Burger King Japan disclosed a breach exposing 11.18 million app users’ personal data after attackers accessed its membership system in early October. Burger King Japan has disclosed a data breach that exposed the personal information of approximately 11.18 million official app members. Burger King Japan, the company operating the fast-food chain in the country, said attackers accessed the system managing customer membership information between October 2 and October 7, 2026. The company disclosed the incident on October 15, after discovering the data leak two days earlier. In its official notice published on October 15, the company confirmed the unauthorized access and apologized to affected customers. The announcement doesn’t identify the attackers or explain how they gained access. BK Japan says it’s working with external security specialists to determine the cause. “We have confirmed that customer membership information from the official app has been leaked externally following unauthorized access by a third party.” reads the data breach notification. The compromised data includes membership IDs, email addresses, names in Japanese characters and kana, phone numbers, dates of birth, gender, prefecture of residence, and membership registration type. The exposed information also indicates whether a customer has a mobile ordering history and whether their email address has been verified. These details can be useful to criminals even without payment data or passwords. Attackers can use them to craft convincing phishing emails, text messages, or phone calls that refer to a customer’s real identity and relationship with Burger King. A message that includes a person’s name, phone number, and other accurate details may look far more credible than a generic scam. Burger King Japan confirmed it does not store credit card numbers and found no evidence that passwords were exposed, with no confirmed cases of fraud so far. However, these factors do not completely rule out the risk of future misuse. According to the company, unauthorized access took place from October 2 through October 7, and the leak was confirmed on October 13. BK Japan says it blocked access from the source of the unauthorized communications as soon as it became aware of the incident. The company has also introduced temporary countermeasures, established an incident response team, and reported the breach to Japan’s Personal Information Protection Commission. It says permanent security improvements, further investigation with external specialists, and email notifications to affected customers are ongoing. “At present, we have confirmed that the unauthorized access was carried out by a third party.” continues the notification. The company has not yet disclosed the precise circumstances that made the intrusion possible, and the investigation is continuing. Until more details emerge, it’s too early to draw conclusions about the initial access vector or attribute the attack to a particular threat actor. Large-scale data breaches create long-lasting risks for follow-on attacks, as criminals can use stolen details for phishing, impersonation, and highly convincing scams. BK Japan urges customers to stay vigilant against fraudulent emails, texts, and calls, warning them never to click unverified links or share sensitive credentials. The core danger is that attackers no longer need network access to cause harm; they can leverage existing stolen data to target customers directly through social engineering. “Please do not access URLs, open attachments, or enter membership information or passwords if you receive a suspicious communication.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Burger King Japan)
PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, evade detection inside FortiOS memory, and maintain stealthy access. PEERSTITCH, a stealthy implant deployed during a prolonged intrusion, helped attackers maintain access to a telecom managed service provider after compromising its FortiManager appliance. Palo Alto Networks Unit 42 documented the operation, which began in September 2024 and exposed credentials and configurations for more than 500 downstream firewalls. “Unit 42 investigated a multi-stage network intrusion against a telecommunications organization that occurred in September 2024, which we are tracking as cluster CL-STA-0954 (aka UNC5820). The attackers behind CL-STA-0954 achieved an initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance.” reads the report published by Palo Alto Networks. “From that single appliance, our observations are that the attackers exfiltrated an archive containing running configurations, cryptographic material and database files containing information about more than 500 managed FortiGate firewalls. Those firewalls protected the target’s own infrastructure and the networks of its clients.” The initial access relied on CVE-2024-47575, known as FortiJump, which allowed an unauthenticated attacker to register a rogue virtual device with the central management platform over TCP port 541. Within minutes, the attackers extracted a configuration archive containing serial numbers, public IP addresses, routing tables, VPN credentials, and cryptographic trust material for every managed firewall. One compromised