{"id":4036,"date":"2026-11-09T14:50:56","date_gmt":"2026-11-09T14:50:56","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=4036"},"modified":"2026-11-09T14:50:56","modified_gmt":"2026-11-09T14:50:56","slug":"sshole-exploited-apt-root-rce-robot-takeovers-15k-hacked-sites-and-more","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=4036","title":{"rendered":"SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Nov 09, 2026<\/span><\/span><span class=\"p-tags\">Cybersecurity News \/ Hacking<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiLQ4v79OUmrbGdf2uJWMlUUmpCSu70Pr6v7oyodgSjFMfLU6JIe6Mr7xpp7AnqIX_vmKca44ImxEkczL88e_4sr2oBw0NL3Zh_JVEOb4cYmYg5pjbrITVv6KgPsv13-RrlBjq6bu7inR7w5-seDsUZvoqn6q7idkElfWysH1itsfgI5-NmFZ-BybjG0gR0\/s1700-nu-rw-lo-l85-e365\/rr.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>A system doesn&#8217;t always need a complicated bug to let someone in. Sometimes, a blank password is enough. That&#8217;s one of the bigger stories this week. And it gets worse when the tools meant to keep systems updated or running safely become part of the attack.<\/p>\n<p>Elsewhere, attackers are hiding inside normal web traffic, stealing credentials from network devices, and finding new uses for exposed systems. AI is helping some of them move faster, but old mistakes are doing plenty of the work too. Even forgotten settings and small changes made months ago are coming back to cause trouble.<\/p>\n<p>There&#8217;s a lot packed into this week&#8217;s news, including some strange research findings, fresh attacks, and a few warnings worth taking seriously. Here&#8217;s the full recap.<\/p>\n<h2 style=\"text-align: left;\"><strong>\u26a1 Threat of the Week<\/strong><\/h2>\n<p><strong>OpenSSH Flaw Sees Exploitation Attempts <\/strong>\u2014 Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set. The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled, including Alpine Linux&#8217;s default OpenSSH server configuration. As of November 9, 2026, a total of 20 exploitation attempts have been recorded from 13 unique IP addresses from Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the U.S.<\/p>\n<p><a name=\"more\"\/><\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjI0rRYPxA2NTu56eVJvIsHEKducanSDChXiiBHMAYb5dXjJyZiHAmWA4Mo73KDi6T2s_4oRW_T4lmhQfFBzZ8IlsVolG4c63BsqX_GOai1gE8cSkEPPnEg-Khkyz0sUXS96LAUUx08GReMgFguXk0TkXkQg6jV49h4aoXTd-9pfTh0bXNFF_hLAnf8fqm9\/s1700-nu-rw-lo-l85-e365\/recap.png\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjI0rRYPxA2NTu56eVJvIsHEKducanSDChXiiBHMAYb5dXjJyZiHAmWA4Mo73KDi6T2s_4oRW_T4lmhQfFBzZ8IlsVolG4c63BsqX_GOai1gE8cSkEPPnEg-Khkyz0sUXS96LAUUx08GReMgFguXk0TkXkQg6jV49h4aoXTd-9pfTh0bXNFF_hLAnf8fqm9\/s1700-nu-rw-lo-l85-e365\/recap.png\" alt=\"\" border=\"0\" data-original-height=\"300\" data-original-width=\"728\"\/><\/a><\/div>\n<h2 style=\"text-align: left;\"><strong>\ud83d\udd14 Top News<\/strong><\/h2>\n<ul>\n<li><strong>Trojanized CWP Web Server Used to Deliver CWPdoor <\/strong>\u2014 A new Linux malware called CWPdoor is being distributed via a trojanized version of cwpsrv, the built-in daemon and web server that powers the Control Web Panel. According to XLab, a shell script named \u00abcwpsrv_update.sh\u00bb is used to download \u00abcwpsrv\u00bb from a remote server (\u00ab136.0.141[.]71\u00bb) and replace the legitimate file on the system. \u00abThe downloaded cwpsrv is a passive backdoor that can be triggered by specific headers in HTTP\/HTTPS traffic to remotely execute commands specified by the attacker,\u00bb XLab said. \u00abIts backdoor logic is triggered only when it receives a specially crafted request from the attacker. At the same time, it suppresses logging for that request, leaving no trace of the interaction in the access logs. This combination of directly replacing the legitimate cwpsrv binary, passive triggering, and log suppression makes CWPdoor exceptionally stealthy.\u00bb<\/li>\n<li><strong>Debian and Ubuntu APT Flaw Allows Code Execution as Root <\/strong>\u2014 A vulnerability in the APT package manager (CVE-2026-109518, CVSS score: 7.7) can be exploited to install a package under certain conditions and achieve code execution with elevated privileges. The issue affects Ubuntu and Debian operating systems. \u00abUnder specific conditions, when APT is configured to use HTTP package sources with retry settings enabled, a third-party with a network position between the host and the package mirror can cause APT to install a package that did not pass verification,\u00bb Amazon <a href=\"https:\/\/aws.amazon.com\/security\/security-bulletins\/2026-172-aws\/\" target=\"_blank\">said<\/a> in an advisory. \u00abMaintainer scripts within that package then run with elevated privileges.\u00bb<\/li>\n<li><strong>CERT-In Flags AI-Driven Attacks Targeting Financial Organizations <\/strong>\u2014 The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country. Calling it a \u00absignificant escalation\u00bb in attacks, the threat actor is said to be re-targeting entities that were originally targeted last month after incomplete remediation, adding that the intrusions \u00abhave been timed to coincide with holidays, weekends and other low-monitoring windows to delay detection and response.\u00bb<\/li>\n<li><strong>Zyxel Fixes 0-Day exploited to Hack About 1,000 Network Switches <\/strong>\u2014 Zyxel has fixed a <a href=\"https:\/\/www.binarly.io\/blog\/zyxel-gs1900-rce-cve-2026-107441\" target=\"_blank\">zero-day vulnerability<\/a> in its GS1900 series network switches that threat actors exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. The vulnerability, tracked as CVE-2026-107441 (CVSS score: 8.8), is an out-of-bounds write flaw that could \u00aballow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.