Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. Apart from emails, exposed data includes account creation date, last login timestamp, number of logins, and the IP address used at the last login. Capcom found that for a small subset of 43 accounts, dates of birth, gender, nicknames, and countries were also exposed. For another subset of 196 accounts, the hackers changed the CAPCOM ID login passwords in an attempt to lock the owners out, but the company took action and reset them. In an alert today, the gaming company says that passwords for all other registered members have not been exposed and that credit card information remained unaffected. Capcom is a Japanese video game developer and publisher known for franchises such as Resident Evil, Monster Hunter, Street Fighter, and Mega Man. The company has 4,000 employees and an annual revenue of $1.24 billion.
A critical Signal flaw could keep calls active after hang-up, exposing microphone or camera. Update to a fixed version immediately. A critical vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 of 10), in Signal ’s calling library could allow a malicious caller to interfere with call termination, potentially leaving the victim’s microphone and camera active after they believe the conversation has ended. The flaw affects versions before 2.72.0 of the library RingRTC, which the messaging app uses to provide voice and video calling. It highlights a security problem that deserves attention beyond a single messaging application: ending a call should be an immediate control action, not something that can be delayed by traffic coming from the other participant. According to the technical report published on GitHub, the vulnerability stems from how RingRTC handles events in the finite-state machine (FSM) that manages a call. The application places events in a queue for processing, but a malicious peer can flood that queue with events and prevent the local hang-up operation from being handled in a timely manner. “A local hang-up is not a kill switch: it is just one more event placed at the back of the call’s finite-state-machine event queue. The remote peer is trusted with that queue — there is no rate limit on peer-originated events and no priority lane for hang-up.” reads the technical report published on GitHub, “Flood the queue with junk and the hang-up waits behind attacker noise forever, so the call (microphone, possibly camera) is never torn down.” People expect that pressing the hang-up button ends the call and turns off the microphone and camera. But if the system is too busy processing other events, it may delay the command to end the call, leaving the audio or video active longer than expected. The report explains that someone taking part in a call could exploit this weakness by sending enough events to overload the system’s queue. This could stop the other person from ending the call properly, potentially keeping the microphone active and possibly the camera too. The underlying problem is not that Signal’s end-to-end encryption has been broken. Rather, it concerns the handling of call state and the reliable termination of a session. Encryption cannot protect users from every flaw in the software that controls when a communication session begins or ends. The vulnerability concerns RingRTC versions earlier than 2.72.0 and can affect Signal clients that embed a vulnerable build of the library. According to the CSIRT Toscana advisory, the affected application versions are Signal for Android before 8.27.0, Signal for iOS before 8.30.0, and Signal Desktop before 8.29.0. The official RingRTC fix and the comparison between versions 2.71.0 and 2.72.0 document the software changes. Users should install the latest available Signal release for their device rather than relying on the library version alone. The technical report also includes a conceptual Python proof of concept. It models the difference between a queue in which a flood can bury a hang-up event and one in which critical events receive priority. The demonstration is synthetic and offline, with no network activity or real calls, so it illustrates the underlying logic rather than providing a working exploit. This is an important distinction. The fact that the vulnerability has been made public does not mean attackers are already exploiting it. However, because it could expose private conversations, updating Signal promptly is a sensible precaution, especially for people who use it to discuss sensitive matters. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, mobile)
Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities dating back to October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches. "The exploit attempt originated from an IP address associated with a commercial anonymization network,
Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. The changes are part of Enhanced Protection in Safe Browsing, which Google claims makes users ten times safer from phishing, social engineering, notification abuse, and other scams compared with Standard Protection. Chrome is also adding a new "suspicious site" warning for pages that show deceptive patterns but haven't reached the confidence level required for its existing full-page red warning. "Suspicious site warnings notify users when a page exhibits deceptive patterns commonly associated with known malicious sites," the company explained. "By tailoring the warning UI in this way, we are able to safely expand our coverage to display a higher volume of protective warnings."
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to an SSH server made through Tor between October 1 and 5, after accepting the interception
Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. Always On VPN replaced the legacy DirectAccess technology and supports domain-joined, non-domain-joined, and Microsoft Entra ID–joined devices running Windows 10, Windows 11, and Windows Server. It runs in the background and establishes secure tunnels back to the user's corporate network whenever their device connects to the internet. Microsoft first acknowledged the issue in a service alert sent to IT administrators in late September, saying it was triggered on systems running Windows 11 24H2 and later after installing the September 2026 security updates when the initial Always On VPN connection failed (e.g., when using automatic protocol selection with IKEv2 and SSTP).
