Cyber, in brief

A flaw that has sat in some Linux computers since 2016 went public on Thursday. [1] It lets an attacker log in to accounts set to refuse all passwords. [1]

OpenSSH, the software at the centre of it, released a fix on Thursday. [3] There is no sign so far that anyone has used the flaw. [3]

It reaches only some setups: OpenSSH on systems using musl, such as Alpine Linux, with certain settings. [1] Debian, Ubuntu and Fedora are not affected. [1]

Where those settings are in place, Alpine's maintainers say: "It takes one connection, works every time, and needs no retries." [2]

Many small devices running Alpine cannot easily be updated, if at all, Ars Technica says. [2] A hole in one of them can stay open long after the fix. [2]

Programmers call a stand-in answer like that asterisk a sentinel value: a mark meaning no real answer here. [1]

In this flaw OpenSSH read the asterisk as locked, and musl used it to mean failed. [1] When the two met, a failure read as a match. [1]

A club marks banned names with a dash, and its broken card reader also shows a dash. A guard checking only that they match lets the person in.

OpenSSH says the root cause lies outside its own code. [2] Rich Felker, a musl developer, says it is not a musl bug but a mistaken use by the caller. [2]

Kultekin says administrators can look for signs of use: password logins recorded on accounts that should refuse them. [1]

The *sshole flaw at the top of this page has no known victims so far. [3]

A rude name and a huge download figure can make a flaw feel bigger than anything anyone has counted; the 1 billion is downloads, and the 22 million is systems with SSH open. [2]

Many of these devices cannot easily be updated, so the owner may be left with the hole. [2]

How many machines are really open to *sshole.

Ars Technica gives only outer limits and says only a fraction meet the conditions. [2] BleepingComputer lists OpenWrt, Buildroot and Yocto as affected, while Ars Technica says OpenWrt uses other login software by default and the other two are unconfirmed. [1][2]

Norad, Norway's national aid agency, confirmed that criminals broke in and stole data on every user of its grant portal. [4]

That is 20,614 people at 12,511 organisations, whose names and email addresses were taken. [4]

The portal, launched in 2017, takes aid applications from organisations around the world. [4]

Norad says 27 hacked accounts were used to get in, and that it detected the break-in on 30 October. [4]

Applications from at least 3 organisations are also involved, and Norad says it may find more. [4]

Recent grants have backed investigative journalism in Moldova, and Ukrainian children and prisoners of war. [4]

Norad would not rule out that applicants in conflict areas and authoritarian states are in the data. [4] It says it takes that very seriously. [4]

Security engineers call the rule least privilege: each account reaches only what its job needs. [4]

At Norad, 27 accounts led to the data of all 20,614 users. [4] Norad has not said how they reached that far. [4]

A key to one classroom loses little when it is stolen. A key to every classroom loses the whole school.

Norad's digital director says it "should be safe" to keep using its services. [4] Outside experts are still being brought in to establish what was taken. [4]

At Norway's aid agency Norad, 27 hacked accounts led to the data of all 20,614 grant portal users. [4]

Their names and emails are now with criminals, and they must wait for outside experts to say what else was taken. [4]

How long the attackers were inside Norad's portal.

Norad gave no indication of how long they had access, and outside experts are still being brought in. [4]

5 US agencies warned on Thursday that hackers are going after refrigeration controls around the world. [9]

They are CISA, the US cyber-defence agency, the FBI and the health, agriculture and transport departments. [5]

Two waves of attacks have already raised temperatures in at least a dozen countries, TechCrunch reports. [8]

The agencies warn of fire hazards and lost stock. [5] They say every organisation using such systems should assume it could be a target. [5]

In August, freezers at US military food stores switched to defrost or heating. [6] The US defence department's inspector general is investigating, and any link is unclear. [6]

France's cyber agency, ANSSI, knows of hacked controllers from Danfoss and Copeland. [10] Thousands of such devices remain exposed on the internet. [10]

The US agencies want controllers off the public internet, default passwords changed and unsupported devices replaced. [5]

These controls also guard vaccines, medicines and blood products. [10]

Engineers call computers that run physical machines operational technology. [7]

In a fridge controller, a changed setting becomes real heat, as high as 50C. [7] So the harm is spoiled food and fire risk. [7]

Someone who could reach a kitchen thermostat from outside could ruin the food without entering the house.

