Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks.
OpenAI employee charged with planting hidden audio recorders to capture sensitive discussions about AI research and company strategy. On September 30, OpenAI staff found a small audio recording device jammed into a USB port on the back of a television in an executive conference room in their San Francisco office. The device had been there since September 28, its contents were encrypted, and whoever put it there had wrapped it in toilet paper to hide it. Federal prosecutors named the man as Abdulrahman Alfozan, 35, a Saudi national who’d been working on OpenAI’s product team since July 2025. Alfozan was fired and arrested on October 9. He faces up to five years in prison and a $250,000 fine if convicted. “An employee of OpenAI has been arrested for and charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications.” states DoJ. “Abdulrahman Alfozan, 35, a national of the Kingdom of Saudi Arabia, was arrested on Oct. 9, and made his initial appearance in federal court today.” The executive conference room hosted meetings about confidential research, product plans, business deals, government relations, and OpenAI’s technical progress. These were clearly sensitive discussions. FBI Director Kash Patel said the alleged goal was to spy on conversations about the company’s intellectual property. “According to the complaint unsealed today, Abdulrahman Alfozan allegedly concealed a covert recording device inside his employer’s executive conference room to secretly capture sensitive communications about the company’s super intelligence technology,” said FBI Director Kash Patel. “Protecting American SI innovation is essential to safeguarding our nation’s economic strength and national security, and the FBI views that mission as one of our highest counterintelligence priorities. Thank you to Director of National Intelligence Jay Clayton and our law enforcement partners for their support — and we will continue working closely with our partners across the U.S. government and private sector to keep American businesses and citizens safe and to ensure our country maintains its competitive edge.” Alfozan had no permission to enter the room or attend meetings there. CCTV footage showed him near the conference room several times before the recording device was discovered. On October 5, five days after OpenAI found it, cameras captured him looking behind the same television where the device had been hidden. He appeared to be checking on it or preparing to retrieve it. Before the device was installed on September 28, Alfozan used an internal OpenAI tool to search for office addresses, meeting rooms and their capacity, room calendars, the locations of executives and senior leaders, and schedules for meetings with external partners. These searches suggest he was gathering information about the company’s facilities and activities. Investigators also found a series of chatbot prompts submitted between September 24 and 30 through an account linked to Alfozan’s spouse. The account shared several identifiers with his own. The prompts covered how to build a continuous audio recorder, configure Wi-Fi, improve recording and live listening quality, encrypt an SD card, and enable remote access. Prosecutors also noted that on September 27 and 28, the account submitted prompts referring specifically to the custom header and unique MAC address of Recording Device 1. This happened just one day before the device was installed. On October 5, the same day Alfozan was caught on camera looking behind the television, he also left a bag unattended in a different room in an OpenAI building. Security staff opened it and found another recording device similar to the first one, along with his wallet and ID. So either he was planning to plant a second device, or he was already carrying a spare. “If convicted, Alfozan faces a maximum penalty of 5 years in prison and a $250,000 fine, followed by 3 years of supervised release.” concludes DoJ. OpenAI said it used its own internal AI models to help analyze the device, which TechCrunch reported “contained advanced encryption, audio monitoring capabilities, and a mechanism for transferring data designed to evade monitoring.” OpenAI also confirmed there’s no indication that Alfozan accessed or exfiltrated model weights, source code, or customer data through any other channel. This case is being prosecuted under National Security Presidential Memorandum 11, specifically tied to protecting American superiority in what the government is now formally calling “super intelligence” technology. The Director of National Intelligence, Jay Clayton, weighed in personally, calling AI development a national security prerogative. That framing, a straightforward wire tap case dressed in super intelligence language, tells you something about where this administration sees AI in the broader geopolitical picture. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, OpenAI)
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking
The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own. One login request let the user choose where the one-time passcode went. The attack was the easy part. Proving it
A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. The flaw was discovered on August 23 by researchers at Defiant's platform Wordfence using their Argus AI-powered system. Ghostscript is a PostScript and PDF interpreter that can render PDFs as images, generate thumbnails for previews, and optimize PDF files by compressing embedded images and removing unnecessary font data. When generating a PDF thumbnail, WordPress can use the PHP Imagick extension to call ImageMagick, which launches Ghostscript. A specially crafted PDF file containing a JPEG 2000 image can trigger incorrect handling of low-bit-depth samples and mismatched component resolutions. Using Argus, the researchers developed two exploits for CVE-2026-39919 that force Ghostscript to write 1,024 bytes into a 256-byte buffer, corrupting nearby memory and leading to unauthenticated remote code execution in a WordPress deployment.
Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers. The company's experiments showed that models could identify unfamiliar devices, connect them into a network, and prepare them to run an AI model. Although the researchers successfully distributed the Gemma4-26B-A4B model from Google DeepMind on 15 off-brand Android TV boxes, they did not demonstrate a fully autonomous, self-replicating AI worm running on real IoT hardware. However, they estimate that smaller models could achieve self-replication by the end of the year if they continue to improve at their historical rate. “Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes,” Anthropic warns.
Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. The frontier AI lab said small AI models could form autonomous, self-propagating worm botnets that are "challenging to shut down," since "there's no centralized point to shut off."
The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday. Established under the Housing Act 1996, the Housing Ombudsman is an executive non-departmental public body sponsored by the Ministry of Housing, Communities, and Local Government. The watchdog settles disputes between social housing residents and social landlords in England, including housing associations, landlords, managers, and letting agents. On Tuesday, the service added an alert to its official website, warning that it's working with the affected service provider to assess the incident's impact and said social housing residents cannot file new complaints until systems are back online. Those who must raise new complaints are advised to call the Housing Ombudsman's phone line or email the watchdog at info@housing-ombudsman.org.uk.
Confirm this action.
Leaving now will discard your changes.