oracle

analysis Google's search revenue Ferrari hits an AI-powered speed bump Just wait 'til we add more AI and this thing'll really fly AWS installs an AI accelerator every 14 seconds and eyes $1 trillion annual revenue Before long, we could be writing about a cloud company with a retail side hustle Oracle wants to bill you for every AI task, not just every seat Big Red says AI units will add to subscriptions, as it juggles $90BN-plus capex, mounting debt and a $225BN revenue goal for 2030 GitHub powering up four million extra cores to stop its service going down Re-architects site to cope with AI slop-pocalypse Microsoft faces potential vote: Shareholders curious about its plans to tackle emissions Greenhouse gas output has risen dramatically since the company promised to become carbon-negative by 2030 Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career Ubuntu 27.04 may bring a preview of the long-awaited Core Desktop Canonical has a long way to catch up, but it knows who it's chasing Systemd adds support for Rust What's even better than Rust in the Linux kernel? Rust in systemd! FreeBSD founder ports Omarchy to FreeBSD in ten days, ten releases Daemonarchy is unaffiliated with the Linux original, built with AI help, and could complicate FreeBSD's debate over AI contributions SparkyOS: Lightweight general-purpose Arch, on a pendrive Interesting new project from the minds behind SparkyLinux Red Hat helps teach about tech writing But learns tough lessons about AI in the process NetBSD may have found a new role: The AI-free FOSS OS Increasing awareness and adoption, followed by increasing donations

A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale. Anthropic said on October 27 that its AI model wrote an exploit that uses the flaw to let a remote attacker with no credentials run commands as root on Linux servers with a

Belgium's finance and tax agency has pulled "several" digital services offline after a cyberattack on the organization. FOD Financiën confirmed the attack on Wednesday, saying that MyMinfin, the agency's main online tax portal, as well as other online services, are temporarily unavailable while they start the initial investigations. "This measure helps limit the risks and makes it possible to carry out the necessary technical interventions to ensure the security of our systems," it said in a public announcement. FOD Financiën added that "this has consequences for tax deadlines in the near future," referring to the October 31 extended deadline to submit tax filings for specific types of income, such as sole traders and earnings from foreign companies. The agency confirmed the deadline will be extended to November 16, by which time MyMinfin, the platform through which such filings would normally be submitted, should be back up and running. The detail offered up in the public statement reflects the early stage of the investigation; not much is known, although there is nothing to suggest data was compromised. "Data protection is a top priority for the FOD Financiën," it said. "At present, there are no indications that a data breach has occurred or that data has been compromised. This aspect is also being closely investigated and followed up. "In the meantime, a large part of our other applications remains available with full or partial functionality. We are closely monitoring the situation and doing everything we can to make the affected services available again as soon as possible." Spokesperson Francis Adyns told local news outlets that the attack was thwarted within hours, and that it was unable to gain access to applications or data. "The attack could not be sufficiently expanded within our environment to take over applications or gain access to data," he told Nieuwsblad. "Elements that were potentially infected were isolated. As a result, MyMinfin, Tax-on-web, and Biztax went offline, but the hacking was successfully stopped. "The various services must be restored in an isolated environment. This requires considerable time to realize, with the necessary caution to rule out new risks." ®

Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw. “Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS’s Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27,” Defused posted on X, noting that no public report of the flaw being attempted in the wild had existed before. About CVE-2026-101767 The flaw carries a CVSS score of 9.8 and … More → The post Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) appeared first on Help Net Security .

An exploited flaw in the Remote Access SSL VPN service lets unauthenticated attackers remotely force ASA and FTD firewalls to reload. The post Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August appeared first on SecurityWeek .

Attackers are probing a critical Oracle E-Business Suite vulnerability that can lead to remote code execution (RCE), despite Oracle issuing a patch earlier this month. Meanwhile, new analysis indicates that an Oracle PeopleSoft zero-day exploited by ShinyHunters as early as May involves three distinct vulnerabilities that can be combined to achieve RCE. Patching alone may not remove attackers from already compromised systems, particularly if they've installed web shells. First up: CVE-2026-101767, a critical, unauthenticated SQL injection bug in Oracle EBS that can lead to RCE. “Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27,” Defused Cyber said in an X post. Horizon3 researchers found and disclosed the bug to Oracle, and the vendor patched the issue in its October release. “An attacker can send a crafted request to the vulnerable servlet to execute SQL with the privileges of the APPS database user,” Horizon3 explained at the time. “The attack chain also enables operating system command execution with the privileges of the EBS application account.” This means an unauthorized user can modify application data accessible to APPS, and execute commands. “Depending on the deployment, affected data may include financial, payroll, HR, and procurement records,” the bug hunters said. The Register reached out to Oracle with multiple questions for this story - including whether it has documented any successful exploitation of CVE-2026-101767 - and did not receive an immediate response. Moving on to the PeopleSoft-ShinyHunters fiasco: TrendAI’s Zero Day Initiative (ZDI) found and reported the PeopleSoft issues on June 10, and Oracle issued a patch under one vulnerability identifier: CVE-2026-35273. In early June, ShinyHunters told The Reg that the group hacked more than 100 organizations via an Oracle PeopleSoft zero-day, CVE-2026-35273. Google’s consulting and incident response biz, Mandiant, later confirmed the data theft and extortion crew exploited CVE-2026-35273 as a zero-day, mostly against schools and the education sector. By late September, however, Mandiant said ShinyHunters massively expanded its targeting, “deploying web shells on dozens of systems globally, spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government.” According to ZDI bug hunter Bobby Gould, there are actually three distinct vulnerabilities across multiple PeopleSoft components, and each should receive its own CVE identifier rather than being grouped under CVE-2026-35273. Gould, along with TrendAI researchers Minh Giang and Lucas Miller, originally found and reported three distinct bugs to Oracle in June. “We are coordinating with Oracle to assign separate CVEs for each issue,” he said in a Tuesday blog. The first issue is a Server-Side Request Forgery (SSRF) vulnerability in the PeopleSoft Integration Gateway (PSIGW), which gives attackers a foothold in the PeopleSoft application. In June, Oracle introduced a “validateClient” method to allow PeopleSoft system administrators to restrict access to certain functionality. The SSRF bug, however, allows crims to make requests that satisfy the validation requirement to access endpoints vulnerable to RCE, Gould wrote. “While this solution does restrict access, an attacker on any trusted host can still reach PSEMHUB,” he said, referring to PeopleSoft Environment Management Hub (PSEMHUB). “Because Oracle allows localhost by default, the PSIGW SSRF provides exactly that access.” The second bug is an external control of file path vulnerability in PSEMHUB’s ExecuteProcessActivityCommand handler. This message handler is designed to allow remote clients to write log entries to the PeopleSoft server’s filesystem - but it doesn’t properly validate requests, which allows an attacker to write a web shell into a file path and achieve RCE. The third vulnerability, also in PSEMHUB, is a deserialization of untrusted data flaw. An attacker can use a file-write vulnerability to plant a malicious XML file inside a PeopleSoft directory that stores environment configuration data, then wait for PSEMHUB to initialize, such as after a service or system restart. This triggers deserialization of the malicious XML file, potentially allowing the attacker to achieve RCE. “Attackers can combine these vulnerabilities to compromise affected instances of PeopleSoft,” Gould warned.®

