Microsoft Paint RCE fix is now available, but Windows Update won't deliver it.
CVE-2026-83844 could allow unauthenticated remote code execution.
The fix requires a Microsoft Store app update, and older Paint copies may remain installed.
CVE-2026-83844 could allow unauthenticated remote code execution.
The fix requires a Microsoft Store app update, and older Paint copies may remain installed.
Chainalysis confirms a wider breach impact.
An agentic cyberattack exposed ALL users' password hashes and live tokens, prompting the company to lock impacted accounts and take key services offline.
An agentic cyberattack exposed ALL users' password hashes and live tokens, prompting the company to lock impacted accounts and take key services offline.
Hackers are hiding a backdoor inside Control Web Panel's Linux web server.
Dubbed CWPdoor, it executes attacker commands through specially crafted HTTP requests, then keeps those requests out of access logs.
Dubbed CWPdoor, it executes attacker commands through specially crafted HTTP requests, then keeps those requests out of access logs.
Paraguayan police RAID former President's MANSION — UNCOVER SECRET VAULT HIDDEN behind a FALSE WALL, COMPLETE with an ISRAELI SECURITY SYSTEM & IRIS SCANNER.
#TGITM
#TGITM
Lula: 'BIG TECH interfered in Brazilian elections with disinformation & FAKE NEWS — but TRUTH defeated LIES'.
Elon Musk:
If you have a humanoid robot that is extremely productive and can work 24/7, it's working 168 hours a week.
You can expect roughly a productivity per week that is on average five times better than a person.
If you have a humanoid robot that is extremely productive and can work 24/7, it's working 168 hours a week.
You can expect roughly a productivity per week that is on average five times better than a person.
Cyber Dispatch™️
Elon Musk: If you have a humanoid robot that is extremely productive and can work 24/7, it's working 168 hours a week. You can expect roughly a productivity per week that is on average five times better than a person.
Take the population of the United States. Perhaps around 120 million people in America have a net positive output of goods and services.
Well, I guess you'd need about 20 to 30 million robots to match the goods and services output of the United States.
Well, I guess you'd need about 20 to 30 million robots to match the goods and services output of the United States.
Hackers exploited a Web3Auth flaw to steal crypto from Keplr wallets using Google and Apple logins.
In an unusual move, Web3Auth emptied thousands of other at-risk wallets to secure their funds
Over $6 million moved into recovery wallets.
In an unusual move, Web3Auth emptied thousands of other at-risk wallets to secure their funds
Over $6 million moved into recovery wallets.
Bitcoin Lightning wallet platform LNbits urges ALL server operators to shut down immediately amid a wave of attacks.
One operator reports attackers exploited an extension to drain 2.28 million satoshis.
Security patches are still pending.
One operator reports attackers exploited an extension to drain 2.28 million satoshis.
Security patches are still pending.
A single hacker in Taiwan used BOSSAI, a 12-agent AI hacking setup, to steal Taipei emergency dispatch records.
The operation targeted hundreds of organizations across 11 countries, with confirmed data extraction in three.
The operation targeted hundreds of organizations across 11 countries, with confirmed data extraction in three.
CISA adds SonicWall SonicOS MFA bypass flaw to its Known Exploited Vulnerabilities catalog.
CVE-2026-19868 could bypass SAML authentication and MFA using valid alternate credentials.
CVE-2026-19868 could bypass SAML authentication and MFA using valid alternate credentials.
'Threatening' leaflets discovered in Tel Aviv mailboxes linked to Handala hacktivist group
Leaflets containing embedded QR codes directing residents to psychological warfare and threat messages appeared across residential mailboxes in northern Tel Aviv today, triggering an immediate security investigation by Israeli occupation police and the Shin Bet.
Settlers alerted law enforcement after discovering red flyers emblazoned with the Hebrew slogans "Without Electricity" and "Without Water." Scanning the embedded QR code directed users to a domain managed by the Handala hacktivist group, which contained threats to target Israeli energy, water desalination, and power generation infrastructure.
The Israeli Occupation Police Spokesperson's Unit confirmed that officers launched an investigation into the psychological operation, urging citizens who encounter the printed flyers not to scan the malicious QR code and to immediately report any physical distributions to local police stations.
Security analysts emphasize that the physical distribution of cyber-linked psychological operations highlights attempts by regional cyber units to bypass digital censorship, attempting direct psychological warfare targeting civilian populations.
