#InfoSEC

PARTENAIRE HACKFEST 2026 SPONSOR : PRIVACY SAFE

Our 18th edition, Hackfest Level Up, would not be possible without our sponsors. And this year, we are happy to have Privacy Safe, a SMB BOOTH sponsor!

If you want to learn more about this company’s mission, visit their website https://privacy-safe.io/

PS: YOU CAN STILL BUY YOUR TICKET for October 29–31, 2026 at the Convention Center of Québec ;) More info: https://hackfest.ca/en/?utm_source=mastodon&utm_medium=socmed&utm_campaign=sponsors

#hacking #infosec #hackfest #hf2026 #cybersecurity

PARTENAIRE HACKFEST 2026 SPONSOR : PRIVACY SAFE

La prochaine édition du 18e Hackfest Level Up ne serait pas possible sans nos partenaires. Nous sommes heureux d’avoir avec nous Privacy Safe, qui est un partenaire KIOSQUE PME!

Visiter leur site web : https://privacy-safe.io/

PS VOUS POUVEZ TOUJOURS ACHETER VOS BILLETS pour les 29, 30 et 31 octobre 2026 au Centre des congrès de Québec ;) Info sur notre site web : https://hackfest.ca/?utm_source=mastodon&utm_medium=socmed&utm_campaign=sponsors

#hacking #infosec #hackfest #hf2026 #cybersecurity

Possible Phishing 🎣
on: ⚠️hxxps[:]//www[.]roblox[.]com[.]bi/users/344434640586/profile
🧬 Analysis at: https://urldna.io/scan/6ad9a67a3b77500006178202
#cybersecurity #phishing #infosec #urldna #scam #infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//login-verifydocusignauthentication[.]dannatel[.]com[.]br/signature/document/
🧬 Analysis at: https://urldna.io/scan/6ad9a6683b77500005427dc3
#cybersecurity #phishing #infosec #urldna #scam #infosec

Let's hope this doesn't include targets among allies, such as they are. The unit was created quietly in April.

"The creation of the Technology Support Office signals the Defense Department's intent to ramp up a range of aggressive covert activities abroad."

"TSO as it is called internally, is nearly impossible to find on Pentagon websites, and the agency is mentioned by name only in several previously unreported Defense Department historical records and memoranda."

Politico: The Pentagon is quietly building an elite new tech sabotage agency https://www.politico.com/news/2026/10/22/technology-support-office-dod-tech-spyware-sabotage-01100327 @politico #infosec

🚨New ransom group blog post!🚨

Group name: qilin
Post title: Airtificial
Sector: Professional Services
Info: https://cti.fyi/#disclosure/qilin/Airtificial

#ransomware #cti #threatintelligence #cybersecurity #infosec

If you missed this yesterday, the platform is called Athena StealthRoute. In addition to phishing on demand, the service includes "a marketplace and link-cloaking capabilities designed to divert security scanners away from malicious destinations."

Infosecurity-Magazine: New PhaaS Platform Uses AI to Craft Phishing Lures and Mask Malicious Activity https://www.infosecurity-magazine.com/news/new-phaas-uses-ai-phishing-lures/ #infosec #phishing #cybercrime

🆕 New event added:

📌 Kernelcon
📅 Mar 4-5, 2027
📍 Omaha (NE) 🇺🇸
🔗 https://kernelcon.org/

#infosec #cybersecurity #conference #Kernelcon #USA

🆕 New event added: @NorthSec

📌 NorthSec
📅 May 13-14, 2027
📍 Montreal (QC) 🇨🇦
🔗 https://nsec.io/

#infosec #cybersecurity #conference #Canada

PHP2Shell field report — the attacker-side view.

The first exploit-shaped request hit our Mirage honeypot fleet at 21:57 UTC on 20 Oct, ~16h before the patch embargo lifted. Over the next 48h: 9 source IPs, 7 countries, 2 distinct attack shapes.

Highlights:

One actor swept body size <1KB → 16KB+, 200+ unique payloads in 2 min — live calibration of the OOM trigger
The lead tool stamps ----p2shell<hex> into its multipart boundary: a zero-false-positive detection tell we haven’t seen documented elsewhere
A B8RAT/1.0 actor reaching for the deserialization path (CVE-2026-109619) while others hammer the OOM path (CVE-2026-109618)
Independent confirmation of the pre-disclosure exploitation Amazon & Cloudflare reported, from a second sensor network

Full writeup + IOCs:
https://offseq.com/en/research/php2shell-first-48-hours/

#infosec #PHP2Shell #threatintel #honeypot #PHP #CVE

"Users who downloaded an unpinned version of LiteLLM between 11:39 a.m. and 1:23 p.m. UTC via pip or used the Docker image v1.107.0, latest, main-latest, or main-stable between 11:46 a.m. and 2:20 p.m. UTC are impacted."

