🔍 CISA flags active exploitation of GitLab RCE flaw
CISA has added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog after confirming in-the-wild abuse. The max-severity bug affects GitLab CE and EE, stems from an integer overflow in the CI/CD Regular Expression Compiler, and can allow unauthenticated remote code execution via a crafted regex in pipeline configuration files. Patched versions are 19.4.2, 19.3.5, and 19.2.8.
The issue moves from patch priority to active incident surface. GitLab says it has observed exploitation attempts and released detections for self-managed instances, while CISA ordered US federal agencies to remediate by Sunday under BOD 26-04.
🛰️ Open sources - closed narratives
@sitreports
CISA has added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog after confirming in-the-wild abuse. The max-severity bug affects GitLab CE and EE, stems from an integer overflow in the CI/CD Regular Expression Compiler, and can allow unauthenticated remote code execution via a crafted regex in pipeline configuration files. Patched versions are 19.4.2, 19.3.5, and 19.2.8.
The issue moves from patch priority to active incident surface. GitLab says it has observed exploitation attempts and released detections for self-managed instances, while CISA ordered US federal agencies to remediate by Sunday under BOD 26-04.
🛰️ Open sources - closed narratives
@sitreports
🔍 Critical Linux kernel flaw exposes MPTCP servers to remote root
CVE-2026-98432 is a 9.8-rated use-after-free bug in Linux IPv4 TCP handling, affecting kernels back to 4.4. Researchers at Anthropic demonstrated unauthenticated remote code execution as root against systems running MPTCP listeners, while the flaw also impacts ordinary TCP paths. Debian has issued fixed kernel packages, while Ubuntu, RHEL, and Rocky remain affected or awaiting broader rollout in Linux distributions.
The key operational issue is exposure visibility: MPTCP may be enabled implicitly, including by Go 1.24 listeners on supported kernels. Disabling MPTCP alone is not a complete mitigation, and interim controls focus on network restriction and filtering IPv4 TCP packets with IP options.
🛰️ Open sources - closed narratives
@sitreports
CVE-2026-98432 is a 9.8-rated use-after-free bug in Linux IPv4 TCP handling, affecting kernels back to 4.4. Researchers at Anthropic demonstrated unauthenticated remote code execution as root against systems running MPTCP listeners, while the flaw also impacts ordinary TCP paths. Debian has issued fixed kernel packages, while Ubuntu, RHEL, and Rocky remain affected or awaiting broader rollout in Linux distributions.
The key operational issue is exposure visibility: MPTCP may be enabled implicitly, including by Go 1.24 listeners on supported kernels. Disabling MPTCP alone is not a complete mitigation, and interim controls focus on network restriction and filtering IPv4 TCP packets with IP options.
🛰️ Open sources - closed narratives
@sitreports
🔍 Malicious Claude Code package on Cursor planted SSH persistence
A trojanized version of Anthropic’s Claude Code extension, listed on Cursor’s marketplace as v2.1.313, was available for roughly 11 hours on 29 October and may have reached up to 5,000 developers. The package added a loader to extension.js, collected host data, installed persistence, dropped an attacker SSH key, and attempted reverse-tunnel access. Cursor removed the extension and published a security notice.
The key point is exposure through a trusted developer workflow rather than malware sophistication. Reported implementation errors likely reduced successful remote access on many Windows and macOS systems, but reconnaissance, persistence, and key placement still make affected machines and accessible secrets high-priority for isolation and rebuild.
🛰️ Open sources - closed narratives
@sitreports
A trojanized version of Anthropic’s Claude Code extension, listed on Cursor’s marketplace as v2.1.313, was available for roughly 11 hours on 29 October and may have reached up to 5,000 developers. The package added a loader to extension.js, collected host data, installed persistence, dropped an attacker SSH key, and attempted reverse-tunnel access. Cursor removed the extension and published a security notice.
The key point is exposure through a trusted developer workflow rather than malware sophistication. Reported implementation errors likely reduced successful remote access on many Windows and macOS systems, but reconnaissance, persistence, and key placement still make affected machines and accessible secrets high-priority for isolation and rebuild.