UK to look at making software companies liable for cyber breaches The British government will consult on how to hold technology companies liable for cyber breaches caused by insecure products — potentially a landmark shift for a country that has for years relied on voluntary codes to encourage software vendors to improve security. The commitment, made in budget documents published on Wednesday, comes amid growing alarm in Westminster over the economic damage caused by cyberattacks. Last year's hack of Jaguar Land Rover alone is estimated to have cost the British economy £1.9 billion ($2.5 billion). According to the budget, the government “will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit.” The work will build on an ongoing review of product liability law by the Law Commission of England and Wales. Although the pledge occupies just one bullet point in the 166-page document, it marks the first formal pledge by a British government to examine where liability for cyber breaches should sit. Significant questions remain, including which department will lead the consultation, when it will begin and whether ministers envisage a civil liability regime, statutory obligations on vendors, or both. HM Treasury did not respond to a request for comment. One option likely to be considered internally is expanding the Product Security and Telecommunications Infrastructure (PSTI) Act, which since 2024 has imposed basic security requirements on manufacturers of consumer smart devices. Officials are expected to ensure any new rules are compatible with the European Union’s own software cybersecurity regime, to avoid businesses facing heavy costs to comply with two separate sets of requirements. The move follows years of pressure from Britain's own cybersecurity authorities, particularly Ollie Whitehouse, the chief technology officer of the National Cyber Security Centre (NCSC), which is part of the cyber and signals intelligence agency GCHQ. The agency called publicly for a “strategic policy agenda” last year, after efforts to address insecure technology had stalled. Whitehouse had already warned, in a keynote address at the CyberUK conference in Birmingham in 2024, that the technology market was failing to reward companies for building resilient and secure products, while regulation and legislation struggled to keep pace. Last year, he wrote that “the reality is that in 2025, we know how to build secure products and services” but “the business and commercial incentives to encourage adoption and sustainment of secure solutions are not sufficient.” His argument echoed a debate in the United States, where proposals to make software makers liable for flawed code stalled for years amid disagreements over how to define the proper standard of care. The Trump administration has since rolled back several Biden-era secure-software requirements for federal suppliers. The political pressure in Britain intensified last November, when the House of Commons Business and Trade Committee, chaired by Liam Byrne, said a lack of liability for software vendors was among the most pressing issues putting Britain’s economic and national security at risk. It urged ministers to make the NCSC's voluntary software security code of practice legally binding, with penalties for companies that fail to comply. Byrne described the Jaguar Land Rover attack as a “cyber shockwave ripping through our industrial heartlands,” while the committee warned of “a huge increase in the private ownership of public risk.” The government's Cyber Security and Resilience Bill, introduced to Parliament that same month and now before the House of Lords, acknowledged some of the market failures identified by the NCSC in its impact assessment, which pointed to the “information asymmetry between vendors and buyers” making it difficult for customers to judge the security of the technologies they purchase. In its current form, the legislation stops short of imposing obligations on software developers, concentrating instead on operators of critical infrastructure and their suppliers. Arguments ahead The European Union’s Cyber Resilience Act allows regulators to fine manufacturers of insecure products up to €15 million or 2.5% of global turnover, whichever is higher, with its main obligations taking effect in December 2027. A separate overhaul of the bloc’s product liability rules, which member states must adopt by December, extends strict liability to software, including defects caused by missing security updates. Attempts in Britain to shift liability onto software vendors are likely to face resistance, with the Business Software Alliance — whose members include Microsoft, Oracle and Amazon Web Services — having lobbied against such measures and argued that they would stifle innovation. The proposals could also create friction with the United States, where the world’s largest technology vendors are based, and where successive administrations have regarded overseas regulatory efforts with suspicion when they appear to constrain the sector's commercial success. In Britain, the Law Commission consultation referenced in the budget opened on October 8 and runs until January 14. It proposes broadening the definition of a “product” under the Consumer Protection Act 1987 to include software and AI systems, which currently sit in a legal gray area because the law was written for physical goods. That review is sponsored by the Department for Business, Innovation, Science and Trade, but responsibility for national cybersecurity policy now lies with the Department for Culture, Media and Sport. The country’s cyber minister, Baroness Lloyd, holds posts in both departments, as Recorded Future News previously reported. £154 million for AI cyber defenses Alongside the liability consultation, the budget commits £154 million ($205 million) in new funding for cyber defenses, much of which the Treasury had announced ahead of Wednesday's statement. The largest allocation is £70 million ($93 million) for a National Exposure and Real-Time Vulnerability (NERV) Centre at the NCSC. The centre will, according to the budget, use artificial intelligence to identify vulnerabilities across critical infrastructure and the wider economy. The NCSC already scans internet-connected devices hosted in Britain, alerting organizations to exposed or vulnerable systems through its Early Warning and Proactive Notifications services. The budget does not explain how NERV will differ from those existing operations, and an agency spokesperson declined to comment. A further £60 million ($79 million) will support the first phase of the NCSC’s Cyber Shield, announced in April as “a national scale, sovereign defense capability” that would use agentic AI systems to discover and fix cybersecurity weaknesses across government networks and critical national infrastructure. Remaining funds will be used to strengthen the security of technology across the public sector, including systems operated by local authorities, hospitals and schools. Separately, the government has allocated £40 million ($53 million) to establish a National Agentic Security Unit, tasked with detecting, investigating and responding to rogue AI agents. The budget describes the unit’s ambitions as developing “world-first capabilities to detect and respond to misaligned agentic activity,” but does not identify which agency will host it nor how it will interact with similar projects associated with the NCSC. The AI Security Institute, transferred to the Cabinet Office in July, will receive another £120 million ($159 million) over four years to expand its testing of frontier AI models. The investments follow a week in which critical flaws in PHP, discovered using AI, forced websites offline around the world. The NCSC urged organizations to patch affected systems or consider taking them offline. Alexander Martin is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79

FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers. The post TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices appeared first on SecurityWeek .

Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of improper authentication in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical

Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability. [...]

The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization. The post China-Linked Hackers Exploit PHP2Shell to Root Firewalls appeared first on SecurityWeek .

CVE-2026-101767 is an unauthenticated SQL injection that can be exploited for remote code execution. The post Hackers Start Probing Fresh Oracle EBS Vulnerability appeared first on SecurityWeek .

The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address

The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. [...]

The University of New Mexico is canceling classes across the medicine, nursing, and pharmacy faculties for a second day amid continued efforts to recover from a "cybersecurity event." The attack targeted the Health Sciences Center on Monday, the Uni revealed, forcing it to shut down systems, cancel appointments and clinics at UNM Health hospitals, and divert ambulances to healthcare facilities in nearby Albuquerque and Santa Fe. Hospital appointments and clinics return to normal today, although nonessential UNM Health Sciences Center staff are being asked to remain at home. "The University of New Mexico Health Sciences Center (HSC), which includes the UNM Health clinical delivery system, experienced a cybersecurity event Monday, Oct. 26, 2026," the university said in a statement on Monday evening. "HSC information technology security teams immediately took steps to contain the event and protect the network. They also notified state and federal law enforcement and engaged external partners to assist with the investigation. "Leadership activated an Emergency Operations Center to coordinate the response and provide guidance to HSC employees, students, and UNM Health system frontline providers." The university announced the attack at 1430 local time, immediately cancelling all remaining clinics and classes, dismissing everyone other than critical and clinical staff, and urging patients not to attend HSC facilities. It has not commented on the nature of the cyberattack, although that hasn’t stopped researchers from speculating about ransomware’s involvement. Rumors were fuelled by the newly assembled BYOD ransomware group claiming responsibility for the attack on Monday afternoon. It's important to note that just because a purported ransomware group took credit for the attack, it does not mean they actually were responsible, nor does it mean they deployed a ransomware/locker payload as part of the attack. However, the group's take on the digital raid is that it compromised 36,000 machines, "both [Active Directory] forests," two Oracle databases, the personal data belonging to every student and employee, as well as internal emails and data from other systems. As Reg readers know, a cybercriminal's word is never one to be trusted. Yet BYOD's claims about breaching Trump Mobile's customer database appear to have held up It was a bold debut, even for a ransomware crew: BYOD’s first named victim was the US president's smartphone biz, with data allegedly leaked for all 3,615 customers. A rival group, EndZone, claimed a similar breach a week earlier, and some experts suggested the two could be one and the same. In May, the Trump Mobile was found leaking thousands of people's data via a poorly secured website. The Trump Organization did not respond to our requests for more information in either of these cases. A UNM spokesperson declined to answer our additional questions, directing us back to its public statement. ®

The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked

A leaked SquareML access key could have been used to access a database containing personal and health information. The post Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk appeared first on SecurityWeek .

University of New Mexico (UNM) Health Sciences Center (HSC), the academic medical arm of the University of New Mexico, has suffered a cyberattack that has temporarily disrupted the operation of its hospitals and may have resulted in a substantial data breach. Hospitals diverted ambulances and canceled appointments The University of New Mexico, located in Albuquerque, New Mexico, is a public research university. Its Health Sciences Center encompasses its clinical, research and education initiatives. The clinical … More → The post Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack appeared first on Help Net Security .