LiteLLM, from yesterday: Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised https://docs.litellm.ai/blog/security-incident-oct-21-2026

More:

The Hacker News: LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html @thehackernews #GitHub #infosec #Docker

Railway made the disclosure yesterday: https://blog.railway.com/p/security-disclosure-wednesday-october-21st

More:

The Hacker News:

Platform-as-a-Service Provider Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html @thehackernews #infosec #databreach

"A pair of Marines filed a class-action lawsuit Tuesday against the Pentagon over a data breach at the Defense Manpower Data Center, or DMDC, arguing it allowed scammers to obtain and use their personally identifiable information, or PII."

Military Times: Pentagon ignored cybersecurity flaws before data breach, Marines’ lawsuit says https://www.militarytimes.com/news/pentagon-congress/2026/10/22/pentagon-ignored-cybersecurity-flaws-before-data-breach-marines-lawsuit-says/ #infosec #scam #databreach

Capcom's CAPCOM ID breach exposed 11.7 Million records.

The part that stands out: 196 accounts had their passwords changed without authorization.

Exposed data includes email addresses, IP addresses, last-login timestamps and login counts.

Capcom says credit card data wasn't involved. It has not confirmed that users' original passwords were compromised.

The bigger concern is what attackers can do with millions of real account records: targeted phishing, account takeover attempts and cross-platform profiling.

The root cause remains unconfirmed. IDOR, session abuse and account recovery flaws are possibilities, not established findings.

Technical breakdown 👇
https://thecybersecguru.com/news/capcom-id-breach-2026/

#InfoSec #CyberSecurity #DataBreach

The day after another AI company scared the world out of its wits:

Reuters: In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it," Cloudflare CEO Matthew Prince said in a post on X late on Wednesday https://www.reuters.com/world/asia-pacific/cloudflare-sees-millions-exploit-attempts-after-php-disclosure-2026-10-22/ @Reuters #Cloudflare #infosec #PHP #vulnerability

PARTENAIRE HACKFEST 2026 SPONSOR : GOSECURE

Our 18th edition, Hackfest Level Up, would not be possible without our sponsors. And this year, we are happy to have GoSecure, a DÉPANNEUR sponsor!

If you want to learn more about this company’s mission, visit their website https://gosecure.ai/

PS: YOU CAN STILL BUY YOUR TICKET for October 29–31, 2026 at the Convention Center of Québec ;) More info: https://hackfest.ca/en/?utm_source=mastodon&utm_medium=socmed&utm_campaign=sponsors

#hacking #infosec #hackfest #hf2026 #cybersecurity

📣 Say hello to the Spamhaus Sender Guidelines! These are for anyone running a mail server, from your IT admin to the biggest ESPs...and because DNS is kind of our thing, we've also built a HELO/DNS checker too!

We're really proud of this one, and we hope it makes life easier for senders everywhere. Now, go grab a cup of coffee, have a read and test your setup:

👉️ https://www.spamhaus.org/sender-guidelines/

🇫🇷 If you’re heading to #M3AAWG68 next week, come and tell us what you think!

#EmailSecurity #InfoSec

PARTENAIRE HACKFEST 2026 SPONSOR : GOSECURE

La prochaine édition du 18e Hackfest Level Up ne serait pas possible sans nos partenaires. Et cette année, nous sommes heureux d’avoir avec nous GoSecure, qui est un partenaire DÉPANNEUR!

Visiter leur site web : https://gosecure.ai/

PS VOUS POUVEZ TOUJOURS ACHETER VOS BILLETS pour les 29, 30 et 31 octobre 2026 au Centre des congrès de Québec ;) Info sur notre site web : https://hackfest.ca/?utm_source=mastodon&utm_medium=socmed&utm_campaign=sponsors

#hacking #infosec #hackfest #hf2026 #cybersecurity

The number of Certificate Authorities (CA) – which can sign valid certificates for *any site* – that our devices trust by default is kinda ridiculous and outrageous.

It's dozens of entities you've never heard of. Not to pick on anyone in particular, as they might be doing a fine / better job than eMudhra, but do you need to trust the GUANG DONG CERTIFICATE AUTHORITY CO LTD. or XRamp Security Services inc.?

Well you can disable whatever CA your phone trusts.

