Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers. The company says the exposed data also includes 92,300 records with additional information yet to be determined. The breach affects 11 newsletters linked to SEGA and SEGA Fave products and services. The investigation found that the compromised data did not include customer names, dates of birth, gender, addresses, phone numbers, credit card details, or account passwords. Also, email addresses registered with a “SEGA Account” are handled by a separate distribution system and were not affected by this incident. The company is working with ARARA to determine what data was exposed and says it has no confirmed evidence of misuse.
N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, including exploits that could let attackers take over vulnerable systems.
York University in Toronto has confirmed that a threat actor breached its systems and accessed personal information submitted through online forms. The unauthorized access was discovered on October 25 and affected forms submitted on 14 university websites between 2007 and 2026. York University is a major university based in Toronto, Canada, with more than 55,700 students across 200 undergraduate and graduate degree programs, and an administrative staff of 7,000. “York was recently subject to a cybersecurity incident involving an unauthorized actor accessing limited online forms used by University departments,” the university stated on Friday. “While York acted quickly to contain the incident following discovery, we regret to confirm the theft of personal information from some departmental forms.”
France blames Iran for supermarket fridge attacks. What’s known, what remains unclear, and how to secure exposed controllers. French Foreign Minister Jean-Noël Barrot said Iran’s Revolutionary Guard Corps was behind the attacks on supermarket fridges in France on 11 and 12 October. He said they hit 700 sites and raised refrigerator temperatures. Some stores threw away their entire stock of perishable food, and fires broke out in several. “France attributes destabilization and sabotage campaigns against French interests to the Islamic Republic of Iran (electronic and cyber center of the Islamic Revolutionary Guard Corps of Iran – IRGC-ECC).” reads the announcement published by French cybersecurity agency ANSSI. “Following its investigation, C4 is able to attribute these destructive actions to the Shahid Kaveh cyber-offensive unit, affiliated with the electronic and cyber center of the Islamic Revolutionary Guard Corps of Iran (IRGC-ECC): infrastructure characteristics, use of signing tools, relay of the attack by a propaganda organ linked to Shahid Kaveh, traces of the use of Persian in the attack infrastructure.” Foreign Minister Jean-Noël Barrot described the attack as “unprecedented in both its scale and its level of aggression” and called it the first major cyber sabotage operation on French soil. He promised EU-level sanctions, and France summoned the Iranian ambassador. EU foreign policy chief Kaja Kallas said the response should be strong, adding that she had only just learned about France’s attribution. “I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran,” Foreign Minister Jean-Noël Barrot said of the cyberattacks on French supermarkets, which occurred on October 11 and 12, and reported Le Monde. “This attack is unprecedented in both its scale and its level of aggression,” said Barrot. “It marks the first large-scale cyberattack aimed at sabotage on our national territory, and it constitutes a major attack on the nation’s interests and the security of the French people.” “We will implement sanctions at the European level against all those responsible,” he added. Paris prosecutors opened a judicial investigation into the head of Shahid Kaveh, an offensive cyber unit tied to the Guards’ Electronic and Cyber Center, and his two deputies. Anyone else they identify can be added to the case. The attribution cites shared infrastructure, attack tools, Persian-language traces, and amplification by a group-linked propaganda outlet. French authorities say Iranian cyber operations targeting French interests date back to at least 2020. Previous incidents include a planned attack against Charlie Hebdo, a 2023 breach of its online store attributed to Emennet Pasargad, and a 2024 attempt to hijack digital advertising kiosks to display anti-Israel messages ahead of the Paris Olympics. C4 attributes these operations to the IRGC-linked Shahid Shoostari unit. France wasn’t alone. On 2 November, supermarkets in at least nine other European countries reported a suspected attack on their freezer systems. Barrot spoke only about the French case, so nothing official yet ties the second wave to Iran. This is where we need to be careful. When a government names a country as responsible for an attack, that’s a serious accusation. But the reports