\u00bb The activity has been attributed to a Chinese-speaking threat actor tracked as Kapibala (aka Red Heron). The attacker has been found to weaponize the flaw to deploy the JITTERLY backdoor and SIXZUT, a ring 3 rootkit.<\/li>\n<li><strong>cPGuard Update Mechanism Hijacked to Deliver Backdoor<\/strong> \u2014 Unknown threat actors compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. \u00abOn 2 November 2026 at 02:06 UTC, an unidentified attacker used compromised credentials to gain unauthorized access to OPSSHIELD&#8217;s update distribution infrastructure (CDN),\u00bb OPSSHIELD said. \u00abThe attacker used this access to distribute a malicious script through the cPGuard update channel.\u00bb The attacker is said to have gotten in through its billing application at manage.opsshield[.]com and logged in to a customer account they had registered.<\/li>\n<li><strong>mSecure Urges Customers to Change their Passwords <\/strong>\u2014 Password manager mSecure has warned customers to change their passwords, reset two-factor authentication, and potentially remove their passkeys after detecting suspicious activity, but it has not explained what happened or whether anyone&#8217;s secrets were exposed. \u00abmSeven Software (&#8216;mSeven&#8217;) recently learned of suspicious activity associated with the mSecure password management application,\u00bb the company said. \u00abIn response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist.\u00bb However, the company has yet to answer what the suspicious activity involved, when it occurred, or whether attackers accessed customer information. The lack of specifics has <a href=\"https:\/\/support.msecure.com\/en\/support\/discussions\/topics\/36000038998\" target=\"_blank\">understandably<\/a> <a href=\"https:\/\/support.msecure.com\/en\/support\/discussions\/topics\/36000038999\" target=\"_blank\">riled up customers<\/a>, with one user on Reddit <a href=\"https:\/\/www.reddit.com\/r\/PasswordManagers\/comments\/1xmn3hj\/mseven_email_msecure_compromised_received_1132026\/\" target=\"_blank\">stating<\/a> \u00abtheir silence on this is mind-bending.\u00bb In December 2025, Germany&#8217;s cyber agency BSI found that mSecure&#8217;s maker could, in theory, access the data users store in it.<\/li>\n<\/ul>\n<h2 style=\"text-align: left;\"><strong>\u200e\ufe0f\u200d\ud83d\udd25 Trending CVEs<\/strong><\/h2>\n<p>Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.<\/p>\n<p>Check the list, patch what you have, and hit the ones marked urgent first \u2014 <a href=\"https:\/\/kb.cert.org\/vuls\/id\/203719\" target=\"_blank\">CVE-2026-16305, CVE-2026-16306<\/a> (INFINITT PACS), <a href=\"https:\/\/www.synology.com\/en-global\/security\/advisory\/Synology_SA_26_13\" target=\"_blank\">CVE-2026-13684, CVE-2026-13639, CVE-2026-13673, CVE-2026-6205<\/a> (Synology DSM), <a href=\"https:\/\/source.android.com\/docs\/security\/bulletin\/2026\/2026-11-01\" target=\"_blank\">CVE-2026-58868, CVE-2026-58882<\/a> (Google Android), <a href=\"https:\/\/github.com\/rails\/rails\/security\/advisories\/GHSA-f3w6-w445-fwh9\" target=\"_blank\">GHSA-f3w6-w445-fwh9<\/a> (Ruby on Rails), <a href=\"https:\/\/xenbits.xen.org\/xsa\/advisory-523.html\" target=\"_blank\">CVE-2026-102703, CVE-2026-102704<\/a> (Xen), <a href=\"https:\/\/tracker.debian.org\/news\/1819482\/accepted-apt-304-source-into-stable-security\/\" target=\"_blank\">CVE-2026-109518<\/a> (Debian apt), <a href=\"https:\/\/psirt.watchguard.com\/\" target=\"_blank\">CVE-2026-98432, CVE-2026-121639, CVE-2026-121638, CVE-2026-121640<\/a> (WatchGuard), <a href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/publicationListing.x\" target=\"_blank\">CVE-2026-76506<\/a> (Cisco), <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2026-119741\" target=\"_blank\">CVE-2026-119741<\/a> (rsync), <a href=\"https:\/\/chromereleases.googleblog.com\/2026\/11\/stable-channel-update-for-desktop.html\" target=\"_blank\">CVE-2026-121156, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121247, CVE-2026-121203, CVE-2026-121126<\/a> (Google Chrome), <a href=\"https:\/\/www.veeam.com\/kb4966\" target=\"_blank\">CVE-2026-98432<\/a> (Veeam), <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2026-83844\" target=\"_blank\">CVE-2026-83844<\/a> (Microsoft Paint), <a href=\"https:\/\/psirt.global.sonicwall.com\/\" target=\"_blank\">CVE-2026-19868<\/a> (SonicWall SonicOS), <a href=\"https:\/\/sshhole.com\/\" target=\"_blank\">CVE-2026-123158<\/a> (OpenSSH), and <a href=\"https:\/\/kb.cert.org\/vuls\/id\/124705\" target=\"_blank\">multiple vulnerabilities<\/a> in the BaseChat Android app version 9.8.1.<\/p>\n<h2 style=\"text-align: left;\"><strong>\ud83c\udfa5 Cybersecurity Webinars<\/strong><\/h2>\n<ul>\n<li><strong><a href=\"https:\/\/thehacker.news\/fuel-the-soc\" target=\"_blank\">Your SOC Has an Identity Blind Spot \u2014 Here&#8217;s How Attackers Exploit It and How to Close It<\/a> <\/strong>\u2192 Your SOC may be tracking threats, but is it missing the identities behind them? As attackers increasingly exploit human, machine, and AI identities, traditional security tools often lack the context needed to detect and contain threats quickly. Join this free webinar to learn how connecting identity security with SOC operations can expose hidden risks, reveal attack blast radius, and accelerate incident response.<\/li>\n<li><strong><a href=\"https:\/\/thehacker.news\/github-actions-security\" target=\"_blank\">Your GitHub Actions May Still Be Vulnerable \u2014 Even With SHA Pinning. Here&#8217;s Why<\/a> <\/strong>\u2192 Think your GitHub Actions are secure because you use SHA pinning? Think again. Attackers can exploit hidden weaknesses in CI\/CD workflows, even when standard security measures are in place. Join this expert-led webinar to discover how these attacks work, why SHA pinning alone isn&#8217;t enough, and what you can do to protect your software supply chain.