Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]
A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. [...]
The online advertising industry has found a new way to make itself even more unpopular, with one adtech outfit accused of helping spyware vendors infect people's phones without them even clicking an ad. Researchers at Citizen Lab say they've uncovered the first publicly confirmed case of a zero-click mercenary spyware attack being delivered through targeted online ads, with devices at Al Jazeera among those infected. The technique, dubbed "AdFection," turns advertising networks into a spyware delivery system. Simply opening a website or app can be enough to trigger the attack, with no suspicious links or downloads involved. Israeli adtech firm Discover-Tech is allegedly behind the operation, according to researchers at Citizen Lab, which says the company acts as a middleman between the online advertising industry and multiple spyware and hacking vendors. "We present technical evidence that the Israel-based company Discover-Tech, while purporting to be a legitimate advertising company, appears to be a front for large-scale ad espionage abuse," the researchers wrote. “In fact, it appears that serving as this bridge is Discover-Tech’s primary purpose." Discover-Tech’s Controlium platform exploits the real-time bidding system that decides which ads appear on websites and apps. Every time someone loads a page, advertisers compete for available ad space and, in the process, receive information about the user's device and location. Discover-Tech allegedly used that data to identify specific targets and serve them malicious ads. One spyware vendor linked to the operation is Candiru, the Israeli developer now known as Integrity Labs. Citizen Lab traced attacks against at least 45 devices at Al Jazeera in 2024 and 2025 to Candiru spyware delivered through ads from Discover-Tech. Discover-Tech didn't have to sneak into the advertising system, as Google and IAB Europe had listed the company as an approved vendor since 2020, apparently unaware of what it was Citizen Lab claims it was doing with that access. Citizen Lab sifted through nearly four billion ad-bidding records and found Discover-Tech ads on more than 70,000 mobile apps and 120,000 websites between March and June 2026. Some reached networks belonging to government agencies, defense organizations, and NATO. Researchers found no evidence that those organizations were infected, but they say the ads could have been used to profile devices on those networks. The researchers said the operation also covertly directed millions of devices toward servers associated with Candiru, although those connections don't necessarily indicate spyware infections. Google has since terminated Discover-Tech's access to its advertising exchanges and removed it from its approved vendor lists. IAB Europe followed suit, while Beeswax, Vungle and Eskimi also took action. Discover-Tech and Candiru did not respond to Citizen Lab's requests for comment, nor ours. The researchers argue that the findings expose serious failings in an advertising industry that allowed a company with links to commercial surveillance operators to operate inside its supposedly vetted ecosystem for years. “Discover-Tech’s mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report,” Citizen Lab said. For years, the worst thing about targeted advertising was that it knew far too much about you. Turns out some advertisers were interested in much more than your shopping habits. ®
Bank of America recruited an additional 1,000 contractors to help patch all the vulnerabilities discovered by Anthropic’s Mythos model, the CEO said on Wednesday. Brian Moynihan, chairman and CEO at BoA, said during the company’s Q3 earnings call that it spent “a couple of hundred million plus” in remediation costs related to Mythos, and the anti-money laundering (AML) orders issued this week. These costs are expected to decline over time, though, with the contractors in place to help ease the initial burden of patching a large number of flaws, an issue that shouldn’t be so pronounced in the longer term. He went on to tell CNBC that the bank brought in outside help after concerns grew over how it would quickly tackle all the work associated with Mythos’ discoveries. The same concerns were shared globally, in part due to how Anthropic marketed Mythos as an all-powerful model that threatened the status quo of cybersecurity. While it ultimately turned out to be highly effective and capable of identifying complex vulnerabilities quicker than humans, leading to the massive influx of patches, some early adopters say it was no smarter than elite researchers. Mozilla CTO Bobby