For the latest discoveries in cyber research for the week of 26th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japanese cloud hosting provider Onamae Desktop Cloud has confirmed a cyberattack in which intruders compromised its infrastructure and installed malware on customer servers. More than 26,000 servers were potentially affected. The provider began shutting down customer environments on October 21 to contain the intrusion and prevent further unauthorized activity. India’s state-run State Bank of India, serving more than 500 million customers, disclosed a data breach after 3,897 customer records appeared online. The exposed information reportedly included contact details, residential addresses, birth dates, bank profiles, loan records, and identity-verification documents. The bank reported no disruption to core services. WordPress backup developer TeamUpdraft has suffered a cyberattack after intruders accessed its website and potentially exposed customer information and management-service connection keys. Attackers subsequently abused compromised UpdraftCentral keys to install backdoors on WordPress websites during an 18-hour campaign on October 18 and 19. LiteLLM, a widely used open-source AI gateway, confirmed an October 21 supply-chain attack in which attackers used stolen developer tokens to publish malicious packages and Docker images. The compromised version 1.107.0 was designed to steal cloud credentials and AI service secrets, with attackers subsequently testing stolen AWS credentials. AI THREATS Check Point Research uncovered how AI-enabled antidetect browsers allow operators to manage thousands of deceptive accounts while evading platform safeguards. Tools including Kameleo, AdsPower, and MultiLogin facilitate account takeovers, financial fraud, and automated distribution of AI-generated content, supporting large-scale influence operations across social media platforms. Researchers observed affiliates of INC and The Gentlemen ransomware groups using AI agents to conduct human-approved cyberattacks. The operation targeted 62 organizations by exploiting remote-access systems and compromised credentials. Victims were concentrated in the manufacturing, energy, healthcare, and pharmaceutical sectors, primarily in the United States. Researchers analyzed a cybercriminal operation that used multiple AI assistants to plan and execute different types of malicious activity. The attacker relied on AI-generated scripts and reconnaissance reports to develop attack capabilities. Exposed operational records revealed how AI tools supported campaign planning, technical execution, and adaptation across different targets. VULNERABILITIES AND PATCHES Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 have been used in widespread exploitation attempts that could enable remote code execution. Attack traffic reportedly increased from thousands to millions of attempts following disclosure. As of October 23, approximately 97.5% of publicly visible PHP instances did not indicate patched versions. Check Point IPS provides protection against this threat (PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560(( Oracle has released its October 2026 Critical Patch Update, addressing 1,209 unique vulnerabilities through 1,295 security patches across 33 product families. The update includes 95 critical CVEs and affects widely deployed enterprise products, including Fusion Middleware, E-Business Suite, MySQL, and Java SE. GitLab has fixed CVE-2026-110264, a critical vulnerability with a CVSS score of 10.0 affecting Community and Enterprise Editions. The integer overflow flaw could allow unauthenticated attackers to execute arbitrary code remotely on affected servers. The vulnerability affects versions before 18.11.13 and several 19.x releases. A critical privilege-escalation vulnerability, CVE-2026-114625, affects on-premises Arista VeloCloud Orchestrator deployments. The flaw carries a CVSS score of 9.4 and allows authenticated users, including those with read-only access, to obtain operator-level permissions. Successful exploitation can expose restricted management functions, and the vulnerability has been exploited in attacks. THREAT INTELLIGENCE REPORTS Check Point Research has profiled Aokigahara, a newly identified infostealer targeting credentials and session data associated with AI applications, developer tools, and cloud platforms. Targeted applications include Claude, ChatGPT Desktop, Cursor, and GitHub Copilot. Stolen information may include authentication tokens, account credentials, and other sensitive application data. Researchers revealed that U.S. federal investigators suspect an executive at a ransomware negotiation company assisted the ShinyHunters extortion group in operating its victim disclosure website. The site reportedly listed nearly 100 organizations between May and October 2026. Researchers mapped Lazarus’s Operation FlashHole, a cyberespionage campaign targeting organizations in South Korea’s software, construction, and telecommunications equipment sectors. Attackers used tailored phishing messages and fraudulent portfolio websites to deliver malware. The campaign exploited trusted financial-security software to execute malicious components. Researchers have uncovered a large-scale campaign by threat actor k0t targeting Fortinet FortiGate, FortiWeb, and Palo Alto Networks GlobalProtect devices. Attackers exploited vulnerabilities and weak credentials to establish persistent access and steal information. The operation exposed more than 70,000 credentials and showed possible connections to ransomware groups. The post 26th October – Threat Intelligence Report appeared first on Check Point Research .

This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with. And that's not even the full story. A leaked key led to a software supply-chain

Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet. The post Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge appeared first on SecurityWeek .

Oracle heeft meerdere kwetsbaarheden verholpen in Oracle Java. In Oracle Java SE, JavaFX en GraalVM Enterprise Edition zijn diverse kwetsbaarheden aanwezig die door ongeauthenticeerde netwerkaanvallers kunnen worden misbruikt via blootgestelde API's of sandboxed Java-applicaties. Deze kwetsbaarheden maken het mogelijk om denial of service te veroorzaken, ongeautoriseerde lees- en schrijfacties op data uit te voeren, en in sommige gevallen beperkte data toegang te verkrijgen. Exploitatie kan plaatsvinden via netwerktoegang, soms met vereiste van gebruikersinteractie, en betreft meerdere componenten zoals de compiler, networking, JAXP, JDBC, RMI, ImageIO, Lightweight HTTP Server en CORBA. Daarnaast zijn er kwetsbaarheden die leiden tot crashes of het vastlopen van systemen bij het uitvoeren van onbetrouwbare code in sandboxed omgevingen.

Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information. The post Splunk, SolarWinds Release Fresh Security Updates appeared first on SecurityWeek .

Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks. The post Cisco Patches 34 Vulnerabilities Across Multiple Products appeared first on SecurityWeek .

Oracle heeft meerdere kwetsbaarheden verholpen in diverse producten, waaronder Oracle SOA Suite, Oracle WebLogic Server, Oracle Data Integrator, Oracle Identity Manager, Oracle Access Manager, Oracle WebCenter Content, Oracle Fusion Middleware (inclusief Helidon) en Oracle HTTP Server. De kwetsbaarheden betreffen onder andere onveilige deserialisatie, onvoldoende authenticatie- en toegangscontroles, kwetsbaarheden in netwerkprotocollen zoals HTTP, HTTP/2, SOAP, T3, IIOP en LDAP, en fouten in cryptografische bibliotheken zoals Bouncy Castle en Jackson-databind. Aanvallers kunnen hierdoor onder meer: Arbitrary code execution uitvoeren via crafted input of deserialisatieprocessen. Volledige systeemcompromittering bereiken via netwerktoegang zonder authenticatie. Ongeautoriseerde toegang verkrijgen tot gevoelige of kritieke data. Data manipuleren, creëren, verwijderen of wijzigen zonder juiste rechten. Denial-of-Service veroorzaken door resource-uitputting, crashes of hangs. Privilege escalation uitvoeren binnen het systeem. Cross-site scripting en spoofing aanvallen uitvoeren. Kwetsbaarheden in authenticatie- en autorisatiemechanismen misbruiken. De kwetsbaarheden zijn aanwezig in specifieke versies van de genoemde Oracle producten en sommige onderliggende open source componenten die Oracle gebruikt. Exploitatie kan plaatsvinden via netwerktoegang, vaak zonder authenticatie, en in sommige gevallen is gebruikersinteractie vereist. Diverse kwetsbaarheden hebben een CVSS score tot 10.0, wat duidt op een hoog potentieel impactniveau. Er is (nog) geen specifieke proof-of-concept-code (PoC) bekend, maar de aard van de kwetsbaarheden maakt exploitatie mogelijk via gerichte netwerkverzoeken of gemanipuleerde data en het NCSC verwacht, vanwege de wijde verspreiding van deze producten, op korte termijn een toename in scan- en misbruikverkeer.

