Skip to content

Home/Digest/Past issues

Weekly digest,

This week: Vulnerability in OpenEMR Enables Remote Code Execution (+9 more)

Vulnerabilities

Vulnerability in OpenEMR Enables Remote Code Execution

A vulnerability (CVE-2026-124450) has been identified in OpenEMR versions prior to 8.3.0, specifically within the fax/sms module. The flaw involves broken access control and path traversal through an unvalidated file_path parameter. This allows authenticated low-privilege users to read sensitive files, such as sqlconf.php, which contains database credentials. Consequently, attackers can write arbitrary files as the web user, leading to potential remote code execution. The CVE was published on November 8, 2026, with a CVSS score of 9.3, indicating a severity level. Users of OpenEMR are urged to update to version 8.3.0 or later to mitigate this risk. There is currently no indication of in the wild.

Vulnerability · 2 sources · score 78 · CVE-2026-124450, Broken Access Control, Path Traversal

Critical Integer Overflow Vulnerability in imgproxy (CVE-2026-123614)

imgproxy versions 4.0.0 through 4.0.15 are affected by an integer overflow vulnerability in the ICO loader, which can lead to a heap buffer overflow. This flaw allows unauthenticated remote attackers to upload a crafted ICO image, potentially crashing the imgproxy process or executing arbitrary code with the application's privileges. A patch has been released in version 4.0.16, and users are urged to upgrade immediately. Currently, there is no evidence of public proof-of-concept or confirmed exploitation in the wild. The CVSS score for this vulnerability is 9.8, indicating a critical severity level. Network-level controls are recommended to restrict ICO image uploads to trusted sources.

Vulnerability · 2 sources · score 70 · CVE-2026-123614

Ransomware

Ransomware Attack Targets Grupa ABS in Poland

On November 9, 2026, Grupa ABS, a Poland-based environmental services company, was reportedly targeted by the PANZER ransomware group. The attack allegedly resulted in the encryption of 895,002 files and the theft of approximately 30 GB of data. The company's domains were reported down, indicating a significant operational impact. However, no specific details about the nature or sensitivity of the stolen data were provided. The articles caution that claims regarding the attack remain unverified and should be treated as unconfirmed until further evidence is available. No ransom amount or financial demands have been disclosed. The incident highlights ongoing concerns regarding ransomware threats to businesses, particularly in the environmental sector.

Ransomware · 2 sources · score 51 · Panzer

Breaches

Large Data Breaches Hit Retail and Corporate Sectors in Japan and Korea

In recent months, the retail sector in Korea has faced a series of personal data breaches, with over 3 million records compromised. SSG.com reported a breach on November 4, 2026, due to an API vulnerability, affecting customer names and IDs. Other companies like Gmarket and Halys have also reported similar incidents, with a total of approximately 3.83 million records leaked. Meanwhile, in Japan, around 260 million personal information records have been exposed since April 2026, with a significant surge in breaches reported in October. The Personal Information Protection Commission noted 2,094 incidents, with many attributed to AI-assisted hacking. The situation highlights vulnerabilities in both internal systems and third-party services, leading to increased security investments by affected companies.

Breach · 2 sources · score 70

Arcadia Disaster Alert System Hacked for Phishing Attack

On October 11, 2026, hackers breached Arcadia's disaster alert service, which is used by 875 public organizations in Japan. They exploited a directory path traversal vulnerability to gain access and sent 1.42 million phishing emails within hours. The attack may have exposed approximately 3.13 million email addresses, including sensitive data from emergency services. Arcadia's president noted the attack's scale suggested possible AI involvement. The Osaka police are investigating the breach, which has disrupted disaster alert services. The incident has raised concerns about public trust in emergency communication systems.

Vulnerability · 2 sources · score 64 · Path Traversal

York University Reports Data Theft in Cybersecurity Incident

York University announced a cybersecurity incident involving unauthorized access to personal data from online forms, discovered on October 25, 2026. The breach affected information submitted between 2007 and October 2026, including student identification numbers, academic histories, and financial details. The university is notifying directly affected individuals and has begun an investigation with external experts. No evidence has been found indicating that the unauthorized actor accessed other systems beyond the affected websites. York University is offering two years of free credit monitoring and identity theft protection to those impacted. The incident has been reported to law enforcement and the Information and Privacy Commissioner of Ontario. The university urges affected individuals to monitor their financial accounts for suspicious activity.