#TGITM @TheGhostITM
Leaflets containing embedded QR codes directing residents to psychological warfare and threat messages appeared across residential mailboxes in northern Tel Aviv today, triggering an immediate security investigation by Israeli occupation police and the Shin Bet.
Settlers alerted law enforcement after discovering red flyers emblazoned with the Hebrew slogans "Without Electricity" and "Without Water." Scanning the embedded QR code directed users to a domain managed by the Handala hacktivist group, which contained threats to target Israeli energy, water desalination, and power generation infrastructure.
The Israeli Occupation Police Spokesperson's Unit confirmed that officers launched an investigation into the psychological operation, urging citizens who encounter the printed flyers not to scan the malicious QR code and to immediately report any physical distributions to local police stations.
Security analysts emphasize that the physical distribution of cyber-linked psychological operations highlights attempts by regional cyber units to bypass digital censorship, attempting direct psychological warfare targeting civilian populations.
#TGITM @TheGhostITM
Investigation exposes Israeli-linked digital campaign weaponizing British royal imagery to fuel anti-Muslim hostility
An covert digital advertising operation traced directly to Israel weaponized images of Kate Middleton, the Princess of Wales, without authorization as part of a multi-year effort to amplify far-right narratives and ignite anti-Muslim hostility across Britain.
According to a recent investigation published by independent outlet The Nerve, authored by disinformation researchers Marc Owen Jones and Sohan Dsouza, the clandestine network deployed unauthorized photos of the royal family across Facebook, YouTube, and TikTok. The targeted ad campaign was timed to influence the UK general election and exploit domestic friction surrounding the Southport riots.
The reporting revealed that production infrastructure and financial trails for the multi-million-pound operation trace back to Israeli actors seeking to bolster western far-right political factions, inflame Islamophobic sentiment, and undermine public support for Palestine.
Digital platforms Meta, Google, and TikTok face growing scrutiny over their direct role in monetizing the covert campaign. Tech giants accepted millions of dollars to run sponsored content promoting far-right conspiracy theories to hundreds of millions of users with minimal regulatory moderation.
Media analysts noted that while online commentary pushed sensational claims twisting the findings to allege intelligence connections, researchers firmly rejected those spin efforts, emphasizing instead that the covert campaign exploited public figures to manipulate western political discourse.
An covert digital advertising operation traced directly to Israel weaponized images of Kate Middleton, the Princess of Wales, without authorization as part of a multi-year effort to amplify far-right narratives and ignite anti-Muslim hostility across Britain.
According to a recent investigation published by independent outlet The Nerve, authored by disinformation researchers Marc Owen Jones and Sohan Dsouza, the clandestine network deployed unauthorized photos of the royal family across Facebook, YouTube, and TikTok. The targeted ad campaign was timed to influence the UK general election and exploit domestic friction surrounding the Southport riots.
The reporting revealed that production infrastructure and financial trails for the multi-million-pound operation trace back to Israeli actors seeking to bolster western far-right political factions, inflame Islamophobic sentiment, and undermine public support for Palestine.
Digital platforms Meta, Google, and TikTok face growing scrutiny over their direct role in monetizing the covert campaign. Tech giants accepted millions of dollars to run sponsored content promoting far-right conspiracy theories to hundreds of millions of users with minimal regulatory moderation.
Media analysts noted that while online commentary pushed sensational claims twisting the findings to allege intelligence connections, researchers firmly rejected those spin efforts, emphasizing instead that the covert campaign exploited public figures to manipulate western political discourse.
Bitter APT is deploying a new backdoor called PapRAT in cyberespionage attacks targeting South Asian organizations.
The campaign uses 3 infection chains, including malicious shortcuts and MSI installers, to deliver malware capable of remote commands, file transfers, and screenshot capture.
The campaign uses 3 infection chains, including malicious shortcuts and MSI installers, to deliver malware capable of remote commands, file transfers, and screenshot capture.
French authorities suspect the Shahid Kaveh unit was behind the October cyberattack that raised refrigerator temperatures at supermarkets across France.
How the Attack Worked
Threat actors remotely overrode temperature and defrost setpoints on internet-exposed refrigeration controllers. CERT-FR advisory CERTFR-2026-ALE-012 identified affected Danfoss AK-SM and AK-SC series units, along with Copeland and Dixell XWEB systems. The attackers exploited basic security weaknesses, including devices exposed directly to the internet. CERT-FR noted that exposing management interfaces online violates good security practice.
