🪱 Tensorlake npm release poisoned with Shai-Hulud via trusted pipeline, 🤖 PoeLLM botnet mines 3,400+ AI servers, 🚔 ShinyHunters leader detained and cooperating with FBI, 🌐 Google cert forgeries traced to hijacked .gh/.sl/.as registries, ⚖️ MonsterCloud CEO charged over secret ransom payments, 🏥 Oracle Health breach climbs to ~20 million

[NEW] The Shai-Hulud npm worm resurfaced this morning inside Tensorlake: version 0.5.144 of the SDK, published from a project with over 1,000 GitHub stars, was poisoned with the self-propagating credential stealer we last tracked in September, harvesting Kubernetes and Vault secrets and spreading through CI environments. The twist that makes this one defining: the attacker poisoned the main branch first and then let the project's own trusted GitHub Actions release pipeline publish the malware with valid SLSA provenance, turning the integrity signal defenders are told to check into the attack accelerator. Version 0.5.143 is clean and 0.5.144 has been pulled from npm, so audit install logs for the exposure window, scan CI runners for the family (a basic YARA rule flags it), and rotate any Kubernetes or Vault credentials that could have passed through a poisoned build.

[NEW] Lumen's Black Lotus Labs on Wednesday unveiled PoeLLM, a cryptomining botnet that has compromised more than 3,400 servers since April, peaking near 800 infections in a single day, by attacking exposed LiteLLM, Ollama, Gotenberg and Gitea instances across the US and Western Europe. Its C2 hiding trick is a poem: the operator posted verse on GitHub, and the malware extracts specific words from it and maps them through a hard-coded dictionary to rebuild server addresses, changing the keywords at least a dozen times to stay ahead of takedowns. The campaign also touches Ivanti Sentry, linked to CVE-2026-10520, so patch that flaw and treat any internet-exposed AI service as a recruitment pool for this botnet.

[REVISIT] The ShinyHunters investigation produced its biggest head yet: KrebsOnSecurity reported yesterday that the group's suspected leader, a teenager from Amman, Jordan who goes by "Rey" and was previously identified as Saif Al-din Khader, has been detained and is reportedly cooperating with the FBI. He was picked up while the gang was mid-extortion of Jeppesen ForeFlight, the Boeing aviation unit divested in a 10.55 billion dollar deal, and the news lands weeks after Dutch police arrested 24-year-old Pepijn van der Stap in September. The investigation has now touched Kodak, McKesson and Boeing's orbit, and the FBI's message that detained members are talking means remaining ShinyHunters affiliates should expect further unmasking.

[UPDATE] The counterfeit TLS certificates for Google domains flagged here yesterday have their mechanism: BleepingComputer details that attackers compromised the third-party registry operators for the .gh, .sl and .as country-code domains and altered authoritative DNS records, letting them pass automated domain control validation and mint unauthorized certificates for Google properties, roughly a dozen per the early counts. Google says its own systems were never breached, blocked the certs in Chrome via CRLSets and coordinated revocation with the certificate authorities, and the registry hijack behind the mis-issuance is a reminder that DCV is only as trustworthy as the weakest national registry operator.

[NEW] Zohar Pinhasi, the 50-year-old owner of ransomware recovery firm MonsterCloud who also used the aliases Zack Silver and Zack Green, appeared in a New York court today on wire fraud charges alleging he defrauded breach victims by marketing proprietary recovery technology while secretly paying attackers for decryptors. Every client who believed they bought attacker-free recovery may have instead funded both sides of their own extortion, and the indictment turns a spotlight on an incident-response niche where customers cannot verify independence from the attacker. Procurement teams should pull contracts and payment records for opaque recovery vendors while prosecutors name additional victims.

[NEW] Double Counter, a widely installed Discord security bot, disclosed that attackers found a forgotten OVH server running an exposed Metabase instance, stole cloud credentials, hijacked the bot, copied about 12 GB of database contents and misused a separate payment account, exposing personal data linked to millions of accounts. Operator Tellter SAS's incident report describes usernames, emails, identity and IP data plus payment-customer records in the copied set. A trust product compromised through its own neglected infrastructure is the canonical third-party risk story for any community that delegated verification to it, and the open question is whether the attacker kept persistent access.

[NEW] Unit 42's Blinder Tunnel campaign, disclosed Tuesday and detailed further today, is an Iranian state-aligned operation that hit Iraqi critical infrastructure using fake Dubai Airports recruitment lures whose coding test delivers ShelbyLoader V2, with command-and-control hosted on GitHub to blend into developer traffic. Recruitment-themed delivery against a Middle East critical-infrastructure target is targeted collection work, not opportunistic crimeware, and the GitHub C2 dependency gives defenders a concrete pivot: audit egress to raw GitHub content from OT-adjacent networks.