#infosec #cybersecurity

🛡 THREAT INTEL | Asensus Surgical

🔴 Actor "Dark Project" claims 600GB

Allegedly exposed (+1 more)
• Financial records
• Employee data
• Internal documents

⚠️ Unverified claim

https://www.yazoul.net/intel/claim/2026-10-21-asensus-surgical-ransomware-claim-by-dark-project-oct-2026

by Yazoul AI

#DarkWeb #DataBreach #ThreatIntel #CyberSecurity #InfoSec

🚨 PingCAP's TiDB Cloud breach raises some serious questions.

FulcrumSec claims it ran a data collection pipeline every 6 hours for 22 days, allegedly stealing massive amounts of customer data.

The confirmed exposure includes customer metadata, SQL editor history, billing records, encrypted API key values and source code.

PingCAP says there's no evidence TiDB production data was impacted. The alleged 10.6 TB haul and the attacker's collection method remain unverified.

The real concern? Your production database can be untouched while the control plane managing it gets compromised.

Full technical breakdown: https://thecybersecguru.com/news/pingcap-data-breach-tidb-cloud/

#InfoSec #CloudSecurity

Possible Phishing 🎣
on: ⚠️hxxps[:]//help--coinbase[.]com
🧬 Analysis at: https://urldna.io/scan/6ad960453b775000027091d8
#cybersecurity #phishing #infosec #urldna #scam #infosec

PHP2Shell: patch now. Patching takes days, attacks took hours.

How bifrost security covers the gap:
→ Our CVE prioritisation engine shows every running instance of vulnerable PHP in your clusters
→ Enforced runtime profiles block shells, tool downloads, dropped binaries and credential theft
→ Every blocked attempt is a high-confidence alert

Hardened before the patch.

The deep dive, with what to look for while you patch: https://bifrostsec.com/blog/2026/php2shell-security-advisory/

#PHP2Shell #Kubernetes #infosec #RuntimeSecurity

CVE-2026-112832 (CRITICAL, CVSS 9.8) in CozyThemes Rootblox <1.0.7 allows unauthenticated remote LFI via improper filename control in PHP. Full system compromise possible. Restrict access & monitor closely. https://radar.offseq.com/threat/cve-2026-112832-improper-control-of-filename-for-includerequire-statement-in-php-program-php-remote-3c455496d4cdf128 #OffSeq #infosec #PHP #LFI

ASN: AS31334
Location: Munich, DE
Added: 2026-10-21T10:40

#shodansafari #infosec

Stop staring at your dashboard trying to tell yourself your patching cadence is optimal. It isn't. Most companies treat their vulnerability lists like restaurant menus.

https://theperimetersite.com/report/387

#vulnerability #healthcare #infosec

Hi! Welcome a new Pwndbg release: 2026.10.22 !

We now support m86k arch, unknown archs, have better C++ support, added tutorials (https://pwndbg.re/dev/tutorials/debugging-cxx/, https://pwndbg.re/dev/tutorials/mangling/, https://pwndbg.re/dev/tutorials/pretty-printing/), `nearpc -o` shows opcode bytes, we have `libcinfo` for Android Bionic libc information, we added Objective-C class inspection commands (`objc show-class` and `objc list-classes`), improved `regs` command (`regs xmm0` and `regs eflags`), have better glibc discovery, added Linux kernel 7+ SLUB sheaf and barn inspection, added `setrlimit` command, improved LLDB support and more (like bug fixes)!

See https://github.com/pwndbg/pwndbg/releases/tag/2026.10.22

Please sponsor us at https://github.com/sponsors/pwndbg !

Thanks to everyone who made it possible!

#pwndbg #gdb #lldb #debugging #security #infosec #pwn #reverseengineering #linux

Possible Phishing 🎣
on: ⚠️hxxps[:]//muskandevpk[.]github[.]io/Netflix-Clone
🧬 Analysis at: https://urldna.io/scan/6ad9a6813b77500005427dc6
#cybersecurity #phishing #infosec #urldna #scam #infosec

We truly can't wait to hear from our fabulous keynote speakers at #osco26! 🤩

⚠️ Stephanie Carstensen will tell us all about "The Day Everything Stops: Preparing for the Cyber Crisis You Hope Never Comes".

🚧 Jahmel Harris will share his insights on "Building a Penetration Testing Lab in 2026".

We believe these topics will inspire great sessions during the open space! Check out the keynote details: https://opensecurityconference.org/conference/keynotes

#osco #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi]

Four reports, one week. One conclusion.

Attackers are not breaking AI models. They are walking through the infrastructure.

1,467 MCP servers in one scan. Half the ecosystem repos teach plaintext credential storage. Shadow MCP servers on laptops via Git, Slack, and zip files, never inventoried.

The infrastructure is the attack surface. Screen it.

<https://blog.relayshield.net/attackers-arent-breaking-the-models-theyre-walking-through-the-infrastructure>

#MCP #AISecurity #infosec