🛰️ Open sources - closed narratives
@sitreports
🤖 AI-enabled intrusion set scales targeting across 200+ organizations
Researchers tracked a China-linked campaign using the AI-powered framework ARTEX against more than 200 organizations worldwide. The activity is framed as cyber-espionage, with AI integrated into the operators’ workflow rather than a standalone payload.
The key significance is volume and efficiency. An AI-assisted operator stack can compress reconnaissance, targeting, and adaptation cycles, allowing one intrusion set to sustain broader global coverage with lower analyst overhead and faster tasking against multiple victims.
🛰️ Open sources - closed narratives
@sitreports
Researchers tracked a China-linked campaign using the AI-powered framework ARTEX against more than 200 organizations worldwide. The activity is framed as cyber-espionage, with AI integrated into the operators’ workflow rather than a standalone payload.
The key significance is volume and efficiency. An AI-assisted operator stack can compress reconnaissance, targeting, and adaptation cycles, allowing one intrusion set to sustain broader global coverage with lower analyst overhead and faster tasking against multiple victims.
🛰️ Open sources - closed narratives
@sitreports
🔍 Trezor flags suspected implant in Safe 5 wallet sold via CryptoBilis
Trezor says it received a credible report of a tampered Safe 5 bought in Indonesia through CryptoBilis, with an extra board reportedly placed between the mainboard and screen, including a cellular module and antenna. The Safe 5 has not yet been examined by Trezor, but the company told potentially affected users to migrate funds and avoid devices bought via CryptoBilis from March 2026 onward.
The case aligns with the earlier Ledger supply-chain compromise tied to the same reseller and points to reseller-layer tampering rather than a firmware-only threat. Trezor had already halted sales through CryptoBilis on 9 October and says device weight is not a reliable integrity check.
🛰️ Open sources - closed narratives
@sitreports
Trezor says it received a credible report of a tampered Safe 5 bought in Indonesia through CryptoBilis, with an extra board reportedly placed between the mainboard and screen, including a cellular module and antenna. The Safe 5 has not yet been examined by Trezor, but the company told potentially affected users to migrate funds and avoid devices bought via CryptoBilis from March 2026 onward.
The case aligns with the earlier Ledger supply-chain compromise tied to the same reseller and points to reseller-layer tampering rather than a firmware-only threat. Trezor had already halted sales through CryptoBilis on 9 October and says device weight is not a reliable integrity check.
🛰️ Open sources - closed narratives
@sitreports
🔍 TeamViewer flaw turns remote hosts into attack surfaces
A newly disclosed TeamViewer flaw allows a remote computer to attack the user who initiates a control session. The issue reverses the usual trust model of remote administration: instead of the controller posing the primary risk, the controlled endpoint can become the attacker during the connection.
Operationally, this matters for help desks, MSPs, enterprise IT, and incident responders that routinely initiate sessions into untrusted or compromised machines. A vulnerable remote-control workflow can turn routine access into lateral exposure for privileged operators and their management infrastructure.
🛰️ Open sources - closed narratives
@sitreports
A newly disclosed TeamViewer flaw allows a remote computer to attack the user who initiates a control session. The issue reverses the usual trust model of remote administration: instead of the controller posing the primary risk, the controlled endpoint can become the attacker during the connection.
Operationally, this matters for help desks, MSPs, enterprise IT, and incident responders that routinely initiate sessions into untrusted or compromised machines. A vulnerable remote-control workflow can turn routine access into lateral exposure for privileged operators and their management infrastructure.
🛰️ Open sources - closed narratives
@sitreports
📡 SS7 and Diameter remain a live attack surface inside telecom core networks
A sponsored explainer on SS7 and Diameter outlines how signaling abuse can expose subscriber IMSIs, enable location tracking, redirect calls and SMS, and support account takeover via intercepted one-time codes. The article notes these attacks occur within carrier trust relationships rather than on the target device.