The overnight attack, disclosed on Oct. 12, raised temperatures in connected cold-storage units—some to approximately 50°C (122°F)—spoiling food and causing fires at hundreds of stores. Estimates of the number of affected French supermarkets range from roughly 350 to 700 out of an estimated 10,000.
The Danfoss/Copeland/Dixell Exposure
The compromised devices were remote refrigeration controllers whose management interfaces were exposed directly to the public internet—a configuration that violates basic security practice. CERT-FR's alert named the Danfoss AK-SM and AK-SC series, along with Copeland and Dixell XWEB systems. Pre-attack scanning by Coalition identified 1,506 unique IP addresses exposing Danfoss StoreView admin panels, with 54% associated with French networks; around 1,100 exposed XWEB controllers were also found. Many affected units were end-of-life models no longer receiving security updates.
CVE-2025-41450 Authentication Bypass
CVE-2025-41450 is an improper authentication flaw in Danfoss AK-SM 8xxA series firmware prior to version R4.2, caused by date-time-based password generation. An attacker could bypass authentication by supplying a date-derived code rather than valid credentials, gaining access to the controller's web management interface. CISA assigned a CVSS v3.1 base score of 8.2 (High) and a CVSS v4 score of 7.3. Danfoss released firmware R4.2 to address the flaw; R4.3.1 fixed related issues CVE-2025-41451 and CVE-2025-41452. The vulnerability was publicly disclosed by Claroty's Team82 in August 2025, months before the October attack.
CERT-FR's advisory does not specify a CVE for the October compromises, and CISA had not reported public exploitation of CVE-2025-41450 prior to the incident. The overlap in affected models and the timing suggest the vulnerability may have been exploited, but this remains unconfirmed.
#TGITM @TheGhostITM
How the Attack Worked
Threat actors remotely overrode temperature and defrost setpoints on internet-exposed refrigeration controllers. CERT-FR advisory CERTFR-2026-ALE-012 identified affected Danfoss AK-SM and AK-SC series units, along with Copeland and Dixell XWEB systems. The attackers exploited basic security weaknesses, including devices exposed directly to the internet. CERT-FR noted that exposing management interfaces online violates good security practice.
The overnight attack, disclosed on Oct. 12, raised temperatures in connected cold-storage units—some to approximately 50°C (122°F)—spoiling food and causing fires at hundreds of stores. Estimates of the number of affected French supermarkets range from roughly 350 to 700 out of an estimated 10,000.
The Danfoss/Copeland/Dixell Exposure
The compromised devices were remote refrigeration controllers whose management interfaces were exposed directly to the public internet—a configuration that violates basic security practice. CERT-FR's alert named the Danfoss AK-SM and AK-SC series, along with Copeland and Dixell XWEB systems. Pre-attack scanning by Coalition identified 1,506 unique IP addresses exposing Danfoss StoreView admin panels, with 54% associated with French networks; around 1,100 exposed XWEB controllers were also found. Many affected units were end-of-life models no longer receiving security updates.
CVE-2025-41450 Authentication Bypass
CVE-2025-41450 is an improper authentication flaw in Danfoss AK-SM 8xxA series firmware prior to version R4.2, caused by date-time-based password generation. An attacker could bypass authentication by supplying a date-derived code rather than valid credentials, gaining access to the controller's web management interface. CISA assigned a CVSS v3.1 base score of 8.2 (High) and a CVSS v4 score of 7.3. Danfoss released firmware R4.2 to address the flaw; R4.3.1 fixed related issues CVE-2025-41451 and CVE-2025-41452. The vulnerability was publicly disclosed by Claroty's Team82 in August 2025, months before the October attack.
CERT-FR's advisory does not specify a CVE for the October compromises, and CISA had not reported public exploitation of CVE-2025-41450 prior to the incident. The overlap in affected models and the timing suggest the vulnerability may have been exploited, but this remains unconfirmed.
#TGITM @TheGhostITM
The Leather Jacket and the Honeytrap: Nvidia's $330 Billion Cold Sweat
The black leather jacket is usually armor. This week, it became a bullseye.
Jensen Huang, the billionaire rockstar of AI, just admitted to an extramarital affair. But this isn't a simple tabloid fling. The woman at the center of it—Alice Huang, a former exec at Singapore-based Megaspeed—is suspected by U.S. intelligence of being a Chinese operative. Cue the geopolitical explosion.
