{"id":3996,"date":"2026-11-05T15:49:43","date_gmt":"2026-11-05T15:49:43","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3996"},"modified":"2026-11-05T15:49:43","modified_gmt":"2026-11-05T15:49:43","slug":"apache-ofbiz-rce-dreamhost-breach-defi-site-hijacks-17-more-stories","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3996","title":{"rendered":"Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Nov 05, 2026<\/span><\/span>Hacking News \/ Cybersecurity News<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be used to lock people out. Even a simple file copy can reach places it shouldn’t. And while new tools are helping find security holes faster, some important systems are still taking months, sometimes over a year, to get patched. Not exactly a great match.<\/p>\n

The stranger part is how little some attacks now need. Ransom demands without encrypted files. Fake websites that look real enough to steal money. AI tools picking up dangerous instructions while trying to help. Even the attackers are making mistakes in their own code.<\/p>\n

This week’s stories are a reminder that the biggest problems don’t always come from clever tricks. Sometimes the easy way works just fine. Here’s what else happened.<\/p>\n

\n <\/p>\n

The threats change every week. Subscribe, and we\u2019ll alert you<\/span> when each new ThreatsDay Bulletin is out.<\/p>\n<\/div>\n

\n
\n
    \n<\/p>\n
  1. \n <\/p>\n
    \n AI Accelerates Zero-Day Discovery<\/span><\/p>\n

    \n The U.K. National Cyber Security Center (NCSC) has warned that the widespread availability of AI-powered cyber tools has \u00abalmost certainly\u00bb led to a significant increase in the discovery of zero-day vulnerabilities. \u00abDefensive AI-cyber tools have reduced the window of a vulnerability moving from zero-day to an n-day vulnerability, and have made patching a quicker process,\u00bb NCSC said<\/a>. \u00abHowever, without correct and widespread configuring of this technology, many systems are still vulnerable to attackers using AI-cyber tools to identify and exploit system weaknesses. Additionally, an organisation\u2019s internal patching and testing processes will need to evolve to meet the pace of accelerating vulnerability discovery. Attackers have subsequently displayed less caution over losing an access to achieve an objective, as the cost to replace is minimal.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  2. \n <\/p>\n
    \n Critical Systems Face Prolonged Exposure<\/span><\/p>\n

    \n An analysis of roughly 383,000 CVEs disclosed from 1999 through September 2026 has found that the median time to patch a vulnerability exceeds a year for network appliances. About 2,000 CVEs (roughly 0.5%) have been linked to real-world exploitation. \u00abThe median vulnerability is patched in about two weeks on Windows workstations but in more than a month on Windows Servers,\u00bb Microsoft said<\/a>. \u00abIt stretches to 10+ weeks on Linux Servers and for applications running on macOS, and beyond a year on network appliances. That gap is the threat actor’s window, widest on the critical systems that stay exposed the longest.\u00bb The tech giant also said threat actors disproportionately target flaws that maximize impact and exposure and enable system takeover, particularly remote code execution, privilege escalation, and authentication bypass.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  3. \n <\/p>\n
    \n $4.5 Million Fraud Network Busted<\/span><\/p>\n

    \n Authorities have arrested seven people<\/a> allegedly involved in an investment fraud scheme that claimed potential victims in more than 50 countries, according to Europol. The operation caused estimated losses of at least $4.5 million. The \u00abcrime-as-a-service\u00bb offering was run by a company from Cyprus and Israel, and allegedly provided cybercrime groups with an assortment of trading websites and fraudulent call centers tasked with tricking victims into transferring their savings. These call centers operated from Albania, Kosovo, and North Macedonia. \u00abMore than 100 servers were seized and seven suspects arrested during coordinated action on 3 November 2026,\u00bb Europol said<\/a>. \u00abAuthorities searched 17 locations and seized servers, other evidence and assets.\u00bb Like other fraudulent investment schemes, the operation leveraged deceptive advertisements to funnel people towards fraudulent investment platforms, promising them substantial, quick returns from cryptocurrency trading and foreign currencies. Although victims were encouraged to transfer a small amount, they displayed illusory gains to push them into transferring increasingly large sums. The operators resorted to delaying tactics to block payments when they attempted to withdraw their funds. \u00abBehind seemingly legitimate platforms, supposed brokers used fictitious profits and sustained psychological pressure to persuade victims to invest more,\u00bb Europol said. \u00abPersonal data collected through this process was sold to criminal groups operating call centers. Operators then contacted potential victims with supposed investment opportunities, turning their initial interest into repeated demands for money.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  4. \n <\/p>\n
    \n $250K Bounty for Critical Cloud Flaws<\/span><\/p>\n