I’ve read don’t explain the technical evidence behind it. We should treat it as an official claim, not a proven fact, and stick to what we know. Fear and uncertainty can be used to spread distrust, and that risk applies to all sides involved in this story. The key issue isn’t just identifying the attackers, but understanding whether someone is exploiting these incidents to promote a hybrid warfare narrative. Hacktivist claims may serve propaganda and visibility more than reflect actual responsibility. If French investigations confirm Iran’s role in the October attacks, the pro-Russian groups claiming November’s incidents could face a serious credibility problem. They may have tried to take credit for someone else’s operations. Still, their involvement in some incidents remains possible. In today’s hybrid warfare, uncertain attribution, strategic ambiguity, and information manipulation make it increasingly difficult to separate real attacks from propaganda. The method used in supermarket fridge attacks, at least, is documented. On 5 November, CISA, the FBI and other US agencies published a fact sheet on the same kind of activity. The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards. The agencies list three ways in: bypassing authentication, injecting code and weak settings. They also warn that operators can lose sight of the real temperatures, which is a bad thing to discover after the cheese has gone. The fixes are dull and they work. Keep controllers off the internet, and if you need remote access, put an updated firewall in front of it. Separate industrial devices from the office network, change default passwords, add phishing-resistant multifactor authentication, patch firmware and replace devices the maker no longer supports. Then limit who can change settings with an allowlist of approved devices and IP addresses. Keep tested backups offsite and offline, turn on logging and read the logs. The last control is the cheapest: Define and maintain reasonable setpoint limits for devices operating downstream of controllers to stay within safe ranges and establish alerting for deviations. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Iran)
France has linked October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations to Iranian state-backed hackers, saying the attacks caused food losses and sparked at least 15 fires. In a statement issued Monday, France's Ministry for Europe and Foreign Affairs blamed the attacks on Shahid Kaveh, a cyber-offensive unit affiliated with the electronic and cyber center of Iran's Islamic Revolutionary Guard Corps (IRGC). "France condemns in the strongest possible terms the unacceptable cyberattacks carried out on its territory by the Islamic Republic of Iran against its interests," reads the statement. The attacks occurred overnight on October 11–12, when hackers compromised industrial refrigeration controllers and remotely changed defrost settings to high temperatures, disrupting systems used to preserve food.
Binance, the world's largest crypto exchange, has denied claims of a new security breach made by a threat actor using the 'ShinyHunters' handle on a newly emerged underground cybercrime forum. This follows the threat actor, believed to impersonate the ShinyHunters extortion gang, putting up for sale what they claimed were records of 335 million Binance users. The allegedly stolen information includes Know Your Customer (KYC) documents, internal infrastructure information, users' account passwords, crypto wallet private keys, transaction history, emails, and phone numbers. The threat actor also asked for $900,000 for the data, adding that Binance has only "two options left: pay or leak." However, a Binance spokesperson told BleepingComputer that the company found no evidence of a breach and said that this is likely a scam.
Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. Multiple cybersecurity firms have confirmed the attacks, reporting that exploitation attempts began on November 5, the day a proof-of-concept exploit became available, with successful exploitation recorded the following day. Disclosed by security researcher Ozgun Kultekin last week, SSHole allows bypassing authentication in OpenSSH running on certain musl-based Linux systems, including the lightweight Alpine distribution used in cloud and virtual environments. The flaw lets attackers log in to accounts with a password hash is set to an asterisk (*) to prevent password logins. An oversized password causes musl’s password-hashing function to return * on error, which OpenSSH mistakenly treats as a match for the account’s stored value.
AI agents are taking over routine governance, risk, and compliance tasks, forcing GRC professionals to rethink the skills needed to stay relevant. Anecdotes examines three essential skills for the AI-driven GRC workplace: data literacy, agent governance, and communication.
