Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites.
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts.
The U.S. Department of Homeland Security (DHS) is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems. The order also covers products from the Chinese AI company's affiliates and third-party products and services built using DeepSeek technology. DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd) develops large language models and offers a chatbot, API services, and models suitable for coding and reasoning tasks. Its AI tools became extremely popular early on, but were but were soon followed by reports of security risks [1, 2, 3, 4] and concerns about the potential for Chinese authorities to access users’ conversations. The DHS is now taking regulatory action to limit the use of DeepSeek and derivatives on critical systems in the United States, and has issued a notice of order for agencies to:
CJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance. Specops outlines five practical priorities covering MFA, account management, passwords, logging, and audit readiness.
A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. 40-year-old Chukwuemeka Victor Amachukwu (also known as Chukwuemeka Victor Eletuo and So Kwan Leung) has pleaded guilty to conspiracy to commit computer intrusions and wire fraud after being extradited from France to the United States in August 2025. "Chukwuemeka Amachukwu believed he was operating safely offshore when he targeted his victims, but he has now been held to account and now faces a serious sentence for his crimes," said US Attorney Jamie McDonald in a Monday press release. "Amachukwu took part in sophisticated schemes to hack into US businesses, steal and use stolen identity information of victims, and commit fraud. These crimes imposed significant harm on the victims and the public, and so it is only appropriate that the crimes also come with a significant sentence for the defendant."
Microsoft announced that IT administrators can now use quick machine recovery on Windows Server 2025 after installing the October 2026 security update. Quick machine recovery (QMR) lets IT admins fix critical boot failures with targeted Windows Update fixes without physical access to affected systems. When enabled, it boots into the Windows Recovery Environment (WinRE) and launches the QMR Tool if Windows 11 fails to start because of a configuration change or a new driver. It then sends crash data to Microsoft, which can remotely fix issues by adjusting settings or removing problematic drivers or updates. "With the October 2026 security update, quick machine recovery extends to Windows Server 2025," the company said in a message center update. "Quick machine recovery is designed to help restore devices experiencing widespread boot issues by using the Windows Recovery Environment (WinRE) to search Windows Update for applicable remediations."
French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. The attacker hijacked a developer’s GitHub account to gain access to the OVHcloud CLI repository and modify versions 0.11.0 through 0.15.0 of the tool. OVHcloud offers the CLI tool as an alternative for system administrators and developers to manage cloud and hosting services directly from a terminal, including for automating tasks. OVHcloud CEO Octave Klaba disclosed that the company’s CLI repository on GitHub had been compromised, urging users who downloaded the latest version yesterday to update or remove the tool. Klaba said that the compromised release appeared at 14:47 on October 19 and was detected and blocked at 16:21 after a customer reported it.
Ahold Delhaize, one of the world's largest food retail chains, confirmed that last week's cyberattack disrupted services at stores across Europe and the United States. Right before the cyberattack was disclosed, customers couldn't use websites, apps, and customer service platforms at Albert Heijn, Etos, and Gall & Gall stores in the Netherlands, and Delhaize in Belgium, while employees at the Stop & Shop American regional supermarket chain reported having trouble accessing their schedules and pay stubs. When BleepingComputer asked right after the incident whether it also affected both corporate and store systems and whether any devices were encrypted during the attack, an Ahold Delhaize spokesperson redirected us to the company's statement. In a Monday update, Ahold Delhaize said the cybersecurity incident announced last week forced it to take some systems offline, including its brands' websites and apps, causing service issues, although stores remained open to serve customers.
Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks. The supply chain attacks took place between April and July 2026 and targeted the update and notification systems used by AOMEI Backupper, a Windows application for backing up data, cloning disks, and restoring systems. Researchers at ManageEngine's Threat Analysis Lab (METAL), working with Google's Threat Intelligence Group (GTIG) and Mandiant, uncovered the campaign and investigated the attacks. In reports published by Google and ManageEngine, the activity is attributed to a threat actor tracked as UNC7017, who used the compromised infrastructure to distribute a previously unknown malware downloader called CROSSROAD and a backdoor named SHINYROAD.
