Elastic Security Labs (12 October 2026) has exposed REF8801, an operation posing as a Web3 venture-capital accelerator called Apex Accelerator (also Apex Foundation and 'Apex Arena') that targets cryptocurrency start-ups and founders. It offers investment, free Anthropic Claude and Google Gemini credits, an AI 'Apex Copilot' due-diligence tool and smart-contract security audits, and built credibility with fake reviews, a TOKEN2049 Singapore presence and in-person events. The tools are two npm packages from the npm user 'apexaccelerator' (GitHub 'apexaccs'): @apexacc/cli, advertised as an AI advisor for Web3 founders, and @apexacc/audit, advertised as a Model Context Protocol (MCP) server with 18 security tools. Elastic says both were malicious from first publish, not a supply-chain compromise; the packages and repositories are no longer available. Their launchers download platform executables from the projects' GitHub releases and ask vrf.apexaccs[.]org for a command to run. On macOS that pulls a script from verify.apexfdn[.]xyz that installs CloudSyncD, the backdoor Jamf documented on 30 September, which phishes the login password with a fake prompt, runs with sudo and takes tasks from ccmihr[.]com. On Windows a PowerShell chain (0auth-chromium[.]com, then bludness.exe and exegis.exe from ehegisnightmare[.]icu, with a UAC bypass, anti-VM checks and a Go loader that patches AMSI and ETW) ends in a native infostealer that takes browser passwords and cookies (including a Chrome app-bound encryption bypass), wallets, messengers, VPN, FTP and remote-access data, screenshots and Claude Desktop, Cursor and Windsurf config files, and sends them out through Telegram. @apexacc/audit also asks for elevation to exclude its folder from Microsoft Defender and tries to switch off Smart App Control. @apexacc/cli is a near-exact copy of the open-source coding agent Oh My Pi (1,351 of 1,363 files identical) with an added bootstrap that points the agent's OpenRouter traffic at arena.apexaccs[.]org and registers an attacker-run MCP server in ~/.apex/agent/mcp.json, so the attacker receives prompts, code, conversation history and local file contents the agent reads, and can feed instructions back into the agent; Elastic did not observe malicious response substitution. All 18 'audit' tools return fabricated results. SafeDep reported earlier packages from the same operation in late July (including @copilot-mcp/apex and @apexfdn/copilot-mcp, which dropped an Atomic Stealer variant). (sources: Elastic Security Labs; Socket; The Hacker News) Updated 19 Oct 2026 (The Hacker News): The Hacker News's report is dated 19 October 2026; details credited to The Hacker News on this card come from that report.
Elastic Security Labs — Auditing the auditor: Unmasking Apex Accelerator (REF8801, 12 Oct 2026)
The Older Persons Advocacy Network (OPAN), the national body behind the Australian aged-care advocacy line, says an unauthorised email titled 'The National Advocate – Special Appeal' was sent to people on its mailing list through a third-party mailing system on 11 September 2026. The email asked for donations and did not come from OPAN. In an update posted 12 October, OPAN says it stopped the email, contacted everyone who received it along with network members, government and sector partners and the National Anti-Scam Centre, and engaged independent forensic, legal and cyber advisers. That investigation is now complete, OPAN has strengthened its security, and it is contacting a small number of individuals directly where required under privacy laws; people who are not contacted need do nothing further. OPAN has not named the mailing provider or said what personal information, if any, was accessed. CEO Craig Gear apologised for the worry caused to older people and families. (sources: OPAN cyber incident update; listed on the Webber Insurance Australian breach list)
Anthropic published a post on 12 October 2026 describing how it has hardened Claude against distillation attacks, in which organised networks of fraudulent accounts harvest a frontier model's outputs, especially its reasoning transcripts, to train a cheaper copy. Anthropic says the measures have cut the amount of data distillers can harvest by about 90 to 99 percent, and that reasoning tokens extracted on its own platform fell 10 to 100-fold after its classifier went live. The measures: 'preserved thinking' in Claude Fable 5.1 and Opus 5.5, which stops API accounts created on or after 31 August 2026 from editing Claude's prior context; blocking older, weaker models from reading newer models' reasoning, and limiting Sonnet 5.5 reasoning transcripts to the organisation whose request produced them; a two-stage classifier, red-teamed internally and externally, that Anthropic says is about as robust as its biological-weapons safeguards with a false-positive rate under 0.1 percent; and, since 24 September, charging for requests blocked by those safeguards. It has banned tens of thousands of distillation accounts, often within two hours, and says one proxy network ran more than 20,000 fraudulent accounts at once. Anthropic names Zhipu as having distilled US models' cyber capabilities into GLM-5.3, which a US government evaluator called the most cyber-capable open-weights model released so far. Anthropic admits trade-offs: some developers had to update integrations, and benign requests are occasionally blocked and billed. (sources: Anthropic; The Hacker News ThreatsDay) Updated 15 Oct 2026 (The Hacker News): The Hacker News's report is dated 15 October 2026; details credited to The Hacker News on this card come from that report.
