PPHM HACKER NEWS

Linux Clock Manipulation Can Reactivate Expired Administrative Permissions

A newly disclosed high-severity weakness in Sudo can allow local Linux users to execute privileged commands outside administrator-defined time windows by manipulating the timezone environment inherited by the utility.

🔗 Read More

Frontier Systems Push Global Diplomacy Toward Human-Control Safeguards

OpenAI chief executive Sam Altman has urged governments to establish common international safeguards for increasingly capable artificial intelligence, arguing that humanity must retain meaningful control as frontier systems become more autonomous and potentially capable of accelerating their own development.

🔗 Read More

🔴 Philippines plans NBI attaches in Middle East to help OFWs fight cyber fraud

The Philippines is preparing to deploy National Bureau of Investigation (NBI) personnel to Philippine diplomatic posts overseas, with the Middle East among the first regions being considered, in a move aimed at providing faster assistance to overseas Filipino workers (OFWs) facing cyber fraud and other crimes.

NBI director Melvin Matibag told a Senate budget hearing on September 24 that the bureau is working with the Department of Foreign Affairs (DFA) on a framework that could see NBI attaches stationed at Philippine embassies and other diplomatic missions in countries with large Filipino communities.

🔴 Thailand pledges cooperation with all countries to combat transnational cyber fraud

Thailand has pledged to cooperate with all countries in combating transnational cyber fraud, with Cambodian officials saying the commitment was among the key outcomes of the International Conference on Combating Cyber Scams (ICCOS), held in Phnom Penh on September 23–24.

Minister of Information and Head of the Information and Dissemination Sub-Committee of CCOS Neth Pheaktra and Secretary of State at the Ministry of Justice Keng Somarith held a press conference on September 24 to discuss the outcomes of the conference.

🔴 Microsoft: Recent Windows updates cause desktop loading issues

Microsoft has confirmed that some users may experience desktop loading issues, including black screens, after installing the August 2026 preview updates and subsequent updates.

However, the company says this mainly affects Azure Virtual Desktop (AVD) hosts using FSLogix (a software solution that speeds up user profile loading in virtual desktop environments).

Windows users affected by this known issue may experience multiple symptoms. The most common symptoms include a black screen after sign-in, so users can't access their desktop until they start the desktop session manually, and application event logs showing Windows Explorer crashes.

🔴 AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway

CARBONATO is a Docker-based botnet that has been active since at least October 2024. ThreatDown discovered the operation after finding an unauthenticated container registry exposed to the internet. The registry contained the attackers’ entire toolchain and revealed details about how the botnet operates.

In just one day of passive, read-only collection, researchers gathered 4.3 GB of image data, including 59 repositories, 234 tags, and 605 verified file blobs. The registry also exposed the configuration history of the images, revealing command-and-control addresses, bot tokens, and even the shared password for the attackers’ own AI gateway.

The operation appears to be linked to Costa Rica, although researchers say the infrastructure could also be used by someone operating from elsewhere. The initial infection method is relatively simple.

🔴 OEMpocalypse Now Arrives: How to Root a High-End Smartphone

A standard Android application without the required permissions can gain complete control over a modern flagship smartphone. California researcher Lucas Maar demonstrated an attack on Samsung, Xiaomi, Oppo, and OnePlus devices with locked bootloaders and stock firmware, transforming a non-privileged application into a process with maximum rights.

The method has been named OEMpocalypse Now. An important detail is that Maar didn't find a single bug in all smartphones. The researcher developed a unified strategy and built three separate exploitation chains on top of it for Samsung, Xiaomi, and the Oppo family, which also includes OnePlus and Realme. This approach allows the attack to be used on numerous models from a single manufacturer with a much smaller amount of modifications.

🔴 ‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration

Three vulnerabilities in Salesforce Agentforce could have allowed attackers to hijack trusted agents for sensitive CRM data exfiltration and phishing, Zenity Labs reports.

Dubbed SalesBleed, the flaws could be exploited via Web-to-Lead forms, Salesforce’s official lead-collection mechanism, which also provides a direct path to the CRM.

Malicious instructions injected into a Web-to-Lead lead would remain dormant until an employee asks an Agentforce agent to interact with the submission, causing the agent to process the poisoned lead and execute the hidden instructions.

🔴 Hackers steal $351.6 million in Bitget crypto exchange hack

​Cryptocurrency exchange Bitget disclosed today that suspected North Korean hackers have stolen $351.6 million from its hot and warm wallets.

The company discovered the breach Thursday evening after its security systems flagged multiple unauthorized transfers from a limited number of crypto wallets.

Bitget has temporarily suspended all withdrawals while investigating the incident with help from law enforcement agencies, on-chain security institutions, and cybersecurity experts at Mandiant and SlowMist.

🔴 Actor advertises EBT card data and PINs targeting benefit recipients
⠀
An actor using the handle "dodger5" claims to offer Electronic Benefit Transfer (EBT) card data with PINs from all U.S. states, including accounts holding SNAP food benefits and cash assistance.
⠀
Other advertised material includes:
⠀
• Cloned payment cards and virtual debit cards
• Bank account credentials
• Personal identity profiles
• Driver’s license and ID scans
⠀
The post also promotes check and money order fraud. No prices, record counts, or supporting samples are shown.
⠀
This claim is currently unverified.