<\/li>\n<\/ul>\n<p><strong>\ud83d\udcf0 Around the Cyber World<\/strong><\/p>\n<ul>\n<li>The Russian-speaking ransomware-as-a-service (RaaS) operation known as <a href=\"https:\/\/www.seqrite.com\/blog\/the-evolution-of-qilin-agenda-a-comparative-reverse-engineering-analysis-of-qilin-agenda-ransomware-across-2026\/\" target=\"_blank\">Qilin<\/a> (aka Agenda) has recorded 179 publicly reported attacks in 2024, and more than 1,000 claimed victims in 2025. This year alone, it has claimed more than 900 victims, making it one of the most active ransomware groups. \u00abAffiliates commonly gain access through phishing, stolen credentials, vulnerable internet-facing systems and remote-management tools,\u00bb Acronis <a href=\"https:\/\/www.acronis.com\/en\/tru\/posts\/inside-qilin-ransomware-esxi-attacks-affiliate-networks-and-double-extortion\/\" target=\"_blank\">said<\/a>. \u00abQilin uses a flexible ransomware platform that allows affiliates to tailor attacks to the victim environment, including the encryption of local files, network shares and virtual machine infrastructure.\u00bb One notable Qilin affiliate is Securotrop, which continues to operate within the Qilin affiliate network, while maintaining an independent channel for publishing stolen victim data.<\/li>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgdGWunxIoSQcTuBffrYV4LASI6Ra5vaUD4pWqlMhshcGpBiz9m9go6uo5IkB28VRvLG-G6a-8jvpbYOsl-aOmmFUaqKr5Jhpc_bS_N4yhAudBvSbRst_qi9pxZHsxtPqSjoCyPX04zIQylPzTAsS_nKC0ubbVaeKRYUPivEXcsOFanzKjeXT0YyytyE25V\/s1700-nu-rw-lo-l85-e365\/1.png\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgdGWunxIoSQcTuBffrYV4LASI6Ra5vaUD4pWqlMhshcGpBiz9m9go6uo5IkB28VRvLG-G6a-8jvpbYOsl-aOmmFUaqKr5Jhpc_bS_N4yhAudBvSbRst_qi9pxZHsxtPqSjoCyPX04zIQylPzTAsS_nKC0ubbVaeKRYUPivEXcsOFanzKjeXT0YyytyE25V\/s1700-nu-rw-lo-l85-e365\/1.png\" alt=\"\" border=\"0\" data-original-height=\"1499\" data-original-width=\"1536\"\/><\/a><\/div>\n<li>Exposed Dixell\/Copeland XWEB PRO refrigeration controllers are being turned into abuse infrastructure, according to SecurityScorecard, which uncovered a <strong>suspected SMTP botnet<\/strong> that includes confirmed refrigeration controllers. Attackers are said to be using compromised Dixell\/Copeland XWEB PRO refrigeration controllers as proxy exits and spam senders. \u00abThe SMTP cluster consists of nine IP addresses, three of them confirmed XWEB controllers,\u00bb Security Scorecard <a href=\"https:\/\/securityscorecard.com\/blog\/a-dish-served-lukewarm-the-refrigerator-botnet\/\" target=\"_blank\">said<\/a>. \u00abOf 1,041 targets, 508 were contacted by at least two nodes. The three most active nodes had approximately 47% of their target lists in common, the report\u2019s strongest signal of coordination.\u00bb<\/li>\n<li>A targeted Browser-in-the-Middle (BitM) phishing operation dubbed <strong>PhantomDOM<\/strong> is using custom DOM-mirroring to hijack Microsoft 365 sessions. \u00abThe attack began with a SharePoint-themed PDF distributed from an apparently legitimate sender and progressed through redirects and browser checks before presenting Microsoft authentication inside an attacker-controlled remote browser,\u00bb ZeroBEC <a href=\"https:\/\/zerobec.com\/blog\/phantomdom-browser-in-the-middle-microsoft-365\" target=\"_blank\">said<\/a>. \u00abThe victim saw a familiar sign-in experience. The attacker controlled the browser in which that experience actually ran.\u00bb According to the email security company, PhantomDOM goes beyond cloned login pages and conventional reverse-proxy phishing. \u00abIts client reconstructs the remote DOM, forwards keyboard and clipboard interactions over WebSocket, survives connection interruptions and supports live operator control,\u00bb it added.<\/li>\n<li>According to a report from the non-profit AI Alignment Foundation, AI agents assigned a <strong><a href=\"https:\/\/aialignmentfoundation.org\/early-explorations\/agents-secrets-swarms\" target=\"_blank\">sandboxed coding task<\/a><\/strong> to fix a broken pricing service \u00abshared a private token and ran untrusted code in exchange for help from an agent forum.\u00bb In an experiment tested against nine models, GPT-6.1-Sol refused every swarm request in 50 of 50 trials, while Gemini 3.8 Flash and Claude Sonnet 5.5 trials were cut short by their providers&#8217; content filters. <\/li>\n<li>A zero-day vulnerability has been disclosed in <strong>CPython<\/strong> that could enable bad actors to breach AI hosting platforms. \u00abA memory-safety flaw in the CPython interpreter allows attackers to escape a code sandbox and execute code hidden in a specially crafted model,\u00bb RunSybil <a href=\"https:\/\/www.runsybil.com\/blog\/cpython-0-day-vulnerabilities-threaten-the-ai-supply-chain\" target=\"_blank\">said<\/a>. \u00abBy exploiting this vulnerability, attackers could gain a foothold inside servers responsible for processing millions of user requests. They also could strike directly at the underlying cloud infrastructure hosting those workloads.\u00bb The findings build upon a previous out-of-bounds read in CPython that could result in a sandbox escape. The issue has been fixed and backported to 3.13, 3.14, and 3.15 branches.<\/li>\n<li>The U.S. Treasury&#8217;s Financial Crimes Enforcement Network (FinCEN) has issued an order effectively cutting off <strong>MEXC Global<\/strong>&#8216;s access to the U.S. financial system under Operation Economic Outcast. \u00abMEXC Global is a convertible virtual currency exchanger that has facilitated at least $16 billion in illicit transactions connected to Iranian, North Korean, and Russian sanctions evasion, as well as cybercrime, including by transacting directly with sanctioned actors,\u00bb FinCEN <a href=\"https:\/\/www.fincen.gov\/news\/news-releases\/operation-economic-outcast-severs-mexc-globals-access-us-financial-system\" target=\"_blank\">said<\/a>.