Friday, October 9, 2026 · Daily editionBack issueBack issues · Search

SitRep

An independent cybersecurity briefing — what matters, with its sources.

You are reading a back issue. Go to the latest edition →

The situation

Ransomware Disrupts 495 IDC Frontier Customers

IDC Frontier outage affects 495 customers; patch, rotate credentials, and validate backups.

Composed by SitRep’s AI editors from 3 sources — Breaches.net, The Hacker News, BleepingComputer

Ransomware Disrupts IDC Frontier Cloud Services

A ransomware attack against IDC Frontier caused system outages that affected 495 corporate and local government customers nationwide. Services were disrupted across multiple clients, producing an immediate operational outage and potential downstream exposure for tenant data.

Context

This matters now because cloud provider outages and exploited infrastructure often lead to follow-on credential abuse and data access; affected tenants should assume possible exposure, rotate credentials tied to the environment, and validate restore procedures immediately. Practitioners with dependencies on IDC Frontier services must identify impacted accounts, isolate service connections, and prioritize forensic preservation and customer notifications.

“Today's stories demonstrate the same operational arc: compromise → disruption → credential/data abuse.”
The move

6 things to do today

  1. Rotate secrets and service account credentials that authenticate to IDC Frontier and any impacted cloud tenants; treat them as potentially compromised.
  2. Revoke and rotate CI/CD tokens and secrets after auditing GitHub Actions workflows for unauthorized changes; enforce repository-level 2FA and least privilege.
  3. Patch or isolate AhsayCBS instances (upgrade from AhsayCBS 10.3.4) and hunt for JSP webshells, modified NSSM services, and the MicrosoftEdgeUpdateSvc persistence artifact.
  4. Apply SonicWall SMA1000 mitigations: patch for CVE-2026-102255, segment appliances from management networks, and alert on atypical OPTIONS requests to the appliance.
  5. Block or restrict inbound TCP port 7070, and update AnyDesk instances to 8.0.3+; detect unexpected AnyDesk processes and connections to port 7070.
  6. Upgrade DCGM Exporter to 4.8.2+, disable /debug/pprof, and restrict access to monitoring endpoints to prevent unauthenticated crashes of GPU monitoring.

On the wire

P0Incident

Ransomware Outage Impacting 495 IDC Frontier Customers

Operational outage affected 495 corporate and local government customers; assume potential data exposure and prioritize containment and incident response. Preserve forensic evidence, rotate service credentials tied to the provider, and validate restores from offline backups before returning systems to production.

BREACHES.NET · Ransomware Hit IDC Frontier Cloud Services, Impacts 495 Customers

P1News

GhostAction Campaign Exfiltrated 3,325 Secrets via GitHub Actions

Attackers injected malicious workflows into 817 repos across 327 users and exfiltrated 3,325 secrets; tokens for PyPI, npm, and DockerHub were captured. Revoke and rotate all CI/CD secrets and tokens, audit GitHub Actions workflows and maintainer account activity, and enable repository-level protections and 2FA for maintainers.

THE HACKER NEWS · GhostAction Credential Theft Campaign Targets GitHub Actions Workflows

P1News

AhsayCBS Flaws CVE-2026-105133/105134 Exploited to Deploy Webshells

Threat actors exploited authentication bypass and OS command injection in AhsayCBS 10.3.4 to install JSP webshells and XMRig, persisting via a fake MicrosoftEdgeUpdateSvc. Restrict the management interface to trusted IPs, restore affected servers from trusted backups, hunt for webshells and modified NSSM services, and patch or isolate vulnerable AhsayCBS instances.

BLEEPINGCOMPUTER · Unpatched AhsayCBS Flaws Exploited to Deploy Webshells and Mine Crypto

P1News

SonicWall SMA1000 CVE-2026-102255 Is Being Exploited

Exploitation uses crafted OPTIONS requests to reach internal CouchDB at 127[.]0[.]0[.]1:5984 and perform unauthorized operations on SMA1000 WorkPlace interfaces. Patch affected SMA1000 appliances immediately, monitor for OPTIONS requests targeting the appliance, and search appliance logs and CouchDB for signs of tampering.

