GitGuardian reported on 7 October 2026 that GhostAction, the CI/CD supply-chain campaign it first exposed in September 2025, ran a new wave from 31 August 2026. Using what appear to be stolen GitHub credentials, the attacker committed a workflow named 'Github Actions Security' to 772 public repositories belonging to 373 GitHub users and organisations by 30 September; each workflow lists the repository's own secret names (scraped from earlier workflow history) and posts their values over plain HTTP to a bare IP address. Together the injected workflows target 2,577 secrets, most often SSH keys and Azure, AWS and database credentials. A variant named 'Security Check' (security-check.yml) appeared in seven repositories from 7 September and tags each theft with an injection ID. GitHub held most runs for approval: of 3,669 runs GitGuardian collected across 605 repositories, 499 executed in 32 repositories and 336 completed, exfiltrating 26 secrets from 13 repositories, with new runs still triggering. Only 124 repositories (16%) had been cleaned in public history by 5 October. In 92 cases the attacker simply re-pointed workflows left over from earlier waves, so GitGuardian says the campaign never really stopped. It also found 13 victim repositories used for GitHub Actions cryptomining by at least four other campaigns, including an XMRig miner hidden in the Docker image of the popular kuafuai/DevOpsGPT project, and thinks the stolen GitHub credentials are being traded among several actors. Researchers at Cynative independently spotted the commits. Primary: GitGuardian; wire: SecurityWeek. UPDATE (9 Oct): StepSecurity and Socket documented a new burst on 8 October in which two compromised maintainer accounts committed a workflow named 'security-audit.yml' ('Add security audit workflow') to every repository they could write to: 27 under kitao (Takashi Kitao, author of the 18,400-star pyxel game engine, published to PyPI and crates.io) from 13:20 UTC, then 318 under henrywoo (39 source repositories and 279 forks) plus Uber's uber/athenadriver in a 16-minute window from 21:10 UTC. This version sends named Actions secrets and also scans the working tree and full git history for cloud, AI and SaaS keys (AWS, Anthropic, OpenAI, OpenRouter, GitHub and GitLab tokens), posting them in cleartext to 193.32.204[.]199; StepSecurity confirmed from the athenadriver run log that exfiltration completed four seconds after the run started. Socket's 9 October update says more than 500 GitHub accounts have committed the workflow to tens of thousands of repositories since 7 October, including organisation-owned ones reached through compromised contributors. No malicious PyPI or crates.io releases had been published as of 9 October, but the stolen publishing tokens stay usable until rotated. UPDATE 13 October (GitGuardian; wire: The Hacker News, 15 Oct): GitGuardian says the campaign accelerated sharply between 8 and 12 October, peaking on 8–9 October. Its dataset now shows the actor targeted more than 30,000 repositories across 3,000 users and organisations by compromising the GitHub accounts of about 1,900 users, attempting to extract 3,174 secrets from public repositories' CI. The payload went first to 160 previously seen victims and, 20 minutes later, to about 28,000 new repositories on 8–9 October; later versions also capture the lines around each AWS key ID found in git history so the actor can pair it with its secret access key. Further waves on 10 and 12 October used the same payload but could not extract any secrets, because GitHub began preventing the malicious workflow from running on 9 October. Some victims of this burst had already been hit in the September 2025 and August 2026 waves, which GitGuardian reads as the actor relying on secrets that were never rotated. UPDATE 19 October 2026 (OpenSourceMalware, 9, 11 and 16 Oct; wire: The Hacker News, 19 Oct): the operator has moved beyond workflow injection. On 9 October it registered my-github[.]com, which resolves (with wildcard DNS) to the same collector, 193.32.204[.]199, and that day emailed an open-source maintainer a fake GitHub 'new sign-in from Moscow' security alert from noreply@my-github[.]com. The link opened a reverse-proxy phishing page that captured the password and authenticator code and ran injected JavaScript that silently approved a GitHub OAuth device flow with repo, workflow and read:org scopes, sending the resulting token to my-github[.]com on TCP 8443, so the victim never sees or types a device code. A lookalike my-gitlab[.]com (registered 22 September) uses the same naming but is not technically linked to the operator. Separately, OpenSourceMalware, starting from a find by Jamf's Thijs Xhaflaire, documented a second stage in 94 repositories belonging to 66 owners, most of them dormant for over a year: after a Stage 1 workflow on 8 October, the main burst on 15 October (UTC) committed a .vscode/tasks.json set to run on folder