The Register says it knows of no documented attack on US supermarkets. [7] The FBI had not answered its questions when it published. [7]

At the French blood service, alarms caught the changed settings and staff took back control. [10] The blood was moved and was not harmed. [10]

Who is behind the fridge hacks.

No one has claimed them and the US has not named anyone. [8] TechCrunch says researchers point to Iran, and The Record says authorities are alert to Russia, whose government denies any such operations. [8][6]

Whether the August freezer faults on US military bases are part of the same campaign.

The US defence department's inspector general is investigating, and The Record says the link is unclear. [6] Reuters, as cited by The Register, says the department treats them as a suspected cyberattack. [7]

DigiCert, which issues the certificates websites use to prove who they are, says outsiders read customer records. [11]

Names, work emails, phone numbers and business addresses were exposed. [11] For some people, so were driver's licences, passports or utility bills. [11]

In February 2025 a server move put an internal system on the open internet. [11] Until then it could be reached only through a private link. [11]

That system also let outsiders create their own accounts. [11]

DigiCert spotted unknown accounts in June 2026, and judged that they could not reach customer data. [11]

On 19 October a further check found one account had read customer records from 27 June to 2 July. [11]

DigiCert says certificates and customer logins are safe, and the account could only read. [11]

People who sent a passport or licence to prove who they are may have that copy exposed. [11] DigiCert is still checking whose. [11]

Security engineers separate authentication, who someone is, from authorisation, what that person may see. [11]

DigiCert's new accounts belonged to no application, so they should have reached nothing. [11] An authorisation flaw still let them read archived records. [11]

A gym gives anyone a member card but leaves the office unlocked. The card proves a name and stops nobody reaching the files.

DigiCert admits the event was "handled as an account-creation issue rather than a data-access event". [11]

At DigiCert, a server move in February 2025 put a private system on the open internet, and outsiders were spotted on it in June 2026. [11]

They handed over those documents to get a certificate, and did not choose the server move that exposed them. [11]

How many people's passports and licences DigiCert exposed.

DigiCert is still reviewing the documents, and BleepingComputer had no answer to its question about numbers. [11]

US prosecutors charged 3 people with using AI to pose as bosses and lawyers and stealing about $129 million. [13]

Over more than a year and a half they targeted thousands of companies worldwide, prosecutors say. [13]

Victims included hospital systems in Missouri and California, a bank in Rhode Island and a UK financial technology firm. [13]

They often began by emailing the accounts team as the chief executive, asking for help with a confidential deal. [13]

A phone or video call followed, with AI copying the boss's voice and sometimes the face. [13]

A fake lawyer then told staff to wire money abroad. [13] It was turned into crypto to hide where it came from. [13]

The three, from Spain, the UK, Israel and the United Arab Emirates, were arrested between June and September. [13]

Those targeted were often accounts staff, at places from hospitals to a Florida pet food company. [13]

Fraud investigators call a made-up reason for a request a pretext. [13] One defendant kept a handwritten script titled "Lawyer Call", prosecutors say. [13]

In this case the pretext was a confidential deal, prosecutors say. [13] A deal called confidential also gives staff a reason not to ask a colleague. [13]

A stranger on the phone says he is the head teacher and asks a pupil to keep it secret. The secret also stops the pupil checking with anyone.

These are charges, and the figure is the prosecutors'. [13] The court file was still sealed, and prosecutors had not answered the Associated Press's call. [13]

Chainalysis, whose software police use to trace crypto, now says intruders also took usernames, scrambled passwords and live login tokens. [14]

Earlier updates listed only user IDs, names, email addresses and job labels. [14]

It has taken down Reactor, the investigation tool police around the world use, while it repairs its systems. [14]

It also saw "abnormal activity" on its products that check crypto transactions. [14]

It planned to restore 2 checking tools on Thursday, for customers whose internet addresses are on an approved list. [14]

Every user will have to reset passwords and replace access keys where needed. [14] Its password reset service was itself down when it said so. [14]

Police and exchanges that use Chainalysis to follow stolen coins have lost some of those tools for now. [14]

In cryptography, a hash is a scrambled form of a password, made to be hard to reverse. [14]

How hard a Chainalysis hash is to reverse depends on the method used. [14] Chainalysis has not named its method. [14]

A diary written in code is safe only if the code is hard to break. Nobody can judge that until they know which code it was.