Anthropic — Strengthening our defenses against distillation attacks (12 Oct 2026)
Tencent Zhuque Lab published a full write-up and working demos on 12 October 2026 for CVE-2026-74580, which it calls Vghost. The bug is in the Linux kernel's vhost subsystem, which accelerates network and other I/O for virtual machines and containers through device nodes such as /dev/vhost-net and /dev/vhost-vsock. vhost caches the memory mapping behind each virtual ring and treats a cache hit as proof the region was already checked, but the cache was not cleared when the VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM commands changed a live ring's addresses or size. With a device IOTLB attached, the old mapping keeps being used and the kernel copies data outside the mapped region. On a host this gives a local user deterministic arbitrary kernel read and write, a KASLR bypass and root, with no heap grooming or race. Where a guest's virtio device sits behind a virtual IOMMU with iommu_platform on, an untrusted guest can trigger the same bug to make the host kernel write out of bounds into the host's QEMU process, which can be used to hijack or crash it. Tencent reproduced local-user-to-root on Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023, Azure Linux 3.0 and Oracle Linux 10.2; on Ubuntu the node is limited to the kvm group, but on the other four it was world-accessible (mode 0666). The flaw dates from a 2017 change (Linux 4.11) combined with a 2020 change (5.9). The kernel.org CNA scores it 8.8 with scope changed; Red Hat scores 7.3 (scope unchanged), Amazon 7.8 and Oracle 7.3. Tencent says its Corvus AI multi-agent system found the bug; the fix (commit de845981da67) was released on 3 August and credits it with an Assisted-by line. No exploitation is reported. (sources: Tencent Zhuque Lab write-up; the upstream kernel commit)
Tencent Zhuque Lab — Vghost: Beyond the Privilege Boundary (CVE-2026-74580, 12 Oct 2026)
Wordfence said on 12 October 2026 that its Argus AI system found CVE-2026-39919, a critical heap buffer overflow in the Ghostscript PostScript and PDF interpreter, during a WordPress 7.1 assessment on 23 August. A PDF containing a JPEG 2000 image with low-bit-depth samples and mismatched component resolutions makes Ghostscript write 1,024 bytes into a 256-byte buffer. Wordfence rates it 9.8 and turned it into unauthenticated remote code execution on a purpose-built WordPress test server, where WordPress calls ImageMagick through PHP Imagick to make a PDF thumbnail and ImageMagick launches Ghostscript. Ghostscript 9.21 to 10.07.1 contain the vulnerable code. In its 15 September tests, the Ghostscript packages in Debian 12 and 13, Ubuntu 22.04, 24.04 and 26.04, Fedora 44, AlmaLinux 10, Alpine and the official WordPress Docker image were all still affected. Its two exploits did not work against those stock packages in 10,240 attempts, but did work after changes to fonts, language settings and one system library, so exploitation depends on the environment. Stock WordPress does not allow anonymous Media Library uploads; an attacker needs some way to upload a PDF that the site then renders. Artifex fixed the flaw in Ghostscript 10.08.0 on 8 September and backported fixes to older lines. Wordfence has seen no exploitation in the wild. Any application that renders untrusted PDFs through Ghostscript is in scope, not only WordPress.