open, a fake font public/fonts/fa-solid-400.woff2 (the file name used by North Korea's PolinRider campaign) that is really a JavaScript stealer, and a second workflow under names such as lint.yml, ci-check.yml, build-check.yml, repo-health.yml, audit.yml, code-review.yml or test-suite.yml with more credential patterns and a secret-gist fallback. Opening the project in VS Code runs the stealer, which takes AWS, PyPI, npm, Git, Kubernetes, SSH and Claude, Gemini, OpenAI and Hugging Face credentials, posts them over plain HTTP to port 8080 on the same server and installs a cron job (marked #ghc2) that fetches and runs server-supplied code every five minutes; deleting the font file does not remove the cron job. One repository also got a cache-cleanup.yml workflow aimed at self-hosted runners that reads cloud IAM role credentials and SSH keys. This stage does not need GitHub Actions to run, so GitHub's 9 October block does not stop it. OpenSourceMalware found no shared indicators with North Korean malware and calls it a copycat of PolinRider's technique.
CVE-2026-107181 was published on 7 October 2026 for a flaw in Telegram Desktop before 7.2.9 that researcher beaksec described in a technical write-up first published on 3 October and updated on 7 October. When a link is opened from outside Telegram (for example from a browser), a second instance passes it to the running app over a local inter-process channel that did not escape its record separator (CWE-143). A crafted tg:// link with an unescaped semicolon could therefore inject an extra command that reached an old internal helper, once used for release publishing, which uploads a local file to a chat without any permission check or prompt. Files that can be taken include Telegram's tdata session keys, so an attacker can take over the account when no local passcode is set. The demonstrated chain was on Windows with version 6.9.3 and is said to work through 7.2.8; it also relies on group files downloading automatically and on anyone being able to add the victim to a group, and the browser may ask before launching the app. Links clicked inside Telegram are not affected. Telegram fixed it in commit db3405699f (16 September) and released 7.2.9 on 17 September 2026 without a separate advisory; CVSS 3.1 is 8.1. No exploitation in the wild is known. Primary: CVE record (NVD) and Telegram's fix; wire: ThreatWire.
Let's Encrypt announced on 7 October 2026 that every certificate it issues or renews on or after 10 February 2027 will be valid for 64 days by default instead of 90, unless the subscriber picks one of the shorter 45-day or roughly six-day profiles it has already announced. The last 90-day certificates should expire on 11 May 2027, and existing certificates will not be revoked. The staging environment switches to 64-day certificates on 14 October 2026 so administrators can check renewal behaviour early. Clients that support ACME Renewal Information (ARI) will be told when to renew; anything renewing at a fixed number of days before expiry should move to about two-thirds of the lifetime (around day 43), and Let's Encrypt suggests searching cron jobs, wrapper scripts and runbooks for hard-coded values such as 83, 80 or 60. The authorisation reuse period also drops from 30 days to 10 days, and to seven hours in 2028, ahead of a 2029 industry limit; rate limits, ACME endpoints and issuance chains do not change. Default lifetimes are due to fall to 45 days in February 2028. Shorter lifetimes reduce the damage from a stolen key or a mis-issued certificate. Primary: Let's Encrypt; wire: Cyber Security News.
DataBreaches.net reported on 7 October 2026 that internal chats of Silent Ransom Group (SRG, also tracked as Luna Moth and UNC3753, a Conti offshoot known for IT-support callback phishing against law firms) had leaked: 5,692 messages from two servers covering 27 August 2025 to 29 September 2026, shared with the site by researcher Tammy Harper. The chats mark completed payments as 'GOLD' for 27 named targets, totalling US$206.95 million, with a median of US$6 million, a low of US$100,000 and a high of US$30 million. The group never encrypts files; it tricks staff into granting remote access, steals documents and threatens to publish them. Crystal Intelligence's blockchain analysis dates the 27 claimed payments between 3 April and 24 September 2026 and found transactions matching several chat entries, including one collection wallet that took in about 344 BTC (about US$27 million) over six weeks, but could not tie individual victims to it. Nine of the 27 named firms disclosed breaches in the same period, yet no victim has confirmed that SRG attacked it or paid the amounts listed, and SRG disputes the leak. For defenders, the lesson is that data-extortion crews without ransomware can be highly profitable; staff need to verify any 'IT support' call before installing remote tools. Primary: DataBreaches.net; wire: Cyber Security News.