Google Cloud’s London outage disrupted Revolut payments and ATM withdrawals, while ING Germany reported online banking issues. Multiple Google Cloud services went offline in the London region this morning, according to Google’s status page, and the disruption didn’t stay contained to infrastructure dashboards. BREAKING: Revolut's app and cards have stopped working across Europe. Google Cloud's London region is affected by network failures. Revolut, and many other services, runs on Google Cloud. Revolut says money and data are safe but has not named a cause. pic.twitter.com/kyxOMlVaak — International Cyber Digest (@IntCyberDigest) October 20, 2026 British digital bank Revolut reported a widespread service outage at roughly the same time, and a person familiar with the matter told Reuters the two events were directly connected. “Multiple Google Cloud services experienced disruptions in the company’s London region on Tuesday, according to its service status page, while British digital bank Revolut also reported a service outage.” Reuters states, “A person familiar with the matter told Reuters that Revolut’s service outage was related to the Google Cloud service disruption.” The outage affected Google’s europe-west2 data center, its main facility in London. Google’s engineering team said they were investigating the problem. Alphabet did not immediately respond to Reuters’ request for more information. This is common during an ongoing incident, but it leaves customers unsure when their cards will work again. Revolut’s own status page showed most services as unavailable or partially unavailable, including card payments and ATM withdrawals. For a bank that exists entirely as an app with no physical branches to fall back on, that’s not a minor inconvenience. “We are currently experiencing a service disruption affecting multiple services. We can confirm that all our customers’ money and data are safe. We’ve been working to fix the issue since it was identified this morning and apologise to anyone affected and for any inconvenience.” the financial company wrote on X. We are currently experiencing a service disruption affecting multiple services. We can confirm that all our customers’ money and data are safe. We’ve been working to fix the issue since it was identified this morning and apologise to anyone affected and for any inconvenience… — Revolut (@Revolut) October 20, 2026 That last sentence is the right thing to say, and it’s also exactly what every bank says during an outage regardless of whether the underlying cause is confirmed. Money and data being safe is a different question from whether you can pay for your coffee. ING Germany also reported problems on Tuesday. Customers had trouble logging into online banking and the mobile app because of a technical issue. Reuters did not link these problems to the Google Cloud outage, and ING has not explained the cause. Two major financial services companies experiencing problems on the same morning could be a coincidence. However, it also raises questions about how much European banks depend on a small number of cloud providers. Google Cloud’s europe-west2 region in London supports many UK and European fintech services. Revolut alone serves tens of millions of customers across Europe. When a major data center goes down, the impact can quickly reach customers, preventing them from paying or accessing banking services before the cause is fully understood. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Revolut)
Fintech company Revolut is working to resolve a massive outage that disrupted most of its services worldwide earlier today. Since the incident began, thousands of users on the Downdetector outage tracking platform have reported issues with the Revolut app, mobile banking services, and transferring funds between accounts. In a statement today, the company said the outage has affected its services since Tuesday morning and added that customers' data and funds are safe. "We are currently experiencing a service disruption affecting multiple services. We can confirm that all our customers' money and data are safe," Revolut said. "We've been working to fix the issue since it was identified this morning and apologise to anyone affected and for any inconvenience caused." On its official status page, the company says the outage affects 28 services, including sign-ins, card payments, transfers, currency exchange, stock trading, and live support chat, which are now flagged as partially unavailable.
