The backdoor was discovered in a modified ARTEX Docker image distributed through Docker Hub. According to independent researcher Badbyte, the malicious code was inserted into the application’s login handler, allowing attackers to execute operating system commands without valid credentials.

Hidden Backdoor in the Login Handler

The compromised image, identified as tomicdd/artex, contains a hidden verifyCaptcha() function.

When a specially crafted value is supplied through the CAPTCHA field, the function executes the remaining input using sh -c with root privileges. This happens before the application performs its normal credential verification.

As a result, an attacker who can reach the exposed login interface can execute commands on the affected system without authenticating.

The modified Docker image reportedly received approximately 9,000 downloads, increasing the potential exposure of organizations that deployed it.

62 Internet-Facing Consoles Identified

Researchers identified 62 ARTEX consoles running the backdoored build between November 2 and 4, 2026.

The exposed instances were distributed across multiple regions:

• United States: 26 instances
• Hong Kong: 17 instances
• China: 7 instances

Separately, researchers identified 1,645 hosts serving ARTEX consoles as of November 4. This broader figure does not mean all those systems were running the compromised image.

Multiple Copies Found Across GitHub and Docker Hub

The investigation also identified several copied ARTEX repositories and Docker images distributed through different accounts.

Some of these copies were found to reference the compromised image, while others require separate verification. The incident demonstrates how modified software repositories and untrusted container images can introduce hidden backdoors into legitimate security tools.

Security Recommendations

Organizations that have deployed ARTEX should:

• Check Docker configurations and running containers for affected images.
• Identify and remove compromised containers and images.
• Rebuild deployments using verified and trusted sources.
• Rotate credentials, API keys and secrets accessible to affected systems.
• Review server logs for suspicious login requests and unexpected root-level command execution.
• Restrict access to security testing consoles and avoid exposing administrative interfaces publicly.

The incident highlights the risks of deploying unverified Docker images, particularly security tools that operate with elevated privileges or have access to sensitive credentials and network environments.

The post Backdoored ARTEX Docker Image Exposes Servers to Unauthenticated Root Access appeared first on First Hackers News.

Researchers at Binarly discovered that the exploit remains effective even on devices running an earlier security update released by Zyxel. The vulnerability, tracked as CVE-2026-107441, has a CVSS severity score of 8.8 according to the vendor.

Earlier Security Patch Failed to Block the Exploit

Zyxel released firmware version 2.90 Patch 2 in June 2026 to address an earlier vulnerability, CVE-2026-7273.

However, Binarly researchers found that the previous patch did not adequately validate HTTP request parameter sizes. Attackers could exploit this weakness to overwrite memory and manipulate program execution, allowing malicious commands to run without authentication.

The researchers reported the issue to Zyxel on September 29. The vendor classified it as a separate vulnerability.

Nearly 1,000 Switches Compromised

According to GreyNoise, attackers compromised 996 Zyxel GS1900 switches across multiple countries during an attack campaign beginning around August 17.

The attackers deployed a data-collection script to gather:

• Switch configuration files
• Hashed root credentials
• Network information

GreyNoise also reported that 564 of the compromised switches were still using factory-default credentials.

The activity has been associated with a threat group tracked as Red Heron, although the precise attribution remains uncertain.

Zyxel Releases Patch 3 Firmware

Zyxel has released 2.90 Patch 3 firmware for ten affected GS1900 models to address CVE-2026-107441.

The affected models include:

• GS1900-8
• GS1900-8HP
• GS1900-10HP
• GS1900-16
• GS1900-24
• GS1900-24E
• GS1900-24EP
• GS1900-24HPv2
• GS1900-48
• GS1900-48HPv2

Administrators should install the corresponding Patch 3 firmware for their specific switch model. Devices running Patch 2 or earlier versions remain vulnerable.

The post Zyxel GS1900 Zero-Day Bypasses Earlier Security Patch, Enabling Root Command Execution appeared first on First Hackers News.

The company revealed the incident on November 3, 2026, stating that the attacker gained initial access through a third-party component before moving from a development environment into parts of its production infrastructure.

Attack Timeline

According to Chainstack, the attacker accessed a development environment on October 26, 2026, and subsequently escalated access to parts of the production environment.

