News
Short, sourced readings of developments in cybercrime, the Dark Web, OSINT and cyber-geopolitical risk, and news from Intellidark and its founder.
Cybercrime
SonicWall Patches Exploited SonicOS Flaw That Weakens SAML VPN Logins
SonicWall has patched CVE-2026-19868, a SonicOS SSL VPN flaw that can let a user with valid credentials for another login method bypass SAML authentication, as reported by SecurityWeek.
Source: SecurityWeek
Cybercrime
ENISA Warns of Attacks on Refrigeration Systems Across Europe
Reporting by Security Affairs says ENISA, the European Commission, Europol and EU cybersecurity bodies issued a joint warning after attacks on commercial refrigeration systems in several Member States, with about 300 Intermarché and Netto stores affected in France.
Source: Security Affairs
Cybercrime
FBI and CISA warn of attacks on refrigeration and cold-chain systems
BleepingComputer reports that the FBI and CISA warn hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide.
Source: BleepingComputer
Cybercrime
Residential Proxy Traffic Found Exiting Through White House Network
Layer3 Intel, as reported by Security Affairs, found residential proxy exit activity on AS2650, a network registered to the Executive Office of the President, between 5 October and 3 November.
Source: Security Affairs
Cybercrime
OpenSSH Patches ‘SSHole’ Authentication Bypass on Linux Systems Using musl libc
SecurityWeek reports that OpenSSH has released emergency patches for a high-severity flaw, tracked as CVE-2026-123158 and scored 8.1, that lets attackers log in with very long passwords on some Linux distributions.
Source: SecurityWeek
Cybercrime
CISA Warns Hackers Are Exploiting 18-Year-Old WordPress Core Vulnerability
The US Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are exploiting CVE-2026-119977, a WordPress core flaw that can allow takeover of websites during an update, as reported by Hackread.
Source: Hackread
Cybercrime
Fake OpenAI and SpaceX event pages steal Microsoft and Google accounts
According to Push Security, as reported by BleepingComputer, attackers use fake OpenAI, SpaceX and Anthropic event invitations to steal Microsoft and Google credentials and sessions.
Source: BleepingComputer
Cybercrime
Fake ChatGPT and Claude Apps Deliver Yoba Malware Through GitHub
According to Check Point research reported by Hackread, attackers distribute fake ChatGPT and Claude desktop apps on GitHub that bundle malware with genuine executables signed by OpenAI and Anthropic.
Source: Hackread
Cybercrime
APT29 Linked to Mobile Watering Hole Campaign Using n-Day Exploit Chains
Sekoia reports a watering hole campaign targeting iOS and Android users through hacked websites and a compromised Ukrainian analytics service, which it links with moderate to high confidence to APT29.
Source: Security Affairs
Cybercrime
CISA adds Apple flaw CVE-2024-27834 to Known Exploited Vulnerabilities catalog
Security Affairs reports that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Apple flaw CVE-2024-27834 to its Known Exploited Vulnerabilities catalog, with federal agencies ordered to fix it by 18 November 2026.
Source: Security Affairs
Cybercrime
Zyxel GS1900 Patch 2 Does Not Block Zero-Day Root Command Execution Exploit
Researchers at Binarly found that Zyxel GS1900 switches with the earlier Patch 2 firmware remain open to a zero-day exploit that runs commands without login, as reported by The Hacker News.
Source: The Hacker News
Cybercrime
Zyxel patches zero-day exploited to compromise nearly 1,000 GS1900 switches
BleepingComputer reports that Zyxel has patched CVE-2026-107441, a zero-day in its GS1900 series switches that attackers exploited to compromise 996 devices across 48 countries, according to GreyNoise.
Source: BleepingComputer
Contact