Nostr notes by Catalin Cimpanu

Nostr event nevent1qqsv4ka3t6mwyasq8na7r7xcxudsjhrhna7tgs8a957edw0m5ump7fqzypvp8jcvpzu4gajewmlfsel28zetz5jw8xclwk4j9vexufvr82nkvtafq93

2026-10-21T17:16:34Z

LOL... is half the internet offline because of that PHP bug?

-Hacker hijacks 10% of Tor exit nodes -Second ransomware ...

2026-10-21T08:09:29Z

-Hacker hijacks 10% of Tor exit nodes
-Second ransomware negotiator linked to ShinyHunters
-Hacker leaks AfD internal data
-Chinese crime ring hacks Staples
-PHP RCE leaks online
-Hacker plants malware in OVHCloud app
-Chinese hacker breaches 100+ sites with AI
-Chinese AI agent used in hacks across Japan
-ICO reprimands two Welsh companies for using dumb passwords
-Cyberattack hits LOXONE home automation company

P: https://risky.biz/RBNEWS623/
N: https://news.risky.biz/risky-bulletin-hacker-hijacks-10-of-tor-exit-nodes/

The eMudhra (emSign) CA has been compromised to issue fraudulent ...

2026-10-20T18:27:13Z

The eMudhra (emSign) CA has been compromised to issue fraudulent HTTPS certificates

https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/

https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2

I'm so confused that the largest info-op that TikTok ...

2026-10-20T17:25:13Z

I'm so confused that the largest info-op that TikTok disrupted in August targeted Haiti with Putin narratives

https://www.tiktok.com/safety/en/transparency/covert-influence-operations

Google Cloud outage takes down Revolut, Lloyds, and other banking ...

2026-10-20T12:55:16Z

Google Cloud outage takes down Revolut, Lloyds, and other banking apps

https://www.businessinsider.com/google-cloud-outage-revolut-halifax-emma-uk-london-2026-10

New Heartbreaker ransomware targets macOS users ...

2026-10-20T03:27:11Z

New Heartbreaker ransomware targets macOS users

https://objective-see.org/blog/blog_0x8A.html

Hackers have accessed the backend database of WordPress plugin ...

2026-10-20T02:05:07Z

Hackers have accessed the backend database of WordPress plugin developer TeamUpdraft, stole connection keys, and then deployed malicious plugins on their sites

https://teamupdraft.com/blog/security-incident-october-2026/

https://www.wordfence.com/blog/2026/10/updraftcentral-connection-key-compromise/

Crypto platform Qubic halted operations after hackers stole $1.4 ...

2026-10-20T00:55:38Z

Crypto platform Qubic halted operations after hackers stole $1.4 million from 1,400 user accounts

Incident traced back to weak randomness on iOS and macOS wallets

https://blockonomi.com/qubic-halts-blockchain-after-1-4-million-hack-drains-1400-wallets/

A new study argues that Canada could develop its own national ...

2026-10-19T21:40:38Z

A new study argues that Canada could develop its own national operating system to replace Microsoft's Windows and still save millions in the process

https://theconversation.com/canada-could-save-millions-by-developing-its-own-operating-system-instead-of-relying-on-microsoft-windows-294027

OVHCloud CLI repo compromised in a supply chain attack ...

2026-10-19T19:48:45Z

OVHCloud CLI repo compromised in a supply chain attack

https://www.thestack.technology/ovhcloud-cli-repo-compromised-customer-reports-incident/

Palo Alto CEO wants AI labs out of the ‘fear-mongering ...

2026-10-19T17:18:30Z

Palo Alto CEO wants AI labs out of the ‘fear-mongering business’

https://finance.yahoo.com/technology/ai/articles/palo-alto-ceo-wants-ai-161700466.html

Two Serbian opposition figures targeted with spyware, research ...

2026-10-19T13:28:23Z

Two Serbian opposition figures targeted with spyware, research group says

https://www.newsobserver.com/news/nation-world/world/article317680738.html

-PwnEscape vulnerability lets you escape KVM -Supply chain ...

2026-10-19T08:33:59Z

-PwnEscape vulnerability lets you escape KVM
-Supply chain incidents at AOMEI and ConnectWise
-Intel discontinues SGX
-US infosec job postings fell by 25%
-OpenCode abused for distillation attacks
-Cyberattack impacts US bankruptcy courts
-Cyberattack hits Romania's stock market agency
-Cali DoE breach impacts 7m California students
-Burger King Japan hack impacts 11.2m customers
-South Korea fires employee who sold patient data

N: https://news.risky.biz/risky-bulletin-pwnescape-vulnerability-lets-you-escape-kvm/
P: https://risky.biz/RBNEWS622/

GitHub has expanded its Malware Advisories database to cover ...