<\/li>\n<li>A new study of <strong>25,964 U.S. government-related domains<\/strong> has found 43 whose DNS records referenced either mistyped, expired, or otherwise repurposed domains. In one case, a misspelled domain&#8217;s SPF configuration (\u00abamzonses[.]com\u00bb instead of \u00abamazonses[.]com\u00bb) authorized at least 32,066 unique IP addresses to send email on behalf of a U.S. county. \u00abThese external dependencies authorize third-party senders, route incoming mail, provide DNS delegation, and receive security telemetry,\u00bb SH Consulting <a href=\"https:\/\/www.sh.consulting\/blog\/government-dangling-dns-records\" target=\"_blank\">said<\/a>. \u00abThe government domains themselves can remain registered and be considered protected, because there are no signs to suggest anything is wrong.\u00bb SH Consulting said it defensively registered 17 of these dangling DNS dependencies to prevent abuse.<\/li>\n<li><strong>Abraham Teklu Lemma<\/strong>, 53, of Maryland and a former information technology contractor at the National Reconnaissance Office, pleaded guilty to conspiring to commit espionage on behalf of the government of the Federal Democratic Republic of Ethiopia. Lemma pleaded guilty to conspiracy to transmit national defense information to a foreign government from 2021 until his arrest in August 2023 and has agreed to a prison term between 120 and 262 months. \u00abHe exploited his IT administrator access to remove classified national defense information, including Top Secret information, from a secure facility and transmitted it to Ethiopian government officials hoping they would use it to target and kill paramilitary fighters in a regional conflict,\u00bb <a href=\"https:\/\/www.justice.gov\/opa\/pr\/former-us-government-contractor-pleads-guilty-spying-ethiopia\" target=\"_blank\">said<\/a> Assistant Attorney General for National Security John A. Eisenberg.<\/li>\n<li>Huntress has <a href=\"https:\/\/x.com\/HuntressLabs\/status\/2119535643466572220\" target=\"_blank\">warned<\/a> of a \u00abcouple waves of activity across multiple organizations involving <strong>GeoVision camera software<\/strong>,\u00bb pointing to broad exploitation of the platform to deliver malware. The activity originates from the IP addresses 45.32.117[.]34 and 156.246.94[.]183.<\/li>\n<li>A single AI-augmented threat actor (AAT) has been observed using a mesh of 12 AI agents called <strong>BOSSAI<\/strong> to conduct persistent campaigns in several countries. The mesh consists of combining HexStrike AI, Hermes, CyberStrikeAI, and HalberdStrike, alongside Grok, OpenClaw, and Claude Code, with some acting as infrastructure builders and maintainers, while others scan for vulnerabilities and attack. The findings once again show how a lone actor can mount offensive operations at scale. \u00abUsing the BOSSAI mesh, the operator targeted hundreds of organizations spanning government emergency services, banks and lenders, universities, military systems, phone directories, e-commerce platforms, and gambling sites in eleven countries,\u00bb Acronis <a href=\"https:\/\/www.acronis.com\/en\/tru\/posts\/bossai-inside-the-ai-attack-mesh-that-targeted-taiwans-emergency-services\/\" target=\"_blank\">said<\/a>. \u00abIt&#8217;s unclear if the attacker has any specific affiliation or goal beyond compromising as many organizations as possible, presumably to monetize the activity.\u00bb The threat actor is believed to be a single individual based in Hualien City, Taiwan.<\/li>\n<li>Truffle Security has launched the <strong><a href=\"https:\/\/trufflesecurity.com\/blog\/launching-the-secrets-revocation-program\" target=\"_blank\">Secrets Revocation Program<\/a><\/strong>, a free initiative that helps API key issuers revoke 1.4 million secrets that have been confirmed to be live and leaked on GitHub, Docker Hub, npm, Hugging Face, and others.<\/li>\n<li><strong>Gnosis Pay<\/strong> said it detected unauthorized access to the system powering its Gnosis Pay-branded cards on November 3, 2026, leading to the exposure of customer information. \u00abThe data breach was limited to the system powering Gnosis Pay-branded cards, which was already scheduled for retirement on 20 December 2026,\u00bb it <a href=\"https:\/\/gnosispay.com\/blog\/data-breach-legacy-system-gnosis-pay-branded-cards\" target=\"_blank\">said<\/a>. \u00abWe have increased our monitoring of card activity and wallets to detect fraud or attempts to access user funds. We have also implemented an extra verification step (3D Secure) and made it mandatory for all online card payments. These measures will stay in place until the B2C system is fully retired as planned on 20 December 2026.\u00bb The company said it directly notified users about what information was accessed from their account, but did not reveal the number of customers impacted.<\/li>\n<li>The U.S. Department of the Treasury&#8217;s Office of Foreign Assets Control (OFAC) sanctioned four individuals and 41 entities that are tied to scam compounds in Cambodia, Madagascar, and other countries across Southeast Asia and Africa. The sanctioned parties are said to have supported the business network of <strong>Prince Group<\/strong>. \u00abCyber scam syndicates continue to steal billions of dollars from American victims while relying on sophisticated international business networks to launder their illicit proceeds,\u00bb <a href=\"https:\/\/home.treasury.gov\/news\/press-releases\/sb0683\" target=\"_blank\">said<\/a> Secretary of the Treasury Scott Bessent. \u00abThe newly designated individuals and entities have helped sustain Prince Group TCO\u2019s illicit global operations after the October 2025 and June 2026 designations by managing offshore corporate structures, concealing beneficial ownership, facilitating commercial activities, and providing administrative and financial services to senior Prince Group TCO executives.