DataBreaches.net — Can you really make more than $200M in six months without encrypting victims? (7 Oct 2026)
On 7 October 2026 the Office of the Australian Information Commissioner announced a commissioner-initiated investigation into Shenzhen Qingcheng Future Technology Co. Ltd, maker of the HeyCyan companion app required for full use of Anko smart glasses sold by Kmart and other low-cost glasses sold via Big W Marketplace, Amazon and similar channels. After an Attorney-General request, the OAIC from 12 August 2026 sent preliminary inquiries to Meta, Kmart, Google and Shenzhen Qingcheng about recording, storage and access to personal information. Shenzhen Qingcheng (China) did not respond. Privacy Commissioner Carly Kind said that absence left no assurance the company protects Australians' personal information as required under APP 1, and that the investigation lets the OAIC use compulsory information-gathering powers. Kind has written to retailers selling HeyCyan-linked devices urging them to consider whether continued sale is appropriate. Opening an investigation is not a finding of breach. Parallel coverage: Kmart removed its $89 Anko camera glasses from online sale while still listing speaker-only glasses; ACS Information Age and SMH reported the retail pull alongside the OAIC action. Distinct from the earlier desk card on APS/Optus smart-glasses policy (au-smart-glasses-policy-20260918). Primary: OAIC media release 7 Oct; wire: ACS Information Age.
OAIC — Opens investigation into maker of HeyCyan smart glasses phone app (7 Oct 2026)
German security firm Jakkaru disclosed on 7 October 2026 a business-logic flaw in iSolarCloud, the cloud platform Sungrow uses to manage solar plants, inverters and battery storage. One value of the login_type field in the (encrypted and signed) login request made the service authenticate the account named in the request and ignore the password, so anyone who knew a user's email address could log in, with no email or other login alert to the owner, and could then use account recovery to keep control. Customer and administrative accounts share the same management environment, so Jakkaru says a compromised administrator account could view and change plants, start or stop inverters and batteries, see registered organisations and users (including large German solar installers), and install custom firmware on any cloud-connected device. iSolarCloud runs four regional systems, European, Chinese, Australian and international, and the flaw was in all of them. Jakkaru says Sungrow published a hotfix within a day of being told and began a root-cause review. CVE-2026-107194 was published on 7 October, and no exploitation is reported. Sungrow is one of the largest inverter makers, with more than 1,000 GW of converters installed by Jakkaru's count, and is common on Australian rooftops. Primary: Jakkaru; wire: Cyber Security News. Correction (22 Oct 2026): this card said no CVE had been published. CVE-2026-107194 was published on 7 October, and Sungrow's own advisory SGSA-202608-0028 (10 October) rates it CVSS 4.0 9.2 Critical, says the flaw was fully remediated on 25 August 2026 with no customer action needed, and describes the access an attacker gained as viewing the account's device list, operating status and historical monitoring data; the wider impact on this card is Jakkaru's assessment. (source: Sungrow security advisory SGSA-202608-0028)
Jakkaru — Sungrow vulnerability exposes gigawatts of power worldwide (7 Oct 2026)