2026-10-18T17:53:37Z

GitHub has expanded its Malware Advisories database to cover eight package repositories.

Starting last week, the database also includes warnings for malicious packages on PyPI, Maven, RubyGems, NuGet, Go, Rust Crates, and PHP Composer... on top of npm

https://openssf.org/blog/2026/10/16/case-study-github-expands-malware-advisories-across-eight-ecosystems-with-openssf/

More than 80 Romanian government institutions kept buying ...

2026-10-18T17:34:32Z

More than 80 Romanian government institutions kept buying Kaspersky security software even after the government banned it in March 2023.

According to Romanian journalists, buyers include city halls, hospitals, schools, and even a military and NATO research institute

https://publicrecord.ro/2026/10/16/antivirus-kaspersky-institutii-publice-rusia/

Hackers backdoored backup provider AOMEI in a novel, ...

2026-10-18T12:23:36Z

Hackers backdoored backup provider AOMEI in a novel, first-of-its-kind supply chain attack.

Hackers replaced backup software on the company's servers in short bursts of five to ten minutes.

The bursts took place across multiple windows between May and July.

https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering/

The Python Software Foundation has rolled out email reputation ...

2026-10-18T09:56:49Z

The Python Software Foundation has rolled out email reputation checks for all new PyPI accounts

The measure specifically targets disposable email providers

It also restored the ability to register PyPI accounts with Outlook and Hotmail domains, blocked in 2024

https://blog.pypi.org/posts/2026-10-16-email-reputation-and-outlook/

A cyberattack has hit Romania's Central Depositary, the ...

2026-10-18T08:23:58Z

A cyberattack has hit Romania's Central Depositary, the agency that handles Romania's stock market transactions.

The attack targeted the agency's online user portal and stole data on all registered users.

https://www.economica.net/ultima-ora-atac-informatic-la-bursa-aplicatia-depozitarului-central-unde-sunt-inclusiv-datele-cuponarilor-blocata-ce-trebuie-sa-faca-investitorii-si-ceilalti-utilizatori_986227.html

German police have detained a Russian man behind the 2024 ...

2026-10-16T20:49:36Z

German police have detained a Russian man behind the 2024 Synnovis hack

https://www.bbc.com/news/articles/c9vgr61kml3mo

-Russia arrests DataSuckers hacking group -Ad company delivered ...

2026-10-16T08:12:33Z

-Russia arrests DataSuckers hacking group
-Ad company delivered zero-click exploits and spyware
-OpenAI employee arrested for planting spy device
-US disrupts 40 DPRK laptop farms
-Cyberattack halts Danish-German tunnel construction
-Bug exposes Czech business registry data
-Hackers leak photos from Netanyahu campaign personnel
-Thailand arrests 39 scammers after visa reviews
-FTC sues a sextortion assistance provider

N: https://news.risky.biz/risky-bulletin-russia-arrests-datasuckers-hacking-group/
P: https://risky.biz/RBNEWS621/

A cyberattack has halted construction on a tunnel between Denmark ...

2026-10-15T17:10:13Z

A cyberattack has halted construction on a tunnel between Denmark and Germany

https://femern.com/da/presse/nyheder/hovedentreprenor-pa-femern-projektet-ramt-af-cyberhaendelse/

https://www.dk-sundhed.dk/ritzau/1f0b6211-3397-4869-98aa-a2e87f289545

Israeli ad company helped a spyware firm target Al Jazeera ...

2026-10-15T10:41:40Z

Israeli ad company helped a spyware firm target Al Jazeera through online ads

Researchers say Discover-Tech used online ads to deliver zero-click spyware, the first public evidence of the technique, with its ads reaching nearly 200,000 websites and apps

https://www.nbcnews.com/tech/security/israeli-ad-company-helped-spyware-firm-target-al-jazeera-online-ads-re-rcna602999

Despite being sanctioned into oblivion by the US, the UK, and ...

2026-10-15T00:48:05Z

Despite being sanctioned into oblivion by the US, the UK, and others, the Aeza bulletproof hosting provider is still operating under seven new identities

https://www.qurium.org/press-releases/aeza-infrastructure-thrives-despite-sanctions/

Looks like Check Point has left the Russian market ...

2026-10-14T23:57:22Z

Looks like Check Point has left the Russian market

https://tass.ru/ekonomika/28211161

Ahsay patches two zero-days spotted last week by Huntress: ...

2026-10-14T22:24:48Z

Ahsay patches two zero-days spotted last week by Huntress:

https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update

https://www.huntress.com/blog/ahsaycbs-flaws-exploit

Wow... Twitter suspended some influence operations clusters for ...

2026-10-14T21:22:21Z

Wow... Twitter suspended some influence operations clusters for the first time in years

https://x.com/GlobalAffairs/status/2110430142199644314

Nextcloud patches zero-day exploited last month ...