\u00bb<\/li>\n<li>The U.S. Treasury also sanctioned <strong>Chui Kok Wa<\/strong> for his role as the leader of a scam compound in Madagascar that was dismantled earlier this year. Late last month, Wa was charged with conspiracy to commit wire fraud, as the leader of the NFT investment scam. \u00abIn the scheme, scammers posed as beautiful women who met victims on dating websites, eventually enlisting them to connect their cryptocurrency wallets to fraudulent websites associated with the NFT investments,\u00bb the Justice Department <a href=\"https:\/\/www.justice.gov\/usao-dc\/pr\/scam-center-strike-force-expands-reach-target-global-crime-syndicates-charges-scammers\" target=\"_blank\">said<\/a>. \u00abOnce connected, the scammers willed the victims to continue to fund their cryptocurrency wallets, and then surreptitiously pulled money from the victims\u2019 wallets without their knowledge.\u00bb Wa&#8217;s phones also allegedly contained employment contracts, detailing overnight work schedules in Madagascar and providing employees with bonus payments tied to money stolen, as well as scripts or guides for what scammers should say to victims and a roster containing employees&#8217; names, passport information, salary, hours, disciplinary actions taken against them, along with a list of cryptocurrency wallet addresses for the employees.<\/li>\n<li>Vercel has launched <strong><a href=\"https:\/\/vercel.com\/blog\/vercel-security-review\" target=\"_blank\">Security Review<\/a><\/strong>, a new capability in Vercel Agent that scans for vulnerabilities on every push to a team&#8217;s connected GitHub repositories. \u00abFindings appear as comments on pull requests, are listed in the Security dashboard, and are available via CLI,\u00bb Vercel said. \u00abWith your permission, Vercel Agent can also validate and push fixes for findings.\u00bb In tandem, Vercel <a href=\"https:\/\/x.com\/cramforce\/status\/2117645359082315988\" target=\"_blank\">said<\/a> it&#8217;s starting the rollout of Device Bound Session Credentials (DBSC) for vercel[.]com to make it harder for stealer malware to siphon session cookies from a device. Google rolled out DBSC support in Chrome earlier this April.<\/li>\n<li>Fortra has revealed that attackers are creating <strong>convincing travel-booking pages<\/strong> that imitate trusted rental platforms. \u00abThe fake sites use familiar branding, realistic property listings, reservation details, and urgent messages to persuade travelers to provide sensitive data such as credit card information, usernames and passwords, and more,\u00bb Fortra <a href=\"https:\/\/www.fortra.com\/blog\/fake-holiday-rental-sites-can-steal-more-your-travel-plans\" target=\"_blank\">said<\/a>.<\/li>\n<li> <strong>Patrick Steven Yaroch<\/strong>, 37, has pleaded guilty today to wire fraud and money laundering related to using his access as an FBI agent to steal cryptocurrency. \u00abFrom 2017 through early 2025, Patrick Steven Yaroch, 37, worked at the FBI Boston Division on an investigative squad focused on an adversarial nation-state,\u00bb the Justice Department <a href=\"https:\/\/www.justice.gov\/usao-edva\/pr\/former-fbi-agent-pleads-guilty-cryptocurrency-theft\" target=\"_blank\">said<\/a>. \u00abFrom February 2025 to July 31, 2026, Yaroch worked in the FBI&#8217;s Counterintelligence and Espionage Division, with access to FBI systems that contained cryptocurrency credentials that the FBI had collected as part of its investigations. Beginning no later than December 2024, Yaroch used his position to steal cryptocurrency from wallets controlled by the subjects of various other investigations or by adversarial nation-state actors, and from at least one wallet the FBI created to use in an operation. Throughout his wire fraud scheme, Yaroch conducted approximately 100 fraudulent transfers using credentials related to 35 separate FBI investigations. He illicitly gained approximately $2,474,380.66 in fraudulent proceeds.\u00bb The stolen funds were used to pay off his debts and finance a new life abroad, even asking ChatGPT how to maximize profit from investments and where to live in the European Union. Yaroch will be sentenced in March 2027.<\/li>\n<li><strong>DigiCert<\/strong> said it <a href=\"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=2084460#c2\" target=\"_blank\">identified<\/a> an event involving unauthorized access to one of its business systems, leading to exposure of names and email addresses. In some cases, driver&#8217;s licenses, passports, utility bills, and other documents containing a name and address that its customers provided as proof were also compromised. The incident has been traced back to a February 2025 change that moved the internal business system to a different network segment, causing it to be opened to the public internet for more than 16 months. Unknown attackers abused a self-registration feature in the system&#8217;s account manager to create a read-only account that had access to archived data between June 27 and July 2, 2026. Although DigiCert blocked the unauthorized account on July 2, it subsequently determined in October that the account was used to access archived customer contact information, including names, email addresses, phone numbers, and business addresses.