Socket Threat Research reported on 7 October 2026 a campaign of 16 malicious Firefox extensions posing as cryptocurrency wallet portals, desktop utilities and browser tools. Four were clones of Rabby Wallet (shown as 'Raabby WaIIet') that hooked mnemonic and private-key import and sent the raw secret in GET parameters to a Cloudflare Worker; twelve were clones of OKX Wallet, eleven of which forwarded 12- or 24-word phrases from a background script, and one shipped broken. Fifteen contacted icy-star-f45c[.]workers[.]dev and the broken one fondationanimalaidrelief[.]workers[.]dev. Every manifest declared Firefox data-collection permission 'none' despite the code. Socket links the operators to an August 2026 wave and says they rotate names, versions, IDs and descriptions while reusing code and infrastructure. All the extensions had been removed from Mozilla's add-ons site by 5 October. Anyone who entered a real recovery phrase or private key into one should treat the wallet as compromised and move funds to a new wallet created on a clean system. Primary: Socket; wire: The Hacker News.
curl 8.23.0 was released on 14 October 2026 with 24 security fixes. The standout is CVE-2026-92392, HTTP/2 upload Use-After-Free, rated HIGH by the curl project (CWE-416). During an HTTP/2 upload, mishandling of a server RST_STREAM (HTTP_1_1_REQUIRED or REFUSED_STREAM) can leave a dangling pointer to a Curl_easy handle; when the application frees that handle and later cleans up the multi handle, libcurl can download attacker-controlled data into the freed memory and then call a corrupted function pointer — remote code execution. Affected: curl 8.12.0 through 8.22.0; not affected: before 8.12.0, 8.23.0 and later, plus the older-branch fixes 8.14.3, 8.16.2 and 8.20.2 listed in the advisory. Daniel Stenberg says successful RCE needs many concurrent conditions (valid server certificate for an upload of roughly the right size, known architecture/libc/heap layout, nghttp2 and OpenSSL/TLS 1.3 allocation behaviour, ~23-byte payload window), so wild exploitation is judged extremely difficult and a crash is the likelier outcome — hence HIGH not CRITICAL. The bug was found and reported by Luna Tong at Anthropic using Anthropic's OSS Scanner on 15 September; the release was brought forward by two weeks. Primary: curl CVE-2026-92392 advisory and Daniel Stenberg's UAF write-up; release notes for 8.23.0. UPDATE 15 October: the reporter's HackerOne write-up (report 4030333), with the malicious server script and a Docker container described as reproducing the code execution, became public alongside the advisory on 14 October, so a proof of concept is available; no source reports attacks using it. curl's machine-readable advisory lists the fixed versions as 8.14.3, 8.16.2, 8.20.2 and 8.23.0. Debian 13 (trixie) is fixed in 8.14.1-2+deb13u7 (DSA-6558-1); Debian 12 (bookworm) does not carry the vulnerable code. The Hacker News says the attack needs the client to upload a file of roughly 135 KB over HTTP/2 to an attacker-controlled server whose certificate passes the client's checks, and that libcurl negotiates HTTP/2 by default for https:// URLs when built with HTTP/2 support. curl's interim advice is not to use HTTP/2. Wire: The Hacker News.
curl — CVE-2026-92392: HTTP/2 upload Use-After-Free (14 Oct 2026)
Have I Been Pwned (HIBP) added CyrusOne on 7 October 2026. HIBP says the data centre operator was the target of a ShinyHunters 'pay or leak' extortion attempt in August 2026, and that the group then published data allegedly obtained from the company, including about 373,500 unique email addresses across records relating to users, sales leads and CyrusOne employees. HIBP says the data was largely corporate contact information (names, physical addresses, phone numbers, employers and job titles) and also included support tickets and other information about the company's operations. When ShinyHunters first made its claim in August, Cybernews reported that the group said it held 12.9 million Salesforce records, demanded US$13 million and listed floor plans, electrical diagrams and access-control records among the data; those are ShinyHunters' claims, and HIBP's description does not mention facility documents. CyrusOne had not commented publicly at the time of Cybernews' report, and no public statement from CyrusOne was found. UPDATE 22 Oct 2026: reworded so each claim is attributed to Have I Been Pwned, and removed wording its breach page does not support (source: Have I Been Pwned).