    \n Google has expanded<\/a> its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws, allowing researchers to earn $250,000 for Root-in-Cloud bugs, including tenant-isolation bypasses and complex cross-service logic flaws that let attackers gain full administrative control over arbitrary Google Cloud organizations. \u00abTo earn this premier reward, you must demonstrate full administrative control, the equivalent of ‘roles\/owner’ or complete IAM control, over arbitrary Google Cloud organizations or projects with no prior access or special project setup,\u00bb Google said<\/a>. \u00abAdditionally, valid vulnerability reports demonstrating remote code execution (RCE) in underlying Google production infrastructure (Borg) or achieving root-in-prod will automatically be evaluated by the Google Cloud VRP panel for root-in-cloud eligibility.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  5. \n <\/p>\n
    \n Edge Blocks Scam Notification Abuse<\/span><\/p>\n

    \n Microsoft has announced that its Edge browser will now automatically disable notifications from sites that push scam or scareware notifications, such as fake virus warnings or security alerts. \u00abAs of last month\u2019s rollout of Edge 156, when Microsoft Defender SmartScreen or Scareware blocker detects a scam that was pushed through a notification, Edge will automatically disable notifications from the site that sent it,\u00bb Microsoft said<\/a>. \u00abThe next time Edge starts, an information bar explains what happened. If you believe a site was blocked incorrectly, you can review sites with blocked notifications and unblock them from Edge Settings, keeping you in control.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  6. \n <\/p>\n
    \n University Cryptojacking Charges<\/span><\/p>\n

    \n Two Canadian men, Ryan James Roach, 35, and Mathiew James Stubbings, 41, have been indicted in the U.S. for hacking multiple U.S. universities and using the access to mine cryptocurrency. Both have been charged with conspiracy to obtain information from a protected computer and to cause damage to a protected computer, obtaining information from a protected computer, and intentional damage to a protected computer, which carry a maximum penalty of 10 years in prison and a $250,000 fine. \u00abBetween June 2016, and December 2019, Roach and Stubbings conspired to engage in a scheme to hack into computers, steal login credentials, and secretly mine cryptocurrency for financial gain,\u00bb the Justice Department said<\/a>. \u00abThey used virtual private servers in multiple countries, which were registered under false names. These servers transmitted malware and mining software to victim computers and stored stolen login credentials. Victims of the scheme included educational institutions in New York, Tennessee, North Carolina, and Massachusetts.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  7. \n <\/p>\n
    \n Ransomware Extortion Without Encryption<\/span><\/p>\n

    \n Cybersecurity researchers have detailed an encryptionless extortion attack involving PAYLOAD ransomware targeting a manufacturing organization in the Middle East. \u00abThe threat actor obtained domain admin-equivalent control of the organization\u2019s Active Directory environment and authored a malicious Group Policy Object (GPO) named PAYLOAD, linking it at the domain root,\u00bb Kaspersky said<\/a>. \u00abThrough that single object, the actor delivered ransom notes, hijacked the desktop wallpaper and lock screen, enforced a logon banner, and disabled the local administrator account across every domain-joined Windows workstation \u2014 all without dropping a ransomware binary or encrypting any data. The only ransomware we found in this incident was a PAYLOAD sample targeting ESXi on Linux servers.\u00bb The attack represents a convergence of two trends: Living-off-the-land abuse of trusted AD infrastructure and a surge in extortion-only incidents.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  8. \n <\/p>\n
    \n AI Sandbox Escape Exposes Sensitive Files<\/span><\/p>\n