management system had effectively handed them the keys to hundreds of networks. The targeted 500 devices didn’t all belong to the same organization. They protected the managed service provider’s infrastructure and its clients’ networks. The attackers got running configurations and private keys for firewalls belonging to organizations that had no idea any of this was happening. Unit 42 was clear about the scope: the investigation covered only the provider’s own environment, not the downstream clients. Armed with decrypted credentials from the stolen configuration files, which stored passwords as reversible ciphertext, the attackers then established unauthorized SSL/VPN sessions into internal network management segments from external staging addresses. That’s the moment reconnaissance turned into active access. In the second stage, attackers exploited CVE-2025-61624, a path traversal flaw in the FortiOS auto-script engine, to deploy a new implant called PEERSTITCH. The implant is a 64-bit ARM64 binary written in C, but what it does is unusual. Unit 42’s researchers put it plainly: “PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections. Instead, it communicates through traffic generated by legitimate processes on the infected host, which makes the malware resistant to conventional endpoint and network detection.” the report continues. “The attackers also impersonated the FortiManager platform to pull from managed firewalls of other hosts in the targeted network.” Instead, it injects itself into two legitimate FortiOS daemons, the logging process and the VPN service, and creates a covert communication bridge between them using memory that’s already allocated to those running processes. When traffic passing through the logging daemon matches two specific markers, a port number embedded in data and a link-local IP address, it extracts a session token and writes it directly into the VPN daemon’s memory using Linux’s /proc filesystem. When the VPN daemon processes a subsequent session carrying that same tag, it takes an alternate execution path, bypassing FortiOS security checks entirely. PEERSTITCH is hard to detect because it leaves no persistent file on disk, opens no listening ports, and initiates no outbound network connections. The only way to detect it is by inspecting live process memory for anomalous read-write-execute (RWX) regions in the two targeted daemons or identifying NOP patches at specific offsets in their code. Fortinet’s Integrity Checker Tool cannot detect the implant because it scans files on disk, which remain untouched. The attackers also established a secondary command channel by abusing Apache’s built-in certificate management module on the firewalls. They embedded shell commands in the domain name field of certificate validation requests and configured Apache to retry them continuously, creating a persistent outbound reverse shell through a legitimate system process. Before running their malicious auto-scripts, the attackers killed the logging and syslog daemons to suppress any trace of what was about to happen. Crash logs were wiped. Rogue administrator accounts and script objects were automatically deleted shortly after execution. The malicious ACME configuration file was overwritten with innocent-looking text. The PEERSTITCH injector unlinked its own binary from disk after completing execution. “The cryptographic trust material governing the platform’s relationship with every managed device leaves with the attacker and remains valid until it is rotated. Defenders must treat edge management interfaces with the highest level of zero trust isolation.” Palo Alto Networks states. “They must also treat the credentials and certificates those interfaces hold as compromised the moment the platform is.” Patching FortiManager doesn’t reverse the data theft. The stolen cryptographic keys remain valid until the trust material on every managed device is individually rotated. A firmware update alone won’t invalidate them. The broader lesson goes beyond Fortinet: management platforms are high-value targets because compromising one can expose an entire network. As Unit 42 noted, “the management platform is the highest-value target on the network.” When that platform belongs to a managed service provider, a single breach can affect hundreds of downstream customers, turning a local compromise into a supply-chain security incident. “For organizations that manage infrastructure on behalf of others, the management platform is the highest-value target on the network. Compromising the management platform is not contained by the boundary of the organization that owns it.” the report concludes. “That compromise also does not end when the platform is patched.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, PEERSTITCH malware)
In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally. Others, like Laya, are
