SecurityWeek’s weekly cybersecurity information roundup gives a concise overview of necessary developments that won’t obtain full standalone protection but stay related to the broader menace panorama.
This curated abstract highlights key tales throughout vulnerability disclosures, rising assault strategies, coverage updates, business stories, and different noteworthy occasions to assist readers keep well-informed concerning the evolving cybersecurity setting.
Listed below are this week’s highlights:
ICS-Sniper assault picks off crucial OT visitors
College of British Columbia researchers have detailed ICS-Sniper, a proof-of-concept assault aimed toward industrial amenities that depend on cloud-hosted SCADA techniques. An attacker who controls a router on the community path might examine the scale, course and timing of VPN-encrypted packets to foretell when crucial instructions or knowledge might be exchanged, then drop payload-carrying packets throughout these home windows. In exams on emulated variations of the SWaT water remedy testbed, the assault delayed the beginning of fresh water pumping by about quarter-hour and, in a separate take a look at, stored a valve open greater than 9 minutes longer than supposed.
Intel pulls SGX from Xeon roadmap after Diamond Rapids
Intel says Diamond Rapids, its next-generation Xeon platform, would be the final to incorporate SGX, because it focuses its confidential computing roadmap on TDX. The corporate says the business has moved towards VM isolation applied sciences like TDX as a result of they’re simpler to deploy and scale. Platforms with SGX will hold receiving assist and safety updates into the early 2030s, giving clients a number of years emigrate.
XWorm operators’ panels open to takeover
Mootoo, an unbiased researcher based mostly in Oman, has revealed a PoC exploit for an unauthenticated RCE flaw within the XWorm RAT’s C2 panel (variations as much as 7.4). The researcher discovered it on October 4 whereas reverse-engineering an XWorm pattern utilized in an try and compromise them. An attacker who has the panel’s tackle, port and communication key (all of which may be pulled from an XWorm shopper’s configuration) can pose as an contaminated machine, overwrite a DLL by way of path traversal, and get code working on the C2 host with none motion from the operator. Mootoo instructed SecurityWeek they used the flaw to compromise infrastructure tied to the individual behind the assault, and that it seems to be exploited on a restricted scale.
Financial institution of America brings in patch military after Mythos
Financial institution of America CEO Brian Moynihan instructed CNBC that the financial institution introduced in 1,000 exterior contractors within the second quarter to assist its 3,000-strong inside crew repair flaws in proprietary and vendor software program uncovered by frontier AI fashions reminiscent of Anthropic’s Mythos. The contractors are nonetheless working there. Moynihan stated the remediation effort, along with anti-money laundering compliance work, added a ‘couple hundred million plus’ to third-quarter prices, however he expects remediation prices to say no over time.
Anthropic catalogs Claude’s rule-bending on actual web sites
Anthropic has disclosed instances the place Claude fashions took unintended actions on stay web sites throughout evaluations and inside use. In a single case, a mannequin exploited an injection flaw to run instructions on a college server. Others concerned submitting an invented tip by way of a Philadelphia Police Division type, and utilizing uncovered entry tokens to succeed in fee-gated knowledge. The corporate describes the influence as minimal, however it has now lower stay web entry for all inside evaluations till it confirms its new detection tooling (which blocked each documented case in testing) works reliably.
West African rip-off facilities focused by tech giants and legislation enforcement
Meta, Coinbase, Google, Microsoft, OpenAI and ten different tech companies joined legislation enforcement from ten international locations in a UK NCA-hosted operation in opposition to rip-off networks in Nigeria, Ghana and elsewhere in West Africa. Meta eliminated greater than 3.7 million Fb and Instagram accounts, pages and teams. Authorities arrested 28 individuals and rescued 117 trafficking victims who had been held in a rip-off compound, and the FBI stated at the very least $11 million in probably freezable funds was recognized.
Burger King Japan app breach exposes 11 million member data
BK Japan, which runs Burger King’s official app in Japan, says hackers accessed the system holding the app’s member knowledge between October 2 and October 7, exposing roughly 11 million member data. Uncovered particulars embrace names, e-mail addresses, telephone numbers, dates of delivery, gender and prefecture. The corporate says it doesn’t retailer card numbers and has to this point discovered no signal that login passwords have been taken.
AI-aided Chrome exploit for Home windows takeover earns $250,000
XBOW has detailed a Chrome full-chain exploit, constructed by its researchers with assist from OpenAI’s GPT-5.6 Sol, that allow a malicious web site take over a Home windows machine. The ultimate chain combines three bugs, all now mounted by Google. It was assembled in six days in August, after Google stated it already knew about one of many flaws within the crew’s first try. Google awarded XBOW a $250,000 bounty, whereas the compute required to develop the exploit price $40,000.
KGB RAT pairs knowledge theft with bounce scares
Group-IB has analyzed KGB RAT, a Home windows trojan bought on underground boards as a “totally undetectable” distant administration device, with subscriptions starting from $150 monthly to $800 per yr. Constructed on NjRAT foundations, it gives credential theft, keylogging, hidden VNC, ransomware and a crypto clipper. It additionally consists of harassment options reminiscent of screamers, bounce scares and compelled blue screens. The builders push day by day crypter updates to evade Home windows Defender, and the samples Group-IB examined level to a number of operators utilizing a shared builder.
Langflow flaw below assault weeks earlier than CVE went public
Previdian says its honeypot sensors have recorded exploitation makes an attempt concentrating on CVE-2026-105740, a crucial Langflow vulnerability. The flaw lets any authenticated consumer run code on the server by including an MCP server set to make use of the Stdio transport, as a result of the provided command is handed to bash with out validation or sandboxing. The bug is mounted in model 1.9.0. Previdian first noticed makes an attempt on September 19, greater than two weeks earlier than the CVE was revealed on October 5, and has since logged over 1,800 makes an attempt from 28 IP addresses in 16 international locations.