Operationally, the key point is that telecom signaling still relies heavily on inherited trust and uneven defensive implementation. That leaves mobile identity, location privacy, and SMS-based authentication vulnerable at network level, beyond the reach of endpoint hardening alone.
🛰️ Open sources - closed narratives
@sitreports
A sponsored explainer on SS7 and Diameter outlines how signaling abuse can expose subscriber IMSIs, enable location tracking, redirect calls and SMS, and support account takeover via intercepted one-time codes. The article notes these attacks occur within carrier trust relationships rather than on the target device.
Operationally, the key point is that telecom signaling still relies heavily on inherited trust and uneven defensive implementation. That leaves mobile identity, location privacy, and SMS-based authentication vulnerable at network level, beyond the reach of endpoint hardening alone.
🛰️ Open sources - closed narratives
@sitreports
🔍 FBI links North Korea to $6 billion theft from Binance
The FBI has attributed the theft of more than $6 billion in virtual assets from Binance to North Korea. The headline frames it as a state-linked cybercrime operation targeting one of the largest cryptocurrency exchanges.
If sustained, the attribution reinforces the role of crypto platforms in large-scale sanctions evasion and illicit finance. It also places renewed focus on exchange security, tracing capacity, and the use of cyber theft as a revenue stream for Pyongyang.
🛰️ Open sources - closed narratives
@sitreports
The FBI has attributed the theft of more than $6 billion in virtual assets from Binance to North Korea. The headline frames it as a state-linked cybercrime operation targeting one of the largest cryptocurrency exchanges.
If sustained, the attribution reinforces the role of crypto platforms in large-scale sanctions evasion and illicit finance. It also places renewed focus on exchange security, tracing capacity, and the use of cyber theft as a revenue stream for Pyongyang.
🛰️ Open sources - closed narratives
@sitreports
🔍 Ivanti Connect Secure flaw chain enables unauthenticated root access
Attackers have been observed chaining three Ivanti Connect Secure vulnerabilities to obtain unauthenticated root access on exposed appliances. The issue set affects a product widely used for remote access, turning the appliance itself into the initial access vector. Public reporting on Ivanti Connect Secure indicates the chain removes the need for valid credentials before full compromise.
Operationally, this compresses the intrusion path from edge exposure to privileged control in a single sequence. For defenders, internet-facing VPN infrastructure remains a high-priority surface because compromise at this layer can bypass downstream controls and provide durable access into internal environments.
🛰️ Open sources - closed narratives
@sitreports
Attackers have been observed chaining three Ivanti Connect Secure vulnerabilities to obtain unauthenticated root access on exposed appliances. The issue set affects a product widely used for remote access, turning the appliance itself into the initial access vector. Public reporting on Ivanti Connect Secure indicates the chain removes the need for valid credentials before full compromise.
Operationally, this compresses the intrusion path from edge exposure to privileged control in a single sequence. For defenders, internet-facing VPN infrastructure remains a high-priority surface because compromise at this layer can bypass downstream controls and provide durable access into internal environments.
🛰️ Open sources - closed narratives
@sitreports
🔍 PHP2Shell chain roots PAN-OS firewalls
Attackers chained PHP2Shell bugs CVE-2026-109618 and CVE-2026-109619 with the Fragnesia kernel flaw CVE-2026-46300 to gain root on PAN-OS devices. Hunt.io documented 24 compromised internet-facing firewalls and one internal management server, with tooling tailored to the appweb management service and the uniform PHP 8.0.30 build in the targeted environment. The campaign also identified roughly 19,000 exposed PAN-OS firewalls and narrowed 240 targets by geography and version.
The key point is reliability: this was not broad spray-and-pray exploitation across mixed PHP estates, but a tuned intrusion chain against a consistent management stack. Reported post-compromise activity included reverse SSH tunneling, showing firewall access was used as a pivot, not an endpoint.