Initial attempts were observed on October 17, and mass activity began shortly after patches were released. The post PHP2Shell Exploitation Started Days Before Patches appeared first on SecurityWeek .

Oracle heeft meerdere kwetsbaarheden verholpen in Oracle JD Edwards EnterpriseOne Tools, specifiek in versies 9.2.0.0 tot en met 9.2.26.5. De kwetsbaarheden in Oracle JD Edwards EnterpriseOne Tools stellen een aanvaller in staat om via verschillende netwerkprotocollen zoals HTTP, HTTPS, SMTP zonder authenticatie of met lage privileges toegang te verkrijgen tot het systeem. Hierdoor kan een aanvaller data creëren, wijzigen of verwijderen, en in sommige gevallen volledige controle over het systeem verkrijgen. Sommige kwetsbaarheden vereisen gebruikersinteractie, andere niet. De impact betreft de vertrouwelijkheid, integriteit en beschikbaarheid van het systeem en de data.

Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches. The post Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU appeared first on SecurityWeek .

Delinea gives AI assistants read-only access to governance data Delinea has announced Delinea Fastpath MCP Server, a new capability that connects access governance data to the AI assistants teams already use. Using the Model Context Protocol (MCP), finance, IT, audit, and compliance teams can ask natural-language questions and get fine-grained, cross-application answers on access risk, access reviews, and audit readiness, with remediation options in seconds. When complex ERP security models surface thousands of segregation of duties (SoD) conflicts, finance teams struggle to know where to start, slowing remediation and audit prep. Fastpath MCP Server lets teams query live Fastpath data in plain language, highlighting the most material risks to speed remediation and cut audit prep time. Because connecting to an AI assistant requires no data migration, teams get started quickly, and every answer reflects their environment right now, across every application they’ve integrated. “Our customers spend too much of their time turning access data into decisions,” said Jason Mitchell, EVP, Product & Technology at Delinea. “Fastpath MCP Server gives that time back. Finance teams and business application owners can ask a question in their own words and get a clear, prioritized answer they can act on, grounded in the same data their auditors already rely on.” Fastpath MCP Server brings this capability to all sides of the organization, delivering value across the following areas: Faster access analysis and audit prep. Instead of exporting and reconciling spreadsheets, teams move from SoD conflict to remediation plan faster. By asking “Are we ready for our audit?” teams can see which access reviews are open, which reviewers haven’t finished, and which SoD risks lack a mitigating control, across every connected system. Cross-application visibility. Teams can ask about users, roles, access risk, controls, and access reviews across 100+ connected cloud and on-premises applications at once, including Microsoft Dynamics 365, NetSuite, Oracle, SAP, Salesforce, and Workday. Fine-grained risk insight. More than thirty out-of-the-box native connections surface risk down to the lowest securable object, using SoD and sensitive access rulesets built by audit experts for each application’s security model and based on the COSO framework and ISACA remediation best practices. “Getting answers out of our access data used to mean building Excel lookups and stitching data points together by hand,” said Neil Poynton, Director of ERP at Chromalox. “With Fastpath MCP Server, we’ll be able to ask a question in plain language and pull together the information held in Delinea Fastpath in a fraction of the time. It’s an exciting addition to our solution.” Fastpath is independently audited under SOC 1 Type 2 and SOC 2 Type 2, and the world’s leading audit and consulting firms rely on its reports to test IT general controls and the access controls behind financial reporting. Every answer runs in that same audited environment and returns the same governed data, so it starts from the source auditors already test. The capability is read-only and bound to each user’s permissions, so a connected AI assistant cannot change anything in Fastpath.

IPAはOracle Javaの脆弱性について注意喚起した。修正された55件のうち49件は、認証を必要とせずネットワーク経由で悪用される可能性がある。被害は攻撃者によるPCの制御に及ぶ恐れもあるという。

The effort is aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure.

Oracle heeft 33 kwetsbaarheden verholpen in diverse Oracle Analytics-producten, waaronder Oracle Business Intelligence Enterprise Edition en Oracle BI Publisher. In de patchnote staan 33 kwetsbaarheden, waarvan 14 kwetsbaarheden op afstand kunnen worden misbruikt zonder dat authenticatie vereist is. Afhankelijk van de kwetsbaarheid, de getroffen productversie en de configuratie kan misbruik leiden tot ongeautoriseerde toegang tot gevoelige gegevens, het aanmaken, wijzigen of verwijderen van gegevens, verstoring van de dienstverlening of compromittering van de getroffen component. De hoogst gerapporteerde CVSS 3.1-basisscore voor Oracle Analytics bedraagt 9,1 op een schaal van 10.