Holley said in April: "So far we've found no category or complexity of vulnerability that humans can find that this model can't," after Mythos found 271 flaws in Firefox 150. "We also haven't seen any bugs that couldn't have been found by an elite human researcher." The 1,000 contractors brought in by the bank in its Q2 added to its existing 3,000 technical staff. The contractors remain at the bank for now, although their assistance won’t be needed in the longer term. Moynihan told financial analysts on the bank’s earnings call that BoA has made its tech engineering workforce around 10 percent more efficient, and that each of the circa 130 AI-related projects it has running is expected to achieve a 2x or 3x return on investment over time. In 2026 alone, the CEO expects AI projects to deliver between $250 million and $300 million in benefits – a sum he expects to shoot up to $700 million by the end of 2027. He didn't detail how. The bank has also reduced around 3,000 roles, including a 5 percent decrease in the number of managers on the payroll, although it didn't specify how much of a role AI played. Moynihan didn’t break down how much of the “couple of hundred million plus” in remediation costs were devoted to AI or Mythos, compared to costs associated with cleaning up its AML issues, both of which the CEO lumped together. BoA’s share price slid more than 8 percent on Wednesday morning after it reported a 17 percent drop in profits owing to the $1.21 billion settlement it agreed to with the Treasury’s Financial Crimes Enforcement Network (FinCEN). The FinCEN order relates to BoA’s failure to police national security risks, including Chinese money laundering, and a failure to report over $5 billion in suspicious activity. FinCEN’s order was issued concurrently with a $750 million penalty from the Office of the Comptroller of the Currency, related to Bank Secrecy Act and AML compliance deficiencies. BoA also agreed an $11.6 million settlement with the Office of Foreign Assets Control for sanctions violations, including those related to Iran, Russia, narcotics, and global terrorism. ®
AI pentesting can uncover vulnerabilities missed by human testers, but it also has limitations in consistency, risk assessment, and understanding business context. Intruder compares the strengths and weaknesses of both approaches and explains where AI agents can improve security testing. [...]
X says it has nuked more than 13,000 accounts involved in three suspected foreign influence operations targeting US political debate. In a post on Wednesday evening, the platform linked the operations to Iran, Russia, and China. It said the networks used inauthentic accounts to post and amplify political content targeting candidates and public figures across the political spectrum. The announcement comes ahead of the US midterm elections on November 3. "People come to X to talk about what's happening in the world, including the upcoming 2026 US midterms," the platform said. "Free speech is the bedrock of a functioning democracy, and we are proud that X is the global town square where these debates happen. Our job is to keep that conversation authentic, open, and safe." X did not publicly explain the evidence behind its attribution. Separately, it highlighted its Civic Integrity policy, which covers misleading information about how, when, and where to vote, as well as content intended to discourage participation. Reports submitted under "Civic Integrity" are routed into requests for Community Notes. X says it uses the crowdsourced feature alongside platform moderation and may label policy-breaking posts in critical cases. Community Notes has faced scrutiny. When the European Commission launched formal proceedings against X under the Digital Services Act in 2023, it raised questions about the feature's effectiveness for validating a post's accuracy. X's reliance on crowdsourced context follows layoffs and senior departures from its moderation teams after Musk acquired Twitter. Foreign influence campaigns aren't confined to US elections. MI5 chief Sir Ken McCallum said this week that Russia had attempted to interfere in the 2016 Brexit referendum, but cautioned against treating that as evidence it changed the result. ®
Procure e legislatori statali stanno colmando il vuoto lasciato dal Congresso sulla sicurezza dell’AI negli Stati Uniti, mentre la Casa Bianca tenta di limitare le norme locali e i laboratori propongono un rallentamento volontario esposto a responsabilità civile, antitrust e pressioni politiche
Law enforcement authorities from 17 countries in Latin America and Europe have arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM) through online messaging groups. [...]