Have I Been Pwned — CyrusOne breach (added 7 Oct 2026; breach August 2026)
Anthropic released Claude Haiku 5.5 on 7 October 2026, describing it as its cheapest, fastest and most capable small model, aimed at high-volume jobs such as summaries, classification and database queries, and as a subagent under Opus 5.5 and Sonnet 5.5 on coding work. Anthropic says it costs about 75% less to run than Haiku 4.5 on average, and it is the first Haiku-class model with an adjustable effort setting. On safety, Anthropic says Haiku 5.5's cybersecurity safeguards are more restrictive than Haiku 4.5's but somewhat less restrictive than those on other recent models: they allow a wider range of defensive work than the Sonnet 5.5 safeguards while still blocking penetration testing and other techniques more likely to be used by attackers. Organisations doing wider-ranging cyber work are pointed to its Cyber Verification Program. It is available on the Claude Platform as claude-haiku-5-5 and through Amazon Web Services, Google Cloud and Microsoft Azure. In the same announcement Anthropic halved Sonnet 5.5 cache-read prices and added computer-use and browser-use support (beta) to its Python and TypeScript SDKs. Primary: Anthropic.
Anthropic — Introducing Claude Haiku 5.5 (7 Oct 2026)
Splunk published five security advisories on 7 October 2026. SVD-2026-1001 lists 17 CVEs in Splunk Enterprise; the worst, CVE-2026-76268 (CVSS 3.1 9.8), affects 10.4 before 10.4.3 and 10.2 before 10.2.7: an unauthenticated attacker with network access to the Patroni REST API on a search head cluster member can run operating-system commands, because that interface does not require authentication for critical configuration operations. Versions 10.0.x and 9.4.x are not affected by that one. The same advisory also fixes a local privilege escalation to root through Linux package upgrades (CVE-2026-76266, 7.7), low-privilege access to other users' search jobs, queries and results (CVE-2026-76269, 6.5), SQL injection in the SPL2 module catalog (CVE-2026-76270, 6.5), an SSRF in the Splunk Observability Cloud app (CVE-2026-76274, 6.5) and several Splunk Secure Gateway authorisation gaps (CVE-2026-76265, 76272, 76280). SVD-2026-1002 groups internally found issues into five CVEs, the highest scored 9.8 (CVE-2026-76281, improper access control) and 9.0 (CVE-2026-76284, improper neutralisation). SVD-2026-1003 and SVD-2026-1005 cover third-party package updates in Splunk Enterprise and the Splunk Add-on for AWS, both rated Critical. SVD-2026-1004 fixes Splunk MCP Server before 1.2.1, which could send a user's Splunk authentication token to the URL of a custom API tool set up by another user (CVE-2026-76286, 5.3). Splunk does not report exploitation. Primary: Splunk security advisories.
Splunk — SVD-2026-1001: Security Vulnerabilities in Splunk Enterprise, September/October 2026 (7 Oct 2026)
HashiCorp published four Vault security bulletins on 7 October 2026, all fixed in Vault Community Edition 2.1.2 and Vault Enterprise 2.1.2, 1.21.12, 1.20.17 and 1.19.23. HCSEC-2026-43 (CVE-2026-89322, CVSS 3.1 7.2): Vault did not always evaluate ACL policies against the canonical form of resource and policy names, so an authenticated user with delegated permissions could get around an explicit deny, reach a protected resource or assign a denied policy, and so escalate privileges. HCSEC-2026-41 (CVE-2026-105816, 8.0): with Shamir seals and an external plugin directory configured, a privileged operator who can restore an Integrated Storage (Raft) snapshot may be able to run arbitrary code on the Vault host, because stored plugin catalog entries were not checked to point inside the plugin directory. HCSEC-2026-40 (CVE-2026-105818, 5.9): under the default directory policy, the PKI secrets engine's ACME server could issue certificates containing identities the ACME challenge never validated, which could allow impersonation toward systems that trust that PKI mount (affects 1.14.0 and later). HCSEC-2026-42 (CVE-2026-105820, 5.4, Enterprise only): crafted policy names with path traversal let a token use policies from other namespaces, including the root namespace. HashiCorp does not report exploitation. Primary: HashiCorp security bulletins and CVE records.