    \n A vulnerability impacting Docker Sandboxes (CVE-2026-103916) could have been exploited to bypass file access restrictions, potentially exposing cloud credentials and other sensitive files on a developer’s machine through a routine copy command. \u00abThe command used to copy files between a sandbox and the developer’s computer (sbx cp) does not enforce these access restrictions,\u00bb Endor Labs said<\/a>. \u00abAn agent can exploit this weakness using what is known as a symbolic link, essentially a shortcut that points to another file or folder. By placing a malicious shortcut inside an approved workspace, the agent can trick a subsequent copy command into accessing files outside the sandbox’s approved boundaries.\u00bb The issue has been addressed in Docker Sandboxes version 0.51.0.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  9. \n <\/p>\n
    \n Smart TVs Keep Tracking After Opt-Out<\/span><\/p>\n

    \n Does Opting Out of ACR Work? <\/span>\n <\/p>\n

    \n A new study has revealed that smart TVs running operating systems from Samsung, Vizio, and Roku continue to transmit data to automatic content recognition (ACR) endpoints even after users opt out of tracking in the devices’ settings. \u00abOpting out fully worked on only four operating systems. On Samsung and Vizio, traffic consistent with ACR kept flowing, and Roku’s opt-out doesn’t cover its own streaming service,\u00bb according to a group of academics from Northeastern University. \u00abVIDAA OS sends ACR data to servers run by Unruly over MQTT without encryption, so anyone on the network path between the TV and those servers can read it.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  10. \n <\/p>\n
    \n Cryptographic Proof for AI Outputs<\/span><\/p>\n

    \n Anthropic has revealed that it’s working on an open-source system called FlashProve to cryptographically verify an AI response came from a given model. \u00abFlashProve is a system for provable inference of large Mixture-of-Experts (MoE) language models,\u00bb Anthropic said<\/a>. \u00abFlashProve involves two parties: the model provider (the prover) and a user (the verifier). It is split into two phases: In the offline phase, the prover publishes a commitment to the model weights, which is a short fingerprint to pin down one exact choice of weights while the weights themselves remain hidden. The later inference claims will be checked against that commitment, i.e., the weight model committed to in this phase. In the online phase, upon requests from the verifier (i.e., prompts and the corresponding output tokens), the prover produces a proof file proving the following statement: The committed model produces these output tokens when evaluated. Anyone who holds the commitment, the prompt, and the reply can check it, without the weights and with limited compute power, and be convinced that the committed weights, run on this prompt, produce exactly these tokens.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  11. \n <\/p>\n
    \n FTP and Webmail Credentials Exposed<\/span><\/p>\n

    \n DreamHost has warned of a data breach after an unauthorized third party gained access to the server that runs its web-based File Manager at files.dreamhost.com between August and October 23, 2026. \u00abThe unauthorized third party exploited a vulnerability in that software and was able to access the FTP\/SFTP usernames and passwords of individuals who logged into this File Manager between approximately August 2026 and October 23, 2026,\u00bb the company said<\/a>. \u00abThe unauthorized third party was also able to reach certain webmail systems, which may have exposed the session information (the data that keeps a user signed in, including session credentials) of a limited number of webmail users. We believe this was a deliberate attack, and our team worked around the clock to contain it.\u00bb DreamHost said the attacker may have accessed the credentials used to access the File Manager or webmail, along with the contents of emails and files in the FTP\/SFTP server. There is no evidence that the attacker accessed control panel login information or customer billing details.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  12. \n <\/p>\n
    \n Pre-Auth RCE and Account Takeover<\/span><\/p>\n

    \n The maintainers of Apache OFBiz have addressed 46 security flaws<\/a>, including CVE-2026-68524, which could result in pre-authentication remote code execution, and CVE-2026-109928, which enables full account takeover due to an incorrect authentication algorithm implementation. The issues have been patched in Apache OFBiz 24.09.08.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  13. \n <\/p>\n
    \n Ransomware Encryption Flaws Exposed<\/span><\/p>\n

