Researchers from the V12 security team (Rick de Jager) published a full working exploit on GitHub on 8 October 2026 for a heap buffer overflow in the session protocol of AnyDesk for Linux. When handling mode-5 stream packets, AnyDesk adds a 16-byte header to the payload length declared by the remote side using 32-bit arithmetic with no overflow check; a declared length of 0xFFFFFFF0 wraps to a tiny allocation while the object keeps the huge length, so attacker data is written past the end of the buffer. Because the AnyDesk service normally runs as root on Linux, the exploit gains root command execution before the desktop user approves the session. The published exploit works over direct TCP connections to port 7070 and is tuned for build 8.0.2; it is probabilistic and may crash the service instead. The researchers say the same code path is reachable through AnyDesk relay servers (shown only with a minimal trigger), while AnyDesk said in June that the issue is limited to direct connections on Linux and that Windows and macOS are not affected. The researchers reported the bug on 22 June; AnyDesk fixed it in Linux 8.0.3 the next day with a changelog line about a crash, assigned no CVE and issued no advisory (none as of 9 October). The latest Linux release is 8.1.0. No exploitation in the wild has been reported. Source: V12's research release on GitHub; report: The Hacker News. Correction (22 Oct 2026): the headline said the flaw had no CVE. CVE-2026-109390 was published on 12 October 2026, assigned and scored (CVSS 3.1 9.8) by MITRE as the CNA, covering AnyDesk for Linux 8.0.0 to before 8.0.3; Censys says AnyDesk still had not published its own security advisory as of 13 October. (source: Censys advisory, 13 Oct 2026; CVE record CVE-2026-109390)
The Hacker News — Researchers publish working exploit for pre-auth AnyDesk Linux flaw that gives root access (9 Oct 2026; V12 code released on GitHub 8 Oct)
The US Justice Department said on 8 October 2026 that Oleg Korniev, 42, a dual Ukrainian and Russian citizen, pleaded guilty to running the Your Mule Cashout (YMCO) money-laundering organisation, which recruited more than 15,000 US-based money mules to launder at least US$10 million stolen by hackers from over 750 US bank accounts. Mules were recruited through spam from fake companies and an apparently normal hiring process, told they were processing payments for real businesses, and then wired stolen funds through Western Union and MoneyGram to cash-out contractors abroad (BleepingComputer lists Moldova, Ukraine, Russia and Latvia). Korniev admitted YMCO caused more than US$14.7 million in actual and intended losses and that he laundered at least US$7 million; he was arrested in the Republic of Georgia, pleaded guilty to money laundering, computer-fraud and access-device conspiracies and aggravated identity theft, and faces two to 50 years at a later sentencing. Four other YMCO members were earlier extradited and sentenced to about 37 to 63 months. BleepingComputer, citing the case, reports that YMCO ran similar mule schemes in Germany, Italy, the UK and Australia since it began in 2007. For employers and job seekers, 'payment processing' job offers that move money through personal accounts remain a classic mule recruitment pattern. (source: BleepingComputer)
US Department of Justice — Ukrainian-Russian dual citizen pleads guilty to running international money laundering organisation (8 Oct 2026)
Microsoft said in its Windows message center on 8 October 2026 that certificates used to make trusted connections to Windows Update expire on 17 May 2027 and 19 June 2027, and that devices must hold the replacement certificates to keep receiving updates after those dates. Windows 11 25H2 and later need no action. Windows 11 24H2 and Windows Server 2025 need the September 2025 security update or later before 19 June 2027. Other supported Windows 11 releases, Windows Server 2022 and supported Windows 10 versions need the July 2026 security update or later before 19 June 2027. Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016 need the July 2026 update or later before 17 May 2027. Any other (unsupported) Windows version must be upgraded, or it will lose access to Windows Update. Devices that get updates through Windows Server Update Services (WSUS) are not affected by this change. Microsoft advises identifying old or unsupported devices now and planning upgrades before the deadlines. (sources: Microsoft Windows message center; BleepingComputer)