HashiCorp — HCSEC-2026-43: Vault inconsistent ACL policy evaluation may allow bypass of deny restrictions (7 Oct 2026)
The US Justice Department said on 7 October 2026 that Zohar Pinhasi, 50, owner of Florida ransomware remediation company MonsterCloud LLC, was arraigned in the Eastern District of New York on two counts of wire fraud and one count of wire fraud conspiracy (docket 26-CR-271; indictment filed 23 September). Prosecutors allege that from June 2018 to June 2023 MonsterCloud told ransomware victims not to pay and claimed to have proprietary tools and advanced decryption techniques, but in practice contacted the attackers, paid them for decryption keys and charged clients far more than the ransom. In one example cited by the Justice Department, about US$8,200 went to a ransomware operator and the client was billed about US$150,000. Over the scheme he allegedly charged clients more than US$19 million and paid more than US$8 million in ransoms, with BleepingComputer reporting hundreds of affected companies in the US and Canada. Pinhasi pleaded not guilty and was released on a US$2 million bond, according to the US Attorney's Office. Each count carries a maximum of 20 years. For Australian organisations the case is a reminder that a paid recovery or negotiation firm may still be paying the attacker on your behalf, which can bring the ransomware payment reporting obligation under the Cyber Security Act 2024 into play. Primary: US Department of Justice; wire: BleepingComputer.
US Department of Justice — Known cybersecurity expert and owner of Florida ransomware remediation company charged with defrauding clients (7 Oct 2026)
breaches
Vulnerabilities
Wed 7 Oct
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NGOAM, MPLS OAM AND NX-API ON NEXUS)
Cisco published its scheduled October 2026 batch at 16:00 UTC on 7 October (midnight 8 October Perth). The headline items are three advisories for Nexus 3000 and Nexus 9000 switches running standalone NX-OS. Next Generation OAM (NGOAM), the VXLAN and SRv6 diagnostics feature, carries three flaws (CVE-2026-76485, CVE-2026-76486, CVE-2026-76501) where crafted IP packets sent to any IP interface let a remote attacker with no login run code as root or crash and reload the switch. MPLS OAM has the same outcome from a crafted MPLS echo-request (CVE-2026-76465). The NX-API management interface has a third path, a crafted HTTP request (CVE-2026-76471). All five score 9.8. Exposure depends on features: CVE-2026-76485 needs only NGOAM enabled, CVE-2026-76486 also needs SRv6 or NV Overlay with a VXLAN peer learned, CVE-2026-76501 also needs SRv6, and MPLS OAM and NX-API are both off by default. On UCS 6300 fabric interconnects the NX-API bug is reachable through the UCS Manager XML API with a low-privileged login, so Cisco rates it High there. In the same release Cisco grouped internally found bugs into Critical 'security hardening' advisories: NX-OS (six CVEs, top score 9.8 for CVE-2026-76455), APIC, the controller for Nexus 9000 in ACI mode (CVE-2026-76498, -76499 and -76500, each 9.8), and Meraki (seven CVEs, top 9.6). It also fixed a Finesse SSRF (CVE-2026-20362, 7.2) that Cisco says has been publicly described, and medium-rated NX-OS, APIC and ACI bugs. Cisco's own engineers found the switch flaws, and PSIRT knows of no public disclosure or malicious use of them. For Australian operators, these are core data-centre and campus switches, so treat the OAM and NX-API advisories as the priority on any switch where those features are on.
Cisco Security Advisory — Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities, cisco-sa-ngoam-rce-LWKQ4BU (7 Oct 2026)
Cisco published two Critical advisories on 7 October 2026 for Cisco License On-Prem, the on-premises licensing server previously sold as Smart Software Manager (SSM) On-Prem. The first covers four bugs. CVE-2026-20328 (CVSS 9.1) is a broken check in the password-reset process of the web management interface: a remote attacker with no account can reset the password of any user, including administrators, and log in as them. CVE-2026-76454 (CVSS 9.1) is in the Smart Licensing Utility API, which lacks authentication and input validation, so a crafted request can write arbitrary files on the server or knock it over. Two lower-rated bugs, an authenticated OS command injection through submitted configuration (CVE-2026-76437) and an authenticated SQL injection (CVE-2026-76452), score 4.9 each. Gabriele Paris of the NATO Cyber Security Centre reported CVE-2026-20328, -76437 and -76452, and Trung Nguyen of CyStack reported CVE-2026-76454. The second advisory is a Critical 'security hardening release' grouping four internally found bugs (CVE-2026-76480 at 9.8, CVE-2026-76482 at 10.0, CVE-2026-76483 at 9.1, CVE-2026-76484 at 8.8). Both advisories say every configuration is affected and there are no workarounds. Cisco PSIRT knows of no public disclosure or malicious use. License On-Prem servers usually sit inside the network holding entitlement data for every Cisco device an organisation licenses, so an exposed management page is the main worry.