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability Cisco confirmed this week that threat actors are exploiting a critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76519 (CVSS score of 9.8). An attacker can exploit the flaw by sending a crafted email attachment through the gateway and, if it lands right, writing arbitrary files to the underlying operating system. The flaw CVE-2026-0322 (CVSS score: 8.6) is a high-severity code injection vulnerability in the management interface of Palo Alto Networks PAN-OS. It could allow an authenticated attacker with network access and high-level privileges to execute arbitrary code with root privileges on an affected firewall. The vulnerability affects PA-Series and VM-Series firewalls and Panorama appliances. Palo Alto Networks confirmed that limited exploitation has been observed targeting the management interface. The company recommends restricting access to trusted internal IP addresses and installing the relevant security updates. The flaw CVE-2026-105133 (CVSS score: 5.5) is an improper authentication vulnerability in AhsayCBS, a backup management platform. The flaw affects the checkSysPwd function in the product’s API and could allow a remote attacker to bypass authentication by manipulating the random parameter. Starting on October 7, 2026, attackers used it to bypass authentication before exploiting a second vulnerability, CVE-2026-105134, to execute commands on affected servers. Huntress reported that at least five organizations had been targeted by October 8. The flaw CVE-2026-105134 (CVSS score: 9.3) is a critical operating system command injection vulnerability in the Replication Receiver component of AhsayCBS. The flaw affects the /rps/api/json/UpdateReceivers.do endpoint and could allow an unauthenticated remote attacker to execute arbitrary commands on the underlying system. The vulnerability is being actively exploited in the wild. Attackers have chained it with CVE-2026-105133 to gain remote code execution with NT AUTHORITY\SYSTEM privileges, deploy JSP web shells and install XMRig cryptocurrency miners disguised as Microsoft Edge processes. Huntress observed attacks against at least five organizations by October 8, 2026. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaws by October 17, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
A proxyjacking campaign has impacted devices in 34 countries, monetizing victims’ internet connections through a commercial residential proxy network. The operator installed Pawns.app, a legitimate bandwidth-sharing application that lets users earn money by sharing their internet connections, on devices without the owners’ consent. Pawns.app account holders are rewarded for allowing traffic from other users to flow through their network, provided it runs on trusted, non-blocking IP addresses. By installing the app on multiple systems, the attacker likely accumulated larger payouts. Threat intelligence company GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization, and identified at least 143 compromised devices worldwide. According to the researchers, the attacker leveraged several vulnerabilities to breach edge devices and install the Pawns.app software:
The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978. The agency employs around 1,250 staff, oversees billions in legal funding, and works with approximately 2,000 providers, including barristers, solicitor firms, and non-profit organizations that deliver civil and criminal legal aid services in England and Wales. The LAA disclosed the cyberattack in early May 2025, warning that payment information for legal aid providers might have been compromised. Two weeks later, it confirmed the resulting data breach was more serious than first believed after finding that attackers had stolen a large trove of sensitive applicant and recipient data from 2010 onward, including contact details, dates of birth, national ID numbers, criminal history, employment status, as well as contribution amounts, debts, and payments.
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems. In a report published earlier
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. The vulnerability affects the PAN-OS management interface and lets authenticated attackers with network access execute code as root on vulnerable devices. Palo Alto Networks confirmed in a security advisory published Wednesday that it has seen limited exploitation of the flaw in attacks. "Very limited exploitation has been observed targeting the Palo Alto Networks management interface," the company said. The vulnerability has a severity score of 8.6 and affects PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances. Palo Alto says Cloud NGFW and Prisma Access are not affected. To exploit the vulnerability, attackers need existing credentials and network access to the PAN-OS management interface.
Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates. The Always On VPN remote access solution replaced the legacy DirectAccess technology and works with domain-joined, non-domain-joined, and Microsoft Entra ID–joined Windows 10, Windows 11, and Windows Server devices. Always On VPN runs in the background and automatically establishes a secure tunnel back to the corporate network whenever a device connects to the internet. As Microsoft first acknowledged in a service alert sent to IT administrators in late September, the bug triggered Always On VPN failures if the initial connection fails (e.g., when using automatic protocol selection with IKEv2 and SSTP) on up-to-date systems running Windows 11 24H2 and later.
Confirm this action.
Leaving now will discard your changes.