Hackers who broke into the UK's Legal Aid Agency last year stole records dating back nearly five decades, the government has admitted, revealing the breach was far more extensive than previously thought. The Legal Aid Agency said on Wednesday that around 250,000 records stolen in the April 2025 attack date from before 2007, including one going back to 1978. That's much further back than the agency previously estimated – it initially said the stolen data covered legal aid applications, claims, and payments from 2007. Most of the newly identified records date from the 1990s and 2000s, with only a “fractionally small number” originating before 1990. Still, the discovery raises an awkward question about just how much historical personal information was sitting in government systems when the attackers came knocking. That wasn't the only surprise in the stolen data, as the Ministry of Justice (MoJ) has also discovered that hackers accessed information from HM Prison and Probation Service (HMPPS), including names, dates of birth, nationalities, and case reference numbers for offenders supervised by probation services between 2010 and 2017. The government says the probation records concern a relatively small number of offenders, with more than 99 percent of the affected data relating to people under supervision in 2016 and 2017. It stressed that none of the stolen probation information relates to victims of crime. The latest revelations come almost 18 months after the Legal Aid Agency disclosed that criminals had accessed and downloaded a significant amount of sensitive personal information. The agency first detected the intrusion on April 23, 2025, but officials didn't establish the scale of the compromise until May 16. The government subsequently took the LAA's online services offline, leaving lawyers struggling to access the systems they needed to submit claims and manage cases. The disruption dragged on for months, with the agency's troubled return to service in December leaving legal aid providers battling delays and ongoing technical problems. Further forensic work has now revealed that the data theft goes back much further than officials originally believed. The compromised information varies by individual but could include names, addresses, dates of birth, National Insurance numbers, financial details, and information about legal proceedings. Some records also contain details of criminal charges, pleas, convictions, and sentences. Among the older material are records relating to legal aid benefit assessments dating from 1978 to 2012, and payments made under the Very High Cost Cases scheme between 1981 and 2004. The government cautioned that the presence of historical records doesn’t mean that everyone who applied for legal aid before 2007 had their information stolen, nor does the 250,000 figure represent a confirmed number of affected individuals. Explaining why it has taken so long to pin down the extent of the theft, the MoJ said the attackers stole information spread across several complex systems, much of it unstructured, fragmented, or incomplete. "Because of our increased capability to identify data, we have developed a more complete understanding of the information compromised," the agency said. The government says it has no indication that the stolen information has been published or shared, although that offers little certainty to anyone whose personal details may now be in criminal hands. Since the attack, the MoJ says it has tightened authentication and access controls, improved security monitoring, addressed vulnerabilities and begun retiring or isolating higher-risk technology. Work to modernize its legacy systems is also underway. The question of why records stretching back to the 1970s remained accessible in the first place is one the latest update does not answer. ®
Welcome, once again, to PWNED, the weekly column where we gawk at organizations that have made serious security mistakes. Normally, we’re talking about businesses or maybe the odd school that messes up, but today we’re writing about a serious IT screwup in the world’s most powerful military. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Today’s tale comes from Justin Henkel, the CISO of IT monitoring and service company SolarWinds. Henkel previously worked in IT security for the Air Force and one day in the early 2000s saw a practice that just wouldn’t fly today. Before USB drives became popular, burning CDs with mission data was the modus operandi, and those discs were put in both unclassified and classified systems. “They would write a CD, and then they would take that CD and then put it in a classified system and do the remainder of the mission planning,” Henkel told us. “Then they would take that disc and then put it in the airplane.” Inside the airplane, the data on the CD would help the pilot navigate and contain information about threats they might encounter. Later, when thumb drives became a thing, pilots used them instead of discs. “They didn't really think about the overall impact of classified versus unclassified systems,” Henkel said of the pilots. “Using the same device