The UK Electoral Commission is building an AI system to alert candidates to damaging deepfakes within three hours. The UK’s Electoral Commission is building an AI-powered system to tell candidates about significant deepfakes within three hours of posting. Its chief executive, Vijay Rangarajan, said so at a panel at the Conservative Party’s annual conference last week, as Tech Policy Press points out that it’s a rare public intervention from a man who has run the regulator since 2024 and who mostly speaks to Parliament in evidence sessions. He began with an example from another country. During Ireland’s 2025 presidential election, a deepfake video falsely showed candidate Catherine Connolly saying the election had been cancelled and that she was withdrawing from the race. The video also urged her supporters not to vote. None of this was true, and Connolly went on to win the election. Rangarajan said a similar video during a UK election could influence a significant number of votes. However, he stressed that the Electoral Commission has clear limits to its role. It does not settle disputes over political claims made during a campaign. Its focus is on false statements that could disrupt the election process itself. ““If that happens to the British election, that will move a significant amount of votes,” he said, adding that it was not the Electoral Commission’s role to arbitrate rival claims made by candidates during the cut and thrust of a campaign, but rather to focus on statements such as this one that could undermine the administration of the election itself. “To address that risk, the commission conducted a pilot program during the UK’s local elections in May 2026, Rangarajan said. “We ran a full pilot, analyzed about three million posts through an AI,” he explained. “So, this is a good example of how AI can work: 147 bits of content were flagged. Humans then looked at those — not a terribly pleasant job in some cases — ten were really quite misleading, and we referred to the social media companies or to the police.”” Tech Policy Press reports. The Commission has tested the idea. During the local elections in May 2026 it ran a full pilot, and an AI analyzed about three million posts. It flagged 147 pieces of content, humans reviewed them (he called that unpleasant in some cases), and ten were really quite misleading, so they went to the social media companies or the police. Rangarajan said the posts had little impact. However, the trial showed that the Electoral Commission now has a system to help voters, journalists and political parties deal with deepfakes. He expects attempts to use them to disrupt UK elections. The pilot began earlier in 2026 and monitored fake audio and videos designed to mislead voters about the election process or falsely show candidates doing or saying things. The Commission said it would publish the results. The system has a clear focus. Identifying and prosecuting the people behind deepfakes can take weeks or months, often long after an election. Instead, the Commission aims to act without first identifying who created the content. AI scans social media posts in real time and flags suspicious material for human review. If a post meets the required criteria, the Commission alerts the relevant candidates or parties, ideally within three hours of its first appearance. Rangarajan said this is roughly the time it takes for content to go viral. That narrow scope has edges. Full Fact, whose AI tools were monitoring more than a thousand candidates in the May elections, found a Glasgow candidate’s campaign videos built with AI. The Commission told Full Fact the clips fell outside its pilot because each was labeled an illustrative AI scene, even though the label sat at the end of the caption. The legal backdrop is the real problem. Rangarajan said the Commission was set up for money and people, and now it’s all about information, so it has to work out how laws from 1983 or 2000 apply in 2026. Earlier this year the Guardian reported, according to a summary on the Resilient Media for Democracy Observatory, that the Commission was seeking legally enforceable takedown powers from the government. Then there’s the part with no legal answer at all. Rangarajan said he believes at least one social network showed signs of algorithmic bias at election time, though he didn’t name it. His scenario is a platform that changes its recommendations during an election without warning, suggesting neighbors with one political view and suppressing others, so users think their neighbors have changed their minds. The Commission believes it has already detected some algorithmic bias in social media campaigns, but Rangarajan said UK law offers no clear solution. Experts and campaigners have also raised concerns about X’s role in UK politics and TikTok’s Chinese ownership. The Commission faces 30,000 to 40,000 cyberattacks a month, sometimes reaching 10,000 a day, including botnet attacks and phishing. Rangarajan wants stronger, more independent security capabilities and believes major social media monitoring could be handled by another body. Tech Policy Press sees his comments as a call to update election laws and possibly create new offenses. The next general election must take place by August 2029, but it could be called earlier, and it remains unclear whether lawmakers will act in time. For now, what the Commission has is a three-hour promise and a pilot that worked at small scale. Rangarajan describes the threat it’s meant for as “an absolutely certain attempt to use some of these deepfakes against the UK.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Deepfakes)