Wordfence — Argus discovers critical vulnerability in Ghostscript, the program that turns uploaded PDFs into thumbnails (12 Oct 2026)
Anthropic published research on 12 October 2026 warning that small AI models may soon be able to copy themselves onto poorly secured internet-of-things devices, such as smart ovens and off-brand Android TV boxes, and run there without a datacenter. It describes this as an AI worm that carries its own model weights, or downloads them again from a public hub, and runs inference on the hardware it has compromised. Anthropic split replication into four stages: finding targets, gaining execution, setting up inference and spreading onward. It focused on the inference step because earlier work already shows small models can exploit systems. In its tests a 9-billion-parameter model got inference running on 8 of the 9 hardware types tried, models of 30B parameters and under could complete many individual steps, and GLM-5.2 and stronger models completed end-to-end replication in simplified evaluations; The Hacker News reports GLM-5.2 was the only one of 11 open-weight models tested to propagate reliably across eight emulated Android nodes. Anthropic also ran Gemma4-26B-A4B split across 15 Android TV boxes (about US$55 each) at 0.39 tokens a second. It estimates small models could reach end-to-end capability by the end of this year at their historical rate of improvement, and says such a worm would be slow (a doubling time of days) but hard to shut down because there is no central point to switch off. This is research, not an observed attack.
Anthropic — AI models may be capable of self-replicating without access to a datacenter (12 Oct 2026)
Docker said on 12 October 2026 that from 26 August 2024, converting a Docker Hub personal account into an organization also re-assigned that account's personal access tokens (PATs) to the account named as the new owner, without rotating the secret and without asking or telling that owner. An attacker could create an account and a PAT, convert it, name a target user as owner, and keep using the token with the target's registry scope, so they could pull, push or delete images in the target's repositories and in organizations the target could reach. Docker rated it critical because it allowed publishing images under a legitimate name. It did not give web access or let anyone change passwords, email or two-factor settings. Researchers Peter Molnar and Krisztian Hozak reported it on 30 September 2026 and Docker deployed a fix in under four hours. Docker says it reviewed every conversion back to August 2024, found no evidence of exploitation after examining 304,000 pushes made with transferred tokens, emailed affected users and organization owners on 2 October, and deactivated transferred PATs on 8 October unless owners asked to keep them. Conversion no longer transfers PATs and now needs the named owner's consent. Updated 13 Oct 2026 (BleepingComputer): BleepingComputer's report is dated 13 October 2026; details credited to BleepingComputer on this card come from that report.
Docker — Docker Hub security advisory: personal access tokens transferred during account-to-organization conversions (12 Oct 2026)
SSD Secure Disclosure published an advisory on 12 October 2026 covering a three-bug chain on LG webOS smart TVs that lets an attacker on the same local network gain root without a PIN or any owner interaction. The Hacker News summarised the chain on 13 October. Entry is through the ThinQ pairing service on port 3001: the attacker replays a sync-demo app manifest signed with a test certificate the firmware still trusts, and a permission in that manifest makes the pairing service skip the PIN and hand over a privileged key. With the key, the attacker launches the built-in cmp-client app to an attacker-controlled page; the page keeps PalmServiceBridge access and abuses the root-running pmlogd logging service with unchecked shell input. The chain was demonstrated on the 32LQ636BPSA and 27TQ600SW models running webOS 7.5.7-25 (firmware 04.54.40); whether other models or builds are affected is not stated. An anonymous researcher took third place in the LG webOS category at TyphoonPWN 2026 (Seoul, May) with the demo. No CVE identifiers have been assigned, and no exploitation in the wild was reported in the sources used here. LG has issued a firmware fix per SSD. Owners should check for a TV firmware update; no workaround is available if the update cannot be applied. This is separate from Bitdefender's 2024 webOS findings and from an earlier TyphoonPWN path-traversal chain on a different port.