<\/li>\n<li>OpenAI announced 2 that it is increasing payouts in its <strong>Security Bug Bounty<\/strong> program. The objective is to get the broader research community hunting for flaws that its own testing may have missed. \u00abA critical vulnerability in a core product such as ChatGPT, Codex, or the API Platform will now earn up to $30,000,\u00bb OpenAI <a href=\"https:\/\/openai.com\/index\/rewarding-defenders-with-bigger-bug-bounties\/\" target=\"_blank\">said<\/a>. \u00abExceptional critical findings on those targets remain eligible for up to $100,000, and now up to $172,000 with bonuses.\u00bb<\/li>\n<li>Three people accused of using AI to impersonate corporate executives and attorneys to plunder about $129 million have been indicted on charges of wire fraud and aggravated identity theft. <strong>Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42,<\/strong> targeted thousands of companies and attorneys at major law firms in order to trick employees into sending large payments to bank accounts under their control between 2024 and 2026, according to the <a href=\"https:\/\/www.justice.gov\/usao-sdny\/pr\/three-foreign-nationals-arrested-and-charged-scheme-use-super-intelligence-defraud\" target=\"_blank\">Justice Department<\/a>. Soall and Hazan were arrested in Spain in June and August 2026, respectively, while Sheetrit was arrested in the U.K. in September 2026.<\/li>\n<li>A <strong>fake download campaign<\/strong> is targeting users searching for cracked commercial software, free games, activators, plugins, and unofficial utilities. The campaign uses trojanized Inno Setup-style installers hosted on bogus sites to distribute multiple payloads. \u00abWe confirmed three downstream monetization branches that transformed affected devices into monetized assets, including by routing third-party internet traffic through the device [WorldProxyPool], enrolling it in a distributed-computing platform [CharityEngine and BOINC], or installing additional utility-style software [AW Manager or Windows Manager], often without users&#8217; informed knowledge or consent,\u00bb Microsoft said. \u00abThese products and components may have legitimate uses, but their silent installation through deceptive software bundles without informed user consent introduces security and privacy risks.\u00bb<\/li>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEilx6cjWWmBb6iOUX2O2KcmLd6CUEAtskS4XIKRMYW0WjeFvGxvPtLG9TPNRu-4KXlkBKaSLGWZV3KX_Dw0IezImD7vfoG6VxjJPWSd_NYIxw-A9LErM16iZH_WO0yu1vv2pJNTmIre51aMRs7jMXPx6hqA9u1oWoxk23pfn61k2k1DwCd3LpFqojPk5SY_\/s1700-nu-rw-lo-l85-e365\/22.jpg\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEilx6cjWWmBb6iOUX2O2KcmLd6CUEAtskS4XIKRMYW0WjeFvGxvPtLG9TPNRu-4KXlkBKaSLGWZV3KX_Dw0IezImD7vfoG6VxjJPWSd_NYIxw-A9LErM16iZH_WO0yu1vv2pJNTmIre51aMRs7jMXPx6hqA9u1oWoxk23pfn61k2k1DwCd3LpFqojPk5SY_\/s1700-nu-rw-lo-l85-e365\/22.jpg\" alt=\"\" border=\"0\" data-original-height=\"523\" data-original-width=\"936\"\/><\/a><\/div>\n<li>A Chinese-language exploitation framework called <strong>Greeter<\/strong> has targeted Flowise honeypots with thousands of chat messages reading only \u00abhello\u00bb while weaponizing an old code injection flaw (<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-58351\" target=\"_blank\">CVE-2024-58351<\/a>) to execute malicious instructions. The framework conducted system discovery, extracted environment variables, probed cloud metadata services, searched for SSH keys and other credentials, tried to set up persistence, and ran quick checks to determine whether the host could run payloads from memory. Era Security said it counted 4,372 Flowise instances exposed online, out of which 703 (21.5%) had no authentication enabled. \u00abIt reveals a new exploitation framework designed to turn exposed AI applications into entry points for code execution, credential discovery, and potentially broader cloud compromise,\u00bb Era Security <a href=\"https:\/\/era.security\/blog\/greeter-flowise-ai-infrastructure-attack\" target=\"_blank\">said<\/a>. \u00abThe framework\u2019s most consequential feature was its ephemeral, per-request execution model. Attack instructions were supplied through overrideConfig.javascriptFunction, while stored user messages contained only &#8216;hello.&#8217; The malicious function could change with each request without altering the saved chatflow, leaving an incomplete picture for defenders inspecting workflow definitions or chat history alone.\u00bb<\/li>\n<li>A threat actor has been abusing <strong>fake \u00absuspended account\u00bb notices<\/strong> to hide phishing content from users revisiting its lookalike pages masquerading as business banking and treasury logins. The campaign, active since May 2026, has been relying on more than 300 fake domains, including 248 impersonating 189 U.S. financial institutions. The first domains were registered in late 2025, but most of them appeared between July and September 2026. \u00abWhat ties them together is one mechanism: the kit remembers every visitor\u2019s IP address, so the first visit gets a bank login page, and any return visit gets what looks like a closed hosting account. We call this cluster the &#8216;Suspended&#8217; infrastructure,\u00bb KELA <a href=\"https:\/\/www.kelacyber.com\/blog\/bank-phishing-campaign-fake-takedown\/\" target=\"_blank\">said<\/a>. \u00abMost domains follow the same recipe, -[bank].com, with keywords such as secure, disable, protect and cancel, which makes the cluster findable in newly registered domain feeds.\u00bb<\/li>\n<li>Meta said it paid nearly <strong>$1.2 million in bug bounties<\/strong> to researchers who found and responsibly disclosed issues in its Muse AI assistant. The bug bounty program went public in September 2026. \u00abThe largest single award was paid out four months before launch for a bug that allowed a researcher to get access to conversations and tokens in pre-release VMs used by employees and engineers testing the product,\u00bb Meta <a href=\"https:\/\/muse.ai\/blog\/securing-muse\" target=\"_blank\">said<\/a>. \u00abAn authentication check treated a header added by a local HTTPS proxy as proof that a request came from a trusted source. During a system migration, the environment gained a second proxy layer. That meant requests from outside could carry the trusted header too. A researcher found this and demonstrated the exploit.