A Broadcom Wi-Fi flaw dating back to 2010 allows attackers within Wi-Fi range to execute code on vulnerable routers without authentication. Researcher Quentin Kaiser presented a talk at Hexacon in Paris documenting a vulnerability in Broadcom’s proprietary 802.11 implementation that has been present in their SDK since at least 2010. The bug allows an attacker to get unauthenticated remote code execution on affected routers without knowing the WiFi password or going through the normal WPS setup process. As of October 15, 2026, none of the affected devices in Belgium had received a patch. “A vulnerability affecting Broadcom’s proprietary implementation of 802.11 has been present in their SDK since at least 2010. An incomplete patch was silently released in 2018, followed by Broadcom’s recommendation to move to hostapd instead, making it a definitive forever day on eCos-based platforms (BCM3380, BCM3383, BCM33834) and a potential forever day on Linux platforms (BCM3390, BCM65xx, BCM68xx) unless affected Original Equipment Manufacturers (OEMs) are willing to migrate.” states Kaiser. “The vulnerability can be triggered remotely over WiFi without knowledge of the network key or completion of a normal WPS enrollment. Exploitation provides controlled information disclosure and arbitrary code execution.” The vulnerability affects the WPS EAP reassembly code, which handles part of the wireless setup process used by many consumer routers. An attacker within Wi-Fi range can exploit the flaw without knowing the Wi-Fi password, completing the setup process, or requiring any action from the user. The attack can expose information and allow the attacker to run code on the router. In his demonstration, Kaiser extracted the Wi-Fi password from the router’s memory and sent it over the wireless connection. He then used the password to connect to the network. These attacks are not just theoretical. Kaiser demonstrated working exploits against two devices: the Orange Belgium ASKEY TCG3000 and the Proximus Sagemcom F@st/BBOX3V+. Both allowed an attacker to run code without authentication. In one demonstration, the attacker opened a reverse shell using only Wi-Fi frames, without needing a command server accessible over the internet. The attack can work from a distance. The close antenna placement shown in the video was only for the laboratory setup and is not a requirement for the attack. In the video below, Kaiser exploited an Orange Belgium router (ASKEY TCG3000). The attack allowed him to run code on the device without authentication. The code retrieves the Wi-Fi password (PSK) from the router’s NVRAM and sends it back to the attacker over Wi-Fi. He then used the stolen password to connect to the network, confirming that the exploit works and that the password is correct. Do not be misled by how close the antenna is in the video. The attack can work over much longer distances. In the next video, the researcher exploited a Proximus router (BBOX3V+, also known as Sagemcom F@st). This attack also allows code execution without authentication. He used it to open a reverse shell over Wi-Fi frames, without needing a command-and-control (C2) server hosted in the cloud. Broadcom quietly released an incomplete fix in 2018, then told customers to migrate to a different software stack entirely rather than shipping a complete patch for their own code. On eCos-based platforms, covering chipsets like BCM3380, BCM3383, and BCM33834, that makes this a permanent unfixable bug by design. On Linux-based platforms (BCM3390, BCM65xx, BCM68xx) the situation depends entirely on whether individual manufacturers decide to act. Kaiser reported the bugs to Broadcom in July 2026. Broadcom said a patch was available and told him to ask the affected device manufacturers to contact Broadcom directly. The company refused to assign a CVE or share the notification it had sent through its customer portal. CERT/CC opened a case but closed it the same day after confirming that Broadcom could assign CVEs itself and had no intention of doing so. This was not a proper disclosure process. It was a dead end, with a paper trail. Kaiser’s rough calculation, done with Belgian telecom market data, puts the affected device count at around 850,000 for Proximus, 500,000 for VOO’s legacy fleet, and 210,000 for Orange Belgium, totalling somewhere north of 1.5 million potentially exposed gateways in one small country. Telenet may also be affected through Sagemcom devices but Kaiser couldn’t confirm because he couldn’t get hold of one. The affected manufacturers sell into markets well beyond Belgium. The chipsets in question appear in devices across dozens of vendors and hundreds of products worldwide. Kaiser is publishing a fingerprinting script and a YARA rule specifically to help map the full scope of affected deployments, because right now nobody has a complete picture. A vulnerability introduced in 2010 and only partly fixed in 2018 still affects routers in use today. Kaiser says AI-assisted analysis helped him find the bugs in less than a week, instead of months. This can help defenders find vulnerabilities faster, but attackers can do the same. The risk is greatest in targeted attacks where an attacker is within Wi-Fi range, such as hotel network attacks or surveillance of nearby targets. Compromised routers are difficult to monitor, and attackers can quietly intercept or collect network traffic. Most users and security teams rarely check the firmware on ISP-provided routers. “Although I could have done this research by myself, it would have taken me months to get there. With AI frontier models it took me less than a week.” Kaiser concludes. “Which is a good thing because we can start looking into deeper and deeper layers of our technical infrastructure for a fraction of the cost.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Broadcom Wi-Fi)
Confirm this action.
Leaving now will discard your changes.