Sam's News — security — 2026-10-12¶
Security¶
8 SonicWall SMA 1000 Critical Flaw Targeted in 135 Exploitation Attempts Post-Patch¶
Threat actors exploited a critical SonicWall SMA 1000 vulnerability (CVE-2026-102255, CVSS 10.0) involving pre-authenticated server-side request forgery within days of disclosure.
- CVE-2026-83548: critical pre-authentication SSRF (CVSS 10.0); CVE-2026-83549: command injection
- Affects SMA 1000 models 6210, 7210, 8200v (Linux platform)
- No credentials required for exploitation; can chain for unauthenticated RCE
- ShadowServer identified 420+ SMA 1000 devices exposed to public internet
- Third confirmed zero-day exploitation wave in just over a year; CISA 72-hour patch mandate for federal agencies
Sources: The Hacker News RSS, SecurityWeek RSS Update to: SonicWall SMA1000 maximum-severity flaw actively exploited days after patch
8 GitLab Warns of Maximum-Severity Code Execution Vulnerability in CI/CD Compiler¶
GitLab issued an urgent warning for a maximum-severity vulnerability in the CI/CD Regular Expression Compiler allowing remote code execution.
Sources: BleepingComputer RSS
7.5 Bricksforge WordPress Plugin CVSS 10.0 Flaw Exploited in Active Attacks¶
A maximum-severity vulnerability (CVE-2026-85097, CVSS 9.8) in the Bricksforge WordPress plugin allows unauthenticated attackers to upload files and execute remote code. Active exploitation began October 7, 2026; patched version 3.1.8.10 was released for versions 3.1.8.9 and earlier.
- CVE-2026-85097, CVSS 9.8: unauthenticated remote code execution via arbitrary file upload
- Affects Bricksforge 3.1.8.9 and earlier; patched in version 3.1.8.10
- Active exploitation detected October 7, 2026; two distinct attack patterns using automated tools and rotating proxies
- Bricksforge used by ~6,000 websites; serves Bricks visual site builder with forms, animations, email designer, admin tools
Sources: SecurityWeek AI Web Searched, The Hacker News RSS
7.5 Ukraine destroys third Yandex data center, disrupting Russian digital services¶
Ukrainian drones struck three Yandex data centers over four days, with two shutting down completely and the third destabilized. The attacks disrupted Yandex Cloud (serving 64,000 customers), email, taxi, food ordering, payments, and third-party services including Russian TikTok. Yandex reached agreements with competitors to help customers migrate.
- Three Yandex data centers struck: Sasovo (Oct 7–8), Kaluga (Oct 9), Vladimir (Oct 12); combined ~115 MW capacity
- Sasovo and Vladimir facilities house Yandex supercomputers for AI training
- Yandex Cloud serves ~64,000 customers; disruptions affected email, taxi, payments, Yandex Pay, Alice voice assistant, TikTok Russia
- Yandex updated terms excluding liability for drone strikes; arranged customer migration with Selectel, K2Cloud, VK Cloud
Sources: The Record AI Web Searched
7 Ledger halts CryptoBilis sales after unauthorized hardware implant discovered amid fund theft¶
Ledger suspended sales through reseller CryptoBilis after unauthorized hardware modifications were discovered in devices, with reported cryptocurrency losses exceeding $86 million from Southeast Asian customers. At least one device contained an unauthorized implant.
- Reported losses exceed $86 million according to blockchain investigator Specter
- At least one affected device contained unauthorized hardware implant
- All confirmed cases involved CryptoBilis sales; limited number of devices affected
- Ledger advised affected customers not to initiate setup if not done, or move assets to new signer with new seed phrase
Sources: The Hacker News AI Web Searched
7 CyberXero uses Claude code in campaign stealing 628,000 Ukrainian records¶
Cybercriminals leveraged Claude AI in a two-pronged campaign targeting WordPress sites and Ukrainian infrastructure, stealing over 628,000 records.
Sources: The Hacker News RSS
7 ShinyHunters claims responsibility for FBI data breach, alleges theft of agent and applicant information¶
The ShinyHunters hacking group claims it breached FBI systems and stole data on federal agents and job applicants.
Sources: The Hacker News Web Search
6.5 Mastermind of 15,000-mule cybercriminal money laundering network pleads guilty in US federal court¶
Oleg Korniev, leader of YMCO, a sophisticated 15,000-member money mule operation facilitating hacker fund transfers, pleaded guilty to federal cybercrime charges.
Sources: SecurityWeek RSS
6.5 iRhythm data breach exposes personal information for at least 360,000 patients¶
A breach at cardiac monitoring company iRhythm compromised personal data including names, addresses, emails, birthdates, and phone numbers for at least 360,000 patients.
Sources: SecurityWeek RSS
6.5 Cybersecurity executive arrested in connection with ShinyHunters FBI breach¶
Edward Dubrovsky, a Canadian cybersecurity executive, was arrested during a visit to the United States in connection with the ShinyHunters FBI hack investigation.
Sources: SecurityWeek RSS