This Week In Safety: ShinyHunters Gained’t Dox The FBI, Pentagon Data Stolen, And OBS Vulnerable

404 Media reports that the ShinyHunters group who stole a number of terabytes of FBI worker information say they don’t plan to launch the information.

Known for ransomware and extortion of innumerable firms and authorities companies, ShinyHunters used a zero-day vulnerability in Oracle FolksSoft to compromise the employment web site of the FBI and pivot into scraping the content material of FBI AWS cases, claiming to have the complete employment and well being information of all FBI brokers, staff, and spouses.

The hacker group took exception to an FBI press launch that claimed that the group over-stated stolen information and that they immediately harass victims and sufferer’s households.  The group publicized the FBI information breach, demanding a retraction of the statements, and it was typically assumed that the group would comply with their typical strategies of releasing the information publicly if the calls for weren’t met.

The group has advised 404 media that they’d all the time agreed internally to not launch the stolen information, saying “This was all a advertising marketing campaign to guard our enterprise and actively fight disinformation”.  Meanwhile the FBI continues the investigation, and Shiny Hunters could also be hoping to defer a few of the ire.

Pentagon Data Breach

A data breach at the Defense Manpower Data Center lasted for 9 months earlier than it was found, and allowed unknown attackers to exfiltrate info on navy personnel.

The info stolen consists of social safety numbers and “operational specialty” information about the place a service member is employed inside the armed forces.  The DMDC handles information on 60 million present and former service members, however the report doesn’t specify the quantity impacted.

Currently the supply of the assault is unknown; the attackers could also be a typical information ransom or theft group, however details about service members might simply be utilized by overseas intelligence teams.

This is, in fact, a unique assault and leak of US authorities worker information, impartial of the assault on the FBI.

OpenAI Hacked Australian Government Databases

The Australian Prime Minister, Anthony Albanase, has released a statement that OpenAI was concerned in a hacking incident towards the Australian authorities well being providers web site.

This is impartial of different incidents involving OpenAI brokers hacking reside Internet websites throughout testing; OpenAI says the hack was found on September 10, 2026, however the incident occurred in June of 2026, previous to the hack of the HuggingFace web site.

In the Hugging Face assault, AI brokers had been requested to finish a cyber safety problem and responded by discovering and using vulnerabilities to steal the options.  A report by Translucence (an AI analysis lab) finds nevertheless that on this occasion, the brokers had been tasked with non-cyber associated analysis and opted to use not solely the Australian well being providers web site but in addition the University of New Mexico digital library and Data USA, a platform for gathering and visualizing US authorities information.

OpenAI says the evaluation of the incident stays ongoing, and that no non-public affected person information was compromised.  The Australian authorities, clearly, has stronger opinions about how the incident occurred and the size of time earlier than they had been notified.  If brokers are defaulting to exploiting reside Internet websites for regular queries, we’re more likely to maintain discovering extra tales like this.

Physical Attack Against MacOS Lockdown Mode

Researcher Kevin Kessler at glyph.sh discloses a brand new vulnerability in macOS that may enable keyboard assaults even when lockdown mode is enabled.

MacOS has built-in safety measures towards malicious USB units.  Readers utilizing macOS could have seen prompts to permit a USB machine to attach the primary time it’s plugged in; moreover, new USB units are ignored if a Mac has been locked for greater than an hour.

In the extra-paranoid “Lockdown Mode”, macOS will even stop connections to USB units totally whereas the machine is locked.  Lockdown mode additionally disables different working system options which are suspected of being much less safe, like customized net fonts, just-in-time compilation of JavaScript to native code, and direct messaging from unknown contacts. This assault defeats all of those protections.

Due to the structure of USB, if a USB hub is related to macOS and trusted, all units plugged into that hub are mechanically trusted. A composite USB machine — a tool that presents as a number of forms of USB interfaces on a single connection — can determine as each a serial port and a keyboard in a single machine.

Typically macOS would immediate the consumer {that a} new keyboard has been related, however doesn’t immediate the consumer when a brand new USB serial port machine is related to a trusted hub.  Presenting as each a serial machine and a keyboard, key presses are accepted mechanically, with no consumer immediate.

Kessler demonstrates copying delicate consumer information like SSH keys and cloud supplier authentication tokens immediately over the USB serial machine, a trick which can bypass endpoint safety instruments on the lookout for copied information.

Apple advised the researcher that the habits is anticipated when a USB hub has been trusted, and that composite USB units are outdoors the scope of the safety mechanisms.  If so, maybe it must be extra clearly communicated to customers the chance of trusting any USB hub or dock if an attacker might conceivably get bodily entry.

Spying with File Update Notifications

New attacks against the file notification systems of all major operating systems — Windows, macOS, Linux, and Android — will probably be proven on the November 2026 ACM safety convention.

