The BBC plans to use emergency FM radio to keep the UK informed during prolonged blackouts, with a self-sufficient studio ready for 72 hours. If electricity fails across the UK for days, the BBC says it has a plan to keep people informed. David Sillito, the BBC’s media and arts correspondent, explained the strategy in a BBC News report, starting with the 2015 Lancaster floods and ending with a simple lesson: when digital infrastructure fails, FM radio may be the most reliable way to reach the public. On December 5, 2015, the River Lune flooded Lancaster, cutting electricity to 61,500 people. Roger Kemp, an engineering professor at Lancaster University specializing in safety and electrical systems, was watching television when the power went out. The following day, he described the scene to the BBC as almost resembling a zombie movie, with residents searching for phone reception and queuing at the only working telephone box. Homes lost heating and lighting, while some water supplies stopped because their pumps depended on electricity. Railway stations, petrol stations and shops closed, cash machines stopped working, and traffic lights failed. Only two communication systems remained operational: copper landlines and FM radio. Local station The Bay continued broadcasting using an emergency generator and a single landline. Kemp’s subsequent report highlighted the irony: a society increasingly dependent on digital infrastructure had relied on technologies dating back decades to receive essential information. The incident illustrated the risk of a wider catastrophe known as a Black Sky event, in which electricity, water, shops and communications fail simultaneously. At a recent UK resilience summit, discussions focused on maintaining essential services for at least 72 hours. One expression often heard in civil contingency circles, “nine meals from anarchy”, captures the concern that three days without food could turn an emergency into widespread disorder. “We are nine meals from anarchy” is a phrase often heard in the civil contingency world. A brutal reminder of the fear that three days without food would be enough to turn a crisis into chaos. If a Black Sky event takes out electricity, water, shops and communications, there is a good reason the government wants us to have our own supplies.” BBC states. “In a major emergency, we are being told to hunker down and turn on an FM radio, as thousands did in Lancaster. This is why the BBC has its own Black Sky plan.” The government’s Be Ready campaign warns that severe weather and cyberattacks could disrupt essential services, although it says there is no specific threat to the electricity grid. According to government advice reported by the Express, households should maintain at least three days of food and drinking water and keep a battery-powered FM radio. Sillito also recommends a hand-cranked radio that can generate its own power. The BBC’s contingency plan revolves around precisely this technology. Around 100 people would operate a dedicated emergency radio studio, equipped with secure communications independent of the internet, alongside enough fuel, water and food to survive at least three days without resupply. Reports published by French outlet Telesatellite and Open magazine on November 7 describe a self-contained studio, generators powering transmission facilities and FM radio as the fallback communication channel. Only a small number of BBC staff know the complete details. The studio would broadcast pre-prepared government announcements, with scripts already published online. These include practical instructions on daily water consumption and disposing of toilet waste when flushing is impossible. Additional reporting would come from satellite vehicles and journalists stationed at emergency centres across the UK. Transmission towers, disconnected from the internet, would use diesel generators and storage tanks ranging from 5 to 40,000 litres, providing approximately three days of power. Satellite phones would support communications between teams, with agreed meeting points and procedures if those systems also failed. FM radio remains central because it can reach almost everywhere, even during a major blackout or disruptive cyberattack. The BBC’s planning assumptions have evolved. An insider told Sillito that the original scenario considered outages lasting five to seven days, while the latest advice from the National Energy System Operator suggests electricity could return within two to three days. The corporation’s contingency arrangements have surfaced before. In October 2022, media reports described leaked draft scripts for a national blackout, including half-hourly Radio 4 updates from an emergency broadcasting centre at an undisclosed rural location. There is, however, a discrepancy in the Express report, which claims that only around 100 people worldwide know the full details. The BBC says approximately 100 people would operate the emergency studio, while only a small number have access to the complete plan. Concerns about grid resilience are not new, but the massive blackout affecting Spain, Portugal and south-western France in April 2025 renewed attention to the issue. Lord Harris, chair of the National Preparedness Commission, argues that the consequences extend well beyond losing electricity. Water supplies could stop because pumping stations need power, while sewage systems could become blocked when water can no longer circulate. Governments across Europe increasingly advise citizens to maintain emergency supplies, and Harris believes the UK has been slow to prepare its population. Some initiatives are already underway. ARIA, the