    \n Cybersecurity researchers have uncovered encryption weaknesses in the updated HYFLOCK ransomware builds. The ransomware operation began to publicly name victims in October 2026, although evidence indicates that the group first appeared in underground forums in March 2026. As of writing, the group has listed 13 victims<\/a>. \u00abThe October 17 build successfully encrypted files, registered a scheduled task, accessed network-share resources, and attempted to interfere with system recovery,\u00bb Check Point said<\/a>. \u00abIn an earlier October version, researchers identified a processing defect that could permanently discard portions of a file, potentially preventing complete recovery even with the correct decryption key. The October 17 build exhibited another issue. Larger files had only their first 4,096 bytes encrypted, leaving additional content accessible beyond that initial section.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  14. \n <\/p>\n
    \n Customer Identity Data Accessed<\/span><\/p>\n

    \n DigiCert said it has identified an event involving unauthorized access to one of its business systems that stores information shared by customer representatives to validate their identity. The company said its certificate operations were not impacted. \u00abMost of the data was limited to business contact information for customers: names, business email addresses, phone numbers, and business addresses,\u00bb DigiCert said<\/a>. \u00abA small minority of customer accounts included additional personal data in the form of a customer-provided document such as a driver’s license, passport, utility bill, or other document with name and address. The access could not write records, act as a validation approver, or issue certificates.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  15. \n <\/p>\n
    \n DeFi Hijack Drains $138K<\/span><\/p>\n

    \n Threat actors have hijacked<\/a> a little over a dozen DeFi websites registered with Name.com, including Flap, Kintsu, Pickle Finance and Origami Finance, ultimately stealing about $138,000 in assets. The sites have been found to be rigged with a malware kit that tricks visitors into approving transfers out of their wallets once they connect them to the compromised site. Vercel said<\/a> it’s aware of nine domains associated with the platform that were impacted. \u00abOver about 45 minutes on Oct 31 (UTC), an account within an associated support team made changes to the nameservers associated with 15 domains registered with name.com,\u00bb Name.com said<\/a> in a post-mortem. \u00abThe domains were directed to a malicious page hosting Step Drainer malware.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  16. \n <\/p>\n
    \n Stolen Cloud App Credentials Abused<\/span><\/p>\n

    \n Todyl has disclosed that an unknown threat actor has been abusing stolen Microsoft Entra ID application credentials and Azure DevOps identities to access MSPs’ Microsoft 365 and Azure environments, reaching at least 27 organizations. \u00abAbout 45 app registrations at roughly 18 organizations were targeted, and more than 33 of them authenticated successfully,\u00bb Todyl said<\/a>. \u00abThrough those apps the actor has reached 27 organizations so far, including the MSPs’ downstream clients in government, energy, food and agriculture, transportation, construction and engineering, legal, education and nonprofits. It has run searches across about 25 tenants, downloaded 81 files and accessed around 2,279 mailbox items.\u00bb The sign-in activity has originated<\/a> from the IP address 199.19.77[.]84.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  17. \n <\/p>\n
    \n Syrian Hacker Gets 42 Months<\/span><\/p>\n

    \n Ahmad Umar Agha (aka Th3Pr0), a Syrian national tied to the Syrian Electronic Army (SEA), has been sentenced to 42 months in prison in the U.S. for his involvement in an expansive hacking conspiracy organized and led by members of former Syrian President Bashar Al-Assad regime between Aug 2011 and January 2014. \u00abTo spread the former Syrian government’s propaganda, Agha hacked approximately 47 Western media entities, businesses, non-governmental organizations (NGOs), and U.S. and allied government entities,\u00bb the Justice Department said<\/a>. \u00abIn one instance, Agha\u2019s actions caused a flash crash in the U.S. stock market, resulting in a temporary $136 billion loss in the value of stocks making up the Dow Jones Industrial Average.\u00bb Agha and his alleged accomplice, Firas Dardar, were first charged in June 2014. Dardar remains at large.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  18. \n <\/p>\n
    \n Malicious AI Search Results Steal Crypto<\/span><\/p>\n

