A researcher says one hacked device on a Tailscale network can take full control of other servers, and Tailscale has no fix out yet

The rest of the day

9 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

1. 02

   PHP flaw used against a European government

   Palo Alto Networks, a security company, says attackers used the PHP2Shell flaws to break into a European government body. [2] Within two hours they had its scrambled passwords and the secrets behind its second login check. [2] PHP is the code behind about 70% of websites. [3] On 22 October Britain's cyber agency said it knew of no successful hacks, and that older systems the fix cannot reach must be replaced. [3] CYFIRMA, a security firm, says a group it links to North Korea is probing 216 servers that are not fully protected in 11 countries and the EU. [2]

   Why it matters — After getting in, the attackers tried to take over the body's whole network, which shows how far one unpatched server can lead. [2] The probing is aimed at government offices, banks, airports, factories and shopping sites. [2]

2. 03

   Router flaw from 2010 has no fix

   Quentin Kaiser, a researcher in Belgium, showed on 16 October that a flaw in Broadcom's Wi-Fi setup code lets someone within radio range take over a router. [4] Broadcom's code sits in routers and Wi-Fi points from dozens of brands, and he estimates millions of devices are affected. [4] He made it work on home routers given out by Proximus and Orange Belgium, two internet providers. [4] Kaiser says Broadcom has known since 2018 and shipped only a partial fix, and on older chips no working fix was ever shipped. [4]

   2010Broadcom setup code

   ↓→

   2018Partial fix

   ↓→

   2026Shown working again

   Why it matters — There is no patch for households to install, and on older chips replacing the router is the only fix Kaiser offers. [4] He published free tools that let anyone check router software for the flawed code. [4]

3. 04

   Ransom gang let AI do the break-ins

   SOCRadar, a security research firm, found an exposed server used by partners of the INC and The Gentlemen ransomware gangs. [5] Its logs showed AI tools carrying out break-ins while a person approved each step, across 8,257 messages. [5] When an AI model refused, the operator told it the job was an authorised security test. [5] About 62 organisations were targeted, more than half in the US, and four were later named on the gangs' leak sites. [5]

   4 of 62

   organisations named on leak sites, of about 62 targeted

   Why it matters — In one case a single reused password let them into a victim's VPN, servers, backups and security tools at once, SOCRadar says. [5] Factories and energy firms were targeted most, then healthcare and drug companies. [5]

4. 05

   A booby-trapped file steers AI coding tools

   Forever Security, a company that watches for risks from AI tools, found a planted instruction file called AGENTS.md in a customer's Downloads folder. [6] AI coding tools read such files to learn how to work in a folder, and this one told the tool to install a harmful software package. [6] In tests it got Codex, OpenAI's coding tool, to run a harmless stand-in program 90% of the time. [6] A similar file tricked Claude Code, made by Anthropic, into leaking its login token. [6]

   Codex ran the test program90%

   Claude Code ran attacker's commands50%

   Why it matters — The researchers say there is nothing for OpenAI or Anthropic to patch, because the tools are doing what they were built to do. [6] OpenAI and Anthropic advise starting these tools inside the one project folder they should work on. [6]

5. 06

   PwC confirms an incident at a supplier

   PwC, one of the world's biggest accounting firms, said on 23 October that an outside company hosting its staff training records had a security incident. [7] A day earlier an extortion gang called Everest claimed it had taken 590 gigabytes of PwC data. [7] Everest posted a countdown of five days and said it would publish the data unless a deal is reached. [7] PwC says no client data, sensitive personal data or financial details were on the site. [7]

   Why it matters — Everest says the files hold staff names, emails, phone numbers and job histories, which PwC has not confirmed or denied. [7] Its countdown runs out around 27 October. [7]

6. 07

   Marines sue over military records

   Two US Marines, one serving and one former, filed a class action against the US Defense Department on 19 October. [8] They say a break-in last year at its personnel records office exposed Social Security numbers and birth dates for months. [8] They want to speak for more than three million service members and seek over $5 million. [8] The lawsuit says intruders used a flaw in a file-sharing system that held unencrypted records. [8]

   Why it matters — Neither the US Defense Department nor the Marines' lawyers answered Reuters at first. [8] In 2022 the US Office of Personnel Management paid $63 million to settle a similar case over federal staff data. [8]

7. 08

   DNS must change before quantum computers

   John Crain, chief technology officer of ICANN, which runs the internet's address system, said work to protect it from future quantum computers is speeding up. [9] Such computers could one day break the codes that prove an address is genuine. [9] Crain said the address system may need to be ready in three to five years, not the ten he once expected. [9] Bigger codes make the system's small messages too large, and changing how they are sent will take a few years, he said. [9]

   Why it matters — ICANN, the IETF and other bodies that set the internet's technical rules have begun early work on the change. [9] ICANN also found that web endings for regulated trades, like .bank, have a 45% higher chance of abuse by scammers. [9]

8. 09

   Mave raises $34 million for AI defence

   Mave, a security start-up in Tel Aviv founded in 2025 by former members of Unit 8200, an Israeli military intelligence unit, has raised $34 million in total. [10] That is $6 million from its first round plus a new $28 million led by Red Dot Capital Partners, announced on 22 October. [10] Mave builds AI programs that gather alerts from a company's security tools and explain them to the team. [10] It has about 30 staff. [10]

   • First round$6m · 18%
   • New round$28m · 82%

   Why it matters — Mave says security teams cannot keep up with attackers who use AI, so defenders need AI too. [10] For now it keeps a person approving actions instead of letting its AI act alone. [10]

9. 10

   Pakistan's cybercrime agency breaks up abuse network

   Pakistan's National Cyber Crime Investigation Agency said on Sunday that it had broken up an international network selling videos of child sexual abuse. [11] It says the suspected leader, from Skardu in the north, was arrested with help from foreign agencies. [11] The videos were sold in secret Telegram groups for cryptocurrency, the agency says, and one suspect is a father accused of filming his own young children. [11] Raids to arrest others are continuing. [11]

   Why it matters — These are the agency's claims at a press conference, and no court has tested them yet. [11] The same officials described a separate gang that befriended children aged 6 to 14 on Instagram and sold videos through WhatsApp groups. [11]