Cryptocurrency wallet provider MetaMask said a recent security incident has not affected MetaMask wallets or its wallet infrastructure. The MetaMask non-custodial crypto wallet (developed by blockchain software company Consensys) lets users store and manage assets on the Ethereum network and compatible blockchains. MetaMask revealed on September 30 that it was investigating an "ongoing infrastructure security incident" and exited affected validators (Ethereum network nodes responsible for proposing blocks, verifying crypto transactions, and maintaining Ethereum blockchain security) within non-custodial staking operations. While the company shared almost no details at the time and redirected BleepingComputer to the public statement when asked what part of its infrastructure was affected, in a Thursday update it said that a threat actor gained access to systems used to store recipient addresses and diverted some execution-layer staking rewards.
A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server.
Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday. One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a
The FBI and CISA warn that hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, potentially causing food spoilage, equipment damage, and fire hazards. The warning was issued jointly with the U.S. Departments of Health and Human Services (HHS), Agriculture (USDA), and Transportation (DOT), urging critical infrastructure operators to secure vulnerable refrigeration controllers used in healthcare, food production, chemical facilities, and transportation. "Every organization that depends on refrigeration and monitoring systems should assume it could be a target," said Chris Butera, CISA's Acting Executive Assistant Director for Cybersecurity. According to a joint advisory published Thursday, attackers are exploiting weaknesses in unpatched or internet-accessible electronic temperature controllers and commercial refrigeration management systems.
Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks, using two different phishing-as-a-service platforms to steal Microsoft and Google account credentials and authentication sessions. According to a new report from Push Security, the attackers use convincing event registration pages offering free access to premium AI services and other rewards to trick victims into signing in with their corporate accounts. What makes the attacks interesting is that the same phishing pages integrate two separate phishing-as-a-service (PhaaS) platforms, Kali365 and VoidProxy, to target Microsoft and Google accounts using different authentication attacks. Kali365 conducts Microsoft device code phishing attacks, while VoidProxy acts as an adversary-in-the-middle (AiTM) reverse proxy to intercept Google sign-ins and steal authentication session cookies.
Truffle Security has launched the Secrets Revocation Program, a free initiative that helps API key issuers revoke 1.4 million publicly exposed secrets that remain valid. Since 2022, the company has discovered secrets embedded in public repositories, packages, container images, datasets, and applications. Earlier this year, Truffle Security reported that it had found 543,000 valid credentials leaked in public GitHub repositories. In a separate investigation, the company identified more than 431,000 AWS secrets across code repositories, Git histories, datasets, Docker images, registries, and CI logs. These secrets are typically exposed by mistake during the development process, by committing credentials to a public repository, including them in published Docker images or packages, or leaving them in configuration files uploaded with an app or dataset.
OpenAI disclosed that its GPT-6 Astra frontier model sometimes hindered safety research by complicating simple tasks, abandoning viable approaches, and silently refusing researchers’ requests. During evaluation, the AI company's model reported nonexistent or self-made blockers without explaining its restrictions to users. OpenAI said it first received a report of what it calls "covert underperformance" in Astra on August 20. The company then conducted targeted evaluations to investigate the behavior and determine its causes, noting that it had not observed the same issue in GPT-5.6 Sol. OpenAI says it received the first report of what it calls “covert underperformance” in Astra on August 20. The company then ran specifically designed evaluation experiments to determine the extent and cause of this behavior, noting that the issues were not observed in GPT-5.6 Sol.
A newly disclosed flaw involving OpenSSH and musl, dubbed "*sshole," allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password. The flaw only affects OpenSSH servers running on Linux distributions that use the musl C library, including Alpine Linux, OpenWrt, Buildroot, and Yocto, under certain authentication configurations. Security researcher Ozgun Kultekin, who discovered and released details on the vulnerability today, says the flaw has existed since 2016 and stems from how OpenSSH handles password verification errors on systems using the musl C library. Linux accounts can be configured to prevent password logins by replacing their password hash with an asterisk (*) in the /etc/shadow file. Because this is not a valid password hash, no password should allow access to those accounts.
A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. CWPdoor acts as a passive backdoor that sits dormant on the compromised system until the attacker sends a specially crafted request. Researchers at XLab, the cybersecurity research arm of QiAnXin Technology Group, describe CWPdoor as "exceptionally stealthy" due to its passive triggering and log suppression feature. CWP, formerly known as CentOS Web Panel, is an open-source web hosting administration solution similar to cPanel and Plesk that allows users to manage web servers and services such as email, DNS, and databases. According to XLab, more than 340,000 CWP instances have been exposed on the public web over the past month.
DigiCert warns it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents. The certificate authority says the breach affected a small portion of its archived customer data, including names, business email addresses, phone numbers, and business addresses. For some people, the exposed records also contained personal identification documents, such as driver's licenses, passports, and utility bills. DigiCert has begun sending data breach notifications to affected customers, with cloud architect Fabian Bader sharing a copy of the notification on X. "Thanks @digicert that your data leak was 'limited' to only my full PII data and potentially any verification documents I submitted for my certificate," Bader wrote.
Confirm this action.
Leaving now will discard your changes.