Microsoft Learn — Windows message center: Prepare for Windows Update certificate rotation in 2027 (8 Oct 2026)
Searchlight Cyber disclosed on 8 October 2026 a flaw in GoBalance, a Go rewrite of Tor's Onionbalance load balancer that ships with the EndGame anti-DDoS toolkit used by many dark-web sites. A Tor ed25519 private key is 64 bytes, but GoBalance passed only the first 32 bytes to the signer, dropping the half that keeps each signature's secret nonce hidden; the nonce becomes computable, so one published service descriptor is enough to recover the site's long-term master key and sign valid descriptors for its .onion address. Taking over the address lets an attacker redirect visitors to a copy of the site, but does not give access to its servers or data. Only sites whose master key is stored in Tor's own key format are exposed; keys written by GoBalance's setup tool use a safer format, and the original Onionbalance and Tor itself are not affected. Between 5 and 7 October both onion addresses of the Dread forum were hijacked and pointed at a rival site, Conclave; Searchlight says the second takeover is the stronger sign the flaw was used, while the first may have been a separate key leak. Dread has moved to a new address, and the Omega market said on 8 October that it also moved because of the bug. There was no official fix or CVE as of 9 October; a community patch has been published. For defenders and investigators, the lesson is that onion addresses seen in threat intelligence can change hands without the original operators. (sources: Searchlight Cyber; The Hacker News)
Searchlight Cyber — Leaking the keys to the kingdom: how a single slip handed over a darknet empire (8 Oct 2026)
VirusTotal announced on 8 October 2026 that it now scans the public IPv4 space daily and records open, closed and recently closed ports with service names, software versions, banners, HTTP headers, SSH host keys, RDP fingerprints, JARM and inferred operating system, alongside its existing IP intelligence. The data appears in a new Ports tab and can be searched in the web UI and API with modifiers such as open_port, port_service_product[80] and fingerprint, combined with asn, country, ssl_subject, threat_actor and collection. VirusTotal's worked example started from an IP in its APT28 and Havoc C2 collections and used a shared SSH host key and an unusual certificate name to find two related hosts with no detections at all. VirusTotal warns that an open port on its own is a weak signal (a Cobalt Strike default-port search returned more than 1.5 million IPs), that reused cloud images share SSH keys across many unrelated hosts, and that old malware links do not prove current ownership or attribution. (sources: VirusTotal blog; Cyber Security News)
VirusTotal blog — Internet scanning in VT (Oct 2026)
On 8 October 2026 Zscaler ThreatLabz said it had found another new installer for the Anatsa (TeaBot) Android banking trojan distributed through the Google Play Store, disguised as a PDF reader with more than 10,000 installs, and published the Play Store listing and indicators (installer and payload hashes, command-and-control addresses) in its alert. Anatsa uses a dropper model: the harmless-looking app is installed first, then downloads the banking payload, often presented as an app update, and overlays fake login screens to steal banking credentials. The install figure is for the dropper app, not confirmed infections; the alert does not name targeted banks or countries, or say whether Google has removed the listing. Earlier ThreatLabz analysis documented Anatsa using environment checks and malformed APK archives to avoid analysis. (sources: Zscaler ThreatLabz; Cyber Security News)
Zscaler ThreatLabz on X — new Anatsa installer on Google Play disguised as a PDF reader (8 Oct 2026)