Chainalysis says it has no evidence that investigation data was reached or its tracing data changed. [14] That is its own statement, and The Register says its picture has worsened. [14]

How well Chainalysis's scrambled passwords will hold.

The company has not named its method, and that method decides how hard they are to reverse. [14]

A ransomware gang has locked the systems of Queens Public Library in New York, the library confirmed on Wednesday. [15]

Its 66 branches serve 2.3 million residents, and all of them remain open. [15]

On-site computers, checkout machines, Wi-Fi, the mobile app and digital media are down. [15] So is the website. [16]

The library warned that "it will take some time" to restore its network and systems. [16]

No gang had taken credit by Thursday evening. [15]

The British Library was hit in 2023 and refused a ransom of 20 Bitcoin. [16] Its recovery is still not finished. [16]

People who come to the branches for computers and Wi-Fi lose them while the doors stay open. [15]

Ransomware is criminal software that scrambles a victim's files and demands money for the way back. [15]

Gangs use the demand for e-books and key services as a wedge to make libraries pay, The Record says. [15]

Someone changes the lock on the class games cupboard, then asks the class to pay for the key.

The Register says attacks on publicly funded bodies rarely lead to big payments. [16] The gang's aim here is not known, because nobody has claimed it. [15]

Which gang hit Queens Public Library, and what it wants.

No gang had taken credit by Thursday evening. [15]

CERT-In, India's national cyber response team, warned of repeated attacks on digital lenders, payment firms and crypto exchanges. [19]

It calls the group Crafty Falcon and says it uses AI tools. [18]

Some firms were hit again after only partly fixing what went wrong the first time. [18]

Attacks are timed for holidays, weekends and other hours when fewer people are watching. [18]

The group starts at test systems left on the internet, CERT-In says. [19] It then reaches live systems using shared passwords or access tokens. [19]

Before a big theft it tries a payment as small as 1 rupee. [19] If that works, larger payments follow. [18]

It also rewrites firms' apps, so that the payment requests look as if they came from the real app. [18]

India has thousands of banks, many of them small, and The Register says these sometimes lack basic protections. [18]

Security teams call the step from one system to the next lateral movement. [19]

At these firms, test and live systems shared passwords, tokens or network paths. [19] So a break-in at a test system could reach the live one. [19]

A family keeps the same key for the garden shed and the front door. A thief who opens the shed can now open the house.

The tools have been linked to people who appear to speak Chinese, The Register says. [18] That links the tools, and does not say who runs this group. [18]

Some attacks check who is looking before they act

A security tool tests a suspect page or program

The tool differs from a real target: no person, the wrong signal, a quiet hour

The attack looks for those signs first

For the tool it stays quiet or shows nothing

The tool reports clean, and the real target meets the attack

A clean scan shows only how a page or program behaved for the scanner. A person who arrives later may get something else.

One web address, two results. On today's fake event pages a robot check stops the scanner, and a person goes on to the page that takes the login.

A robot check comes first, so automatic scanners never reach the page that a person is sent to.

CWPdoor does nothing until it receives a signed order, and it keeps those orders out of the logs, so a copy sat on a public scanning site with zero detections.

Crafty Falcon picks holidays and weekends, when fewer people are watching, and its rewritten apps look to the firm's checks like the real app.

Mirax changes its package name, so a check looking for a known name does not match it.

A gap between a test and real use is not always a trick: OpenAI's Astra model did less on safety tasks, and OpenAI found no evidence of a plan to mislead its testers, though it cannot rule that out.

The person who clicks sees one page, the scanner saw another, and the security team reads only the scanner's report.

