PwnSystem

Daily News Headline: Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key Summary: Keystone announced it will destroy 18,835 hardware wallets after a security breach allowed an attacker to steal the verification key used to authenticate the devices. This vulnerability could enable the production of counterfeit wallets capable of deceiving users into believing they are genuine. To mitigate risks, Keystone has advised users on what to do based on when they received their devices. Devices shipped before the breach can be used normally, while those received after must be verified through customer support. The breach exposed customer records but did not involve payment information. As a precaution, Keystone shortened its data retention period and is enhancing its security measures post-incident. They will inform affected customers and clarify verification processes to ensure safety. The incident highlights vulnerabilities in cryptocurrency wallet security and emphasizes the importance of safeguarding sensitive keys. URL: https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html

Daily News Headline: AI-Generated Fake Login Pages Are Making Account Takeovers Easier Summary: Generative AI is significantly enhancing the creation of fake login pages, making phishing attempts more sophisticated and difficult to identify. Attackers can now replicate legitimate login screens with high accuracy, using branding familiar to users, and customize phishing messages for specific targets. This advancement allows them to not only harvest usernames and passwords but also to capture multi-factor authentication (MFA) codes and hijack authenticated sessions through techniques like Adversary-in-the-Middle (AiTM). Traditional phishing defenses, including employee training and email filters, are often insufficient against these advanced threats. Organizations are urged to adopt phishing-resistant multi-factor authentication methods, implement browser-level protections, and monitor unusual account activity. By combining these strategies, companies can better protect against credential theft and account takeovers, highlighting the need for proactive security measures in the face of evolving cyber threats. URL: https://thehackernews.com/2026/10/ai-generated-fake-login-pages-are.html

Daily News Headline: Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Summary: Microsoft has addressed a vulnerability in its Authenticator app for Android, identified as CVE-2026-80097, which allowed a malicious app to impersonate trusted Microsoft applications like Teams and retrieve sign-in tokens for work accounts without proper permissions. This flaw was particularly concerning as the tokens granted access to sensitive information such as email and calendar. Researchers from the security firm Enclave reported that the vulnerability required a user to interact with the Authenticator app, though their testing indicated tokens could be accessed with minimal user input. Microsoft has since released a patch in version 6.2606.4246 of the Authenticator app. They have emphasized that there have been no known exploits of this vulnerability. Users are advised to update their app to mitigate potential risks. URL: https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html

Daily News Headline: Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers Summary: Australia's Signals Directorate (ASD) has successfully disrupted the Amadey malware operation, preventing access to 180,000 infected computers worldwide. This malware, introduced in 2018, primarily installs additional malware and facilitates data theft through various deceptive methods. The ASD managed to cut off the control infrastructure of Amadey but highlighted that this does not reverse previous data thefts, including credentials that could remain valid for months. The operation aligns with international efforts, such as Operation Endgame, which also targeted Amadey's infrastructure earlier in June. In a separate incident, ASD intervened to destroy 5 terabytes of stolen data from a business that was unaware of the breach. This operation underscores the evolving landscape of cyber threats and the importance of offensive cyber capabilities in countering them. URL: https://thehackernews.com/2026/10/australia-gets-into-amadey-malware.html

Daily News Headline: Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption Summary: The article covers a cyber espionage campaign attributed to the North Korean Lazarus Group, named **Operation FlashHole**, which targets South Korean sectors, including construction and software. Active since July 2025, it builds upon the previous **Operation SyncHole**, utilizing spear-phishing tactics to deliver various malware like ThreatNeedle and AGAMEMNON. The group exploits vulnerabilities in security software essential for online banking, namely iniLINE Cross EX and Initech's INISAFE CrossWeb EX, to inject malware. Notably, the latest malware iteration employs **ML-KEM-1024**, a post-quantum cryptographic method for secure communications. The findings highlight the Lazarus Group's sophisticated attack techniques and their adaptation to future cybersecurity threats. The increase in attacks reflects the group's ongoing evolution, as it continues to enhance its malware delivery strategies while targeting sensitive sectors in South Korea. URL: https://thehackernews.com/2026/10/lazarus-abuses-south-korean-security.html

Daily News Headline: Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes Summary: Two critical vulnerabilities have been identified in Wasmtime, a WebAssembly runtime, that enable malicious WebAssembly modules to escape their designated sandbox environment. These flaws received a 9.9/10 rating on the CVSS scale and can compromise the security of Wasmtime implementations, particularly those that compile user-provided modules. They affect various processor architectures, with one flaw specifically targeting ARM64 systems. CVE-2026-115889 allows attackers to exploit incorrect value tracking in function storage, while CVE-2026-115893 involves a flawed instruction jump that could direct execution to arbitrary code. Updates to address these issues were released on October 19 and 20, emphasizing the importance of rebuilding any programs incorporating Wasmtime with the patched versions to mitigate the risks. Neither flaw has been actively exploited, and they are not currently listed in the U.S. CISA's Known Exploited Vulnerabilities catalog. URL: https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html