\u00bb Meta paid a $300,000 bounty for this report.<\/li>\n<li><strong>Chinese nation-state threat activity<\/strong> declined by 41.4% in the six months from April to September 2026, according to a new study by Trellix. The change is \u00aba shift in operational focus, we assess, rather than reduced intent, and one that warrants vigilance rather than reassurance,\u00bb it <a href=\"https:\/\/www.trellix.com\/blogs\/research\/the-speed-of-cyber-threats-is-changing-are-we-keeping-up\/\" target=\"_blank\">added<\/a>.<\/li>\n<li>QNAP is urging users to <a href=\"https:\/\/www.qnap.com\/en\/how-to\/faq\/article\/plex2shell-check-and-remediation-faq-for-qnap-nas-users\" target=\"_blank\">update Plex Media Server<\/a> on their NAS instances to the latest version available in the QNAP App Center following reports of active exploitation of a set of vulnerabilities known as <strong>Plex2Shell<\/strong>. \u00abQNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through these vulnerabilities,\u00bb it <a href=\"https:\/\/www.qnap.com\/en\/security-news\/2026\/qnap-security-notice-plex-media-server-vulnerabilities-plex2shell-update-to-1-43-3-10861-or-later-immediately-no-data-loss-reported\" target=\"_blank\">said<\/a>. \u00abThe QNAP Technical Support team is assisting affected users and has confirmed that no data loss has occurred.\u00bb<\/li>\n<li><strong>MetaMask<\/strong> has disclosed that the security incident it identified on September 28, 2026, resulted in unauthorized access to part of its infrastructure, and that it took steps to contain the incident and secure affected systems. \u00abWe have identified no indication that MetaMask wallets or our wallet infrastructure were compromised as a result of this incident,\u00bb it <a href=\"https:\/\/metamask.com\/news\/user-update\" target=\"_blank\">said<\/a>. \u00abWe have not identified evidence that the incident enabled unauthorized access to or withdrawal of customers&#8217; staked principal. However, a limited amount of execution-layer staking rewards was diverted during the incident.\u00bb The attacker is said to have briefly altered the addresses used to receive execution-layer staking rewards for certain validators, diverting approximately 0.385 ETH in rewards. \u00abThese rewards are separate from customers&#8217; staked ETH,\u00bb MetaMask added. \u00abWe have found no evidence that customers\u2019 staked principal or withdrawal keys were compromised, and the affected systems have been secured.\u00bb<\/li>\n<li><strong>Infected security-themed GitHub projects<\/strong> are being used to target cybersecurity professionals to deliver backdoors and infostealer malware. According to Doctor Web, more than 2,000 PCs have been affected. The malicious code is embedded in Visual Studio project files, Python scripts, and Go source files. Once launched, the malware establishes persistence on the infected host, escalates privileges, disables security and recovery features, and deploys additional payloads, including AsyncRAT, a clipper malware, and an information stealer. The malware also attempts to remove ESET, McAfee, and Malwarebytes antivirus tools from the host and interferes with Windows backups. \u00abThe attackers behind these compromised development projects target blockchain game enthusiasts and (most intriguingly) information security professionals,\u00bb the Russian cybersecurity company <a href=\"https:\/\/news.drweb.com\/show\/?i=15311&amp;lng=en&amp;c=5\" target=\"_blank\">said<\/a>. \u00abThe first infected repositories emerged two years ago. The early uploads targeted crypto wallet users \u2013 back then attackers used repositories containing Visual Studio projects related to blockchain games, game bots and cheating.\u00bb<\/li>\n<li>Security researcher Scott Helme has <a href=\"https:\/\/scotthelme.co.uk\/we-know-15-579-websites-are-infected-how-do-we-tell-them\/\" target=\"_blank\">revealed<\/a> that about <strong>15,579 websites<\/strong> are currently infected with malicious JavaScript delivering credit card skimmers, ClickFix lures, iOS exploitation kits like Coruna and DarkSword, and malicious redirects. These websites receive more than 135 million visits every month.<\/li>\n<li>A new report from Layer3 Intel has found that residential proxy traffic has exited through the <strong>White House network<\/strong> (<a href=\"https:\/\/ipinfo.io\/AS2650\" target=\"_blank\">AS2650<\/a>) 236 times over a 30-day period between October 5 and November 3, 2026, with 28 separate residential proxy services able to route traffic through six of its addresses. \u00abMost of the activity happens in the evening, Eastern time: about half of it falls between 5 p.m. and midnight, and almost none happens in the early morning,\u00bb Layer3 Intel <a href=\"https:\/\/layer3intel.com\/blog\/residential-proxies-white-house-network\" target=\"_blank\">said<\/a>. \u00abThat pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK. Our data shows the exits, not the device or the person behind them.\u00bb In a post shared on X, Synthient <a href=\"https:\/\/x.com\/synthient\/status\/2118115310922518777\" target=\"_blank\">said<\/a> \u00abseveral White House staffers are running a Windows 11 machine with InfaticaSDK installed,\u00bb <a href=\"https:\/\/x.com\/synthient\/status\/2118205874951110841\" target=\"_blank\">adding<\/a> it found \u00aba number of Windows 10 and Windows 11 devices beaconing to known proxy providers like <a href=\"https:\/\/krebsonsecurity.com\/2026\/11\/want-to-rent-an-internet-address-at-the-white-house\/\" target=\"_blank\">Geonode, Infatica, and Mellowtel<\/a>.