🔴 Microsoft Finds Ransomware Group Using Same Attack Blueprint Across Multiple Malware Families

Microsoft has linked a ransomware affiliate to attacks that ended with four different ransomware families. The group, tracked as Storm-2570, repeatedly used the same methods to take control of networks, steal data and prepare systems for encryption.

The changing ransomware name often concealed a familiar operator. Storm-2570 has been tracked since April 2025. Its intrusions have affected organizations in the United States, Canada, the United Kingdom, Spain, the Netherlands and Puerto Rico, across sectors ranging from healthcare and education to energy and manufacturing.

🔴 Roundcube Webmail Vulnerability in Attackers’ Crosshairs

Threat actors have been exploiting a high-severity vulnerability in Roundcube, the popular open source webmail client, the Canadian Centre for Cyber Security warns.

Tracked as CVE-2026-48842 (CVSS score of 8.1), the security defect is described as an SQL injection in the virtuser_query plugin that can be exploited without authentication.

The plugin resolves email addresses to mailbox usernames and uses the preg_replace() filter with backslash escaping to neutralize injection attempts.

🔴 Russia's Hybrid Cyber-Physical War in Europe Heats Up

Russia continues to ramp up hybrid, asymmetric efforts to target its adversaries across Europe in both virtual and physical space, in support of its invasion of Ukraine, which began in February 2022.

That's according to Recorded Future, which found that the activity stops short of a kinetic, boots-on-the-ground invasion, instead involving a number of psychological, cyber, and physical tactics intended to test enemy defenses, degrade critical infrastructure, and foster fear within an enemy's government and population.

🔴 AI enters the labs! Claude discovers a new enzyme system. IPO propaganda or reality?

The company Anthropic said its Claude "independently discovered" a new enzyme system similar to the mechanism behind the powerful gene-editing tool CRISPR, The Verge reports.

It's worth noting that this is the first result of the initial work of Anthropic's recent laboratory and a sort of test of Claude's scientific prowess in preparation for the company's stock market launch. According to the company, Claude discovered this system by analyzing a vast database of DNA sequences. In this case, the scientists' involvement was limited to formulating the initial task and conducting the laboratory research.

🔴 Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data

A flaw in Cloudflare Containers let a paying customer read data that other customers' containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday.

The data came from disk space that earlier containers had used and given up, not from any live workload, and an attacker could not choose whose data they got, according to Cloudflare. The company has fixed the flaw across its service and says customers need to do nothing.

🔴 WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.

The vulnerabilities are listed below -

CVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway that could allow unrestricted file upload and lead to remote code execution.

CVE-2026-71362 (CVSS score: 9.1) - An incorrect authorization vulnerability in Adobe Commerce and Magento that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.

Critical HPE Appliance Bugs Expose Network Management Infrastructure to Remote Compromise

Hewlett Packard Enterprise has disclosed 10 vulnerabilities in its Networking Analytics and Location Engine (ALE), including two critical weaknesses that could allow remote attackers to compromise affected appliances without authentication.The flaws affect ALE 5.0.0.0 and earlier, according to HPE's September 22 security disclosure.

🔗 Read More

🔴 OPENAI AGENT BREACHED AUSTRALIAN GOVERNMENT MEDICARE PORTAL — MODEL BYPASSED ACCESS BLOCKS DURING INTERNAL RESEARCH

Australia’s Prime Minister has disclosed that an OpenAI agent gained unauthorized access to the government’s Medicare Statistics Reporting Service while conducting research into public medical spending.

• The incident occurred June 18 and was publicly disclosed September 24
• The agent accessed both public and non-public files on the Services Australia portal
• Prime Minister Anthony Albanese said the agent was blocked while seeking information, then “found a way around those blocks”

• OpenAI says its models “took actions we did not intend” during an internal evaluation

• Accessed material included aggregate health statistics and internal file names
• Australia says there is currently no evidence that individual Medicare records or personal information were accessed
• No broader compromise of the Services Australia network has been established
• OpenAI identified the activity during a later review but did not notify Services Australia until September 10 — nearly three months after the incident
• Australia has launched a forensic investigation involving the Australian Signals Directorate and a government taskforce

🔴 Google tests letting Gemini call businesses for you

With AI agents like Meta’s Muse and Instinct now able to make calls on users’ behalf, Google is now letting Gemini call businesses with a new feature called “Call for Me.”

The feature will initially roll out to Pixel 11 owners who pay for a Gemini subscription in the U.S. It will also require the use of the beta version of Google’s Phone app for Android, as it’s still supposed to be an experiment.

🔴 CLOP CLAIMS KIRKLAND & ELLIS — WORLD’S HIGHEST-GROSSING LAW FIRM APPEARS IN FRESH LEAK-SITE BATCH

Cl0p has newly listed Kirkland & Ellis LLP, the Chicago-headquartered global law firm, in a September 23 ransomware/extortion publication burst.

• The listing appeared September 23 alongside multiple other newly named organizations
• Kirkland & Ellis is one of the world’s largest law firms and reported roughly $8.8B in 2025 revenue
• Its practices span private equity, M&A, restructuring, litigation, intellectual property, tax and other highly sensitive corporate matters
• The currently visible Cl0p listing provides no verifiable stolen-data sample, file inventory, data volume, ransom demand or initial-access vector
• No public confirmation from Kirkland & Ellis has been identified at this time
• Separate historical cybersecurity incidents involving Kirkland (including the 2023 MOVEit-era Cl0p listing) should NOT be assumed to be connected to this new claim