BLEEPINGCOMPUTER · Max Severity SonicWall SMA1000 Flaw Exploited in Attacks

P2News

AnyDesk Linux Pre-auth RCE Exploit Published (Port 7070)

A working exploit (AnyPwn) grants pre-auth root via TCP connections on port 7070 for AnyDesk 8.0.2; updating to 8.0.3+ mitigates the issue. Block or restrict inbound access to port 7070 on exposed hosts, prioritize upgrades to 8.0.3+, and detect unexpected AnyDesk processes or connections to port 7070.

THE HACKER NEWS · Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw

Elsewhere in the edition

Anthropic Introduces Free Open-Source Vulnerability Scanner

Anthropic unveiled OSS Scanner, a free opt-in AI vulnerability scanner for open-source projects, using Claude Mythos to generate outputs without human review. Enrollment via GitHub PR with YAML config (repo, contact email, Dockerfile). 116 PRs so far; 29,000+ candidate vulnerabilities identified, 6,000+ reported, 584 advisories as of Oct 2, 2026. No mandatory 90-day disclosure yet; may evolve und…

4 reports

US Disrupts Chinese State-Sponsored Hacking Tools

The US disrupted two Chinese-state tools, MicroScan and FishHub, built by Integrity Technology Group. MicroScan used for vulnerability scanning via a Mirai-based IoT botnet; FishHub enabled remote network access and data exfiltration. Attacks hit a US power company, NGOs, airports in Japan/Poland, Taiwanese infrastructure, and 20 Taiwan universities. Domains tied to the operation were seized; san…

4 reports

Citrix Warns Patch NetScaler RCE Flaw CVE-2026-107406

Citrix urges immediate patching of NetScaler ADC and NetScaler Gateway due to CVE-2026-107406, a memory overflow that enables remote code execution or DoS when configured as an IdP or SP via SAML. Upgrades to specific 14.1-73.46+/13.1-64.29+ releases are advised. Shadowserver tracks over 21,000 Internet-exposed NetScaler assets, though exploitation is not yet observed.

3 reports

Remote Hacking Successes on Pixel 10 at Pwn2Own Ireland

Three teams demonstrated remote exploits on Google's Pixel 10 at Pwn2Own Ireland in Cork on Oct 8, 2026, despite fully patched targets. Ikotas Labs won $300,000, Xint earned $150,000, and a third team $112,500, totaling $562,500. Several exploits relied on known bugs (collisions). Pixel 10 had prior patch coverage, including CVE-2026-58704 for the modem, with details not published by ZDI.

3 reports

FBI Arrests Another ShinyHunters Suspect Involved in Its Jobs Portal Hack

The FBI arrested another suspected ShinyHunters co-conspirator, a Canadian citizen detained in Pennsylvania, amid the FBI jobs portal breach. Earlier arrests include a 24-year-old Amsterdam man and a Jordan detainee cooperating with investigators. The breach exposed FBI employees’ data and job details; ShinyHunters reportedly extorted over $70 million across 140+ targets.

2 reports

Germany Arrests Alleged Core Qilin Ransomware Member After Extradition

Germany arrested a Russian national suspected of being a leading member of the Qilin ransomware group after extradition from Japan. Qilin, a ransomware-as-a-service operation, targeted more than 2,350 organizations in 62 countries, including Nissan, Asahi, Lee Enterprises, and Court Services Victoria. The group has been linked to ATF breaches and VPN flaws from Check Point and Palo Alto. The susp…

2 reports

AI-Driven Korean Bank Breaches, Poem-Guided Botnet, 40-Year Empire Admin

SecurityWeek notes AI-enabled Korean bank breaches under investigation, PoeLLM uses a poem hosted on GitHub to derive C2 IPs, and the Empire Market co-founder Raheim Hamilton received a 40-year sentence. Also linked is Nvidia DCGM Exporter flaw CVE-2026-47483, exposing telemetry from over 12,000 GPUs, with PoeLLM active since at least April 2026.

2 reports

ASOS Breach Update: Hackers Stole Customer Details and Shopping Searches

Hackers accessed ASOS customer data after tricking an employee into handing login credentials. Stolen data includes names, addresses, phone numbers, emails, customer numbers, dates of birth, and shopping searches. Payment card info and passwords were not accessed. Attackers cited Snowflake and Simon AI platforms; Snowflake says no breach. ASOS faces investigation and potential ransom pressure; ad…

2 reports

Also reported

End of the Friday, October 9, 2026 edition.