🛰️ Open sources - closed narratives
@sitreports
Attackers chained PHP2Shell bugs CVE-2026-109618 and CVE-2026-109619 with the Fragnesia kernel flaw CVE-2026-46300 to gain root on PAN-OS devices. Hunt.io documented 24 compromised internet-facing firewalls and one internal management server, with tooling tailored to the appweb management service and the uniform PHP 8.0.30 build in the targeted environment. The campaign also identified roughly 19,000 exposed PAN-OS firewalls and narrowed 240 targets by geography and version.
The key point is reliability: this was not broad spray-and-pray exploitation across mixed PHP estates, but a tuned intrusion chain against a consistent management stack. Reported post-compromise activity included reverse SSH tunneling, showing firewall access was used as a pivot, not an endpoint.
🛰️ Open sources - closed narratives
@sitreports
🎭 Nvidia probes whether CEO Huang was targeted in foreign spying case
Nvidia has opened an internal review over whether CEO Jensen Huang was the target of foreign intelligence activity, while Huang separately acknowledged an extramarital affair in a message to employees. The issue places both executive security and corporate exposure under scrutiny at Nvidia.
For OSINT and counterintelligence watchers, the key point is the overlap between personal vulnerability and strategic corporate leadership. Any confirmed targeting of a major semiconductor executive would elevate concerns around access, leverage, and information security.
🛰️ Open sources - closed narratives
@sitreports
Nvidia has opened an internal review over whether CEO Jensen Huang was the target of foreign intelligence activity, while Huang separately acknowledged an extramarital affair in a message to employees. The issue places both executive security and corporate exposure under scrutiny at Nvidia.
For OSINT and counterintelligence watchers, the key point is the overlap between personal vulnerability and strategic corporate leadership. Any confirmed targeting of a major semiconductor executive would elevate concerns around access, leverage, and information security.
🛰️ Open sources - closed narratives
@sitreports
📡 Nvidia drops in after-hours and perpetual futures
Nvidia fell about 3% in after-hours trading, with perpetual futures tied to the stock also moving lower. The move followed disclosure that the company is investigating whether CEO Jensen Huang was targeted in a foreign intelligence effort.
The market reaction links a counterintelligence-related issue directly to a major semiconductor name. For OSINT watchers, this highlights how executive targeting can rapidly spill into price action, especially for firms central to AI and advanced chip supply chains.
🛰️ Open sources - closed narratives
@sitreports
Nvidia fell about 3% in after-hours trading, with perpetual futures tied to the stock also moving lower. The move followed disclosure that the company is investigating whether CEO Jensen Huang was targeted in a foreign intelligence effort.
The market reaction links a counterintelligence-related issue directly to a major semiconductor name. For OSINT watchers, this highlights how executive targeting can rapidly spill into price action, especially for firms central to AI and advanced chip supply chains.
🛰️ Open sources - closed narratives
@sitreports
📡 South Korea says Nvidia issues won't affect contracted GPU supplies
Seoul says existing deliveries of Nvidia GPUs under contract will proceed despite controversy involving CEO Jensen Huang. The statement frames current procurement channels as stable and separates executive-level fallout from already agreed supply obligations.
For South Korea, that matters for AI, data-center, and public-sector compute planning. The message is aimed at reducing disruption risk in downstream deployment schedules and signaling that contracted access to high-end processing capacity remains intact.
🛰️ Open sources - closed narratives
@sitreports
Seoul says existing deliveries of Nvidia GPUs under contract will proceed despite controversy involving CEO Jensen Huang. The statement frames current procurement channels as stable and separates executive-level fallout from already agreed supply obligations.
For South Korea, that matters for AI, data-center, and public-sector compute planning. The message is aimed at reducing disruption risk in downstream deployment schedules and signaling that contracted access to high-end processing capacity remains intact.
🛰️ Open sources - closed narratives
@sitreports
📄 Mitsui Chemicals to buy JSR for $11.6 billion with DBJ backing
Mitsui Chemicals plans to acquire JSR for $11.6 billion, with support from the Development Bank of Japan. The deal would bring a major chipmaking materials producer under Mitsui’s control in one of the largest transactions in Japan’s chemicals and semiconductor supply chain space.