\u00bb The root cause is believed to be Rave[.]io, a shared streaming app that bundles 12 proxy SDKs into the platform. Rave allows users to watch content from YouTube, Netflix, and Disney+ with friends and runs on Mac, iPhone, Android, and Windows.<\/li>\n<li>A set of five vulnerabilities has been disclosed in <strong>Reachy Mini<\/strong>, an open-source, expressive companion robot from Pollen Robotics and Hugging Face, that, when chained together, can allow an attacker to \u00abexecute attacker code, escalate to a persistent root via the robot\u2019s passwordless sudo, and ultimately gain control of the device&#8217;s motor,\u00bb JFrog <a href=\"https:\/\/jfrog.com\/blog\/reachy-http-request-hijacks-ai-robot\/\" target=\"_blank\">said<\/a>. \u00abA second variant of the attack works through the browser, where the operator visits a malicious web page, which silently compromises the robot.\u00bb<\/li>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjtQnvBbxiLoTnz3i-5zD5ZeTLFma7yIbcNF0dgOGe9W3cgHKo5H5tqhiQ5ddSINYO0Od7eGRfyJ7rRZR8SaqpxvbFr2US6xkeMgOT-ilQnQGSm1ToBM1zAinfn9O5OhYIoeb2tiJz27GpsuFoQGSZIzFsE-z325EsY2JJ2813dgyqcJBGqlkE4Fu98J42u\/s1700-nu-rw-lo-l85-e365\/3.jpg\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjtQnvBbxiLoTnz3i-5zD5ZeTLFma7yIbcNF0dgOGe9W3cgHKo5H5tqhiQ5ddSINYO0Od7eGRfyJ7rRZR8SaqpxvbFr2US6xkeMgOT-ilQnQGSm1ToBM1zAinfn9O5OhYIoeb2tiJz27GpsuFoQGSZIzFsE-z325EsY2JJ2813dgyqcJBGqlkE4Fu98J42u\/s1700-nu-rw-lo-l85-e365\/3.jpg\" alt=\"\" border=\"0\" data-original-height=\"1856\" data-original-width=\"2348\"\/><\/a><\/div>\n<li>A phishing campaign built around <strong>fake registration pages for OpenAI, SpaceX and Anthropic events<\/strong> is luring marketing employees with rewards like \u00ab3 months of ChatGPT Pro\u00bb or \u00ab3 months of Grok Heavy\u00bb to get them to sign in with their work accounts. \u00abThis campaign uses them in email-delivered invitations that lead to AitM and device code phishing, expanding the use of AI-themed lures across various payload types,\u00bb Push Security <a href=\"https:\/\/pushsecurity.com\/blog\/ai-themed-fake-event-campaign-analysis\" target=\"_blank\">said<\/a>. \u00abEmployees want access to the latest AI tools, making them excellent bait for attacks.\u00bb The Microsoft option launches a device code phishing flow run through the Kali365 phishing-as-a-service platform, while clicking \u00abContinue with Google\u00bb opens a VoidProxy reverse proxy of Google&#8217;s sign-in page. It is unclear how the attackers initially distribute the phishing links. The kits used to build and deploy the fake event invite lure pages as ZoomMock and MSDRoot. Similar campaigns have been reported by <a href=\"https:\/\/x.com\/anyrun_app\/status\/2077370282193404060\" target=\"_blank\">ANY.RUN<\/a> and <a href=\"https:\/\/cofense.com\/blog\/would-your-employees-join-a-fake-anthropic-ai-preview\" target=\"_blank\">Cofense<\/a> in recent months.<\/li>\n<li>A U.S. school estate was compromised by the <strong>3AM ransomware group<\/strong> as part of a hybrid human-AI operation, according to Bitdefender. The exact initial access vector used is unknown, but the first recorded activity started on September 10, 2026. \u00abSome parts show a human operator at the keyboard while others behave like an agentic loop, a language model reading each result and retrying with different commands,\u00bb Bitdefender <a href=\"https:\/\/www.bitdefender.com\/en-us\/blog\/businessinsights\/3am-ransomware-hybrid-ai-attack\" target=\"_blank\">said<\/a>. \u00abWith the exception of the encryptor itself, the whole operation was built on legitimate, built-in tools, which is standard for ransomware operations. What is different is how the attacker behaved, and several things point to an agentic loop, a program that feeds each result back to a model and runs what comes back. The retries behave like a loop too.\u00bb<\/li>\n<\/ul>\n<h2 style=\"text-align: left;\"><strong>Conclusion<\/strong><\/h2>\n<p>The strange part is how many of these attacks start with something small. A setting nobody checked, an update nobody questioned, or a system left online longer than it should have been. Add a little patience from the attackers, and suddenly a minor mistake becomes a much bigger problem. Not every attack needs a clever trick.<\/p>\n<p>That&#8217;s it for this week&#8217;s roundup. Some of these stories will fade, while others may get worse as more details come out. Either way, there&#8217;s enough here to keep security teams busy. Check what applies to your systems, fix what you can, and we&#8217;ll be back next week with whatever turns up next.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Nov 09, 2026Cybersecurity News \/ Hacking A system doesn&#8217;t always need a complicated bug to let someone in. Sometimes, a blank password is enough. That&#8217;s one of the bigger&hellip;<\/p>\n","protected":false},"author":1,"featured_media":4037,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[4087,1528,128,715,316,3214,61,228,4071,3952],"class_list":["post-4036","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-15k","tag-apt","tag-exploited","tag-hacked","tag-rce","tag-robot","tag-root","tag-sites","tag-sshole","tag-takeovers"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4036","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4036"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4036\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/4037"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4036"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4036"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4036"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}