Article Read Time
434
Words
1 min
Read Time
- US Disrupts Chinese State-Sponsored Hacking Tools Tied to Flax Typhoon On October 8, the US announced the disruption of two tools, MicroScan (vulnerability scanning) and FishHub (spear-phishing intrusions), built by Integrity Technology Group and used by Flax Typhoon and other China-linked actors against critical infrastructure. Authorities seized six domains, and a joint advisory with the UK, Australia, Canada, Japan, New Zealand, and Spain documented MicroScan activity dating back to 2017. Targets included a US power company, airports in Japan and Poland, and at least 20 Taiwanese universities. Source: SecurityWeek URL: https://www.securityweek.com/us-disrupts-chinese-state-sponsored-hacking-tools/
- Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments CVE-2026-107406 (CVSS 9.5) is a memory overflow in NetScaler ADC and Gateway that can lead to remote code execution or denial-of-service. It only applies when the appliance is configured as a SAML service provider or identity provider. Citrix has seen no exploitation of this specific flaw, but three other NetScaler vulnerabilities are being actively exploited, so patching to the fixed builds (such as 14.1-73.46 or 13.1-64.29 and later) should move up the list. Source: The Hacker News URL: https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html
- GhostAction Campaign Plants Credential-Stealing GitHub Actions Workflows Attackers used hijacked maintainer accounts to push a fake “security audit” workflow into more than 340 repositories, including 318 from a single account in 16 minutes. Socket reports over 500 accounts have committed the workflow to tens of thousands of repositories since October 7. The workflow harvests repository secrets, including AWS keys, AI API keys, and GitHub and GitLab tokens. Developers should hunt for the workflow files, revoke and rotate exposed credentials, and review forks. Source: The Hacker News URL: https://thehackernews.com/2026/10/credential-stealing-github-actions.html
- Hijacked Country-Code Domains Led to Fraudulent Certificates for Google Domains Attackers took over three country-code top-level domains (.gh, .sl, and .as), changed authoritative DNS records, and obtained unauthorized HTTPS certificates for several Google domains and other well-known brands. Google blocked the certificates in Chrome and worked with certificate authorities to revoke them. Domain owners are advised to monitor Certificate Transparency logs and publish restrictive CAA records. Source: SecurityWeek URL: https://www.securityweek.com/google-domains-impacted-by-recent-cctld-domain-hijacks/
- Silent Ransom Group Allegedly Extorted $207 Million From Law Firms Without Encrypting a File Leaked internal chats suggest the group extorted 27 law firms between April and September 2026 using phone calls and social engineering instead of malware. In one case, an attorney was tricked into uploading files to an external Google Drive. Blockchain analysis supports the scale but not the exact figures, and the group denies a breach of its systems, so some payment claims remain unverified. Source: Security Affairs URL: https://securityaffairs.com/200719/cyber-crime/silent-ransom-group-allegedly-extorted-207-million-without-encrypting-files.html