Censys published a report on 7 October 2026 after finding open directories, between 15 and 17 September, on five previously undocumented hosts used to deliver, stage and control the DarkSword iOS exploit chain and Coruna implants. DarkSword gets in through WebKit and JavaScriptCore browser exploits, escapes the Safari sandbox, gains kernel access and reaches SpringBoard, the process that runs the home screen and app launches. Coruna's core implant then watches for wallet apps to open and injects one of 18 matching modules, covering apps such as MetaMask, Phantom, Trust Wallet, Coinbase, Exodus, imToken and Bitpie. It also searches Photos and Apple Notes for BIP39 recovery phrases, sending only checksum-valid ones, and takes the address book. A copy of one production server held 11 victim recovery phrases, 179 device data folders and 75 operator accounts, and the admin panel supports agents, commissions and device quotas, which points to a theft service sold to others; Censys stresses this does not prove 179 victims. The 18.x chains are patched in iOS 18.7.3 and iOS 26.3. Censys also found unfinished development work on an iOS 26 chain built around a JavaScriptCore bug it tracks as CVE-2026-31001; it is not deployed, and Censys does not call it a zero-day. Censys published detection signatures for the Mach-O samples. Primary: Censys; wire: Cyber Security News. UPDATE (8 Oct): iVerify separately reported a new DarkSword variant it calls P7 DarkSword, after the threat actor's p7_ code prefix, found while investigating an infected customer iPhone in August 2026. Compared with common variants it drops debug logging over HTTP and syslog, uses fewer process injections, uses browser localStorage to avoid re-exploiting the same phone, and converts keychain data to JSON on the device before sending it. Its implant sits in SpringBoard and polls its server every 15 seconds for commands, with dozens of handlers for file browsing, uploads, running JavaScript, and pulling Apple Notes databases, recent photos and crypto wallet app data. iVerify also saw several unsuccessful, apparently AI-assisted attempts to port the leaked kit to iOS 26 and published indicators of compromise. Keep iPhones on current iOS and use Lockdown Mode for high-risk staff.
Censys — DarkSword/Coruna open directory finding report (7 Oct 2026)
Cofense Intelligence reported on 7 October 2026 on email campaigns against the accommodation industry that pose as guest complaints or negative reviews, describing dirty rooms, disputes with staff or threatened legal action, and link to supposed photo, video or document evidence. The link gives an archive holding a Windows shortcut (LNK) disguised as a JPG, plus a dummy MP4 whose size changes on each download so file hashes keep changing. Opening the shortcut downloads Node.js and installs EtherRAT or TONResolver. EtherRAT reads an Ethereum smart contract through a public JSON-RPC service to recover its current command server; TONResolver does the same through a public TON blockchain API. Because the server address lives on a public blockchain, the operator can move servers with one transaction and existing infections follow, which blunts domain or hosting takedowns, and the lookups resemble normal wallet traffic. Cofense assesses with moderate confidence that this continues earlier Booking.com-themed phishing that used ClickFix pages to deliver PureRAT or NetSupport Manager, and that generative AI is used to vary the email wording. Primary: Cofense Intelligence; wire: Cyber Security News.
Cofense — From guest complaints to malware: blockchain abuse targets hotels (7 Oct 2026)
Socket Threat Research reported on 7 October 2026 a campaign of 16 malicious Firefox extensions posing as cryptocurrency wallet portals, desktop utilities and browser tools. Four were clones of Rabby Wallet (shown as 'Raabby WaIIet') that hooked mnemonic and private-key import and sent the raw secret in GET parameters to a Cloudflare Worker; twelve were clones of OKX Wallet, eleven of which forwarded 12- or 24-word phrases from a background script, and one shipped broken. Fifteen contacted icy-star-f45c[.]workers[.]dev and the broken one fondationanimalaidrelief[.]workers[.]dev. Every manifest declared Firefox data-collection permission 'none' despite the code. Socket links the operators to an August 2026 wave and says they rotate names, versions, IDs and descriptions while reusing code and infrastructure. All the extensions had been removed from Mozilla's add-ons site by 5 October. Anyone who entered a real recovery phrase or private key into one should treat the wallet as compromised and move funds to a new wallet created on a clean system. Primary: Socket; wire: The Hacker News.