government’s Advanced Research and Invention Agency, is investing £70 million in high-altitude aircraft designed to provide at least a week of emergency mobile and internet connectivity over the UK. Programme director Rico Chandra has warned that satellites alone have limitations when terrestrial networks fail. Harris argues that decades of efficiency-driven decisions have gradually removed essential redundancies. One example is the migration of emergency services from dedicated radio systems to mobile network technology, potentially exposing their communications to the same outages affecting the public. The government maintains that the transition to 4G and 5G provides reliable and resilient communications. “The UK has one of the most resilient electricity systems in the world, and there has never been a complete outage in the grid’s 75-year history.” The Cabinet Office states describing the UK electricity system. Government efforts to improve resilience predate the current debate. In May 2024, then deputy prime minister Oliver Dowden launched the previous Conservative government’s disaster preparedness initiative. During his investigation, Sillito also reconsidered the BBC’s isolated transmission infrastructure. What initially appeared outdated became a strength: independence from the internet could help keep broadcasting alive when digital networks collapse. Yet the UK is preparing to switch off its copper landline network on January 31, 2027, while the future of FM radio is also under review. The government’s position is that copper landlines, although useful during power cuts, have become unreliable and increasingly difficult to maintain. Kemp is less convinced that the country is moving in the right direction. Asked whether his report had improved national preparedness for a Black Sky event, he argued that the planned landline shutdown showed little consideration for how people would communicate during a prolonged power failure. Sillito experienced a smaller reminder while preparing his report: a power cut in his own street, leaking torch batteries, missing candles and an emergency radio he could not find. His conclus: “If anything, we’ve gone backwards,” he said. “Switching off the public switch telephone network, I think shows that there has been really no thought at all about how you communicate when you’ve no longer got power.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, BBC)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks. The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement
Brenner Base Tunnel SE confirms a breach and Everest claims 812 GB. What we know, what we don’t, and why overblown alarm helps propaganda more than the attackers. Brenner Base Tunnel (BBT) SE, the company building the Brenner Base Tunnel between Italy and Austria, has confirmed that unauthorized people accessed some of its data. The extortion group Everest claims it took 812 GB of files. Nobody has verified that, and a criminal bragging about file sizes isn’t an audited source. The timeline is thin. The intrusion reportedly dates to mid-October, Everest’s claim to 17 October, and the Austrian press broke the story on 6 November. On 7 November BBT SE told ANSA that operations are unaffected, the systems involved are isolated, and outside forensic experts and the authorities are on the case. If real and current, drawings, surveys and site procedures would save an attacker a lot of reconnaissance. Together they could show how the infrastructure fits together, and fraudsters could borrow project names to fool contractors. Those are scenarios, not sightings. Dates matter too. The tunnel won’t open before 2034, at a projected cost of about €11.7 billion, so older drawings may describe a design that has since changed. Knowing how a tunnel is built does not mean being able to control it. Sabotage requires access to operational systems and weaknesses that attackers can exploit. So far, there is no evidence that attackers accessed industrial systems or tampered with the tunnel’s control functions. BBT SE has not confirmed any encryption of its systems either. Claims that ransomware could stop the tunnel therefore have no factual support. Everest is a Russian-speaking cybercriminal group. ZeroFox has also noted that the group tends to exaggerate the amount of data it steals. Speaking Russian and operating within a Russian-speaking cybercrime environment does not prove that the group is directed by the Russian state. In July, the same group demanded CHF 10 million from Stadler Rail after using stolen credentials to access a supplier’s data platform. Production continued despite the incident. The response should focus on practical security measures. Organizations need to identify which information was exposed, revoke potentially compromised credentials, keep document management systems separate from industrial control networks, and warn suppliers about fraudulent requests. Whether NIS2 applies to a project company that is still under construction depends on its activities and the relevant national legislation. There is no benefit in creating unnecessary alarm. It only helps the attackers and anyone trying to exploit the incident for an influence campaign. Blaming Moscow without evidence would play directly into propaganda efforts. There are three key questions that need clear answers: which files were actually stolen, how recent and relevant they are, and who might still be able to use them. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Brenner Base Tunnel)
