SysBlue Cyber Solutions

20/10/2026

Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software.

The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20.

An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept.

Eight eMudhra CA keys were compromised, prompting browser blocks and software fixes. Chrome found no rogue certificates in CT logs.

19/10/2026

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor.

Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public.

According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell.

Attackers exploit four Plex Media Server flaws chained as Plex2Shell to deploy XMRig miners and reverse proxy software after PoC release.

18/10/2026

ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants.

ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants.

ConnectWise disabled seven application identities and suspended Cloud Backup after attackers compromised Microsoft 365 tenants.

17/10/2026

MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX.

The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of the package is 1.0.3.

The MALFEX-linked npm package imgdecode uses a Windows DLL to fetch and decrypt a GitHub payload before injecting it into dllhost.exe.

15/10/2026

ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More.

Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories.

The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and some flaws are so simple you wonder how nobody spotted them sooner.

This week's ThreatsDay covers ransomware attacks, critical security flaws, credential theft, new malware, and sneaky tricks attackers use to break in.

14/10/2026

Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability.

Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday.

The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware, and other threats, and only a gateway with the File Reputation service enabled and a Content Scanner Tools package older than version 25.3.0.5525 is vulnerable.

https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html?m=1

13/10/2026

Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets

Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic.

The frontier AI lab said small AI models could form autonomous, self-propagating worm botnets that are "challenging to shut down," since "there's no centralized point to shut off."

Anthropic warns small AI models could form IoT botnets; GLM-5.2 propagated Llama3.1-8B to eight nodes in four of five tests.

11/10/2026

P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands.

Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.

"Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure," iVerify said in a new report published Thursday.

P7 DarkSword adds on-device keychain and crypto wallet data theft to the iOS exploit kit, alongside two-way C2 communication.

08/10/2026

FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails.

Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other countries said on October 8.

The company, Integrity Technology Group, has been sanctioned by the U.S. and the UK. The hackers scanned websites for flaws using a tool containing more than 1,300 scripts, guessed passwords for Microsoft 365 and Exchange accounts, and copied mailboxes using tools designed to collect mail.

FBI says Integrity Technology Group-linked hackers stole email in Southeast Asia using custom tools and a scanner with over 1,300 scripts.

05/10/2026

Rejetto HFS servers now actively scanned for critical RCE flaw.

Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows session forgery, account takeover, and remote code ex*****on (RCE).

VulnCheck VP of Security Research Caitlin Condon posted on LinkedIn over the weekend that the company's Canary Intelligence honeypots had observed probes targeting CVE-2026-61500.

Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows session forgery, account takeover, and remote code ex*****on (RCE).