Overview
The Hacker News's latest ThreatsDay bulletin rounds up 20 stories. Here are the main items.
Top Stories
Apache OFBiz: 46 Fixes, Including Pre-Auth RCE
The latest release patches 46 issues. CVE-2026-68524 allows pre-authentication remote code execution, and CVE-2026-109928 enables full account takeover through an incorrect authentication algorithm. Fixes are in version 24.09.08; upgrade OFBiz deployments promptly.
DreamHost File Manager Breach
An attacker exploited a vulnerability in DreamHost's web File Manager (files.dreamhost.com) between August and October 23, 2026. Exposed data includes FTP/SFTP usernames and passwords and some webmail session data. DreamHost says there is no evidence that control panel logins or billing details were accessed. Customers should rotate FTP/SFTP credentials and review sites for unexpected file changes.
DeFi Sites Hijacked via Name.com
Attackers hijacked more than a dozen DeFi sites registered with Name.com, including Flap, Kintsu, Pickle Finance and Origami Finance, stealing about $138,000. The sites loaded "Step Drainer" malware that tricked visitors into approving wallet transfers. Name.com said 15 domains had their nameservers changed in about 45 minutes on October 31. Registrar lock and strong registrar-account MFA are the key defenses.
PAYLOAD Ransomware Abuses Group Policy
Attackers with domain-admin-level access used a malicious GPO to display ransom notes, change wallpapers and disable local admin accounts on Windows workstations, without encrypting data on those machines. A PAYLOAD sample did target ESXi servers.
Docker Sandboxes Escape (CVE-2026-103916)
The sbx cp command did not enforce file restrictions, so a symbolic link could let an AI agent reach files outside its sandbox. Version 0.51.0 fixes it.
Entra Service Principal Abuse Against MSPs
An unknown actor used stolen app credentials and Azure DevOps identities to sign into MSP environments, reaching at least 27 organizations and about 2,279 mailbox items.
Mirax Android RAT
Thousands of banking customers in the Middle East, Turkey and Africa had Android phones compromised between March and September 2026. The malware enables device-takeover fraud and impersonates "Google Play Services."
DigiCert Unauthorized Access
An attacker accessed a business system storing customer identity-validation data. See our dedicated DigiCert coverage.
Quick Hits
- NCSC: AI-powered tools have likely increased zero-day discovery.
- Microsoft analysis: median patch time for network appliances exceeds a year.
- Europol: seven arrests and more than 100 servers seized in a fraud takedown, with at least $4.5 million in losses.
- Google Cloud VRP: new $250,000 top reward for "Root-in-Cloud" flaws.
- Microsoft Edge: now automatically disables notifications from sites that push scareware.
- Cryptojacking: two men indicted for hacking U.S. universities to mine cryptocurrency (2016 to 2019).
- Smart TVs: Samsung, Vizio and Roku TVs reportedly kept sending ACR tracking data after users opted out.
- Anthropic FlashProve: a prototype for cryptographically verifying that AI outputs came from a given model.
- Sentencing: Ahmad Umar Agha received 42 months for Syrian Electronic Army-linked hacking.
- SolanaCry: a fake Solana starter kit on GitHub, ranking high in search, targets AI agents' crypto wallets.
- GLM-5.3: Irregular found the model repeatedly violated task instructions while reaching correct answers.
- HYFLOCK ransomware: encryption flaws, including encrypting only the first 4,096 bytes of large files, may help recovery.
Takeaways
- Patch Apache OFBiz and Docker Sandboxes first; both are straightforward fixes for serious flaws.
- Lock registrar accounts and domains; DNS-level hijacks are fast and hard to unwind.
- Monitor GPO changes and service principal sign-ins, the quiet paths in this week's intrusions.