[UPDATE] Pwn2Own Ireland concluded with day two awarding $232,500 for 45 unique zero-days, the highlight being the Samsung Galaxy S26 falling three times in one day to KAIST Hacking Lab's Kyeongmin Kim, PetoWorks, and Mobile Hacking Lab's Dimitrios Valsamaras and Ken Gannon, alongside exploits of a Sonos Era 300 speaker, an Oracle Autonomous AI Database and a Home Assistant Green hub. Vendors now have 90 days to patch, which makes the final leaderboard a preview of next quarter's patch queue.

[UPDATE] Fortinet's own analysis confirms the FortiBleed campaign is still active and has shifted to locking organizations out of their FortiGate firewalls and SSL VPN appliances by changing passwords and deleting admin accounts, using credentials harvested since June plus brute force against internet-exposed devices. As the FBI and Secret Service warned this week, a device you cannot log into is not a device you have cleaned, so assume credential theft predates any lockout and rebuild rather than negotiate with the console.

[NEW] Oracle's breach ledger grew again: Bloomberg, citing the Texas attorney general, reports the Oracle Health legacy Cerner compromise from early 2025 now involves personal and medical information of nearly 20 million people, stolen via customer credentials on an unmigrated server with data copied out after January 22, 2025. The figure dwarfs the counts in earlier filings and patient notifications, and Oracle still has not publicly confirmed it, so watch for the official tally and whether the unmigrated-server pattern shows up in other cloud-migration estates.

[NEW] SonicWall patched CVE-2026-102255, a CVSS 10.0 pre-authentication SSRF in the SMA1000 WorkPlace portal that gives unauthenticated attackers an unintended forward proxy into internal resources, fixed via hotfixes under advisory SNWLID-2026-0017 on October 7. Censys is already tracking exposed appliances, and given how SonicWall edge devices have been ridden into networks before, treat internet-facing SMA1000s as urgent patch targets and hunt the forward-proxy path in logs.

[NEW] Splunk's October round fixed 17 CVEs, the one that matters being CVE-2026-76268, a critical unauthenticated OS command execution through the Patroni REST API on a search head cluster member disclosed Wednesday in advisory SVD-2026-1001. Network access alone is enough, so any search head cluster reachable from untrusted networks should be patched before it is scanned by someone else.

[NEW] Cisco's October advisory batch covers 18 CVEs with seven criticals and workarounds for none of them, worst of all the NX-OS NGOAM trio CVE-2026-76485, CVE-2026-76486 and CVE-2026-76501, all CVSS 9.8 unauthenticated RCE or denial of service via crafted packets. Until updates land, disabling the NGOAM feature is the only mitigation, and data-center teams should inventory which NX-OS devices even have it enabled.

[NEW] Openfind's SecuShare Pro v4 file-sharing product has CVE-2026-107459, an unauthenticated OS command injection (CWE-78) that yields RCE from a single HTTP request with no credentials, scored between CVSS 9.3 and 9.8 depending on the tracker. Internet-exposed document-sharing appliances have been a favorite initial access vector all year, so patch or take it offline.

[NEW] The X.Org Foundation shipped X.Org Server 21.1.25 and Xwayland 24.1.14 on Wednesday fixing 12 critical vulnerabilities across the display server stack, a reminder that the graphics stack sits on far more than workstations, including build servers and kiosks running graphical sessions.

[NEW] Veeam fixed CVE-2025-64393 in Backup & Replication 12.3.2 P4, a CVSS 4.0 score of 9.4 flaw letting a low-privileged authenticated user with the Backup Viewer role reach arbitrary code execution through insecure deserialization in the Mount Service; versions through 12.3.2.4854 are affected and version 13 is not. Backup infrastructure is the first thing ransomware crews hunt, and a fix that shipped October 6 with a Cyber Centre advisory October 7 should be fleet-wide before the next backup window.

Watchlist: whether the Tensorlake pipeline compromise spreads to further packages published through the same poisoned GitHub Actions path, browser vendors' follow-through beyond CRLSets on the hijacked ccTLD certificates, new FortiBleed lockout victims, KEV action or mass scanning against the SonicWall, Splunk, Cisco NGOAM and Openfind criticals, Oracle confirming the 20 million figure, co-conspirators named as the Pinhasi case unfolds, and the first Pwn2Own Ireland patches arriving inside the 90-day window.

Generated by zai/glm-5.3-flash. Input tokens: 83,684, output tokens: 28,734, cache read: 1,428,288, cache write: 0.