Hunt.io traced ARTEX servers and AI-powered hacking tools used in breaches affecting seven South Korean financial institutions. Between late September and early October 2026, seven South Korean financial institutions had data breached through internet-facing systems. About 66,000 to 67,000 people and around 2,200 corporations were affected, and personal, employment, income and loan data was exposed. Hunt.io dug into the infrastructure behind the campaign, and its findings add a lot to what CrowdStrike and Genians already published. CrowdStrike reported on October 7 and Genians Security Center on October 12, and both pointed to ARTEX, an open-source autonomous penetration testing framework developed in China and licensed under AGPL-3.0. CrowdStrike assessed with moderate confidence that a single Chinese-speaking individual motivated by money ran it, and not an established threat group. DeepSeek v4.1 Flash was the main model, with GLM 5.3 and Grok 4.6 as backups, reached partly through a reseller domain, xcai[.]pro. The public indicators were a server at 38.244.50[.]120, which hosted the ARTEX console, plus a Hong Kong address and nine proxies. Genians said the ARTEX GitHub repository and Docker image were removed on October 11, though forks and mirrors remain. “CrowdStrike assessed with moderate confidence that the operator was a single Chinese-speaking individual motivated by financial gain rather than an established threat group.” reads the report published by Hunt.io. “The infrastructure reportedly accessed these services in part through the reseller domain xcai[.]pro. Both reports described a two-server configuration, consisting of a Hong Kong-based IP address used as primary infrastructure and 38.244.50[.]120, which hosted the ARTEX console.” Hunt.io notified the relevant national CERT before publishing, and says the report holds no personal records or credentials. The company’s own scanning showed 38.244.50[.]120 sits on Cogent’s network in Los Angeles, with 15 open ports. The ARTEX login page, with a Chinese title meaning “autonomous penetration testing console”, appears on ports 443 and 8090. Other services include a Gemini2API admin console and a Tinyproxy server. Searching its AttackCapture platform for that address, Hunt.io found another open directory at 23.248.226[.]250, a jump server in Hong Kong on AS138415. It held 42 files in 2 subdirectories, 105 MB in all, and the platform had logged warnings on September 5, September 26 and October 5. A file in it names 38.244.50[.]120 as the jump host, and its own comment tells the operator never to paste the credentials into a session. It sat in an open directory. Three scripts back up the link. They keep reverse SSH tunnels alive, run a local relay, and copy files to the jump host, one tunnel is named grok2api, and the credentials file also holds keys for Zhipu AI’s GLM models, an OpenAI-compatible relay and a proxy service. That explains how several language models ran in one campaign. The AI setup is the most striking part. A state file shows the harness is Claude Code itself, version 2.1.221, started 510 times since August 4, but it isn’t talking to Anthropic. A small proxy, ds-models-shim.py, fixes a compatibility problem by faking a model list and sending requests to DeepSeek, and another, xcai-effort-shim.py, adds a reasoning setting because the DeepSeek backend otherwise skips its reasoning step. The route runs from Claude Code through Claude Code Router, an open-source project, to xcai and then to DeepSeek. “A small local proxy, ds-models-shim.py, addresses a compatibility issue: the official /v1/models endpoint returns a 404 response when queried against a non-Anthropic backend, preventing Claude Code from discovering the available models. The shim intercepts that specific request and returns a locally defined model list containing deepseek-v4-pro and deepseek-flash. All other requests are forwarded to api.deepseek.com/anthropic.” states the report. The same file counts 19 custom skills, reusable instruction sets for the agent, with 147 recorded uses. They cover code audit, reconnaissance, web injection, WAF bypass testing, authentication testing, Telegram Mini Apps, APK download and decompiling, cloud phone control and payment logic testing. Next to the payment skill sat three self-registered test accounts with tokens for a cash-in deposit API, dated September 12, and a comment calls them an authorized, self-built test. The setup fits testing for insecure direct object reference flaws, a technique CrowdStrike and Genians described against Korean loan and inquiry services. The directory also held supporting tools. A script queried FOFA, a Chinese asset search engine like Shodan, through a third-party API, and a comment says the primary membership had expired and a backup key was in use. Proxy scripts enumerated a rotating proxy service at 154.201.79[.]246:443, where 79 unique exit IPs showed up among the first 100 identities tested. A separate directory at 23.248.226[.]250:8001 held a small staged setup for JNDI and LDAP exploitation, retrieved on October 5 at 03:42 UTC. It confirms command execution through a DNS callback, and one script lets web and LDAP traffic share a single port. Hunt.io’s analysis describes the tooling without publishing steps to reproduce it. Other recovered files include tools aimed at a cryptocurrency exchange’s admin session and withdrawals, Linux privilege escalation exploits, iOS probe source code and Android kernel and firmware utilities. Hunt.io says their connection to the Korean breaches isn’t confirmed. Hunt.io then showed how to hunt ARTEX servers. Searching for an ARTEX certificate issuer returned 19 IP addresses, and searching its malware classification returned 1,303 addresses across 30 countries, led