Lumen's Black Lotus Labs published research on 7 October 2026 into PoeLLM, Linux malware (an ELF file named libgcrypt) behind a cryptomining and exploit-scanning campaign aimed mainly at self-hosted AI infrastructure. Instead of a hard-coded server, each infected host reads a poem titled "On the Nature of Connection" from a dash.css file in a GitHub repository dressed up as a Node.js fork, picks out four words or phrases and turns them into an IPv4 address with a built-in dictionary; the operator moves command-and-control by editing the poem, which has been changed 11 times since the first commit on 13 April 2026. Black Lotus Labs first found the infrastructure while investigating Ivanti Sentry CVE-2026-10520, when a compromised Sentry appliance contacted 5.78.73[.]122 in early June and began scanning. Most victims run vulnerable, internet-exposed LiteLLM or Ollama, and hundreds run the Gotenberg PDF converter or Gitea; infected servers scan ports 3000 and 4000 (Gotenberg and LiteLLM) and try LiteLLM CVE-2026-42271, which Horizon3.ai showed can be chained with CVE-2026-48710 for unauthenticated code execution. The implant includes a remote shell, XMRig and Iron miners tied to the Russian mining service Kryptex, HTTP/S scanning and exploit delivery, and some command servers sat on compromised home routers. Lumen counted almost 2,200 affected servers at the mid-June peak with nearly 800 active a day, mostly in the US and Western Europe; BleepingComputer and The Hacker News report the live count has since passed 3,400. Lumen assesses with moderate confidence the operator speaks Italian, and says it has blocked all traffic to the known command servers. Primary: Lumen Black Lotus Labs; wires: BleepingComputer and The Hacker News (7 Oct).
Lumen Black Lotus Labs — Canto Incognito: tracking the PoeLLM malware (7 Oct 2026)
JFrog disclosed CVE-2026-105192 on 7 October 2026, a critical flaw in LMCache, the open-source key-value cache that speeds up LLM serving engines such as vLLM. In multiprocess (distributed) mode LMCache runs as a standalone server and opens a ZeroMQ socket, port 5555 by default, so worker processes can register and share cached blocks. That socket has no authentication. One message type carries a msgpack extension that is handed to Python's pickle.loads while the server is still decoding the REGISTER_KV_CACHE arguments, before any handler or type check runs, so a single crafted message executes the sender's code as the LMCache user. JFrog says the official container images run that process as root. The 9.8 score applies when the server is bound to a routable address with --host, which is the documented multi-node setup and what LMCache's own example Kubernetes DaemonSet does (it listens on every interface); a default single-host install that stays on localhost is not reachable from other machines, and LMCache running inside a single vLLM process does not open the port at all. The decode path arrived in 0.3.9 (October 2025) and is still present in 0.5.5, the latest PyPI release, the 0.5.6 release candidates through rc3 and the dev branch as of 7 October. LMCache has not published its own advisory, and JFrog gives no way to tell whether a server has already been hit. Separately, one GitHub account opened six more LMCache security reports on 6 October alleging unauthenticated cross-tenant cache access and command-running network services; those have no CVE or maintainer confirmation. Researcher: Yuval Moravchick (JFrog). Primary: JFrog Security Research advisory JFSA-2026-001694382; wire: The Hacker News (7 Oct). Correction (22 Oct 2026): this card said no fixed release existed and that LMCache had not published its own advisory. LMCache published advisory GHSA-w5f2-9q9c-ff4h on 13 October (CVSS 3.1 9.8) listing 0.3.9 up to 0.5.6 as affected and 0.5.6 as the fix; 0.5.6 was released on PyPI on 15 October. (source: LMCache GitHub advisory GHSA-w5f2-9q9c-ff4h)
JFrog Security Research — LMCache unauthenticated RCE via pickle deserialization on the multiprocess ZMQ transport, CVE-2026-105192 (7 Oct 2026)
US energy group Southern Company is notifying roughly 400,000 utility customers that an unauthorised third party accessed their account information through its online customer portal, SecurityWeek reported on 7 October 2026. About 300,000 of the accounts belong to Georgia Power customers and about 100,000 to Alabama Power; Mississippi Power is named in the company's notice but no number has been given for it. The notice says the information reached was name, mailing address, phone number, email address or the last four digits of the US Social Security number, plus other basic account details, and that bank account numbers, payment card numbers and driver's licence numbers were not accessed. The company says it found the activity through its own monitoring, stopped it, brought in law enforcement and has found no sign of ongoing access. It has not said when the intrusion happened or how the attacker got into the portal. Affected customers are being told by email or letter and offered a year of Equifax credit monitoring. No Australian customers are involved. Primary: Southern Company / Georgia Power customer notice; wire: SecurityWeek.
Southern Company — Information regarding a recent incident involving customer information (customer notice; date not shown on page)