curl 8.23.0 was released on 14 October 2026 with 24 security fixes. The standout is CVE-2026-92392, HTTP/2 upload Use-After-Free, rated HIGH by the curl project (CWE-416). During an HTTP/2 upload, mishandling of a server RST_STREAM (HTTP_1_1_REQUIRED or REFUSED_STREAM) can leave a dangling pointer to a Curl_easy handle; when the application frees that handle and later cleans up the multi handle, libcurl can download attacker-controlled data into the freed memory and then call a corrupted function pointer — remote code execution. Affected: curl 8.12.0 through 8.22.0; not affected: before 8.12.0, 8.23.0 and later, plus the older-branch fixes 8.14.3, 8.16.2 and 8.20.2 listed in the advisory. Daniel Stenberg says successful RCE needs many concurrent conditions (valid server certificate for an upload of roughly the right size, known architecture/libc/heap layout, nghttp2 and OpenSSL/TLS 1.3 allocation behaviour, ~23-byte payload window), so wild exploitation is judged extremely difficult and a crash is the likelier outcome — hence HIGH not CRITICAL. The bug was found and reported by Luna Tong at Anthropic using Anthropic's OSS Scanner on 15 September; the release was brought forward by two weeks. Primary: curl CVE-2026-92392 advisory and Daniel Stenberg's UAF write-up; release notes for 8.23.0. UPDATE 15 October: the reporter's HackerOne write-up (report 4030333), with the malicious server script and a Docker container described as reproducing the code execution, became public alongside the advisory on 14 October, so a proof of concept is available; no source reports attacks using it. curl's machine-readable advisory lists the fixed versions as 8.14.3, 8.16.2, 8.20.2 and 8.23.0. Debian 13 (trixie) is fixed in 8.14.1-2+deb13u7 (DSA-6558-1); Debian 12 (bookworm) does not carry the vulnerable code. The Hacker News says the attack needs the client to upload a file of roughly 135 KB over HTTP/2 to an attacker-controlled server whose certificate passes the client's checks, and that libcurl negotiates HTTP/2 by default for https:// URLs when built with HTTP/2 support. curl's interim advice is not to use HTTP/2. Wire: The Hacker News.
curl — CVE-2026-92392: HTTP/2 upload Use-After-Free (14 Oct 2026)
Have I Been Pwned (HIBP) added CyrusOne on 7 October 2026. HIBP says the data centre operator was the target of a ShinyHunters 'pay or leak' extortion attempt in August 2026, and that the group then published data allegedly obtained from the company, including about 373,500 unique email addresses across records relating to users, sales leads and CyrusOne employees. HIBP says the data was largely corporate contact information (names, physical addresses, phone numbers, employers and job titles) and also included support tickets and other information about the company's operations. When ShinyHunters first made its claim in August, Cybernews reported that the group said it held 12.9 million Salesforce records, demanded US$13 million and listed floor plans, electrical diagrams and access-control records among the data; those are ShinyHunters' claims, and HIBP's description does not mention facility documents. CyrusOne had not commented publicly at the time of Cybernews' report, and no public statement from CyrusOne was found. UPDATE 22 Oct 2026: reworded so each claim is attributed to Have I Been Pwned, and removed wording its breach page does not support (source: Have I Been Pwned).
Have I Been Pwned — CyrusOne breach (added 7 Oct 2026; breach August 2026)
Anthropic released Claude Haiku 5.5 on 7 October 2026, describing it as its cheapest, fastest and most capable small model, aimed at high-volume jobs such as summaries, classification and database queries, and as a subagent under Opus 5.5 and Sonnet 5.5 on coding work. Anthropic says it costs about 75% less to run than Haiku 4.5 on average, and it is the first Haiku-class model with an adjustable effort setting. On safety, Anthropic says Haiku 5.5's cybersecurity safeguards are more restrictive than Haiku 4.5's but somewhat less restrictive than those on other recent models: they allow a wider range of defensive work than the Sonnet 5.5 safeguards while still blocking penetration testing and other techniques more likely to be used by attackers. Organisations doing wider-ranging cyber work are pointed to its Cyber Verification Program. It is available on the Claude Platform as claude-haiku-5-5 and through Amazon Web Services, Google Cloud and Microsoft Azure. In the same announcement Anthropic halved Sonnet 5.5 cache-read prices and added computer-use and browser-use support (beta) to its Python and TypeScript SDKs. Primary: Anthropic.
Anthropic — Introducing Claude Haiku 5.5 (7 Oct 2026)