for both, they didn’t understand that you could read and write onto a USB drive with malware. [They were] not really understanding the overall threat picture.” According to Henkel, Air Force personnel would buy their flash drives from local vendors rather than sourcing them from official military contractors. If they were in Afghanistan, those drives could literally come from a store in Kabul. And it wasn’t exactly the equivalent of Best Buy. “It was more difficult to bring a US-based computer into the nation than it was just to buy local,” he said. “So they were just going out into the local market in Kabul or whatever city that they were out [in]. And I used to do this: go out, make relationships with the local vendors. ‘Hey I need 100 USB sticks.’” Unfortunately, enemies of the US noticed and soon started selling infected USB drives to local vendors in the Middle East. Henkel knew that using a sneakernet with classified systems was a recipe for disaster. It’s just that no one would listen to him. “It was just a shock,” he told us. “I was a young 22-year-old guy, very junior in the overall rank system, trying to tell colonels and majors that what they’re doing is a violation.” In 2008, the US Department of Defense was infected by malware after somebody attached an infected USB flash drive to a laptop with access to US Central Command. The worm, dubbed Agent.BTZ, could collect information from infected computers and communicate with remote servers. A 2016 report from the FBI and DHS attributed the malware to one or more Russian groups. It took the Pentagon 14 months to scrub it from its systems. It took this attack for the Pentagon to wise up in 2008 and ban the use of USB drives, instead forcing data transfers to go through more secure systems. Eventually, in 2010, the drives were allowed again under certain circumstances. ®
Nelle grandi imprese entrano in media 21 nuove applicazioni SaaS al mese, ma il portafoglio resta quasi fermo. Il ricambio continuo, le integrazioni, l’AI e i modelli a consumo spostano così il problema dal numero delle licenze al debito operativo che l’organizzazione deve governare
The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978. [...]
The Information Commissioner's Office (ICO) has reprimanded London's Metropolitan Police Service (MPS) and issued an enforcement notice after officers used a retail crime platform without the force's approval or required data protection checks. Between March 2023 and September 2024, MPS officers registered around 500 free accounts on Auror, a platform retailers use to record crimes such as shoplifting. The force had not formally procured the service or completed the required data protection checks. Retailers such as supermarkets encouraged officers to use Auror and directed them to the platform to access CCTV footage. Auror Europe, registered in England and Wales, is a subsidiary of New Zealand-based Auror. The platform allows retailers to share incident reports, images, and CCTV footage. Retailers pay for access through a browser or mobile app, while police partners use it free of charge. The force had not completed a data protection impact assessment (DPIA) or established data-sharing agreements with Auror Europe, the ICO says. Between August and September 2024, two separate internal security reports were filed regarding officers' use of Auror. The first related to officers uploading the names of suspects they recognized from CCTV footage, and the second pertained to officers collecting CCTV footage from the platform despite no checks being made on it. Access to Auror was blocked as of September 26, 2024. The MPS data protection officer (DPO) informed the ICO of the force's use of Auror in December 2024 during discussion about a separate matter. The watchdog launched a formal probe in April 2025. The ICO found that officers unlawfully uploaded personal data relating to 179 people, including three children, to Auror. For 128, this consisted of names alone; for 49, names and dates of birth; and for two, names, dates of birth, and home addresses. The ICO said the MPS failed to ensure adequate oversight was implemented when deciding what third-party platforms officers were allowed to use – failures that persist today. It claimed the MPS is overly reliant on soft controls to prevent officers from using unapproved software, such as policy reminders and staff training, which often go unnoticed, rather than technical blocks. The ICO also said the force had failed to test whether its web controls worked: officers used Auror for more than 18 months without triggering an alert. The regulator described a repeat failure, pointing to officers' use of Clearview AI in 2021 without proper oversight. The ICO considers the failures ongoing because the force has not demonstrated that its safeguards can prevent similar incidents. The enforcement action compels the MPS to strengthen its safeguards against improper use of third-party tools and provide the ICO with periodic progress updates. David Doodson, head of investigations at the ICO, said: "This action should send a message across the policing sector, and beyond: