 24 months in prison

An Armenian man was sentenced to 24 months in prison and 3 years of supervised release for hacking U.S. companies and encrypting their systems in Ryuk ransomware attacks.

35-year-old Karen Serobovich Vardanyan (also known online as "Maneeken" or "Karl Lagerfeld"), who specialized in gaining initial access to corporate networks, pleaded guilty in July after being extradited from Kyiv, Ukraine, following his April 2025 arrest.

According to court documents, Vardanyan hacked into the networks of multiple U.S. organizations in Ryuk ransomware attacks between March 2019 and approximately June 2020.

🔴 F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks

F5 has released security updates to address a critical BIG-IP APM zero-day vulnerability being exploited in remote code execution attacks.

BIG-IP APM (short for Access Policy Manager) is the company's centralized access management proxy solution that helps admins secure access to their organizations' networks, applications, cloud, and application programming interfaces (APIs).

Tracked as CVE-2026-94127, the flaw affects instances configured as an OAuth Authorization Server when a BIG-IP APM access policy and an OAuth profile are configured on a virtual server.

🔴 ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants

The cyber extortion group known as ShinyHunters on Tuesday claimed it had breached the U.S. Federal Bureau of Investigation and stolen data belonging to current and former employees at the agency.

"We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job," the group said in a statement posted on their dark web site. "Whether it be a Special Agent or any other role within your agency. The following FBI services were compromised: Criminal Justice (CJ), HR, Medlink, and more."

The development was first reported by 404 Media. ShinyHunters said the FBI was targeted in response to a May 2026 public service announcement (PSA) that detailed the threat actor's targeting of Canvas, an online Learning Management System (LMS), while urging victims not to pay.

🔴 Qwen 4 will be huge! Alibaba aims for 10 trillion parameters. What about US AI cloud IPOs?

Alibaba has decided to significantly raise the stakes in the race to AI , simultaneously scaling three tiers: models, proprietary processors and data centers.

The Qwen team is already training Qwen 4, while the company plans to increase the training to 5–10 trillion parameters for future versions, Qwen 4.5 and Qwen 5. For comparison, the current flagship model, Qwen 3.8 Max, contains 2.4 trillion parameters. Alibaba intends to use the next-generation models for more complex tasks with a longer planning horizon and gradually move towards increasingly autonomous systems.

Irish Regulator Orders Major Privacy Overhaul After Android Tracking Investigation

Ireland's Data Protection Commission has imposed €403 million ($463 million) in fines on Google after concluding that the technology company violated European privacy law in its handling of users' location information.

🔗 Read More

🔴 REPAR'STORES (FRANCE) ~340GB / ~1.8M CUSTOMER RECORDS OFFERED FOR SALE

A threat actor claims to have exfiltrated and is selling a large dataset from French company Repar'stores (reparstores.com), describing about 340GB raw / 20GB cleaned and roughly 6.1 million lines including about 1.8 million customer records.

The underground listing alleges contents such as:

* Customer names, emails, phone numbers, physical addresses
* Invoices and order-related files
* Internal user credentials / hashed passwords
* Mixed JSONL, spreadsheet, PDF, and image exports

🔴 Malicious B-tree NPM Package Accumulates Millions of Downloads

The NPM ecosystem has suffered another supply chain attack in which a malicious package has accumulated millions of downloads, Checkmarx reports.

Still ongoing, the campaign has managed to bypass NPM’s recent protections by hiding a malicious trigger in the package’s JavaScript prototype code, rather than using an install script that could be detected by security solutions.

Instead of targeting highly popular packages for fast propagation, and likely immediate detection, the threat actor built trust by creating a legitimate-looking GitHub repository.

🔴 Microsoft to Disable SMS as Primary Entra ID Sign-In Method in 2027

Microsoft will turn off SMS as a primary sign-in method for Microsoft Entra ID workforce tenants on February 1, 2027, accelerating its transition to phishing-resistant authentication.

This change affects workers who currently use a registered phone number and a one-time SMS code as their initial sign-in credential, a passwordless flow utilized by frontline organizations.

🔴 TASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote Commands

A Windows-focused backdoor dubbed TASK#STOMP that uses VBScript, PowerShell, Scheduled Tasks, and runtime C# compilation to establish resilient persistence and continuously steal business documents.

The implant also captures screenshots, extracts saved Wi-Fi passwords, harvests clipboard data, and executes arbitrary commands received from its operators.

While the original delivery method is unconfirmed, the location is consistent with payloads introduced through phishing attachments, browser downloads, archive extraction, removable media, or manual execution.

Congress Proposal Seeks Full Review of Federal Cyber Defense Staffing

Three House Democrats have introduced legislation requiring the Cybersecurity and Infrastructure Security Agency to assess whether its current workforce, skills and resources are sufficient to protect federal networks and U.S. critical infrastructure.

🔗 Read More

🔴 D-Link DIR-822A Router Vulnerability Scores CVSS 10.0 With Public PoC Available

D-Link has announced a critical stack-based buffer overflow vulnerability affecting the non-US DIR-822A router, identified as CVE-2026-86296.

This vulnerability has received a maximum CVSS v3.1 score of 10.0 and a CVSS v4.0 score of 10.0. Furthermore, a public proof-of-concept (PoC) exploit is reportedly available.

The company published advisory SAP10516 on September 18 and updated it on September 21. D-Link’s security portal offers global security advisories, vulnerability responses, and product lifecycle notices at supportannouncement.us.dlink.

🔴 Chinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits

A third Chinese threat actor has been linked to phishing campaigns that cloned trusted websites and chained Chrome and Windows zero-day exploits to deploy a previously undocumented backdoor.

The activity occurred on September 3 and 4, 2026, while the targeted vulnerabilities remained unpatched in Google Chrome.

It followed Volexity’s September 9 disclosure that UTA0560 and JungleBamboo, also known as APT31 or Violet Typhoon, had used the exploit chain in separate operations.