Daily digest,
Two Turkish Nationals Arrested Over Russian Sabotage of Starlink… (+4 more)
Vulnerabilities
Google's $90k RCE Vulnerability Exposed in Developer Documentation
A remote code execution (RCE) vulnerability was discovered in Google's DevSite infrastructure, which affected seven domains including developers.google.com and firebase.google.com. The flaw stemmed from a reused OAuth client secret stored in a Flask session cookie, allowing attackers to forge valid cookies and execute arbitrary Python code on the server. The vulnerability was rated S0, the highest severity level, and the finder, Simon Köck, was awarded a $90,000 bounty for the report. Google took two months to patch the vulnerability, which involved rotating secrets and improving session key management. Concerns remain regarding potential access to internal services and the possibility of supply-chain attacks, although Köck did not test for write access to content systems. The vulnerability highlights risks associated with using insecure serialization methods like pickle in web applications.
Supply Chain · 2 sources · score 57
Ransomware
Luna Moth Ransomware Group's Operations Exposed in Leaked Files
Leaked documents from the Luna Moth ransomware group, also known as Silent Ransom Group, reveal their structured approach to cyber extortion. The files, released on an anonymous onion site, detail how attackers manipulate victims into providing remote access to their systems. Researchers from Check Point analyzed these documents, which include scripts for social engineering tactics and coordination between attackers. The group operates by posing as IT support to gain trust and access to networks. Despite the group's denial of any breach, the leaks indicate a sophisticated operation targeting individuals and organizations for financial gain. The incident highlights the need for organizations to implement stronger defenses against social engineering attacks.
Ransomware · 2 sources · score 51 · Chatty Spider UNC3753, Luna Moth, SIG, Silent Ransom Group
Breaches
Personal AI Agents Compromise Corporate Security
Personal AI agents are increasingly being integrated into corporate systems through employee-approved OAuth grants, saved passwords, and long-lived API keys. This integration poses significant security risks as these agents can operate under the employee's identity without proper oversight. Major companies like Amazon and Meta are involved in this landscape, with Amazon blocking Meta's Muse for not identifying itself as a bot. The Bring-Your-Own-Agent (BYOA) trend raises concerns about unauthorized access and identity management. Organizations are advised to identify each agent, limit its access, and have the ability to revoke permissions independently. The current status indicates that these agents are already present in many corporate environments, often without IT knowledge or approval.
Breach · 2 sources · score 51
Also worth knowing
Two Turkish Nationals Arrested Over Russian Sabotage of Starlink Station in Poland
Two Turkish citizens were detained in Germany for allegedly setting fire to a Starlink station in Poland, an act attributed to Russian intelligence aimed at disrupting internet services for Ukraine's military. The fire occurred in Masovia and targeted the station's power system and backup generator. Polish officials stated that the incident is part of a broader Russian campaign of sabotage and hybrid attacks against Ukraine. The Polish Interior Minister confirmed that the suspects would face charges of sabotage on behalf of a foreign intelligence agency. This incident follows a series of similar attacks that EU officials believe are orchestrated by Russian services to undermine support for Ukraine. The Russian embassy in Warsaw has dismissed these accusations as unfounded.
Other Threats · 2 sources · score 63
UK Maritime Sector Warned of GPS Reliance Risks Amid Rising GNSS Interference
The UK Maritime and Coastguard Agency (MCA) issued Marine Guidance Note 719 on 1 October 2026, urging maritime stakeholders to prepare for potential disruptions to GPS due to increasing GNSS interference, particularly in the Baltic, Black Sea, Middle East Gulf, and parts of East Asia. The guidance highlights risks of jamming and spoofing, which can compromise critical systems like ECDIS, AIS, and GMDSS. Recent data indicates an average of 5,131 GPS jamming incidents daily, affecting over 124,000 vessels. A seven-day GNSS outage could cost the UK maritime economy £1.5 billion, with significant impacts on port operations. The MCA recommends crews practice navigation without GPS and develop contingency plans. The UK government is working on an Enhanced Long-Range (eLoran) program to provide a terrestrial backup, with initial capabilities expected by 2028 and full operational capability by 2030.
Other Threats · 2 sources · score 62
New on leak sites
72 victims listed on ransomware leak sites by 14 groups in the 24 hours before this issue. The most active:
Also moving
- Ransomware groups: Qilin, Beast, Chatty Spider UNC3753
- Malware: Cobalt Strike, AvisLoader
- CVEs: CVE-2025-41450, CVE-2025-41451, CVE-2025-41452, CVE-2026-0257, CVE-2015-3306
- Vulnerabilities: Code-of-the-Day, Code-of-the-Day Vulnerability, Crime
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.