SSD Secure Disclosure — LG webOS sync-demo preauth RCE / local root chain (12 Oct 2026)
Progress Software, the CNA for MarkLogic, published 20 CVE records (CVE-2026-85957 to CVE-2026-85976) on 12 October 2026, all pointing to its MarkLogic Critical Security Alert Bulletin for October 2026. Every flaw is in MarkLogic Server, the enterprise multi-model database used for document and metadata-heavy workloads, and affects the 12.x releases before 12.1.0 and, for most of them, 11.x before 11.3.7. The items to read first are the unauthenticated network ones. In deployments using SAML, a remote attacker could get the server to accept an assertion it should reject (CVE-2026-85962, 7.5). A separate validation weakness lets the server accept a token it should refuse (CVE-2026-85958, 7.5). On 11.x, the SAML parser processes external DTDs and entities (XXE, CVE-2026-85957, 7.5). The deprecated OpsDirector component carries SSRF and a hard-coded key that an unauthenticated attacker could use to forge trusted requests (CVE-2026-85963, 7.5). Azure deployments may record security-sensitive data in logs (CVE-2026-85961, 7.5), and S3 connections may use cleartext transport (CVE-2026-85975, 7.5). Progress's top score is 8.0, for memory-safety defects in the JavaScript engine integration that a high-privileged attacker could use to corrupt memory (CVE-2026-85965). The rest include predictable Query Console CSRF tokens that could lead to server-side code running with a victim's permissions (CVE-2026-85960, 7.5), Query Console path traversal and information exposure (7.7), out-of-bounds read and write and a second XXE (7.1), Kerberos, TLS hostname and cluster-join transport weaknesses (7.4), world-readable log files (7.1), XSS (6.1) and response splitting (5.4). The CVE records do not mention exploitation or public exploit code. (sources: the Progress MarkLogic bulletin; the Progress-assigned CVE records)
Progress Community — MarkLogic Critical Security Alert Bulletin, October 2026
iRhythm Holdings, the US maker of the Zio wearable cardiac monitor, said on 2 October 2026 that its forensic investigation into the June incident was complete and that it had begun notifying affected individuals. The company detected unauthorised access to certain third-party-hosted business applications on or around 8 June 2026, and found that data was accessed and downloaded between 3 and 8 June. In its 15 June Form 8-K, iRhythm said the access was obtained through social engineering. A threat actor contacted the company on 9 June, claimed to hold proprietary data, patient protected health information and other personal information, and demanded payment in exchange for not publishing it. The exposed fields are patient name, address, email, phone, date of birth, iRhythm patient account number, device serial number, insurance number and date of service. iRhythm says it holds no financial account or payment card data, and that products, clinical and medical-device systems, manufacturing and patient safety were not affected. The Record (9 Oct) reports breach notices covering 298,647 people in Texas and another 69,526 in South Carolina, and that iRhythm also filed breach notices in California. No group has publicly claimed the attack. iRhythm has not said whether it paid. (sources: iRhythm update; SEC Form 8-K; The Record) Correction (23 Oct 2026): this card earlier credited the state-filing figures to two outlets (12 Oct) and added them together; they are now credited to The Record (9 Oct) and are not combined. UPDATE (23 Oct 2026): Oregon's Department of Justice breach database lists an iRhythm Technologies Inc. entry with 8,179,772 as the number affected, reported on 6 October 2026, giving 3 to 8 June 2026 as the dates of breach (the entry also shows a placeholder date of 1/1/0001), 8 June 2026 as the date of discovery and 2 October 2026 as the date notice was sent. The database says its entries show the information in an organisation's initial breach report and do not reflect later updates to affected numbers.
