InfoSec News 20261012
Publicada em: 12/10/2026
TOP NEWS
SonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin
Attackers are exploiting SonicWall SMA 1000 vulnerability, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after its public disclosure.
Attackers have begun exploiting a critical flaw in SonicWall SMA 1000 appliances, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after public disclosure. The vulnerability is a server-side request forgery (SSRF) flaw that requires no login. Attackers could abuse it to make the appliance send requests and access internal functions, allowing unauthorized actions.
Link
TLP1: Green
U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND to its Known Exploited Vulnerabilities catalog.
CVE-2015-3306 (CVSS score of 10.0) – An access control flaw in ProFTPD that could let remote attackers read or modify arbitrary files by abusing the SITE CPFR and SITE CPTO commands.
CVE-2021-3199 (CVSS score of 9.8) – A path traversal flaw in ONLYOFFICE Docs when JSON Web Token (JWT) is enabled. Attackers could exploit a /.. sequence in an image upload parameter to potentially execute code remotely.
CVE-2023-22894 (CVSS score of 7.2) – A vulnerability in Strapi that exposes sensitive information stored in cleartext. An attacker with admin panel access could use query filters to retrieve confidential user details.
CVE-2016-3081 (CVSS score of 8.1) – A command injection flaw in Apache Struts that could allow remote attackers to run arbitrary code through method: prefixes when Dynamic Method Invocation is enabled.
CVE-2015-5477 (CVSS score of 7.5) – A reachable assertion vulnerability in ISC BIND that could be triggered by remote TKEY queries, potentially causing a denial-of-service condition.
Link
TLP1: Green
Cyberattack shuts down refrigerators at French supermarkets
Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers.
Victims include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, with French outlets reporting that the attack affected between 250 and 350 stores, causing significant financial losses and food waste.
Link
TLP1: Green
Cybersecurity State: Surveillance, Cyberwarfare, Cybercriminality and Hacktivism
CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records
CyberXero used 51 AI agents to support cyberattacks, stealing 628,000 Ukrainian records, including sensitive data from energy infrastructure.
CyberXero is an operation that combines traditional hacking tools with AI agents to carry out cyberattacks. According to SOCRadar researchers, the attackers use the same infrastructure for two different campaigns: one targets WordPress websites and e-commerce platforms worldwide, while the other focuses on Ukrainian energy and critical infrastructure.
Link
TLP1: Green
Silent Ransom Group Allegedly Extorted $207 Million Without Encrypting Files
Silent Ransom Group allegedly extorted $207 million from 27 law firms in six months using phone calls and social engineering, not encryption.
The leaked data comes from two of the group’s servers and covers about 13 months, from August 2025 to September 2026. It contains 5,692 chat messages about ransom negotiations, ways to access victims’ systems, and plans for future targets.
Link
TLP1: Green
US Sentences Empire Market Co-Creator Over $430 Million Criminal Marketplace
Empire Market co-creator Raheim Hamilton was sentenced to 40 years in prison for running a dark web marketplace linked to $430 million in illegal trades.
The case against Empire Market shows how a dark web marketplace can become a major criminal business, bringing together drug trafficking, stolen credentials, personal data and hacking tools.
Link
TLP1: Green
Breaches: Data Breaches and Hacks
Astrana Health Data Breach on October 12, 2026
Astrana Health is a physician-centric, technology-enabled healthcare company based in the USA (California), providing value-based care, healthcare management, and risk-bearing medical services. Leak Size: 1500GB
Link
TLP1: Green
Vulnerabilities: Vulnerability Advisories, Zero-Days, Patches and Exploits
GitLab warns of max severity code execution vulnerability
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances.
Tracked as CVE-2026-97229, this critical security flaw was discovered by a security researcher using the 'joaxcar' handle and reported via GitLab's HackerOne bug bounty program.
Link
TLP1: Green
Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland
The Pwn2Own Ireland 2026 hacking contest has concluded, with hackers collecting $1,262,000 in rewards after exploiting 98 zero-day flaws.
Ikotas Labs security researchers won this year's Pwn2Own Ireland edition with 42.5 Master of Pwn points and $361,000 earned over the three-day contest after hacking the Samsung Galaxy S26, OpenAI Codex, and the Oracle Autonomous AI Database.
They also collected the competition's top reward of $300,000 on the third day after chaining multiple zero-days to hack the Google Pixel 10.
Link
TLP1: Green
Incident Response: Infrastructure, Training, SIEM and Incident Handling
Retail giant Ahold Delhaize takes systems offline after cyberattack
Retail giant Ahold Delhaize, one of the world's largest food retail chains, confirmed today that it was forced to take some systems offline after a "cybersecurity incident."
As a wholesale company and multinational retailer, Ahold Delhaize operates more than 9,400 local stores across Europe, the United States, and Indonesia, employs nearly 400,000 people, and serves around 60 million customers each week through physical retail locations and online.
Link
TLP1: Green
Technical Articles: Forensics, Reverse Engineering, Malware, Phishing, Pentesting, Software Security and Cryptography
Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
Varonis Threat Labs recently discovered AvisLoader, a new Windows loader named after the Latin word for bird. We found it on an exposed staging server alongside a ClickFix lure, supporting tools, and its Command Center.
The attack starts with a familiar ClickFix lure. A page posing as a document-signing request asks visitors to copy and run an attacker-supplied command on their machine.
The more interesting part is how AvisLoader stays connected. It communicates via Tox, an encrypted peer-to-peer (P2P) messaging network that carries commands and additional payloads from the operator
Link
TLP1: Green
1Traffic Light Protocol (TLP) [1] for information sharing:
- Red: Not for disclosure, restricted to participants only.
- Amber: Limited disclosure, restricted to participants organizations.
- Green: Limited disclosure, restricted to the community.
[1]https://www.first.org/tlp