Taiwanese vendor QNAP urges users to update Plex Media Server after reports of NAS compromises through the Plex2Shell vulnerability chain. QNAP urges users to update Plex Media Server through the QNAP App Center after reports that threat actors exploited the Plex2Shell vulnerability chain to compromise NAS devices. “QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through these vulnerabilities, and QNAP Technical Support is assisting the affected usersadvisory published by QNAP. ” reads the report published by the vendor. “The QNAP Product Security Incident Response Team (QNAP PSIRT) has confirmed that the vulnerabilities exist only in Plex Media Server; QTS, QuTS hero, and other QNAP operating systems are not themselves affected.” Plex Media Server is designed to make movies, music, and other media available across devices. But when a server is exposed to the internet and runs vulnerable software, it can become an entry point for attackers who have little interest in your film collection. On October 16, 2026, security researcher Zach Main published technical details and proof-of-concept (PoC) code for a vulnerability chain dubbed Plex2Shell. Within a day, researchers had observed attackers using the exploit against an internet-facing honeypot, deploying cryptocurrency-mining malware and proxy software. The incident is a reminder of how quickly a public exploit can be weaponized by threat actors. The chain combines four vulnerabilities in Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Together, they can allow attackers to execute arbitrary code on vulnerable servers without valid credentials, provided the required conditions are met. The code runs with the privileges of the Plex service, giving attackers an opportunity to install additional software and abuse the host. The technical details are available in Main’s original analysis, Plex2Shell. Plex had been notified of the vulnerabilities on July 27 and acknowledged the report on August 4, awarding a bug bounty. The company released fixes in September, before the exploit code became public. The loader does not check the library’s name, executable permissions, digital signature, or symbols. As a result, the library’s ELF constructor can run with the same privileges as the Plex service. “It doesn’t check for a lib prefix, doesn’t require the execute bit, doesn’t verify any signature, and doesn’t look for any specific symbol.” reads the report published by zmain.com. “When dlopen loads a shared object, it runs the ELF’s DT_INIT_ARRAY (constructor functions) before doing any symbol resolution. A .so that only has a constructor and no exported symbols will still execute its code on load. We then trigger a second transcode. The codec directory gets re-enumerated, the .so we wrote in Stage 4 gets loaded, and the constructor runs as uid=1000(plex).” That detail matters because the final stage can exploit how Plex loads shared libraries. The chain uses a setting related to transcoding to influence execution, allowing a specially crafted library to run when Plex loads it. The result can be code execution under the service account, without requiring the attacker to obtain an interactive login first. QNAP urges users to update Plex Media Server immediately, users should go to App Center, open My Apps and update Plex Media Server to version 1.43.3 or later. They should then check in Plex Web, under Settings and General, that the installed version is 1.43.3.10861 or later. QNAP will release further updates after verifying them, but users should not wait. If Plex was reachable from the internet while running version 1.43.2 or earlier, users should treat the NAS as potentially compromised. This may apply if Plex Remote Access was enabled, port 32400 was forwarded, or the port was opened automatically through UPnP or router settings. Updating alone will not remove anything an attacker may have installed. In those cases, users should follow QNAP’s FAQ to perform a clean reinstall, check for signs of compromise and reset both their Plex and NAS credentials. The company also advises disabling Plex Remote Access if it is not needed and avoiding port forwarding for port 32400. Users who need remote access should use a VPN instead. QNAP also recommends keeping QTS or QuTS hero and all installed apps up to date. Step-by-step instructions are available in the Plex2Shell: Check and Remediation FAQ for QNAP NAS Users. CISA added Plex2Shell flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026, urging federal agencies to addresse them by October 23, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, QNAP)
A former FBI agent has pleaded guilty to stealing nearly $2.5 million from the wallets of fraud victims and nation-state hackers under investigation. 37-year-old Patrick Steven Yaroch worked on a national security investigative squad at the FBI Boston Division (FBI BS) from 2017 to 2025, and as a supervisory special agent in the FBI Headquarters (FBIHQ) Counterintelligence and Espionage Division (CED) between February 2025 and July 2026. He was arrested on July 31 at his residence after self-reporting the crypto theft to Department of Justice (DOJ) National Security Division (NSD) and FBIHQ employees on July 29. The FBI fired Yaroch on July 31, 2026, after first placing him on administrative leave on July 29. Yaroch pleaded guilty on Thursday to wire fraud and money laundering charges, admitting that he used passphrases (obtained from the FBI's case management systems and another platform used to share investigative data) to transfer funds from the cryptocurrency wallets of fraud victims or suspects under FBI investigation to his own wallets.
Confirm this action.
Leaving now will discard your changes.