Here’s the spicy part: Nvidia’s board has launched an independent investigation into whether Jensen was the target of a foreign intelligence "honeytrap". The stock? It didn't just wobble. Nvidia shed a staggering $330 billion in market value as investors panic-sold. For a company worth trillions, that’s a very expensive affair.
The timeline is messy. Jensen reportedly met Alice through business circles; Megaspeed was a major Nvidia buyer. U.S. officials suspect she was feeding intel straight to Beijing, potentially influencing Jensen’s lobbying efforts to ease chip export bans. While the board says they have "no reason to believe" secrets were compromised, Congress is already breathing down their necks.
Beijing’s response? A classic eye-roll. China’s Foreign Ministry dismissed the whole thing as "groundless speculation" and a smear campaign.
Jensen told employees he is "deeply sorry" and takes "full responsibility". But in the high-stakes game of AI supremacy, a broken vow might just be the least of his problems. The real question is whether the world’s most valuable chipmaker just got played.
#TGITM @TheGhostITM
The black leather jacket is usually armor. This week, it became a bullseye.
Jensen Huang, the billionaire rockstar of AI, just admitted to an extramarital affair. But this isn't a simple tabloid fling. The woman at the center of it—Alice Huang, a former exec at Singapore-based Megaspeed—is suspected by U.S. intelligence of being a Chinese operative. Cue the geopolitical explosion.
Here’s the spicy part: Nvidia’s board has launched an independent investigation into whether Jensen was the target of a foreign intelligence "honeytrap". The stock? It didn't just wobble. Nvidia shed a staggering $330 billion in market value as investors panic-sold. For a company worth trillions, that’s a very expensive affair.
The timeline is messy. Jensen reportedly met Alice through business circles; Megaspeed was a major Nvidia buyer. U.S. officials suspect she was feeding intel straight to Beijing, potentially influencing Jensen’s lobbying efforts to ease chip export bans. While the board says they have "no reason to believe" secrets were compromised, Congress is already breathing down their necks.
Beijing’s response? A classic eye-roll. China’s Foreign Ministry dismissed the whole thing as "groundless speculation" and a smear campaign.
Jensen told employees he is "deeply sorry" and takes "full responsibility". But in the high-stakes game of AI supremacy, a broken vow might just be the least of his problems. The real question is whether the world’s most valuable chipmaker just got played.
#TGITM @TheGhostITM
CRITICAL 10.0 · Confection WordPress Cable: unauthenticated remote code execution in settings saving (CVE-2026-115252)
Anyone on the network can run arbitrary PHP code on the server without logging in.
No patch yet · affected: >=0.4.0 <=0.4.7
Anyone on the network can run arbitrary PHP code on the server without logging in.
No patch yet · affected: >=0.4.0 <=0.4.7
CRITICAL 9.2 · WebPros Plesk extension "Site Import": path traversal leads to root code execution in importer (CVE-2026-107246)
A remote attacker without a login can run arbitrary code as root on the server.
Fix: 1.13.2
A remote attacker without a login can run arbitrary code as root on the server.
Fix: 1.13.2
CRITICAL 9.8 · Hitachi HiRDB Server: remote compromise via partial string comparison flaw (CVE-2026-115646)
An unauthenticated remote attacker, needing no user action, can read, alter, or disrupt data and service.
Fix: 10-11-02
An unauthenticated remote attacker, needing no user action, can read, alter, or disrupt data and service.
Fix: 10-11-02
CRITICAL · SAP products: 9 new CVEs
Products: BusinessObjects Business Intelligence Platform (1), Gateway (1) and 7 more
Worst (NetWeaver AS ABAP and ABAP Platform, 10.0): auth bypass in SAML2 service provider (CVE-2026-120017)
No patch listed yet
Products: BusinessObjects Business Intelligence Platform (1), Gateway (1) and 7 more
Worst (NetWeaver AS ABAP and ABAP Platform, 10.0): auth bypass in SAML2 service provider (CVE-2026-120017)
No patch listed yet
CRITICAL · Asp.Net-Core-Inventory-Order-Management-System: 2 new CVEs
Worst (9.3): auth bypass via hard-coded JWT signing key (CVE-2026-125383)
Fix: 10.20261109
Worst (9.3): auth bypass via hard-coded JWT signing key (CVE-2026-125383)
Fix: 10.20261109