On 8 October 2026 Anthropic announced the Anthropic Cyber Mission, which it describes as a long-term effort to give defenders tools, research and funding, starting with critical infrastructure and open-source software. The Critical Infrastructure Defense Program puts frontier Claude models, on-site Anthropic engineers and threat research with trusted providers that secure operational technology (power, water, factories, transport). Founding partners: Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation; Anthropic says it is starting with a small cohort. OSS Scanner is an opt-in service, modelled on Google's OSS-Fuzz, that periodically scans enrolled open-source projects free of charge. Each report includes a proof of concept, an explanation and a suggested fix where available; reports are model-generated and sent without human review, so some will be wrong (for example severity), and Anthropic says it expects a true-positive rate above 90%. Anthropic also cites funding for the Python Software Foundation, Alpha-Omega and OpenSSF (Linux Foundation) and the Apache Software Foundation, and says the Defender Advantage Fund keeps OSS Scanner free. It builds on the Project Glasswing lesson that finding bugs is now easy but verifying, prioritising and fixing them is slow. (sources: Anthropic; Cyber Security News)
Anthropic — Introducing the Anthropic Cyber Mission (8 Oct 2026)
Bitdefender Labs (8 October 2026) describes Midnight Mimosa, malware preinstalled in the firmware of low-cost multi-brand Android phones built on MediaTek platforms so it is present before first boot and cannot be removed through normal uninstall. Platform-signed system packages (including com.android.system.lite, com.android.sys.prot, com.android.sys.gmsprot and related names) run as system, silently install and remove apps, grant permissions and load remote code. Cover apps (weather, app-lock, notes, OCR) drive ad and click fraud; the same framework can enrol devices as residential-proxy botnet nodes. Bitdefender observed thousands of devices across more than 150 countries over about two years, with the largest shares in Mexico, France and Italy, then the United States, Germany, Brazil and Spain. Model names associated with Doogee S200 X and Cubot KINGKONG X appear, as do phones impersonating major brands. Some affected firmware was signed with certificates bearing the name Shenzhen Zediel; Bitdefender does not claim that company knowingly planted the malware. Thirteen Google Play apps talking to the same C2 infrastructure were also found. Cleaning typically needs firmware replacement or ADB disable — unrealistic for most owners. (sources: Bitdefender Labs; BleepingComputer)
Bitdefender Labs — The phone was compromised before the user turned it on: Midnight Mimosa (8 Oct 2026)
On 8 October 2026, CISA, FBI, NSA and international partners including Australia's ACSC published joint Cybersecurity Advisory AA26-281A on China-linked threat actors enabled by Integrity Technology Group (Integrity Tech), a China-based company with government links that builds or acquires cyber tools, hosts infrastructure and compromises networks. Observed TTPs are consistent with activity tracked as Flax Typhoon, Ethereal Panda and Red Juliett (vendor names may not map 1:1). Actors combine automated scanning (including MicroScan with 1,300+ scripts), large IoT botnets, password spraying against Microsoft 365/Exchange, VPN persistence and hands-on exploitation to steal email and credentials, and have run a portal giving third parties access to stolen mail. Same day, the US Justice Department and FBI announced court-authorised seizures of seven domains used for MicroScan and FishHub spear-phishing/malware delivery; scanning targets cited in court papers include a South Carolina power company, airports in Japan and Poland, Taiwanese energy firms and universities. Integrity Tech was previously sanctioned by the US (Jan 2025) and UK (Dec 2025); a 2024 FBI action disrupted its Raptor Train botnet. Mitigations in the advisory include disabling unused services/ports, sanitising web inputs, MFA everywhere, and timely patching of listed n-day flaws. (sources: CISA AA26-281A; US Department of Justice) The advisory's victim list covers US government services, critical manufacturing, healthcare and IT organisations, US law enforcement, education and religious organisations, and organisations across Southeast Asia, Africa and North America; it does not name Australia. Besides ASD's ACSC, its co-authors include agencies from the UK, Canada, Japan, New Zealand and Spain. It says the FBI recovered an archived email database the actors used, with victims of email theft among government, law enforcement, healthcare and religious organisations in Southeast Asia, and access to the stolen data in some cases restricted to IP addresses in Xiamen, China; the actors also used a tool called DC.exe to run DCSync. It advises watching for unexpected Active Directory replication and replacing end-of-life products. (source: CISA AA26-281A) Correction (29 Oct 2026): removed an 11 October update that rested on an iTnews report, including an ASD spokesperson's comment to iTnews and a count of about 20 Taiwanese university FishHub victims, which no other linked source states; the iTnews link was removed and the advisory details that update repeated are now credited to CISA's advisory directly. (source: CISA AA26-281A)