If you are using new technology to process people's information you must do so lawfully, transparently and with appropriate governance from the outset. "Where organisations fail to protect people's information, we will take action. Our role is not only to hold organisations to account, but to drive improvements and promote the standards people have a right to expect." The MPS told The Register that following the implementation of stricter controls and a pilot scheme, officers in 14 London boroughs are once again using Auror. "Following formal approval and a pilot, the platform is now used in 14 London boroughs," a Met spokesperson said. "It helps officers identify shoplifters more quickly, enabling retailers to directly share evidence and CCTV at the point of reporting and has quadrupled positive outcomes for shoplifting." In an August 2026 announcement, the MPS said the tech, which it did not identify by name, would be rolled out beyond the 14 boroughs and was already deployed in stores such as Tesco, Boots, Greggs, and M&S. It said that instances of shoplifting reported via the platform result in a positive outcome in 29.4 percent of cases. Of the ICO's findings, the spokesperson said: "We accept the ICO's findings that our data protection arrangements at the time were insufficient in relation to individual officers using the Auror platform. "While officers were using the platform in good faith to identify and arrest shoplifters, we recognise that we had not completed the relevant security and data protection work for the platform to be used. "As soon as we became aware of this issue, we immediately suspended access to the platform and carried out a full review. We have subsequently completed the necessary legal, security, commercial and data protection checks before approving the platform for use." This reprimand and enforcement action follow a separate rebuke from the ICO in August, concerning two sensitive cases. In one, a Met officer sent unredacted legal documents to the subject of a stalking protection order, exposing the victim's new home address and contact details. The other saw an officer commit the cardinal CC-not-BCC sin, exposing the email addresses of 18 people linked to Parliament who were targeted in a honeytrap sting. ®
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]
Cisco “strongly” implored customers to patch yet another critical, make-me-root vulnerability in its Secure Email Gateway (SEG), one that has already been exploited in zero-day attacks. A Cisco spokesperson told The Register that the critical vuln, which received a 9.8 out of 10 CVSS rating, affects “a limited number of customers.” The bug, now tracked as CVE‑2026‑76519, allows remote, unauthenticated attackers to write files and execute commands with root privileges on the appliance’s operating system - simply by sending a malicious email. In separate Wednesday advisories, both the networking vendor and the US government warned that attackers were exploiting the latest SEG vulnerability before Cisco issued a fix. The US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog, and set a Saturday deadline for federal agencies to fix the issue. “We are aware of active exploitation of this vulnerability,” the spokesperson said, but declined to answer our questions about how many appliances had been compromised, and what attackers were doing with this access after exploiting the bug. “We strongly urge customers to upgrade to a fixed software release and follow additional recommendations and hardening guidance in our advisory,” the spokesperson said. The flaw exists in SEG’s Advanced Malware Protection (AMP) feature, and it’s due to improper handling of email attachments. An attacker could exploit the bug by sending an email with a malicious attachment, and a successful exploit would allow them to write files and execute commands as root on the compromised appliance. This vulnerability affects both physical and virtual SEG appliances running a vulnerable release of Cisco AsyncOS Software if both of the following conditions are met: The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy. The Content Scanner Tools version is earlier than 25.3.0.5525. Cisco's Wednesday advisory includes steps organizations can take to determine whether File Reputation is enabled and which Content Scanner Tools version is installed - so give that a read if you are unsure. Upgrading to a fixed Cisco AsyncOS Software release will patch the security hole, and there are no workarounds. The vendor recommends any customers who are running Cisco AsyncOS Software releases earlier than v 16.5 migrate to 16.5.0-780. In its alert, Cisco said it became aware of active exploitation in October. This is the second such zero-day in SEG in as many months. In mid-September, Cisco warned customers that criminals were exploiting a similar bug in SEG, tracked as CVE-2026-76461, that also turns a malicious email into root access. In January, attackers exploited another critical AsyncOS flaw, CVE-2025-20393, to break into Cisco SEG appliances and install persistence mechanisms. That bug eventually scored a perfect 10.®
Accedi