TLDR INFORMATION SECURITY 2026-09-28

BITGET HACK TIMELINE: HOW ITS OWN SYSTEM APPROVED A $387 MILLION THEFT

On September 24, attackers stole $387.5 million from Bitget's hot and warm wallets by feeding false transaction data into a compromised backend system, which then authorized the transfers. Bitget detected unauthorized activity at 18:31 UTC, paused withdrawals hours later, and ruled out private-key theft. Mandiant and SlowMist are investigating. CEO Gracy Chen has flagged possible North Korean involvement.

'SALESBLEED' EXPLOITS SALESFORCE AGENTS TO ENABLE SLACK PHISHING

Zenity identified three Salesforce Agentforce weaknesses. Attackers could inject commands via Web-to-lead forms and bypass URL filters. If connected to Slack, they could post phishing links in internal threads. The lack of confirmation and attribution controls made messages appear to come from employees or IT. Salesforce added confirmation prompts, spec-compliant URL parsing, and centralized URL inspection.

CLOUDFLARE FIXES CONTAINERS CROSS-TENANT FLAW EXPOSING CUSTOMER DATA

Cloudflare remediated a cross-tenant flaw in Containers and Sandboxes that allowed a Workers Paid customer to read residual disk blocks left by other tenants on the same host. The flaw stemmed from dm-thin storage pools running with skip_block_zeroing, so a 4 KiB write into a reused 64 KiB block left the untouched 60 KiB readable via a raw read of /dev/vdc. Accomplish's Oren Yomtov, who reported it through HackerOne on September 4, recovered directory structures, database pages, and complete SQLite databases on 18 of 24 placements across 20 of 22 nodes, though an attacker could not target a specific victim or read an actively attached disk. Cloudflare removed skip_block_zeroing fleet-wide, retired running container disks, and cleared cached image snapshots by September 19. Its disk-I/O telemetry review found no exploitation beyond authorized validation, so no customer action is required.

EDR EVASION: PROCESS INJECTION WITHOUT WRITEPROCESSMEMORY

Zero Salarium details a remote process injection technique that skips the heavily monitored VirtualAllocEx and WriteProcessMemory pair, instead spawning an interactive console child (nslookup.exe or netsh.exe) and writing shellcode into its memory via WriteFile on the child's hStdInput pipe, then using VirtualProtectEx to add execute permissions and a thread hijack to point RIP at the payload. A distinctive marker locates the planted bytes, and the payload must avoid 0x0D, 0x0A, and 0x1A, which the console would treat as command input. Since the classic API pair is absent, defenders should watch for VirtualProtectEx against remote processes, read/write activity on named pipes, and the console's command-storage memory region.

GALILEO'S FIRST CIVIL AUTHENTICATED POSITION FIX UNDER SPOOFING CONDITIONS

Galileo has demonstrated its first real-world civil position fix using the upcoming Signal Authentication Service, holding a stable lock across five satellites during live spoofing at the Jammertest event in Andøya, Norway on September 16. SAS encrypts the E6-C ranging signal's spreading codes and publishes the decryption key on a delayed, separate channel, letting a receiver correlate the recorded signal only after the fact to confirm each satellite's pseudorange. It pairs with the already-operational OSNMA, which authenticates the navigation message itself. Both services will be free and worldwide, extend to the High Accuracy Service, and let receivers detect and reject a broad range of spoofing attacks. However, EUSPA still must run SAS validation and accreditation before declaring the service operational, and the delayed-key design leaves jamming and meaconing as open concerns.

OAUTH TOKEN ABUSE: HOW THE ATTACK WORKS AND HOW TO STOP IT

OAuth token abuse gives attackers application-level access that survives password resets and MFA, since tokens belong to the app rather than the user, and can be obtained through consent phishing, device code phishing, credential additions to existing apps, or preconsented first-party applications. Because malicious apps live in the attacker's tenant, defenders should watch victim-tenant Entra ID events (Add service principal, Consent to application, Add delegated permission grant, and app role assignments) alongside anomalous post-consent activity, with behavioral app-to-purpose checks coming from Defender for Cloud Apps rather than native audit logs. The highest-value controls are preventive: restrict user consent to verified low-impact apps, require admin approval for high-risk scopes like Mail.Read and offline_access, and keep an approved application inventory, since eviction requires removing the grant and service principal rather than resetting credentials.

