International Cyber Digest

Independent reporting on cybersecurity, tech, AI & digital policy.

[International Cyber Digest @IntCyberDigest]

The bug is like a joke.

On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀

[International Cyber Digest @IntCyberDigest]

‼️ BREAKING: OpenSSH has rushed out a fix for a critical flaw that lets attackers log into some Linux servers without the right password.

The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours.

It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY".

Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.

[International Cyber Digest @IntCyberDigest]

Source: https://t.co/947lh3ZUqA

Don't miss out on any news, join our newsletter: https://t.co/gOdCLGiqtO

Be sure to join our TG channel: https://t.co/IkIOSHcSUP

[International Cyber Digest @IntCyberDigest]

‼️ German police are hunting a suspect in the drone bomb attack on Leipzig airport with an AI-generated image of a hooded person on an e-bike.

Germany's federal crime agency, the BKA, says the person was around the suspected launch site in the days before the 4 August attack, dressed unusually warmly for midsummer. Posters and billboards with the image now hang in nearby towns.

The drone was found next to Ukrainian Antonov cargo planes. Its bomb apparently failed only because the detonator had torn off.

Germany officially blames Russia. Prosecutors already have two named suspects.

[International Cyber Digest @IntCyberDigest]

Source: https://t.co/MuMdydzFsD

Don't miss out on any news, join our newsletter: https://t.co/gOdCLGhSEg

Be sure to join our TG channel: https://t.co/IkIOSHcl5h

[International Cyber Digest @IntCyberDigest]

‼️ Hackers have knocked Russia's official economic data off schedule. Bloomberg says major releases from statistics agency Rosstat are delayed to at least 13 November.

A week after Belarusian hacktivists claimed the attack, parts of Rosstat's systems are still cut off.

The agency has moved filing deadlines for 12 reporting forms and given no date for full recovery.

[International Cyber Digest @IntCyberDigest]

Symantec says few ransomware operators build their own backdoors, and this one, which it calls Lindnor, also turned up at two other organisations where no ransomware was found.

Source: https://t.co/BrWzl9POji

Don't miss out on any news, join our newsletter: https://t.co/wCLSRPDvs1

Be sure to join our TG channel: https://t.co/tXwFKv6wzn

[International Cyber Digest @IntCyberDigest]

‼️ Ransomware hackers threw a new custom backdoor and at least 13 security-killing tools at one US organisation in about an hour.

Then they set AnyDesk to run in Safe Mode, where most security tools don't fully work.

Two of those tools were disguised as Symantec's own software.

Symantec says the attackers also dropped five signed but vulnerable drivers, to switch off security software.

[International Cyber Digest @IntCyberDigest]

Gitleaks and TruffleHog, two widely used secret scanners, missed 215 of the 1,122 files, because passwords typed into commands carry no recognisable prefix, researchers say.

Source: https://t.co/fSqB8AZ3Lk

Don't miss out on any news, join our newsletter: https://t.co/wCLSRPDvs1

Be sure to join our TG channel: https://t.co/tXwFKv6wzn

[International Cyber Digest @IntCyberDigest]

‼️ Click "don't ask again" in Claude Code and it can save the approved command, password included, in plain text in a project file.

Researchers found 1,122 public copies of that file on GitHub holding secrets, including 379 database passwords and 23 AWS keys.

Of 16 coding agents compared, only Claude Code saves the full command this way by default. Bug reports about it were closed as "not planned" by a bot.

[International Cyber Digest @IntCyberDigest]

Source: https://t.co/mmUPqOlYwZ

Don't miss out on any news, join our newsletter: https://t.co/gOdCLGhSEg

Be sure to join our TG channel: https://t.co/IkIOSHcl5h

[International Cyber Digest @IntCyberDigest]

‼️ South Korean crypto exchange GOPAX halted all trading and withdrawals after an email threatened to hack it.

It cancelled every open order and is moving all its crypto offline. No hack or losses are confirmed.

Users can only withdraw by emailing support. No date to reopen yet.

[International Cyber Digest @IntCyberDigest]

Source: https://t.co/uTO3vsGE6T

Don't miss out on any news, join our newsletter: https://t.co/gOdCLGiqtO

Be sure to join our TG channel: https://t.co/IkIOSHcSUP

[International Cyber Digest @IntCyberDigest]

‼️ Hackers are breaking into the Nintendo Switch 2 with a Civilization VII cartridge. Its publisher 2K is reportedly recaling the physical copies.

The original Switch cart has an unpatched flaw. CivSwitch, a tool by modder Gezine, uses it to run code fed in from a phone over USB.

That opens the Switch 2 to saves, mods and homebrew apps. It can't run pirated Switch 2 games, for now.

One buyer says Amazon cancelled their order over a 2K mandate and "technical and security-related requirements." 2K hasn't commented.

Some buyers say they were offered the code-in-box edition instead. The exploit doesn't work on it.

[International Cyber Digest @IntCyberDigest]

Source: https://t.co/jJwjTsINJy

Don't miss out on any news, join our newsletter: https://t.co/gOdCLGiqtO

Be sure to join our TG channel: https://t.co/IkIOSHcSUP

[International Cyber Digest @IntCyberDigest]

❗ Someone built a script that emails Sam Altman to let him know when their RAM sits idle.

Sam Altman said the RAM belongs in datacenters, that the RAM in people's PCs is used "maybe 5% of the time", and called it "quite terrible".

Ram-Altman logs a Linux PC's memory every five minutes and, once a day, reports in if more than 10% of it is unused.

[International Cyber Digest @IntCyberDigest]

@elonmusk The Model Y is a good car and the only self-driving SUV in Europe and most of the world. A tip to improve it: they should use the improved suspension with electronically controlled damping modes from the Performance and Y L on the entire premium lineup.

[International Cyber Digest @IntCyberDigest]

Source: https://t.co/u2aTcSE1S1

Don't miss out on any news, join our newsletter: https://t.co/gOdCLGiqtO

Be sure to join our TG channel: https://t.co/IkIOSHcSUP

[International Cyber Digest @IntCyberDigest]

‼️ The AI hacking agent China-linked hackers attacked 2,250 Microsoft 365 tenants with last month is now aimed at banks.

Microsoft says a Cambodia-based crime group has used ARTEX since October against financial firms in Southeast Asia and some big global banks.

Its agents exploit web-app flaws such as open file uploads at machine speed, plant web shells and drop remote-access malware.

[International Cyber Digest @IntCyberDigest]

The plaintiffs' amended complaint is due 2 December. If they don't amend, Anthropic must answer by 16 December.

Source: https://t.co/TKook4F77R

Don't miss out on any news, join our newsletter: https://t.co/gOdCLGhSEg

Be sure to join our TG channel: https://t.co/IkIOSHcl5h

[International Cyber Digest @IntCyberDigest]

‼️ A US judge says Anthropic must face claims that it misleadingly advertised its $ 200-a-month Claude Max plan as "20x more usage than Pro" when it delivers about 6x a week.

The multiplier applies per five-hour session, but weekly caps don't scale with it. A Max subscriber can run out for the week before a Pro user does, the order notes.

By the plaintiffs' maths on Sonnet 4, the $100 Max 5x plan gets 3.5x Pro's weekly usage.

Judge Alex Tse found the ads plausibly misleading. The "per session" fine print sat two hyperlinks away from the sales pages.

[International Cyber Digest @IntCyberDigest]

@nikitabier Xi approves.