The significance is industrial as much as financial: consolidation around a strategic materials supplier tightens the link between state-backed capital and semiconductor inputs. That matters for supply chain resilience, pricing power, and Tokyo’s broader effort to secure upstream technology sectors.
🛰️ Open sources - closed narratives
@sitreports
Mitsui Chemicals plans to acquire JSR for $11.6 billion, with support from the Development Bank of Japan. The deal would bring a major chipmaking materials producer under Mitsui’s control in one of the largest transactions in Japan’s chemicals and semiconductor supply chain space.
The significance is industrial as much as financial: consolidation around a strategic materials supplier tightens the link between state-backed capital and semiconductor inputs. That matters for supply chain resilience, pricing power, and Tokyo’s broader effort to secure upstream technology sectors.
🛰️ Open sources - closed narratives
@sitreports
🔍 Huawei unveils a claimed fully Chinese PC stack
Huawei says the Qingyun HM650 desktop uses only components made in China, built around its Kirin X90 processor and an enterprise edition of HarmonyOS. The company also says one Chinese government agency has ordered 600 systems. The key unresolved point in the Qingyun HM650 claim is whether every part is also Chinese-designed, not just manufactured locally.
The significance is less technical than institutional: the system aligns with Beijing’s push to replace Wintel fleets across government procurement. Even with ambiguity around component origin, a deployable domestic desktop platform narrows market access for Intel, AMD, and Qualcomm in one of the world’s largest state IT buyers.
🛰️ Open sources - closed narratives
@sitreports
Huawei says the Qingyun HM650 desktop uses only components made in China, built around its Kirin X90 processor and an enterprise edition of HarmonyOS. The company also says one Chinese government agency has ordered 600 systems. The key unresolved point in the Qingyun HM650 claim is whether every part is also Chinese-designed, not just manufactured locally.
The significance is less technical than institutional: the system aligns with Beijing’s push to replace Wintel fleets across government procurement. Even with ambiguity around component origin, a deployable domestic desktop platform narrows market access for Intel, AMD, and Qualcomm in one of the world’s largest state IT buyers.
🛰️ Open sources - closed narratives
@sitreports
🤖 Anthropic secures $3.4 billion generator deal for AI data centers
Anthropic has reportedly signed a $3.4 billion deal to secure gas-fired power generators for AI data centers, as outlined in the Anthropic agreement cited by the FT. The move ties large-scale AI expansion directly to dedicated on-site or contracted power capacity.
Operationally, this highlights how power supply is becoming a core constraint in AI infrastructure planning. Securing generation at this scale signals that compute growth is now shaped not only by chips and real estate, but by access to reliable energy.
🛰️ Open sources - closed narratives
@sitreports
Anthropic has reportedly signed a $3.4 billion deal to secure gas-fired power generators for AI data centers, as outlined in the Anthropic agreement cited by the FT. The move ties large-scale AI expansion directly to dedicated on-site or contracted power capacity.
Operationally, this highlights how power supply is becoming a core constraint in AI infrastructure planning. Securing generation at this scale signals that compute growth is now shaped not only by chips and real estate, but by access to reliable energy.
🛰️ Open sources - closed narratives
@sitreports
🔍 Brenner Base Tunnel breach: confirmed access, unverified scale
Brenner Base Tunnel SE confirmed unauthorized access to some company data, while the Everest extortion group claims it stole 812 GB. The reported timeline points to a mid-October intrusion, a 17 October claim, and public disclosure in early November. BBT SE said operations were unaffected, impacted systems were isolated, and investigations with authorities and external forensic experts are ongoing in the breach.
At present, there is no evidence of industrial control system access, operational disruption, or system encryption. The key variables are what files were actually taken, how current they are, and whether exposed project data could support follow-on fraud or reconnaissance.
🛰️ Open sources - closed narratives
@sitreports
Brenner Base Tunnel SE confirmed unauthorized access to some company data, while the Everest extortion group claims it stole 812 GB. The reported timeline points to a mid-October intrusion, a 17 October claim, and public disclosure in early November. BBT SE said operations were unaffected, impacted systems were isolated, and investigations with authorities and external forensic experts are ongoing in the breach.
