Sam's News — security — 2026-10-13¶

Security¶

8.5 GitLab patches critical CVSS 10.0 flaw allowing unauthenticated code execution¶

GitLab released patches for CVE-2026-97229, a CVSS 10.0 maximum-severity integer overflow vulnerability in CI/CD configuration handling that allows unauthenticated users to execute arbitrary code via malicious regular expressions. The company also patched three high-severity flaws affecting authentication, authorization, and cache security.

CVE-2026-97229: CVSS 10.0 integer overflow in CI/CD configuration
Allows unauthenticated arbitrary code execution on GitLab server
Affected versions: 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2
CVE-2026-92883 (CVSS 8.7): XSS allowing authenticated code execution
CVE-2026-16301 (CVSS 8.5): improper authorization in downstream pipelines
CVE-2026-14814 (CVSS 8.2): regex allowing cache poisoning and environment variable exposure

Sources: The Hacker News AI Web Searched

8 $86 Million Crypto Heist Attributed to Hardware Implant in Ledger Signer Devices¶

A hardware implant inserted under Ledger device screens by someone in the Southeast Asia distribution chain stole at least $86 million in cryptocurrency. The soldered circuit board read 24-word recovery phrases during setup and transmitted them via LTE eSIM to attackers; all confirmed losses involved signers sold through reseller CryptoBilis.

Implant soldered onto signer circuit board under screen
Intercepted 24-word recovery phrase during device setup
Transmitted credentials over LTE using provisioned eSIM
At least $86 million stolen; actual losses may exceed this figure
All confirmed losses from CryptoBilis reseller in Southeast Asia
Disclosure October 9, 2026; Ledger confirmed October 13

Sources: SecurityWeek AI Web Searched

8 Maximum-severity SSRF flaw in SonicWall SMA devices exploited in attacks¶

CVE-2026-102255, a CVSS 10.0 maximum-severity pre-authentication server-side request forgery in SonicWall Secure Mobile Access (SMA) 1000 devices, is being actively exploited within three days of patch release. The flaw allows remote attackers to direct appliances to issue requests reaching internal functionality.

CVSS 10.0 maximum-severity SSRF vulnerability
Affects SMA 1000 models 6210, 7210, and 8200v
Pre-authentication; requires no credentials to exploit
Patch released October 6, 2026
Exploitation detected October 9, 2026 in honeypot networks
Third SMA1000 security incident for SonicWall in 2026

Sources: Daniel Roth / Cybersecurity reporting AI Web Searched, Dark Reading Web Search

7.5 Two critical MarkLogic Server flaws let delegated managers escalate to full admin¶

Progress Software disclosed 31 flaws in MarkLogic Server on October 12, 2026, including five critical vulnerabilities. Two critical flaws allow delegated managers with limited privileges to escalate to persistent administrator control via account creation or XQuery injection.

31 total flaws disclosed; 5 critical, remaining scored high or medium
CVE-2026-85947 (CVSS 9.9): allows admin account creation with forest-management privileges
CVE-2026-85948 (CVSS 9.9): XQuery injection with manage-user-level privileges
Three additional critical flaws: CVE-2026-85955, CVE-2026-85956, CVE-2026-9191
Fixes in MarkLogic 11.3.7 and 12.1.0 (released September 10)
No active exploitation detected; no workarounds available

Sources: The Hacker News AI Web Searched

7.5 Low-cost Android phones shipped with firmware malware turning devices into proxies¶

Affordable Android phones built on MediaTek chips are being sold with malicious firmware that secretly installs apps, conducts ad fraud, and converts devices into residential proxies.

Sources: The Hacker News RSS

7 AI-Driven Cyberattacks Accelerate Enterprise Defense Challenge¶

IBM security leaders warn that AI-augmented attacks are raising the speed and complexity of threats, compressing response times for defenders.

Sources: SecurityWeek RSS

7 Cyberattack on refrigeration controllers spoils food across European supermarkets¶

A coordinated cyberattack targeted refrigeration controller systems across European supermarkets, causing widespread food spoilage by defrosting units.

Sources: SecurityWeek RSS, The Hacker News RSS

7 iRhythm data breach impacts at least 360,000 people¶

A data breach at cardiac monitoring company iRhythm has affected at least 360,000 individuals.

Sources: SecurityWeek Web Search

6.5 XWorm RAT malware expands into full surveillance platform¶

The XWorm remote access trojan evolves to include expanded surveillance capabilities including location monitoring, live audio streaming, and browser session hijacking.

Sources: SecurityWeek RSS

AI security¶

6.5 Anthropic warns small AI models may self-replicate across IoT devices unsupervised¶

Anthropic research shows small AI models can run on cheap devices like TV boxes and may soon spread autonomously across IoT networks.

Sources: SecurityWeek RSS