CISA — AA26-281A: Chinese government-linked cyber threat actors combine automated and hands-on hacking tools (8 Oct 2026; ACSC co-author)
IDC Frontier (IDCF), a SoftBank Group subsidiary that runs the IDCF Cloud IaaS platform, said a third-party ransomware attack caused a disruption in East Japan Region 1 from about 3:40am JST on 7 October 2026. Its third notice (8 Oct) says 495 corporate and municipal customers were affected. Impacted zones named: tesla, henry, pascal and joule. Effects included virtual servers stopping and not restarting. IDCF isolated East Japan Region 1, stopped the management console across regions while it checked safety, and is working with an external security firm to find and block the intrusion path. For the four named zones it says customer data is difficult to retrieve or restore and that recovery currently depends on customers' own backups; it is guiding those customers to rebuild in a separate environment. Other East Japan 1 zones and other regions had no confirmed unauthorised access at the time of the notice, but customers were told to take their own backups. IDCF has reported to regulators and the Tokyo Metropolitan Police. Press coverage (BleepingComputer, NHK, Mainichi) notes knock-on outages including Nissui logistics shipping and Ibaraki prefectural and police websites; IDCF has not itself confirmed every downstream victim in the notice. Threat-actor social posts claiming encrypted databases and hypervisors are unverified by IDCF. (sources: IDC Frontier notice 20261008001; BleepingComputer)
IDC Frontier — Notice 3: unauthorised access / disruption on part of IDCF Cloud (8 Oct 2026, Japanese)
Citrix Security Bulletin CTX697191 (published 8 October 2026) assigns CVE-2026-107406 to a memory-overflow flaw (CWE-119) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a SAML service provider or identity provider. CVSS v4.0 base 9.5 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L). Successful abuse can lead to remote code execution or denial of service. Exposure is version-specific: builds 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 (and matching FIPS/NDcPP ranges) are affected only as SAML IdP; older supported builds before those floors are affected as either SAML SP or IdP. Citrix urges upgrades to 14.1-73.46 or later, 13.1-64.29 or later, 14.1-73.46 FIPS or later, and 13.1-37.283 or later for 13.1-FIPS/NDcPP. Secure Private Access Hybrid deployments that use affected NetScaler instances also need the upgrade. Customer-managed appliances only; Citrix-managed cloud and Adaptive Authentication are updated by Citrix. Check config for add authentication samlAction (SP) or add authentication samlIdPProfile (IdP). Citrix said it was not aware of unmitigated exploits at publication. (sources: Citrix CTX697191; Cyber Security News)
BleepingComputer reported on 8 October 2026 that Jonathan Spalletta, 36, of Maryland (online 'Jspalletta' and 'Cthulhon'), has been found guilty of computer fraud and money laundering over the April 2021 hacks of Uranium Finance, an automated market maker on BNB Chain. In the first attack on 8 April 2021 he drained about US$1.4 million by abusing a smart-contract flaw with zero-token withdrawals, then pressured Uranium into a sham 'bug bounty' of nearly US$386,000. About three weeks later he exploited a second coding error, where transaction checks used 1,000 instead of 10,000, to withdraw nearly 90% of the liquidity pools, about US$53.3 million in total, and Uranium closed. Prosecutors say he laundered the funds through Tornado Cash and decentralised exchanges and bought rare collectibles, including Magic: The Gathering packs and a Black Lotus card, a first-edition Pokémon base set and a Roman coin. Agents seized the collectibles in February 2025 and recovered about US$31 million in crypto. He surrendered on 30 March and faces up to 10 years for computer fraud and 20 years for money laundering. Source: BleepingComputer, quoting the US Attorney's office.
BleepingComputer — Uranium crypto exchange hacker convicted for stealing $53 million (8 Oct 2026)