2026-10-14T19:38:43Z

Nextcloud patches zero-day exploited last month

https://github.com/CollaboraOnline/richdocumentscode/issues/354#issuecomment-6164261298

-Spyware chip found in Ledger crypto-wallets -Cyberattack ...

2026-10-14T08:10:28Z

-Spyware chip found in Ledger crypto-wallets
-Cyberattack defrosts supermarket fridges
-Ahold Delhaize supermarkets go offline across the world
-EU wants smart glasses to beep loudly when recording
-Meta discloses security breach
-H&M denies hack
-Foschini Group also got hacked
-Papertrade hacked for $1.28m
-79th Vault hacked for $12.5m
-UK Housing Ombudsman data breach
-US Fiji embassy also hacked
-Meta lets its AI agent generate porn

N: https://news.risky.biz/risky-bulletin-spyware-chip-found-in-ledger-crypto-wallets/
P: https://risky.biz/RBNEWS620/

New Ivanti zero-day ...

2026-10-13T16:56:13Z

New Ivanti zero-day

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

French authorities have arrested three teenagers who built and ...

2026-10-13T15:36:03Z

French authorities have arrested three teenagers who built and ran a platform that allowed users to search through hacked and stolen data.

The service launched in March under the name of Reacher and rebranded to Stryx in June.

PDF: https://www.tribunal-de-paris.justice.fr/sites/default/files/2026-10/2026-10-09%20CP%20Stryx.pdf

-28 arrests in Ghana and Nigeria -$11 million seized -3.7 million ...

2026-10-13T15:18:34Z

-28 arrests in Ghana and Nigeria
-$11 million seized
-3.7 million accounts suspended

https://www.justice.gov/usao-dc/pr/department-justice-announces-results-law-enforcement-and-private-industry-joint

quoting
nevent1q…gpw7
There's a major announcement from the UK NCA and US DOJ later today on some sort of cyber fraud crackdown

Data collected by Poland law enforcement through the Pegasus ...

2026-10-13T12:55:30Z

Data collected by Poland law enforcement through the Pegasus spyware was also sent outside the country's borders, a Parliament commission finds

https://ua.news/en/world/tusk-nazvav-peredavannia-danikh-pegasus-za-kordon-zlochinom-proti-derzhavi-anadolu-agency

TL;DR: A new hacker going by Hasanbr0ker has come forward to ...

2026-10-13T10:38:38Z

TL;DR: A new hacker going by Hasanbr0ker has come forward to claim leadership of the ShinyHunters group after the arrest of its previous leader, Rey, in Jordan.

However, security researchers don't believe the claims, citing the lack of secure signing key material.

quoting
nevent1q…vp6u
Haven't read it yet, but Jon DiMaggio out with a piece on the shenanigans around ShinyHunters leadership.

It's been fascinating to watch, and there's no better person to hear the story from than DiMaggio.

https://arkemcyber.com/research/who-gets-to-be-shinyhunters/

Netskope says detections for the XWorm infostealer have increased ...

2026-10-13T09:46:47Z

Netskope says detections for the XWorm infostealer have increased four times compared to Q3 2025, mostly because of a spike in the malware's development, with XWorm creators putting out four new versions and 11 plugins over the past year.

The malware now also includes a rootkit, a GPS location data harvester, and a webcam recording module.

https://threatlabs.netskope.com/blog/2026/09/xworm-reborn

There's a major announcement from the UK NCA and US DOJ later ...

2026-10-13T09:28:29Z

There's a major announcement from the UK NCA and US DOJ later today on some sort of cyber fraud crackdown

Hackers compromised the GitHub account of the Zod JavaScript ...

2026-10-13T08:22:11Z

Hackers compromised the GitHub account of the Zod JavaScript library to add malware to recent releases at the end of September, but the incident was caught early and the malware never made it to npm

https://github.com/orgs/community/discussions/208477

Norwegian military personnel discovered that rented Chinese-made ...

2026-10-13T08:04:41Z

Norwegian military personnel discovered that rented Chinese-made cars automatically recorded and stored video footage during military exercises.

https://militarnyi.com/en/news/chinese-cars-in-norway-stored-military-exercise-footage-and-access-codes/

Fun times ahead for Pegasus customers Israeli ambassador to Spain ...

2025-05-31T12:31:35Z

Fun times ahead for Pegasus customers

Israeli ambassador to Spain threatens to use Pegasus data seized from NSO to attack Spanish government

"Mi Gobierno aún no ha respondido con revelaciones de Pegasus"

"My Government has not yet responded with Pegasus revelations"

https://www.elespanol.com/espana/politica/20250527/embajador-israel-funciones-advierte-gobierno-no-respondido-revelaciones-pegasus/1003743774464_0.html