The intrusion was detected on October 31, when Chainstack blocked the attacker’s access and began securing its systems.

Customer Information Potentially Exposed

The compromised database contained customer-related information, including:

• Organization names
• Account holder names
• Member email addresses
• Password hashes

The attacker also gained access to systems storing node credentials. Although Chainstack reported no evidence that these credentials were read, the company is treating them as potentially exposed.

The compromised database contained customer-related information, including:

• Organization names
• Account holder names
• Member email addresses
• Password hashes

The attacker also gained access to systems storing node credentials. Although Chainstack reported no evidence that these credentials were read, the company is treating them as potentially exposed.

Customers Urged to Rotate Credentials

Chainstack has advised customers to take precautionary security measures, including:

• Rotate node credentials.
• Regenerate platform API keys.
• Change account passwords, particularly reused passwords.
• Monitor accounts for suspicious activity.
• Remain alert to potential phishing attempts.

Possible Connection to AI-Powered Attack Campaign

The incident is assessed to share links with a broader AI-powered cyberattack campaign involving the ARTEX framework. Other organizations, including WorkOS and Chainalysis, have also reported security incidents involving AI-assisted offensive operations.

However, the specific attack method used against Chainstack has not been publicly detailed, and the company has not confirmed the identity of the attacker.

The incident highlights the growing risks facing blockchain infrastructure providers and the importance of securing third-party components, monitoring production environments, and maintaining strong credential management practices.

The post Chainstack Data Breach Exposes Customer Data and Password Hashes appeared first on First Hackers News.

The vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, involve an authorization bypass and command injection. They carry CVSS scores of 9.3 and 8.6, respectively.

Two Vulnerabilities Identified

The first vulnerability, CVE-2026-116606, affects Barracuda Email Security Gateway (ESG). It involves a pre-authentication authorization bypass that could allow attackers to circumvent security restrictions.

The second flaw, CVE-2026-111560, is a command injection vulnerability affecting multiple Barracuda products, including:

• Email Security Gateway
• Load Balancer Application Delivery Controller
• Message Archiver
• Web Application Firewall
• WAF Control Center
• Web Security Gateway

When exploited together, the vulnerabilities could allow attackers to bypass authorization controls and obtain root access to affected devices.

Administrative Interface Access Required

Barracuda clarified that successful exploitation requires attackers to have access to the administrative interface of an affected product.

Therefore, devices whose administrative interfaces are not exposed to the internet are less vulnerable to this particular attack path.

The company recommends restricting administrative access to trusted internal networks and implementing appropriate network access controls.

Barracuda Releases Security Patches

Barracuda has released firmware updates addressing both vulnerabilities. Customers are advised to verify their installed firmware versions and ensure that all applicable security patches have been applied.

Organizations running outdated firmware may need to perform multiple updates before reaching the latest supported version. Barracuda also recommends enabling automatic patching where possible.

The post Barracuda Vulnerabilities Could Allow Attackers to Gain Root Access appeared first on First Hackers News.

The operation, announced on November 2, 2026, targeted the XCPE botnet, which allowed attackers to remotely control infected devices and use them for various criminal activities.

How the XCPE Botnet Worked

The x.cpe backdoor operated as a system application with elevated privileges, allowing attackers to remotely control infected devices.

Through the malware, operators could:

• Install applications without users’ knowledge.
• Disable Google Play Protect.
• Execute remote commands and capture screenshots.
• Collect account details, device information and system logs.
• Turn infected devices into residential proxies.
• Generate fraudulent advertising traffic.

Although most affected devices were Android TV boxes, the backdoor was also identified in telehealth equipment, karaoke machines and digital signage devices.

Google Takes Action Against Videostrong

Google used legal action to shut down domains and servers responsible for controlling the XCPE botnet and distributing additional malware modules.

The operation involved Japan’s National Police Agency and cybersecurity organizations including Lumen, HUMAN Security, Plume, Synthient and TrendAI.

Google also banned Videostrong and its future subsidiaries or affiliates from manufacturing certified Android devices or supplying software to other certified manufacturers.

The disruption is expected to cut off criminal access to at least 10 million additional compromised devices associated with other malware families.

Infected Devices Remain at Risk

The backdoor is embedded in device firmware and can reinstall itself after a restart. Consequently, simply deleting the malicious application may not permanently remove the infection.