Attackers exploit Plex2Shell flaws to install crypto miners and proxy software. Admins should update their Plex Media Server. Plex Media Server is designed to make movies, music, and other media available across devices. But when a server is exposed to the internet and runs vulnerable software, it can become an entry point for attackers who have little interest in your film collection. On October 16, 2026, security researcher Zach Main published technical details and proof-of-concept (PoC) code for a vulnerability chain dubbed Plex2Shell. Within a day, researchers had observed attackers using the exploit against an internet-facing honeypot, deploying cryptocurrency-mining malware and proxy software. The incident is a reminder of how quickly a public exploit can be weaponized by threat actors. The chain combines four vulnerabilities in Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Together, they can allow attackers to execute arbitrary code on vulnerable servers without valid credentials, provided the required conditions are met. The code runs with the privileges of the Plex service, giving attackers an opportunity to install additional software and abuse the host. The technical details are available in Main’s original analysis, Plex2Shell. Plex had been notified of the vulnerabilities on July 27 and acknowledged the report on August 4, awarding a bug bounty. The company released fixes in September, before the exploit code became public. The loader does not check the library’s name, executable permissions, digital signature, or symbols. As a result, the library’s ELF constructor can run with the same privileges as the Plex service. “It doesn’t check for a lib prefix, doesn’t require the execute bit, doesn’t verify any signature, and doesn’t look for any specific symbol.” reads the report published by zmain.com. “When dlopen loads a shared object, it runs the ELF’s DT_INIT_ARRAY (constructor functions) before doing any symbol resolution. A .so that only has a constructor and no exported symbols will still execute its code on load. We then trigger a second transcode. The codec directory gets re-enumerated, the .so we wrote in Stage 4 gets loaded, and the constructor runs as uid=1000(plex).” That detail matters because the final stage can exploit how Plex loads shared libraries. The chain uses a setting related to transcoding to influence execution, allowing a specially crafted library to run when Plex loads it. The result can be code execution under the service account, without requiring the attacker to obtain an interactive login first. The first confirmed activity appeared on October 17, when a researcher monitoring a vulnerable Plex honeypot reported seeing exploitation in the wild. “My honeypot mostly saw scanning and generic exploitation attempts. As of this morning (Oct 17th), I finally saw in the wild exploitation.” reports the researcher on BoredHackerBlog. “So by default, I don’t allow outbound traffic from my honeypots but due to how this vuln works, I had to go modify my settings later on so sadly I didn’t get payloads for all the attacks. It’s possible that I have partial data. I haven’t gone through pcaps and I had to modify settings for tcpdump anyway. The attacker could be using slightly modified code & technique too.” The attackers used the publicly available exploit to deploy an XMRig-based cryptocurrency miner. Later that day, the researcher found a second payload named myawesomeproxy, which turns the compromised system into a proxy node and may allow others to use its internet connection. Cryptomining consumes computing resources and electricity, while proxy software creates a different risk. Attackers can route traffic through compromised residential or business connections, potentially using their reputation and IP addresses to reach services or networks that might otherwise block suspicious infrastructure. A Plex server can therefore become more than a source of unwanted costs: it can provide an attacker with a foothold for further activity. Plex released patched versions in September, and administrators should ensure they’re running Plex Media Server 1.43.3.10861 or later. This includes installations running on NAS devices, virtual machines, and Docker containers. Updating the application is the immediate priority, particularly for servers exposed directly to the internet. Administrators should also investigate unexpected child processes launched by Plex, unexplained CPU usage, unfamiliar files in the Plex Codecs directory, and outbound connections to unrecognized IP addresses. The appearance of cryptocurrency miners or proxy processes deserves particular attention. Because attackers can change filenames, infrastructure, and payloads, detection shouldn’t depend on a fixed list of indicators alone. The honeypot findings provide evidence of exploitation, but they don’t establish how many real-world systems have been compromised or identify the operators with certainty. Organizations should treat the activity as a warning to check exposure and patch promptly, rather than assume that every vulnerable server has already been attacked. “I wouldn’t be surprised if threat actors deploy more sophisticated things. Plex may be hosted on residential IP and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails. (edit: see update at the bottom. i do see proxy being deployed now)” the researchers adds. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Plex2Shell )
Confirm this action.
Leaving now will discard your changes.