by the United States, China and Hong Kong. Those figures show where addresses are registered, not where the operator sits. “The result returned 19 distinct IP addresses, including 38.244.50[.]120. This method is precise but limited to hosts that expose a matching certificate. Systems using a different certificate will not appear in these results.” continues the report. Matching the console’s page title returned about 1,300 IPs, and a looser search found 21 title strings, 19 of them likely ARTEX consoles, in English, Chinese, Korean, Japanese, Russian, Portuguese and Vietnamese. A malware-name search in AttackCapture gave 280 results with open directories. One at 130.94.31[.]86:18888 in Seoul held two small scripts, and another at 156.251.11[.]39 held an SMB reconnaissance toolkit whose test script writes a file named artex_probe_11876.txt. More hosts held exploitation kits for DedeCMS and FangCMS, a CAPTCHA bypass suite, a RuoYi and Spring administrative console exploit and CAPTCHA-based login automation. Together they show the framework attracting many operators. For defenders, the advice is plain. Remove public access and put administration behind VPNs or allowlists, and reset SSH passwords and rotate API keys, proxy credentials and tokens that exposed files may have revealed. Patch internet-facing services, watch for unexpected LDAP and JNDI activity, DNS callbacks and remote script downloads, and store secrets in a managed vault with least-privilege permissions. Also restrict access to model gateways, watch their requests, and enforce compliance rules on managed phones. Hunt.io’s lesson is that an investigation shouldn’t stop at the first list of indicators, because The company also published indicators of compromise in its analysis. “The findings highlight risks associated with exposed administrative services, reusable credentials, remote access tunnels, proxy infrastructure, and exploitation tooling.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ARTEX)
French cooperative bank Crédit Mutuel Arkéa was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to respond by suspending certain systems. The bank says that the attacker used its own account to initiate transactions to other banking organizations, but customer assets remain unaffected. Crédit Mutuel Arkéa is a major French banking group with more than 5.8 million members and 211.5 billion euros in assets. Reports about the incident emerged on November 2, initially from blockchain fraud investigator ZachXBT, who warned of a large-scale unauthorized withdrawal from multiple centralized exchange accounts occurring a day earlier. According to the investigator, the attacker may have stolen up to 118 million euros ($133 million) and withdrawn it as USDC and USDT stablecoins.
Scammers are impersonating major brands and celebrities to lure consumers into fake gift card giveaways that collect personal information and trigger unwanted subscriptions. CTM360 reveals how these campaigns use deceptive verification steps and affiliate networks to generate revenue without delivering the promised rewards.
U.S. CISA adds SonicWall SonicOS SSLVPN vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SonicWall SonicOS SSLVPN flaw, tracked as CVE-2026-19868 (CVSS score of 7.5), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-19868 is an authentication bypass vulnerability affecting the SSL VPN service in SonicWall SonicOS. “An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).” reads the advisory. The flaw occurs when the system does not properly enforce SAML authentication controls. An attacker who already has valid credentials for an alternative authentication method may exploit this weakness to bypass SAML-based authentication. The impact is particularly serious when organisations rely on SAML to enforce multi-factor authentication (MFA). Successful exploitation may allow an attacker to access the SSL VPN without completing the expected SAML authentication process, potentially bypassing the additional MFA protection. In practical terms, the vulnerability could weaken an organisation’s remote access security by allowing users with alternative valid credentials to circumvent its intended authentication controls. It’s important to highlight that this is not an unauthenticated remote access vulnerability. The attacker needs valid credentials for an alternative authentication method, but may then bypass SAML-enforced security controls. SonicWall’s PSIRT team is investigating a report of possible exploitation of this flaw. The company strongly recommends that customers install the latest available update as soon as possible to reduce the risk of attacks. “SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.” reads the advisory. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by November 20, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks. The vulnerability, tracked as CVE-2026-19868, allows attackers with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication (MFA). The flaw has a CVSS severity score of 7.1 and only affects SonicOS SSL-VPN services configured to use SAML authentication. In a security advisory published Friday, SonicWall warned that it had investigated a report that the vulnerability was exploited in an attack and urged customers to install the latest security updates. "SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks," the company warned.
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file. Software security company Apiiro said yesterday that 1,122 public
WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked the company.
Confirm this action.
Leaving now will discard your changes.