Synthient has published a list of 182 device model names identified during its investigation, although a model appearing on the list does not automatically confirm infection.

Organizations are advised to identify potentially affected devices, block associated malicious infrastructure and isolate unmanaged smart devices from sensitive corporate networks.

Google has also modified its Android device certification review process to strengthen firmware security checks and prevent similar techniques from bypassing testing.

The post Google Disrupts Android Botnet Infecting 1.3 Million Devices appeared first on First Hackers News.

Langflow is an open-source platform used by developers to build AI applications, agents and automated workflows through a visual interface. Since these environments can connect to external tools, APIs and sensitive information, security weaknesses could expose important application resources and server infrastructure.

According to IBM, Langflow versions ranging from 1.0.0 through 1.12.8 are affected. The company recommends upgrading to version 1.13.0, which addresses the reported vulnerabilities.

Four Security Vulnerabilities Identified

IBM’s security bulletin identifies four vulnerabilities affecting Langflow OSS. Two are rated critical, while the remaining issues carry high and medium severity ratings.

The vulnerabilities are:

The most serious concerns involve CVE-2026-93680 and CVE-2026-110186 because they can be exploited remotely without requiring valid user credentials.

Authentication Bypass and Remote Code Execution Risks

CVE-2026-93680 is an authentication-related vulnerability that could allow an attacker to bypass security restrictions and access functionality without proper authorization.

The issue is particularly relevant to Langflow’s Model Context Protocol (MCP) integration. MCP allows AI applications to interact with external tools and services, while Langflow can expose its workflows as tools through an MCP endpoint.

A publicly available module in the Metasploit Framework references this vulnerability. The module can connect to a vulnerable Langflow MCP endpoint without credentials, establish a session and enumerate the tools exposed by the server.

However, the module’s documented functionality focuses on authentication bypass and tool enumeration; it does not itself execute commands or run arbitrary code on the server.

The second critical issue, CVE-2026-110186, is more severe from a server security perspective. IBM reports that improper control of code generation could allow a remote attacker to execute arbitrary code without authentication.

Six Earlier Langflow Vulnerabilities Already Listed by CISA

The latest vulnerabilities add to a growing list of security concerns involving Langflow.

According to the reported update, six other Langflow vulnerabilities were already included in the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalog. The most recently added issue was CVE-2026-9198, which appeared in August 2026.

However, the four vulnerabilities covered in IBM’s October bulletin were not listed in the KEV catalog as of its update.

The absence of these vulnerabilities from the catalog should not be treated as confirmation that affected systems are safe. Organizations should still prioritize remediation based on the severity and exposure of their deployments.

The post Critical Langflow Vulnerabilities Allow Authentication Bypass and Remote Code Execution appeared first on First Hackers News.

The incident, which occurred on October 29, 2026, affected Binance, one of the world’s largest cryptocurrency exchanges. Following the attack, the exchange temporarily restricted withdrawals while investigating the breach and arranging the replacement of affected assets.

FBI Identifies North Korean Hacking Group Behind Binance Attack

On October 31, the FBI publicly attributed the cryptocurrency theft to TraderTraitor, a North Korean state-sponsored hacking operation.

The agency reported that the attackers stole more than $6 billion in virtual assets from Binance. Law enforcement agencies subsequently began tracking the movement of the stolen cryptocurrency and monitoring transactions associated with the attackers.

According to the FBI, the stolen funds were being converted primarily into Ethereum (ETH). Authorities warned that the attackers could use decentralized finance (DeFi) platforms and cryptocurrency swap services to move the assets and complicate efforts to trace their origins.

The FBI also called on cryptocurrency exchanges and digital asset service providers to identify suspicious transactions and prevent the movement of funds connected to the attack.

How Did the Binance Crypto Heist Happen?

Binance’s initial investigation pointed towards a compromised employee laptop as one of the possible entry points into its infrastructure.

The exchange subsequently indicated that the incident was more complex than initially understood, involving additional points of compromise and malicious software designed to remove traces of the attackers’ activities.

The incident highlights how attackers can exploit weaknesses in employee devices and internal technology environments to reach sensitive financial systems.