    \n A new piece of malware has been observed targeting AI agents creating cryptocurrency wallets. \u00abA GitHub repository posing as a Solana starter kit, which ranks as the top result when an agent searches for one, contains malware that gives an attacker remote control of the victim’s machine, including the crypto wallets on it,\u00bb AIR Security said. The activity has been codenamed SolanaCry<\/a>. The attack builds upon the foundation of Web Hole<\/a>, where an AI agent, in its quest for finding answers to a problem, can inadvertently run a command suggested by an attacker and perform malicious actions. \u00abTo get a payload into search results, an attacker has two options,\u00bb AIR said. \u00abThe first is to build a site of their own and grow its reputation with SEO, backlinks, content, time, until the search engine treats it as relevant and trusted. Once it ranks, they change the content and drop in the payload. The second is easier: find dead sites<\/a> that still show up as ranked results, and use those to deliver it.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  19. \n <\/p>\n
    \n Android Banking Malware Spreads<\/span><\/p>\n

    \n Thousands of Android phones belonging to retail banking customers in the Middle East, Turkey, and Africa (META) region have been compromised with the Mirax trojan between March and September 2026, leading to estimated losses worth millions of U.S. dollars. \u00abWhere unauthorized international transfers were reported, funds were sent to accounts abroad, some of which are suspected to be mule accounts,\u00bb Group-IB said<\/a>. \u00abThe campaign uses dynamically generated package names and impersonates ‘Google Play Services’ to evade user suspicion and signature-based detection.\u00bb Like most Android malware, Mirax is used to facilitate device takeover (DTO) fraud by abusing Android’s accessibility services. \u00abWith it, the attacker is able to see and control the compromised device in real time: reading credentials, intercepting one-time codes, capturing the PIN to unlock the device later, opening a banking app and moving money out to newly added beneficiaries and mule accounts abroad,\u00bb Group-IB said. Campaigns using Mirax have been attributed to Aquafina, a threat actor known to be active since March 16, 2026.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  20. \n <\/p>\n
    \n AI Model Bypasses Task Instructions<\/span><\/p>\n

    \n Irregular’s evaluation of Zhipu AI’s open-weight model GLM-5.3 across 13 offensive cyber scenarios using CyScenarioBench has found<\/a> that the model \u00abdid not refuse any of the tested offensive tasks\u00bb and \u00abrepeatedly reached correct answers while violating explicit task instructions.\u00bb The AI security company said these violations can be interpreted as a form of reward hacking. \u00abCrediting the answer alone could mislead capability assessments and deployment decisions, while rewarding it during training could reinforce these instruction violations,\u00bb it added.\n <\/p>\n<\/p><\/div>\n<\/li>\n<\/ol>\n<\/section>\n<\/div>\n

    One thing stands out this week: attackers don’t always need to be smarter than the systems they’re targeting. They just need to find what was missed, left open, or trusted a little too much. And with AI making some of that searching easier, the time between finding a problem and using it is getting shorter. Patching still matters, but so does checking whether the controls already in place actually work.<\/p>\n

    That’s it for this week. Some of these problems have fixes. Others need a closer look at how people, tools, and systems are allowed to work together. The next big headache may not come from a new bug at all. It could be something that’s been sitting there for years, waiting for someone to notice. See you next week.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    \ue804Ravie Lakshmanan\ue802Nov 05, 2026Hacking News \/ Cybersecurity News How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several…<\/p>\n","protected":false},"author":1,"featured_media":3997,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1142,278,1380,4065,774,4064,316,3237,187],"class_list":["post-3996","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-apache","tag-breach","tag-defi","tag-dreamhost","tag-hijacks","tag-ofbiz","tag-rce","tag-site","tag-stories"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3996","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3996"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3996\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3997"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3996"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3996"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3996"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}