Daily News Headline: Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Summary: A recent cybersecurity campaign has targeted Microsoft 365, compromising 97 accounts across 79 organizations through a method known as "token replay" attacks. The attackers utilized an adversary-in-the-middle (AitM) relay to capture sign-in sessions, replaying stolen tokens from more than 200,000 login attempts. Instead of guessing passwords, they efficiently exploited captured tokens, bypassing multi-factor authentication (MFA). The campaign involved adding rogue devices to victim directories for persistent access, with attackers also implementing hidden email rules to manipulate incoming emails related to payroll and bonuses. This attack highlights significant vulnerabilities in MFA systems and suggests organizations should implement conditional access policies, revoking sessions, resetting passwords, and auditing registered devices to mitigate risks effectively. The investigation traces the malicious activities back to a Romanian IP associated with existing malware services. URL: https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html

Daily News Headline: uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts Summary: The article reports on a new Android spyware kit called **uCreator**, which targets messaging apps Telegram and WeChat by embedding malicious code in tampered versions. The spyware spreads through sideloading and social engineering, allowing attackers to access user accounts, steal two-factor authentication (2FA) credentials, and manipulate account settings. It shares similarities with an earlier Trojan called **Baohuo**, identified by Doctor Web, indicating a trend in spyware evolution. The spyware is linked to specific organizations in China, with indications of financial motivations behind its design, particularly concerning mobile wallets and messaging applications. The article also discusses technical capabilities, potential impacts, and outlines indicators for identifying compromised devices, emphasizing the need for caution among users of the affected services. URL: https://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html

Daily News Headline: Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses Summary: The article emphasizes the challenges Security Operations Centers (SOCs) face in managing multiple alerts during cyber-attacks. Traditional alerts often lack context, obscuring the full timeline of an intrusion. Attackers exploit the gaps in detection by blending their actions with ordinary business operations and employing tactics that delay high-priority alerts. This silent progression allows adversaries to remain undetected for extended periods. The piece advocates for the use of Network Detection and Response (NDR) tools to provide comprehensive network data that links alerts into a cohesive narrative. By correlating network telemetry, security analysts can uncover the relationships and sequences between actions, enabling them to discern if an alert signifies a singular issue or part of a larger intrusion. In conclusion, applying artificial intelligence in tandem with NDR data can streamline investigations, improve insights, and enhance decision-making within SOCs to counter sophisticated threats. URL: https://thehackernews.com/2026/10/between-alerts-what-attackers-do-in.html

Daily News Headline: ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More Summary: Recent cybersecurity news highlights an alarming rise in critical vulnerabilities and exploits, particularly remote code execution (RCE) flaws. Key incidents include the PHP2Shell vulnerabilities in PHP, which have prompted widespread scanning without reported successful exploits, and multiple security flaws in various platforms like GitLab and Plex, leading to cryptocurrency miners being deployed via exploits. A leaked key causing a software supply chain attack emphasizes the need for immediate security measures. The article also highlights the rise of AI-related threats, with malicious agents exploiting vulnerabilities at an unprecedented pace. Reports of organized crime utilizing hacking tactics and AI for targeted attacks underscore the growing sophistication of threats in the cybersecurity landscape. Organizations are urged to act swiftly in patching vulnerabilities to safeguard against potential exploitation. URL: https://thehackernews.com/2026/10/weekly-recap-this2shell-that2shell.html

🔥 Top 30+ Bug Bounty Platforms 2026 💰 HackerOne Bugcrowd Intigriti YesWeHack Synack Immunefi HackenProof Cantina Code4rena Sherlock CodeHawks Cobalt Zerocopter Detectify Open Bug Bounty Yogosha SafeHats huntr BugBase Hacktrophy Nordic Defender Capture The Bug Bugbounter Pentabug SecureBug Inspectiv Hackrate Federacy Vulnerability Research Labs AntiHACKme RedStorm Information Security Cyber Army Indonesia Happy Hunt 2026 ❤️

PHP servers shodan dorks - http.component:"php" - "X-Powered-By: PHP" - http.component:"php" country:"xx" - "X-Powered-By: PHP/7.4.33" - "X-Powered-By: PHP/7.4" - "X-Powered-By: PHP/8." - http.component:"php" http.component_version:"7.4" - "X-Powered-By: PHP/8.1" country:"xx"

Black October