This rapid movement of digital assets demonstrates the challenges associated with detecting and containing attacks against cryptocurrency platforms, where transactions can be executed across multiple blockchain networks in a short period.

Stolen Cryptocurrency Converted Into Ethereum

Following the theft, investigators observed the attackers converting the stolen digital assets primarily into Ethereum.

This activity has raised concerns about potential cryptocurrency laundering through decentralized exchanges, instant swap services and other blockchain-based financial platforms.

Such techniques can make investigations more complicated by moving assets across different networks and converting them into multiple cryptocurrencies.

The FBI has been working with other US law enforcement agencies, including the US Secret Service and the Internal Revenue Service Criminal Investigation division, to track the stolen funds.

Cooperation between cryptocurrency exchanges, blockchain analytics companies and law enforcement agencies will be important in identifying suspicious wallets and preventing further transfers.

Security Lessons for Cryptocurrency Exchanges

The Binance crypto heist highlights several security challenges for organizations operating digital asset platforms.

Endpoint Security: Employee laptops and workstations must be protected through continuous monitoring, endpoint detection and response solutions, and effective device security policies.

Privileged Access Management: Organizations should restrict administrative privileges and implement strong authentication mechanisms to prevent compromised accounts from accessing critical infrastructure.

Continuous Security Monitoring: SIEM platforms and Security Operations Centers can help identify unusual access patterns, suspicious transactions and potential security incidents before they escalate.

Incident Response: Cryptocurrency exchanges must maintain effective incident response procedures to investigate breaches, contain threats and coordinate recovery activities.

Threat Intelligence: Sharing indicators of compromise and suspicious wallet information with industry partners can help organizations identify emerging threats and prevent stolen assets from moving through their platforms.

The post Binance Crypto Heist: FBI Links $6.3 Billion Theft to North Korean Hackers appeared first on First Hackers News.

The warning applies as a precaution to Trezor devices purchased through CryptoBilis from March 2026 onward. So far, the company has received a report involving only one suspected device.

In its October 30, 2026 security notice, Trezor advised potentially affected customers to create a completely new wallet with a fresh recovery phrase and move their funds. The company has not yet examined the reported device, and no stolen funds have been reported by CryptoBilis customers.

The March 2026 date is a precautionary measure. It does not mean that every device sold during this period has been tampered with.

How the Suspected Hardware Implant Works

The incident was reported by a customer in Indonesia who purchased a Trezor Safe 5 through CryptoBilis on Tokopedia in August 2026.

According to the customer’s report, an additional circuit board was installed between the wallet’s main board and its screen. The component reportedly contains a cellular module and antenna.

This hardware may be able to capture information displayed on the wallet screen, including recovery phrases, and transmit that information over a mobile network when the device is connected to power.

If confirmed, this would create a serious security risk. Anyone who obtains a wallet’s recovery phrase could potentially restore it on another device and gain control of the funds.

Trezor reviewed photographs and spoke with the customer over a video call. The device is now being sent to the company’s security laboratory for further investigation. Until testing is complete, the reported implant’s capabilities have not been independently confirmed.

The incident also highlights a wider risk involving counterfeit or physically modified crypto hardware. In another case, fake crypto wallet screens were reportedly used to trick users into revealing their recovery phrases.

Connection to the Ledger Hardware Incident

This warning follows a separate investigation involving Ledger devices sold through the same reseller.

Ledger reportedly began investigating customer fund losses on October 9 and later confirmed physical tampering in some devices. Trezor removed CryptoBilis from its authorized reseller network on the same date.

However, Trezor has not confirmed whether the incidents involve the same attackers or a connected operation. The company is working with Ledger and other security teams to investigate the matter.

The customer who reported the suspected Trezor implant had already transferred their funds before discovering the issue. Trezor says it has not received similar reports involving devices purchased from other resellers.

What Trezor Users Should Do Now

Trezor recommends that customers who purchased devices through CryptoBilis from March 2026 onward take precautions.

• Create a completely new wallet with a freshly generated recovery phrase.
• Transfer all funds from the existing wallet to the new one.
• Do not reuse the old recovery phrase on another device.
• If the device has not been set up, do not use it or enter an existing recovery phrase.
• Contact official Trezor Support to check replacement options.

Simply restoring an existing wallet on another device is not enough because the old recovery phrase may already be exposed.