Oracle heeft 110 kwetsbaarheden verholpen in diverse Oracle Communications-producten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications Service Catalog and Design en Oracle Communications Operations Monitor. De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle Communications-producten, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores variërend van laag tot kritiek, met een maximale score van 9,8. De update bevat in totaal 110 kwetsbaarheden voor Oracle Communications, waarvan 77 kwetsbaarheden op afstand zonder authenticatie kunnen worden misbruikt. Succesvol misbruik kan, afhankelijk van de specifieke kwetsbaarheid, leiden tot ongeautoriseerde toegang tot gevoelige informatie, het wijzigen van gegevens of het verstoren van de beschikbaarheid van getroffen systemen. Sommige kwetsbaarheden vereisen voorafgaande toegangsrechten of gebruikersinteractie, terwijl andere via netwerktoegang zonder authenticatie kunnen worden misbruikt.

Oracle heeft 194 kwetsbaarheden verholpen in Oracle E-Business Suite en gerelateerde componenten, specifiek voor versies 12.2.3 tot en met 12.2.15. Afhankelijk van de specifieke kwetsbaarheid kunnen deze door een aanvaller met netwerktoegang worden misbruikt om ongeautoriseerde toegang tot gegevens te verkrijgen of om gegevens aan te maken, in te zien, te wijzigen of te verwijderen. In ernstige gevallen kan misbruik leiden tot Remote Code Execution (RCE), waardoor een aanvaller willekeurige code kan uitvoeren op het getroffen systeem. Een deel van de kwetsbaarheden kan op afstand worden misbruikt zonder authenticatie. Voor andere kwetsbaarheden zijn geldige inloggegevens, specifieke toegangsrechten of gebruikersinteractie vereist. De impact en de voorwaarden voor misbruik verschillen per kwetsbaarheid en getroffen component. De CVSS 3.1-scores lopen op tot de maximale score van 10,0.

Oracle heeft kwetsbaarheden verholpen in diverse producten, waaronder Oracle MySQL Server, MySQL Cluster, MySQL Enterprise Backup, MySQL Connectors (waaronder Connector/ODBC) en MySQL Router. De kwetsbaarheden in Oracle MySQL betreffen diverse componenten, waaronder MySQL Server, MySQL Cluster, MySQL Enterprise Backup, MySQL Connectors en MySQL Router. De potentiële impact omvat ongeautoriseerde toegang tot of wijziging van gegevens en verstoring van de beschikbaarheid van systemen (denial-of-service). De Oracle Critical Patch Update van oktober 2026 bevat 98 nieuwe beveiligingspatches, waarvan 29 kwetsbaarheden op afstand kunnen worden misbruikt zonder authenticatie. De hoogste CVSS-score bedraagt 9,8. De ernst en impact verschillen per kwetsbaarheid en zijn afhankelijk van de getroffen component en configuratie.

Oracle heeft meerdere kwetsbaarheden verholpen in Oracle Enterprise Manager, waaronder de Base Platform, Data Guard Management, Siebel en Virtualization-componenten. De kwetsbaarheden betreffen versies 13.5 en 24.1. De kwetsbaarheden in Oracle Enterprise Manager kunnen leiden tot ongeautoriseerde toegang tot gevoelige gegevens, wijzigingen in data en aantasting van de beschikbaarheid en integriteit van systemen. Sommige kwetsbaarheden maken het mogelijk om willekeurige code uit te voeren. De kwetsbaarheden bevinden zich in verschillende componenten, waaronder Data Guard Management, Base Platform, Siebel en Virtualization. Twee kwetsbaarheden zijn op afstand te misbruiken zonder authenticatie. Voor andere kwetsbaarheden zijn lage gebruikersrechten of lokale toegang vereist.

Oracle heeft nieuwe kwetsbaarheden verholpen in Oracle PeopleSoft Enterprise. De kwetsbaarheden in Oracle PeopleSoft Enterprise betreffen verschillende beveiligingsrisico's, waaronder ongeautoriseerde toegang tot gegevens, ongeautoriseerde wijzigingen van gegevens en verstoring van de beschikbaarheid van systemen (denial-of-service, DoS). Afhankelijk van de specifieke kwetsbaarheid kan misbruik leiden tot aantasting van de vertrouwelijkheid, integriteit of beschikbaarheid van gegevens en systemen. Sommige kwetsbaarheden zijn via het netwerk exploiteerbaar en vereisen geen authenticatie, terwijl andere lokale toegang, authenticatie of aanvullende voorwaarden vereisen. De kwetsbaarheden treffen diverse componenten van Oracle PeopleTools en andere PeopleSoft Enterprise-modules. De ernst en potentiële impact verschillen per kwetsbaarheid; de daadwerkelijke gevolgen zijn afhankelijk van de getroffen component, de configuratie en de voorwaarden voor exploitatie.

Oracle ha rilasciato il Critical Patch Update di ottobre che mira a correggere numerose vulnerabilità su più prodotti, di cui 64 con gravità “critica” e 383 con gravità “alta”.