iRhythm — Provides update on cybersecurity incident previously disclosed in June 2026 (GlobeNewswire, 2 Oct 2026)
Independent researcher Simon Koeck published on 12 October 2026 a write-up of a critical chain in Google's shared DevSite platform (the Flask/OAuth front end used by Google developer documentation sites). A /oauth2authorize response set a large Flask session cookie that was signed but not encrypted. Decoding it exposed a pickle-serialized OAuth2WebServerFlow object holding a Google OAuth client_id and client_secret in cleartext; that same client_secret was the Flask SECRET_KEY (itsdangerous cookie-session derivation), so anyone with a cookie could recover the key, forge a valid session, and smuggle a malicious pickle into the OAuth callback's pickle.loads path for remote code execution. Koeck showed the developers.google.com signing key also validated sessions on other DevSite hosts including firebase.google.com, developer.android.com, source.android.com and docs.partner.android.com. Timeline: reported 6 Aug 2026, triaged/accepted 7 Aug, $90,000 VRP reward decided 27 Aug (T2 S0 RCE base $75,000 × 1.2), fixed 7 Oct 2026. Google's fix path, per the write-up: rotate the exposed OAuth secrets and kill sessions signed with them; give each deployment its own high-entropy Flask SECRET_KEY unrelated to OAuth; keep the OAuth flow object server-side with only an opaque reference in the cookie; and stop unpickling client-supplied data. No evidence of exploitation in the wild was published. (sources: Simon Koeck write-up; Cybersecurity News)
Simon Koeck — How I Found a $90,000 Remote Code Execution Vulnerability in Google (12 Oct 2026)
GitLab published a critical patch release on 12 October 2026 (versions 19.4.2, 19.3.4 and 19.2.8 for Community Edition and Enterprise Edition) remediating CVE-2026-97229, an integer overflow in the CI/CD Regular Expression Compiler that, under certain conditions, could let an unauthenticated attacker execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. GitLab rates it CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Impacted self-managed installs are all CE/EE versions from 19.2 before 19.2.8, from 19.3 before 19.3.5, and from 19.4 before 19.4.2. GitLab.com is already patched; GitLab Dedicated customers do not need to act. The advisory does not state that the flaw has been exploited in the wild. Researcher joaxcar reported it via HackerOne. GitLab's advisory now titles the release 19.4.2, 19.3.5 and 19.2.8 and lists the affected 19.3 range as before 19.3.5; it says 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled, fixed in 19.3.5. The same release also ships other High/Medium fixes (XSS in syntax highlighting, several authorization issues, Duo Agent Platform input neutralization, and more) — this card is the Critical regex RCE only. UPDATE (22 Oct): GitLab fixed a separate, further regular-expression-compiler flaw, CVE-2026-110264 (CVSS 10.0, all versions from 7.0 affected), on 21 October in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13; see the CVE-2026-110264 card. UPDATE (29 Oct 2026, Perth; Alpine Linux; GitLab): Alpine Linux said on 28 October that on 20 and 21 October an attacker tried to exploit CVE-2026-97229 on its GitLab instance, which was still running 19.3.4 without the 12 October fix; crafted CI configurations from a newly registered account crashed GitLab worker processes 8 times, and in 4 of those crashes the attacker got partway through the exploit and failed at the next step. Alpine says it found no evidence the attack succeeded but cannot rule it out, so it treated the instance as compromised, rebuilt it, reset all passwords and replaced GitLab's secret keys, and that its aports repository, packages and 21 October releases were not tampered with and no signing keys were on the GitLab server. Alpine also says its upgrade to GitLab 19.3.6 on 22 October did not fix the flaw, because the fix is a set of patches to the Ruby that GitLab bundles only in its official packages and container images; the underlying bug is in Ruby's Onigmo regular-expression engine, fixed upstream on 23 October in Ruby 3.3.13, 3.4.12 and 4.0.9, so installations that run GitLab with their own Ruby (from source or a custom container image) also need one of those Ruby releases or later. As of 29 October, GitLab's advisory lists six threat detections released to help self-managed customers detect exploitation attempts. (source: Alpine Linux; GitLab)