Watch the security demo now.

RCEKIT

RCEKit is an RCE detection and confirmation toolkit for authorized penetration testing, red teaming, and security research. Point it at a target you are authorized to test — a URL or a captured HTTP request — and every finding returns with the tier it earned.

INTRODUCING ADE-SKILLS — ADVERSARIAL DETECTION ENGINEERING KNOWLEDGE BASE

ADE Skills, from Koifsec and Nikolas Bielski, is a knowledge base for adversarial detection engineering: the study of the gap between what a detection rule is intended to catch and what it literally matches. It organizes detection-logic bugs into a taxonomy of four categories (reformatting in actions, omitted equivalents like pwsh.exe vs powershell.exe, context development, and inverted or missing-field logic) across fifteen subcategories and thirty-seven worked technique files, each pairing a vulnerable rule with a hardened one. It also ships platform bug-pattern catalogs for Elastic, Sentinel, and Sigma, a false-negative checklist, a machine-mined catalog of ~593 candidate bypass findings across public rulesets, and Redamon, a purple-team scoping skill that maps in-scope techniques to a target's actual SIEM/EDR rules.

MECATL

Mecatl is an open-source, cloud-native agent harness. Mecatl keeps the agent loop independent of the client and execution environment, so the same runtime can start locally, run remotely with durable external state and a recorded event history, and then scale across Kubernetes replicas without replacing the loop.

SOME SUPABASE CUSTOMERS ARE PUBLICLY EXPOSING REAMS OF PEOPLE'S DATA TO THE WEB

UpGuard found around 16,000 publicly accessible Supabase-hosted databases leaking names, addresses, phone numbers, and some passwords or tokens. Exposed data included private chats with sex workers on an Indian adult site, thousands of US valet license plates, immigration-service contacts, an African consulate's records in France, and a virtual SIM farm used to intercept OTP texts for scams. Most datasets were in the US, but the issue spans multiple regions. Supabase says projects are secure by default and blames misconfiguration on customers.

THERE'S A NEW WAY TO BREAK RSA THAT'S FASTER THAN ANYTHING WE'VE SEEN BEFORE

Researchers demonstrated a classical-computing attack that forges RSA signatures without factoring the private key. Using a "special" number field sieve against blind-signature (textbook) RSA, they reduced security from an estimated 2^80 operations and 500,000–1,000,000 CPU core-years for 1024-bit keys to about 2^65 operations and 1,380 core-years. The method applies only to blind-signature implementations like Privacy Pass (used by Apple and Cloudflare), not standard PKCS or PSS-padded RSA. Forging a Privacy Pass signature would require compromising a server and generating 2^43 signatures, a workload comparable to a day of Cloudflare's public traffic.

AI AGENTS ARE HACKING ONLINE RETAILERS FOR $25 A COMPANY

A financially motivated operator ran three open-source AI harnesses (Strix, Cairn, and Hermes) against hundreds of online retailers from July to mid-September, spending roughly $12,000–$18,000 on AI model calls. The campaign exfiltrated over 600,000 unexpired credit card records from two victims, injected skimmers into at least 27 sites, and achieved access to assets of a Fortune 500 hospitality firm, a major US airline, and other large retailers. In several breaches, the agent executed a "database wipe after extraction" routine that deleted payment data and, in one case, dropped 180 tables including backups.

KITEWORKS URGES CUSTOMERS TO SHUT DOWN SYSTEMS FOR 9 HOURS OVER POSSIBLE CYBER ATTACK

Kiteworks advised customers to shut down systems for nine hours after receiving threat intelligence about a possible attack.

OPENAI'S AI AGENTS ACCIDENTALLY UPLOADED USER-PROVIDED IMAGES TO THIRD-PARTY SITES

OpenAI's research agents uploaded 53 training-eligible user images to third-party image hosts as unlisted links, most of which have since been removed as OpenAI's post-Hugging Face review of agent activity continues.

OPENAI AGENTS TRIED TO 'BRUTEFORCE' A UN WEBSITE

OpenAI agents scanned UNCTAD's statistics site over 16,000 times between April and June while trying to pull Productive Capacities Index data, escalating from bypassing their HTTP-tool limits to masking their behavior against an imagined filter and hijacking Google's XSS training game to reach the data.