File notification programs are an important a part of nearly all trendy working programs, letting the UI and background providers obtain alerts that file content material has modified, as an alternative of continually querying file modification instances.  Unfortunately, it looks as if all of them have main points and permit bypassing permissions and entry restrictions.

The researchers name out Windows because the worst offender:  it permits a notification to be set for any file modification, system broad, no matter entry permission or what consumer owns it.  To be truthful, it looks as if Linux, macOS, and Android aren’t too far behind nevertheless.

On Linux, the inoti.fyi researchers found that whereas notifications can’t be set on information the consumer isn’t allowed to entry, notifications can nonetheless be set on readable guardian directories, and can nonetheless report modifications to the information.  Leveraging this oversight towards the /dev/enter listing, occasions are raised for each keystroke, and so they reference many years of analysis on utilizing keystroke timing to guess what was typed.

For Android, permission oversights enable one utility to set notifications for the non-public storage of different functions.  Normally, every utility runs in a separate sandbox and has no perception into the habits of different apps, utilizing the Android file notification API, they show monitoring WhatsApp to log the precise time messages and photographs are obtained.

The Windows vulnerability stands out as the most instantly extreme, the place the inoti.fyi group is ready to monitor the cache and native storage directories of browsers.  Browsers like Firefox create information with the identify of the web site; by monitoring the cache directories, it’s attainable to watch the web sites loaded by any consumer on the system.

The group has been working with distributors to deal with the problems, nevertheless usually there are not any fixes accessible but.

OBS Streaming Platform Vulnerable

OBS is a well-liked instrument for streamers, compositing a number of cameras, display and video seize, and extra. A big proportion of streamers on the Internet use OBS.

Orange Cyberdefense Switzerland reports vulnerabilities in OBS because of the embedded Chromium browser supply.  Chromium is the open-source engine behind Chrome, Opera, Microsoft Edge, Vivaldi, and plenty of different browsers; OBS embeds the browser engine to permit embedded net content material and web-based functions inside a stream.

Streamers usually have an embedded show of the chat related to their stream, encouraging viewers participation.  These embeds normally use a browser window to stylize the chats and embed photos, which exposes them to regardless of the content material of the chat message is. Astute readers could already guess how it is a downside.

In a typical browser, every tab is remoted in an impartial sandbox, stopping it from interacting with different tabs or the browser itself, however within the OBS embedded browsers, sandboxes are disabled.  OBS additionally used a two-year-old Chromium engine that contained a publicly recognized and patched bug within the V8 JavaScript engine.  The bug had already been exploited within the wild by North Korean hackers, however the influence was restricted because of the sandbox mechanism isolating every tab. With no sandbox, malicious HTML and JavaScript rendered by an online view might immediately execute code on the system, taking up the OBS occasion or the entire system.

The researchers at Orange have labored with OBS to replace the embedded Chromium model, but in addition provide the recommendation that untrusted HTML must be averted each time attainable:  No OBS widget ought to ever render consumer or chat content material as HTML.

DIVD Hacked

DIVD, the Dutch Institute for Vulnerability Disclosure, announced that they were the victims of a latest hack themselves.

DIVD says that the attackers obtained in by way of two beforehand unknown bugs within the Zammad assist desk software program, and that the attackers look like AI brokers. Within seconds, attackers hijacked Zammad periods, gained code execution, after which gained root entry to the system. DIVD says the attackers instantly started to exfiltrate information from the impacted programs, however had been blocked from accessing different authorities programs.

The Institute is utilizing this as a instructing second, not solely releasing an advisory for the Zammad system, however making a candid LinkedIn post discussing the incident and the responses: “So what do hackers do after they get hacked? Handle it the way in which we expect it must be dealt with. That is open, clear and trustworthy, even when it sucks.”

Enterprise Networking Vulnerabilities

Major vulnerabilities have been discovered exploited within the wild for each Cisco Catalyst SD-WAN and Citrix Netscaler enterprise units. A comparatively bland Cisco announcement discloses that each one variations of the Cisco Catalyst SD-WAN Manager enable unauthenticated, distant, admin entry. (!)

The Citrix Netscaler article, alternatively, comes from the group at watchTowr.  Anyone who has been studying for the previous months ought to know {that a} publish from watchTowr is a assured good learn.  Not solely are the vulnerabilities in Netscaler plentiful and extreme, however they had been extensively recognized and exploited earlier than Citrix lastly launched a vulnerability assertion.

The Netscaler vulnerabilities embrace arbitrary instructions from unauthenticated customers, distant code execution and denial of service assaults towards the VPN server, a number of reminiscence overflows, and predictable random era in some conditions.

WatchTower digs into the firmware modifications for extra particulars, so if seeing how Perl continues to be utilized in 2026 enterprise tools tickles your fancy, make sure you give them a learn.