Short, sourced readings of developments in cybercrime, the Dark Web, OSINT and cyber-geopolitical risk, and news from Intellidark and its founder.
What we’re watchingCybercrime
The U.S. Cybersecurity and Infrastructure Security Agency added two flaws, one in Check Point products and one in UnrealIRCd, to its Known Exploited Vulnerabilities catalog, as reported by Security Affairs. Federal agencies must fix both by 16 November 2026.
Cybercrime
Hackread reports, citing Aikido Security, that attackers used 4,837 compromised GitHub accounts to open probe pull requests across 61,764 repositories, with credential-stealing code confirmed to have run in at least 1,835 of them.
Source: Hackread
Cybercrime
According to SecurityWeek, Citrix announced patches for 28 vulnerabilities in NetScaler ADC and NetScaler Gateway, nine of them rated critical, and a further critical flaw in NetScaler Console.
Source: SecurityWeek
Cybercrime
According to SecurityWeek, N-able has patched several zero-days in N-central after a researcher published proof-of-concept code for more than 30 flaws and the company reported in-the-wild scanning targeting them.
Source: SecurityWeek
Cybercrime
Poland temporarily shut down its ePUAP e-government platform after detecting and stopping a cyberattack, according to Security Affairs, citing the Digital Affairs Minister Krzysztof Gawkowski.
Source: Security Affairs
Cybercrime
According to Huntress, a threat actor compromised 288 hosts across 48 organizations using ConnectWise ScreenConnect, exploiting a flaw in the third-party RMM+ extension.
Source: SecurityWeek
Cybercrime
Security Affairs reports that Zoom has released updates for two vulnerabilities in Zoom Workplace for Windows, one rated critical (CVSS 9.6) and allowing privilege escalation over a network without logging in.
Source: Security Affairs
Cybercrime
According to BleepingComputer, Europol and law enforcement partners from nine countries seized hundreds of servers and domains used by the Gootloader, CastleRAT and StealC malware operations, as part of Operation Endgame.
Source: BleepingComputer
Cybercrime
BleepingComputer reports that a worm-like toolkit named SCKit was deployed in ScreenConnect attacks on managed service providers, which Huntress and Blackpoint Cyber have not seen spreading successfully.
Source: BleepingComputer
Cybercrime
Krebs on Security reports that the administrator of the Qilin ransomware affiliate program, who uses the handle Haise, is linked to a 36-year-old man in St. Petersburg, Russia, based on identity links drawn from several intelligence firms.
Source: Krebs on Security
Contact