At present, there is no evidence of industrial control system access, operational disruption, or system encryption. The key variables are what files were actually taken, how current they are, and whether exposed project data could support follow-on fraud or reconnaissance.
🛰️ Open sources - closed narratives
@sitreports
🔍 Iris Ohyama cloud breach may have exposed 7.7 million records
Japanese manufacturer Iris Ohyama says unauthorized access to a third-party cloud service used by its Iris Plaza store may have exposed data on up to 7.7 million people. The affected set includes 5.8 million members or former members and 1.9 million non-members, with possible exposure of names, addresses, phone numbers, email addresses, gender, birth dates, and some encrypted passwords. Iris Plaza and related systems were suspended.
The incident is notable for its scale and for the concentration of consumer identity data in an external cloud environment. Even without payment card data in the affected service, the exposed fields are sufficient for credential abuse, account recovery targeting, and follow-on phishing operations.
🛰️ Open sources - closed narratives
@sitreports
Japanese manufacturer Iris Ohyama says unauthorized access to a third-party cloud service used by its Iris Plaza store may have exposed data on up to 7.7 million people. The affected set includes 5.8 million members or former members and 1.9 million non-members, with possible exposure of names, addresses, phone numbers, email addresses, gender, birth dates, and some encrypted passwords. Iris Plaza and related systems were suspended.
The incident is notable for its scale and for the concentration of consumer identity data in an external cloud environment. Even without payment card data in the affected service, the exposed fields are sufficient for credential abuse, account recovery targeting, and follow-on phishing operations.
🛰️ Open sources - closed narratives
@sitreports
📡 ITU plenipotentiary opens with 278 proposals on the table, putting internet governance under a four-year stress test.
The UN telecom agency remains central to spectrum, satellite orbits, and technical standards, but multiple proposals could overlap with roles held by ICANN, the IETF, RIRs, and W3C. The Internet Society says it is actively challenging measures that could affect core internet architecture or increase fragmentation.
The significance is procedural as much as political: most decisions are made by consensus, but proposals can be amended during the 18-day meeting, creating space for mandate expansion into DNS, IP-based networks, AI, quantum policy, and other emerging governance areas.
🛰️ Open sources - closed narratives
@sitreports
The UN telecom agency remains central to spectrum, satellite orbits, and technical standards, but multiple proposals could overlap with roles held by ICANN, the IETF, RIRs, and W3C. The Internet Society says it is actively challenging measures that could affect core internet architecture or increase fragmentation.
The significance is procedural as much as political: most decisions are made by consensus, but proposals can be amended during the 18-day meeting, creating space for mandate expansion into DNS, IP-based networks, AI, quantum policy, and other emerging governance areas.
🛰️ Open sources - closed narratives
@sitreports
🤖 Doom reaches IBM Z through a text terminal
WND Software has exposed a public browser demo that connects over SSH to an IBM Z mainframe and runs DOOM-ASCII in a terminal emulator. The session is playable in colored ASCII, carries no sound, requires no login or installation, and is capped at five minutes with up to 50 concurrent users.
The notable element is not Doom on mainframe hardware, but usable interaction through a terminal session. This demonstrates a lightweight remote access path for visually dynamic workloads on IBM Z, while also serving as a practical showcase for terminal emulation on legacy enterprise infrastructure.
🛰️ Open sources - closed narratives
@sitreports
WND Software has exposed a public browser demo that connects over SSH to an IBM Z mainframe and runs DOOM-ASCII in a terminal emulator. The session is playable in colored ASCII, carries no sound, requires no login or installation, and is capped at five minutes with up to 50 concurrent users.
The notable element is not Doom on mainframe hardware, but usable interaction through a terminal session. This demonstrates a lightweight remote access path for visually dynamic workloads on IBM Z, while also serving as a practical showcase for terminal emulation on legacy enterprise infrastructure.
🛰️ Open sources - closed narratives
@sitreports