On the second day of Pwn2Own Ireland 2026, security researchers collected $232,500 in cash awards after exploiting 45 unique zero-day vulnerabilities. The day's highlight was the Samsung Galaxy S26 flagship getting hacked three times by KAIST Hacking Lab's Kyeongmin Kim, PetoWorks, and Mobile Hacking Lab's Dimitrios Valsamaras and Ken Gannon. Jack Dates of RET2 Systems demoed a Sonos Era 300 exploit chain in under a minute, and Out of Bounds team's HaeJung Yang was awarded $40,000 for hacking Dynamo in the AI Infrastructure category. PetoWorks, Yves Bieri of Xint, Kyeongmin Kim, _McCaulay, and Doyensec's Yassine Bengana and Maxence Schmitt also hacked the Home Assistant Green smart home hub, while Ikotas Labs breached the Oracle Autonomous AI Database using a seven-chain zero-day exploit. Before day two began, Kyeongmin Kim withdrew his attempt at a USB-based attack targeting the Google Pixel 10. Trend Micro's Zero Day Initiative (ZDI) organizes the competition to identify zero-day flaws in fully patched devices before attackers exploit them in the wild. According to Pwn2Own rules, all devices run the latest firmware versions, and contestants must compromise the target and demonstrate arbitrary code execution. After zero-days are exploited and disclosed at Pwn2Own, vendors have 90 days to patch their software before ZDI publicly discloses them. Throughout the Pwn2Own Ireland 2026 contest, competitors target products in seven categories, including mobile phones (Samsung Galaxy S26 and Google Pixel 10), messaging apps, smart home devices, printers, AI infrastructure, AI coding apps, and a new category where hackers will try to exploit wellness healthcare devices. While Apple's iPhone 17 was also a potential target with a maximum award of $300,000 for a remote hack, no contestant registered for an attempt. Interrupt Labs, Ikotas Labs, and Nguyen Thanh Dat of Viettel Cyber Security also hacked Samsung's Galaxy S26 flagship on day one, but some of the bugs exploited were already known to the vendor. Vũ Chí Thành and Huỳnh Đức Tin of VinSOC, who topped the leaderboard on the first day, won $40,000 for a five-zero-day exploit chain targeting the Oracle Autonomous AI Database, plus an additional $40,000 for chaining seven zero-daysto exploit a Philips Hue Bridge Pro smart lighting hub. On the third day, security researchers will attempt to hack multiple smart home, AI infrastructure, and printer devices, as well as the Samsung Galaxy S26 and Google Pixel 10 smartphones again. During the Pwn2Own Ireland 2025 competition, hackers demoed 73 zero-day flaws to earn $1,024,750. Summoning Team won the contest and collected $187,500 after hacking the Samsung Galaxy S25, the Home Assistant Green, the QNAP TS-453E NAS, and multiple Synology devices. Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat

A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle “ Rey ,” was detained as ShinyHunters was in the process of extorting a business unit recently divested by the global aerospace company Boeing , which manufactures the fleet of planes used by the employer of Rey’s father — Royal Jordanian Airlines . The logo for Jeppesen ForeFlight, a business unit divested last year by the aerospace firm Boeing. On October 3, Reuters cited three unnamed sources saying a suspected ShinyHunters member in Amman named Saif Al-din Khader was detained by Jordanian authorities and was cooperating with the FBI. KrebsOnSecurity identified Rey as Khader in a November 2025 profile , in which the young man admitted working with multiple ransomware groups. Rey was featured again in a September 28 exclusive about the Dutch police arresting 24-year-old convicted cybercriminal Pepijn van der Stap on suspicion of aiding in data thefts and extortions by ShinyHunters. The story noted that immediately following the Dutchman’s arrest on the evening of September 15, Rey assumed control over the ShinyHunters brand and boasted publicly about stealing highly sensitive data from the FBI and extorting the ransomware group Cl0p . Rey taunted both the FBI and Cl0p with memes posted to his longtime account on Twitter/X, while simultaneously including images of the avatar used by Van Der Stap’s former hacker alias “ Umbreon ” in an apparent attempt to frame the Dutchman for both hacks. A taunting meme uploaded to Twitter/X by Rey on Sept. 22. A giant sized version of the Pokemon character Umbreon can be seen in the bottom left. As noted in our September 28 report, ShinyHunters gained access to the FBI site and other victims by exploiting a vulnerability (CVE-2026-35273) in PeopleSoft , a software-as-a-service platform from the tech giant Oracle that is broadly used by companies to manage hiring and human resources, benefits and payroll. Oracle quickly issued a fix for CVE-2026-35273, which ShinyHunters first began exploiting as a zero-day in June, and at the time Mandiant released web application firewall rules intended for organizations that couldn’t apply the security update quickly enough. ShinyHunters told BleepingComputer in June that the original goal behind exploiting the PeopleSoft vulnerability was to breach the FBI’s own PeopleSoft database, but the hackers said those attacks were unsuccessful for some reason. In recent weeks, however, ShinyHunters turned to a well-known URL-encoding trick to bypass Mandiant’s suggested web application firewall rules. In a report released Sept. 25, security experts at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had mass-exploited the PeopleSoft vulnerability to steal data from dozens of systems across a range of industries, including higher education, technology, healthcare, agriculture, transportation and government. Reuters reported October 5 that the FBI has removed a contractor at Accenture over their failure to patch the FBI recruitment website hacked by ShinyHunters, which exposed sensitive data on more than 5,000 FBI personnel, including each’s person’s unit and specialization, as well as medical and psychiatric records. ‘REY’ MEANS KING, AS IN ROYAL According to two sources familiar with the ShinyHunters investigation, a navigation and digital aviation unit recently divested by the global aerospace company Boeing was among the victims that ShinyHunters was in the process of extorting when Rey was apprehended by Jordanian authorities. Those sources said the FBI’s investigation into ShinyHunters gained renewed urgency with the group’s attempted extortion of the former Boeing unit, which allegedly included the theft of sensitive information that sources said could pose operational safety and security risks. In a brief statement shared with KrebsOnSecurity, Boeing acknowledged the extortion attempts by ShinyHunters, and said the incident concerned data stolen from Jeppesen ForeFlight , a subsidiary that Boeing sold in November 2025 to the private equity firm Thoma Bravo for $10.55 billion. “We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight,” a Boeing spokesperson shared. “We are actively reviewing the matter with the Jeppesen ForeFlight team.” A spokesperson for Jeppesen ForeFlight shared a written statement in response to questions, saying the company has seen no impact on their end. “Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products.” Rey’s alleged involvement in attempting to extort the former Boeing unit is noteworthy because there is strong evidence that his father works for Royal Jordanian Airlines , which is mostly controlled by the Jordanian government and operates its long-haul fleet on passenger planes built by Boeing. Rey claimed on Telegram in early 2025 that his father was an airline pilot, although that could not be independently confirmed. However, as noted in our November 2025 profile of Rey , his family’s shared computer was at one point compromised by password-stealing malware, and the data collected by that malware clearly shows Rey’s father used the same credentials to log in at multiple online portals for Royal Jordanian Airlines employees. Royal Jordanian Airlines has not yet responded to a request for comment. In advance of our September 28 story, KrebsOnSecurity once again emailed Rey’s father to seek comment and update him on his son’s alleged activities. Neither of the Khaders have responded. But just hours after that request was sent, Rey began deleting his various social media accounts, including the Twitter/X account he previously used to taunt the FBI, Cl0p, and other ShinyHunters victims. Rey may have nixed many of his social media profiles, but his cybersecurity blog on GitHub somehow escaped the purge, and it shows that Rey was fixated on the leaders of the Cl0p ransomware group. In March 2026, Rey’s blog featured a lengthy post that identified two Russian men as the core developers and hackers behind Cl0p. Rey’s blog on GitHub. This post doxes two Russian men as the core operators behind Cl0p, one of the oldest and most established ransomware groups still in operation today. MURDER FOR HIRE? Meanwhile, news outlets in the Netherlands reported explosive new allegations leveled at Van der Stap, whose supposed personal transformation from convicted to reformed hacker has been widely covered in the tech news media. The Dutch daily RTL reported on Sept. 29 that investigators suspect Van der Stap tried to orchestrate at least two murders. According to RTL, the murders were allegedly to be committed abroad, and there are indications Van der Stap gave the order for these attacks. Van der Stap was released from prison after serving the better part of a four year sentence for data theft and extortion activity that prosecutors said netted between €1.5 million and €2.7 million. In an interview with KrebsOnSecurity on September 9, Van der Stap described his new role as “offensive security lead” at the Dutch cybersecurity company Neo Security , saying the job involved probing client networks for security vulnerabilities. Neo Security’s owner Benjamin Korper told Reuters he has hired an outside firm to investigate whether Van der Stap had hacked Neo Security or its customers, but that so far investigators have found no evidence he acted against his employer or clients. Korper said Dutch forensic investigators visited his office on September 15, the night Van der ⁠Stap was arrested in a dramatic police raid that reportedly involved flash bang grenades . A screenshot of a Sept 16 story by the Dutch news outlet at5.nl, describing a police raid on Van Der Stap’s residence that reportedly used flash-bang grenades. Prior to his first arrest in 2023, Van der Stap was working as a software engineer at the Amsterdam-based cybersecurity startup Hadrian, while volunteering at the Dutch Institute for Vulnerability Disclosure (DIVD) — even as he was hacking into and extorting a number of large organizations. When asked in a recent interview why anyone should believe the word of a self-described “reformed” cybercriminal who had so casually deceived countless friends, co-workers and journalists for years, Van der Stap replied that his work spoke for itself and there was nothing he could say that would convince his worst critics. “You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced,” Van der Stap told KrebsOnSecurity on Sept. 9. “I’m doing what I can to repay victims, and that’s all I can do. If someone doesn’t want to believe me, then that’s on them.” FRANCHISING AND BURNING A BRAND Cybercriminals aligned with ShinyHunters have been responsible for dozens of data breaches involving billions of stolen records, and breaches claimed by the group stretch back to at least 2019. But experts say the people recently operating behind the ShinyHunters name are not the same core members that populated the group in its early days, most of whom are French citizens who have been arrested (if not also imprisoned) on at least one prior occasion for alleged cybercrime activity. More to the point, ShinyHunters has become something of a franchise. Think the Dread Pirate Roberts character in the 1980s cult movie classic “The Princess Bride,” only succession by death is replaced with succession by arrest, and there can be multiple simultaneous Dread Pirate Robertses. Sources close to the investigation say the FBI is focusing on a remaining handful of cybercriminal freelancers or affiliates who have been feeding the group stolen credentials to various software-as-a-service (SaaS) platforms used by major companies in exchange for a cut of any data ransoms later paid by victims. In the days after the news broke of Van der Stap’s arrest, a cybercrime-focused chat server on Telegram that was allegedly operated by Rey erupted with hot takes, with most participants heaping ridicule on the teenage hacker after he publicly backed down from threats against the FBI and Cl0p, and again when the ShinyHunters’s darknet website suddenly went offline . Several commentators accused Rey of resurrecting the ShinyHunters brand after its core members were rounded up in France, and making a mockery of the group’s name and reputation ever since. “He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data or resell his forum when he goes broke,” one member recounted. A relatively new Telegram channel called “The Battle” has been doxing and needling Rey and other alleged ShinyHunters members for several weeks, and it has gained a considerable readership among the cybercrime communities operating on Telegram. One of the coordinators of that harassment campaign repeatedly portrayed Rey as clueless greenhorn who sought to ride the coattails of a cybercriminal brand that has long enjoyed a reputation for ruthlessly selling or publishing data stolen from victim companies who refuse to give in to extortion demands. “Rey (Saif Al-Din Khader) made a serious mistake when he started pretending to be a member of ShinyHunters,” wrote the administrators of The Battle server on Telegram. “That group had already been dismantled, with many of its members either arrested or imprisoned, yet Rey still chose to use its name while carrying out his crimes. We’re aware of claims that [Rey] caused over $200 million in damages and helped around 5–6 friend groups in the community make money by using Shiny Hunters group aliases to negotiate deals for a 25–30% cut over the past few months.” In an interview with The Register , ShinyHunters claimed they hacked the FBI to counter the agency’s narrative in a May 2026 alert that advised victims against paying a ransom to the group, which came off looking unprofessional and capricious in the FBI’s advisory. A flash notice on ShinyHunters released by the FBI on May 15, 2026. The public notice warned the group has been known to pursue a number of different victim harassment strategies , from sending threatening text messages and phone calls to victims and their family members to in some cases swatting victims. The FBI warned ShinyHunters members “may also falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist.” The hackers told The Register their attack on the FBI “demonstrated our technical capabilities and directly refuted the misinformation disseminated by the FBI, journalists, and industry researchers.” At the same time, the group’s leaders seemed to acknowledge that the FBI’s warning materially harmed their prospects for convincing victims to pay, saying “this was fundamentally a public relations and marketing initiative for our business.”