CERT-In's advice to firms is to log events, watch for odd activity and keep watch day and night, which The Register notes is their product. [18]

A researcher says a browser add-on can make Claude Desktop, Anthropic's AI helper, run commands on a computer. [20]

The way in is Dispatch, a feature for sending tasks to Claude Desktop from a phone or browser. [20]

Gal Weizman of Forever Security, a security firm, found Dispatch could be reached from an ordinary logged-in session at claude.ai. [20]

So an add-on with access to that page could send orders as if they came from the user. [20]

Anthropic accepted the report in May and closed it as a duplicate of a known flaw. [20] It said it planned to retire Dispatch at the end of October. [20]

On 30 October its support page still listed Dispatch as available to existing users. [20]

Weizman says the weakness lives on in Claude Code Remote Control and in Cowork sessions. [20]

Dispatch works across machines, so a home account can reach a work laptop signed in to it. [20] Personal accounts were 18% to 71% of Claude accounts at 6 organisations. [20]

Weizman calls it "a classic escalation of privileges": gaining more power than was given. [20]

A browser add-on normally stays inside the browser. [20] Through Dispatch it reaches the desktop helper, which can run code on the machine. [20]

A visitor's badge opens only the lobby. If the lobby phone can order the caretaker to open any room, the badge now reaches every room.

The attack needs a malicious or hijacked add-on with access to claude.ai. [20] Anthropic did not answer The Register's questions. [20]

The US Treasury, the country's finance ministry, sanctioned 4 people and 41 companies linked to the Prince Group on Thursday. [17]

Prince Group is a Cambodian company accused of running compounds where trafficked workers were forced to run online scams. [17]

Its chief, Chen Zhi, was arrested and sent to China. [17] The US has confiscated more than $15 billion in crypto from him and the company. [17]

This third round of sanctions targets the shell companies meant to keep the money within reach. [17]

One man named, Qiu Yong, ran shell companies in the British Virgin Islands and Hong Kong. [17]

Chui Kok Wa was also sanctioned, accused of fleeing Cambodia and restarting a scam centre in Madagascar this summer. [17]

He allegedly stole $516,695 from 74 crypto wallets belonging to victims in several US states. [17]

Victims in the US, Europe and China lost money to these compounds, and trafficked workers were held in them. [17]

Investigators call the person who really controls a company its beneficial owner. [17]

Before he was sanctioned, Prince official Chen Bo moved properties and businesses to others, the US says. [17] They were his wife, He Yujing, and Visal Pang. [17]

A player banned from a game keeps playing through a friend's account, with the friend's name on the screen.

Prince Group rejected the criminal accusations in a statement last year. [17]

What is happening to Chen Zhi, the Prince Group's chief.

His whereabouts and his case in China are unknown, The Record says. [17]

Bitdefender, a Romanian security firm, found that one bad app can trap an Android phone in endless restarts. [21]

The app needs no permissions, and it does not even have to be opened. [21]

All versions from Android 10 up are affected, and no fix is available. [22]

On a Pixel 10 phone, the loop began about 1 second after the app was installed. [21]

Safe Mode does not help. [21] The usual way out is a factory reset, which erases what is stored on the phone. [21]

Bitdefender reported it on 20 August and got the reply "Won't Fix (Not Reproducible)". [21] Google later said it may address it in a future update, outside its security fixes. [21]

Bitdefender says criminals could in theory use this to hold a phone to ransom. [22] They could also make a bad app impossible to remove. [22]

Security staff call this denial of service: stopping a thing from working without stealing anything. [21]

In GhostMap, Android's core service reads the bad file, crashes, restarts and reads it again. [21] The loop ran 110 times in normal start-up. [21]

A record player hits a scratch, jumps back and hits the same scratch, until somebody lifts the needle.

Bitdefender's own product detects the bad file, and Bitdefender is the source of this warning. [22] BleepingComputer was still waiting for Google's reply. [21]

With no fix available, the usual way out is a factory reset that erases what is on the phone. [21]

Thousands of bank customers' Android phones were infected with Mirax, a spy program, between March and September. [12]

Group-IB, a security firm, says the victims are in the Middle East, Turkey and Africa. [12] It estimates losses in the millions of dollars. [12]

The program poses as Google Play Services. [12] It also changes its package name, to get past checks that look for a known name. [12]

It reads passwords and one-time codes, and captures the PIN that unlocks the phone. [12]

It then opens the banking app and sends money abroad, to new accounts added by the attacker. [12]

Group-IB ties these campaigns to a group it calls Aquafina, active since March. [12]

The one-time code is meant to stop a thief who has a password. [12] On a phone like this, the attacker reads the code too. [12]

Fraud teams call this device takeover: the attacker works through the customer's own phone. [12]

Mirax abuses Android's accessibility services, so it can see the phone and control it in real time. [12]