TLDR INFORMATION SECURITY 2026-10-14

READ MORE

GITLAB PATCHES CVSS 10.0 FLAW THAT COULD LET UNAUTHENTICATED USERS RUN SERVER CODE

GitLab fixed CVE-2026-97229, a CVSS 10.0 integer overflow vulnerability in regex validation for CI/CD configurations. In certain conditions, an unauthenticated user could execute arbitrary code on a GitLab server. The fixes are included in CE/EE versions 19.2.8, 19.3.5, and 19.4.2. The release also addresses high-severity XSS, authorization, and response-cache poisoning vulnerabilities.

OWNER OF FASHION BRANDS HOBBS AND WHISTLES JOINS AUTUMN PWNED COLLECTION

TFG London, owner of Hobbs, Phase Eight, and Whistles, detected a cyberattack on October 11. Several IT systems remain offline, website functions are limited, and orders placed on or after Sunday may be delayed. TFG has not found evidence that payment data was exposed. It is still checking whether customer data was compromised. Attack method, ransomware involvement, and restoration timing remain undisclosed.

GHOSTSCRIPT FLAW LETS HACKERS HIJACK SERVERS VIA PDF UPLOADS

Wordfence discovered a new vulnerability in the Ghostscript interpreter and rendering engine which could allow attackers to achieve remote code execution (RCE) using specially crafted PDFs. For WordPress sites to be vulnerable, an attacker must be able to upload PDFs which are then processed by a vulnerable version of Ghostscript to generate a preview or thumbnail. Other applications that use Ghostscript to generate previews or thumbnails from PDFs may also be vulnerable.

PLAYING IT SFAPE: CODE EXECUTION IN ISOLATED USER MODE

Doyensec found a chain in Windows' SFAPE VBS enclave, used by Defender's Enhanced Phishing Protection and loaded by LSASS. A repeated call to Initialize wrote a fixed 32-bit value without validating the destination. The researchers corrupted the enclave-range check, then used a ClipboardInput race to gain a controlled memset, which led to VTL1 read and write primitives, replacement of the valid-target table, and arbitrary calls to existing VTL1 code through NtContinue. Microsoft fixed CVE-2026-83498 in September's Patch Tuesday and blocked older SFAPE images through the VBS Code Integrity policy.

BEYOND VALID CREDENTIALS: HOW EXPOSED AWS KEYS ARE TESTED FOR BEDROCK ACCESS

When attackers obtain AWS credentials, they frequently test them for access to other services of interest like SES, SNS, and Bedrock. Datadog examined three credential harvesting platforms and found that they utilize the ListFoundationModels, InvokeModel, and Converse API to determine access. It also found a script that checked for promotional credits available in the account.

TWO ARRESTED AS DOJ TAKES DOWN LAPTOP FARMS RESPONSIBLE FOR $3 MILLION IN NORTH KOREAN REVENUE

The DOJ raided more than 40 Texas residences in late September and seized 187 laptops used by North Korean IT workers, while two US facilitators were arrested for helping funnel over $3 million from about 70 companies. A new FBI advisory said the scheme has adapted, with operatives subcontracting jobs to freelancers in South Asia and West Africa and recruiting financially stressed Americans, including active-duty military, to host laptops or sit interviews. Exposed workers have threatened violence or data leaks to extract payment, and some are now chasing identities that qualify for security-cleared roles.

solutions in AWS Marketplace.

LASTWALL (PRODUCT LAUNCH)

Lastwall provides identity security for defense and government organizations. Its IDCommand Suite combines zero-trust architecture, PKI, passwordless authentication, and risk scoring from 200 contextual signals. Quantum Shield secures data in transit with NIST-approved post-quantum cryptography.

SECURITY-SUITE

A comprehensive open-source security tools suite for OSINT reconnaissance, web security testing, API security assessment, and compliance checking with AI-powered analysis.

CODEGRAPH

CodeGraph is a tool to build pre-indexed code knowledge graphs which can be fed to AI agents to speed up code exploration.

AI REGULATION MUST MIMIC INDUSTRIAL REVOLUTION LAWS

The UK's AI minister, Kanishka Narayan, is drafting plans for compulsory safety reporting and monitoring for frontier AI, and a potential requirement that labs grant pre-release access to models for review. Narayan compared this to the Industrial Revolution and said frontier labs shouldn't release tools they can't guarantee are safe. Narayan also confirmed that he reached an agreement with Anthropic to provide the AISI preview access to Mythos again.

ANTHROPIC WARNS SELF-REPLICATING AI COULD SPREAD TO YOUR SMART DEVICES

Anthropic warns that small AI models could soon self-replicate across consumer IoT devices, creating distributed botnets capable of running AI workloads. Anthropic distributed Gemma4-26B-A4B onto 15 off-brand Android TV boxes but could not demonstrate self-replication. On the hardware in question, inference would be a slow process, so defenders may be able to respond in time to stop any abuse.

TREZOR WALLETS ALSO COMPROMISED WITH IMPLANTS

Hardware hacker Joe Grand found implants in a Trezor One and a Trezor Model T bought from unauthorized sellers, contradicting Trezor's public claim that none of its devices had been compromised, despite Grand reporting the findings in August. The attackers replaced each device's microcontroller with malicious firmware derived from open source that displayed one of a dozen pre-generated seed phrases while passing integrity checks against a copy of the legitimate firmware stored on an external microSD card. Unlike the Ledger implants, which exfiltrated real seeds over a cellular link, these relied on predictable seeds, and Trezor's move to cut authorized resellers suggested the company feared a similar shift into trusted supply channels.

REFRIGERATION CONTROLLER HACK SPOILS FOOD ACROSS EUROPEAN SUPERMARKETS

Hackers remotely altered Danfoss refrigeration controllers at hundreds of European supermarkets, forcing freezers into defrost for up to six hours.

FBI ARRESTS OPENAI EMPLOYEE FOR ALLEGEDLY PLANTING RECORDING DEVICE IN COMPANY OFFICES

An OpenAI engineer was arrested for allegedly hiding a toilet-paper-wrapped audio recorder in an executive conference room TV's USB port, after a complaint showed he had queried a productivity tool for leadership meeting locations and a chatbot account tied to his spouse had asked how to build and obfuscate the device.

RACKET INFRASTRUCTURE COMPROMISE

A crypto miner on a compromised Northwestern University build server exposed Racket's Apple and Windows signing keys, prompting the project to rotate both, have GlobalSign revoke the Windows certificate, and urge macOS users on versions 8.12 through 9.3 to reinstall before Apple revokes its certificate at semester's end.