Breach · 2 sources · score 56

Iris Ohyama Data Breach Affects 7.7 Million Customers

Iris Ohyama disclosed a data breach involving its Iris Plaza online shopping platform, potentially exposing personal information of 7.7 million individuals. The breach was linked to unauthorized access to a third-party cloud service, discovered on October 28, 2026. Affected individuals include approximately 5.8 million registered members and 1.9 million non-members. The compromised data may include names, addresses, phone numbers, email addresses, gender, dates of birth, and encrypted passwords, while credit card information was not stored in the affected service. The company suspended the Iris Plaza site and related systems immediately after the breach was detected and reported the incident to Japan's Personal Information Protection Commission and local police on October 29. As of November 5, there have been no reports of misuse or financial loss related to the exposed information. The investigation is ongoing, and the company has not yet identified the attacker or the method of access.

Breach · 3 sources · score 52

Threat actors and malware

Viral ChatGPT Prompt Poses Phishing Risk for Crypto Users

On November 7, 2026, a viral prompt on social media urged users to ask ChatGPT to fill an empty room with personal data it knows about them. This prompt reveals stored user data, which can be exploited by attackers for phishing campaigns targeting cryptocurrency holders. The risk arises as users share the generated images publicly, potentially exposing sensitive information such as wallet details and trading habits. OpenAI has not issued a formal security bulletin regarding this specific prompt, and the full extent of the exposed data remains unclear. Attackers can leverage this information for credential-stuffing and wallet-drain attacks if they gain access to a user's ChatGPT session. The prompt does not exploit OpenAI's servers but reveals data retained in the model's memory. As the trend spreads, variations of the prompt have emerged, increasing the potential for misuse. Users are advised to review their memory settings before sharing any generated content.

Phishing · 3 sources · score 52

Cyber Resilience Critical for Fintech Amid Rising Threats

In November 2026, cybersecurity experts emphasize the need for fintech companies to embed cyber resilience into their operations as cyber attacks remain the top risk for businesses in Ireland since 2021. Leann Moroney from Aon Ireland highlights that as fintechs innovate and expand, they face increased vulnerabilities, necessitating robust risk management strategies. The interconnected nature of digital services means that a single cyber incident can lead to business interruptions, regulatory issues, and reputational damage. Regulations like DORA and NIS2 are pushing firms to enhance their cybersecurity measures. The articles also reference Singapore's Cybersecurity (Amendment) Act, which mandates stricter oversight of digital infrastructure and incident reporting. This regulatory framework is crucial as cyber threats evolve, with advanced persistent threats targeting critical infrastructure. The articles underscore that traditional security measures are insufficient against sophisticated attacks, urging organizations to adopt proactive governance and automated security controls.

APT · 2 sources · score 52 · UNC3886, Operation Cyber Guardian

Also worth knowing

AI-Driven Phishing Campaigns Present New Security Challenges

Recent advancements in artificial intelligence have significantly enhanced the effectiveness of phishing attacks. Cybercriminals are now using AI tools to craft highly convincing phishing emails that mimic the tone and style of legitimate communications, making detection difficult. A study presented at Black Hat and DEF CON demonstrated that AI-generated phishing emails outperformed those written by human experts, achieving a higher click-through rate. This evolution in phishing tactics poses a serious risk to organizations, as AI allows for rapid customization and automation of attacks, targeting specific job roles or industries. A Gartner survey indicated that 79% of security leaders reported phishing incidents in the past year, with a notable rise in deepfake usage during attacks. Traditional static security awareness training is becoming ineffective against these sophisticated methods, necessitating a shift towards more adaptive training programs. Organizations must reassess their cybersecurity strategies to address these emerging threats effectively.

Disinfo & Influence · 2 sources · score 62

New on leak sites

283 victims listed on ransomware leak sites by 46 groups in the 7 days before this issue. The most active:

Get the next one by email

The digest is free and arrives once a week. One click to leave.

Subscribe to the digest

A free account turns the digest into a personal watchlist: choose what you want to follow.