‼️ An email address with backticks in it let researchers run commands on GNU Savannah, home of the source code for Bash.

Hacktron got root via an unpatched 2023 kernel bug and logged in as Bash maintainer Chet Ramey.

It says it could have pushed to Bash's Git repo, but didn't.

https://x.com/IntCyberDigest/status/2116157421534257377

‼️ A 1992 safety system called LZB failed on Spain's Madrid-Seville high-speed line, setting off a chain of events that killed 69.

After which the control centre then cleared a train despite a red signal.

https://x.com/IntCyberDigest/status/2116173725674688618

‼️ Picking up a Telegram voice call was enough to let an attacker run code on an Android phone, NebuSec says.

It says its GPT-5.4 tool found the flaw, which hit every Android version from March 2022 until 12.10.4 in late September.

Telegram's iOS app got the same fix in May.

https://x.com/IntCyberDigest/status/2116187620313350171

‼️ WARNING: Updating the poisoned Claude Code extension won't remove its backdoor, Kevin Beaumont says.

Cursor, which served the bad build to up to 5,000 users, warns that even uninstalling it may not be enough.

The backdoor never lived only in the extension. On loading, it planted the attacker's SSH key and its own startup scripts, which keep trying to open a tunnel to the attacker every 60 seconds or so.

An update swaps the extension's files but leaves the key and the scripts in place.

https://x.com/IntCyberDigest/status/2116202468447269148

‼️ UPDATE: US officials suspect Iran-linked hackers sabotaged freezers at US military bases, Nextgov/FCW reports.

Two sources say about six base grocery stores were hit from late August. Cyber Command is investigating with French help.

https://x.com/IntCyberDigest/status/2116217819377348718

‼️ Ransomware called C3RB3R is encrypting files on Synology NAS devices, Chinese security firms 360 and Solar say.

360 blames two critical DSM flaws that Synology patched in September.

Solar says one victim was already on the latest DSM 7.4.1 build and suspects a zero-day.

https://x.com/IntCyberDigest/status/2116232918976655617

‼️ French lawmakers voted for an internet traffic tax that the makers of VLC say would cost them more than €1M a year.

Content providers would pay €0.055 for every gigabyte sent to French users, as counted by ISPs. Its Socialist authors expect €10B a year.

The government opposed it, warning that about half the bill would fall on smaller providers, many of them French.

It passed 11 votes to 10, with 35 of 577 deputies present.

https://x.com/IntCyberDigest/status/2116243714209124557

‼️ Chainalysis, the firm that tracks crypto hackers, was hacked itself.

It told customers in an email seen by ICD that an attacker using "offensive agentic techniques" accessed users' names, emails and role labels.

It says this has nothing to do with the $6.3B Binance heist.

https://x.com/IntCyberDigest/status/2116257776045281620

🚨 BREAKING: Trezor told CryptoBilis buyers to move their crypto after one reported a spy implant in a Trezor Safe 5.

The Indonesian buyer says an extra board with a cellular module sat between the mainboard and screen, reading the wallet backup.

https://x.com/IntCyberDigest/status/2116278217464279448

‼️ The Syrian hacker who hijacked AP's Twitter account to post that Obama was injured in White House explosions was sentenced to 42 months in a US prison.

The 2013 fake tweet briefly wiped $136B off Dow stocks, the DOJ says.

Ahmad Umar Agha later called that crash "our goal".

https://x.com/IntCyberDigest/status/2116293316816060453