Trezor also advises users not to open or weigh their devices to check for tampering. These methods cannot reliably identify a modified wallet.

Eligible customers can contact Trezor Support for a replacement device or a voucher. They should keep their original device for investigation.

Important: Never share your recovery phrase with anyone, including someone claiming to be from Trezor Support. The company will never ask users to provide their recovery words.

The incident is a reminder that crypto security depends on more than software protection. Buying hardware wallets from trusted sources and protecting recovery phrases are equally important.

The post Crypto Wallet Spyware Targets Recovery Phrases appeared first on First Hackers News.

In an October 29, 2026 update, the company’s Unit 42 team confirmed that attackers were combining two PHP vulnerabilities with a Linux kernel flaw to gain full system access.

The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, have critical CVSS scores of 9.2 each. They could allow attackers to run malicious code remotely without logging in.

Palo Alto said around 0.02% of its global customer base had internet-facing management interfaces affected by this issue. The company has contacted those customers directly.

This is a significant development because the vendor had not previously confirmed active attacks against its products using these PHP flaws.

How PHP2Shell Attacks Work

The two vulnerabilities are related to how PHP handles memory when a request fails.

• CVE-2026-109618: Improper memory handling during an error can leave data in an unsafe state, giving attackers an opportunity to execute malicious code.
• CVE-2026-109619: PHP may continue using memory that has already been released. Attackers can take advantage of this condition to run their own commands.

These issues affect several PHP environments, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

The PHP Group has released fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Unit 42 also estimated that more than 22.6 million internet-facing PHP instances could be vulnerable. This number represents potential exposure, not confirmed compromises.

Researchers at Dream Research identified evidence of attacks involving 25 compromised PAN-OS firewall and management servers across the United States, Japan, Taiwan and South Korea. Three of the systems were associated with a US government-affiliated environment.

The attackers reportedly sent specially crafted requests to the PAN-OS management web server to exploit the PHP flaws. This allowed them to execute commands with limited privileges. They then used another Linux kernel vulnerability, known as Fragnesia (CVE-2026-46300), to escalate privileges and gain root access.

Investigators also found signs of webshell installation, internal network tunneling, LDAP credential theft and Active Directory discovery. However, they could not confirm whether all attempted follow-up attacks were successful.

PAN-OS Security Updates and Protection Steps

Palo Alto confirmed that the affected areas are the management HTTPS interface and XML API. PA-Series and VM-Series firewalls, along with Panorama, are included.

GlobalProtect portals, gateways, Clientless VPN and Captive Portal are not affected by these PHP vulnerabilities.

Organizations using PAN-OS should take the following steps immediately:

• Remove direct internet access to management interfaces.
• Restrict management access to trusted internal IP addresses.
• Install the appropriate PAN-OS security hotfix.
• Review firewall logs for unusual requests and suspicious activity.
• Check systems for unexpected webshells or unauthorized access.

Palo Alto has released fixes for multiple PAN-OS versions, including 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 and 10.2.18-h13.

The key takeaway: Internet-facing firewall management interfaces can become a serious entry point for attackers. Restricting access and applying security updates quickly are essential to reducing the risk of compromise.

The post Critical PHP2Shell Threat Targets PAN-OS appeared first on First Hackers News.

Researchers from Zimperium’s zLabs team discovered a large network of websites distributing these exploits. Their investigation, published on October 29, 2026, identified 608 domains associated with Coruna-related attacks.

The malicious websites check which iOS version a visitor is running and use the corresponding exploit chain. Devices running iOS 17.2.1 or older are targeted with Coruna, while newer devices running iOS 18 may receive the DarkSword exploit chain.

Researchers also linked 93 of the identified domains to 21 tracking servers.

How Coruna and DarkSword Infect iPhones

The campaign uses websites that appear to offer ordinary online services. Researchers discovered malicious pages disguised as dating platforms, AI chat services, cryptocurrency promotions, and streaming websites.

Once someone visits one of these pages, hidden scripts can load the exploit without displaying an obvious warning.

Some websites also encourage visitors to open links in Safari. This helps the malicious code run in the browser environment it is designed to target.

The two exploit kits use different techniques:

• Coruna: Uses Safari and WebAssembly-related weaknesses to access browser memory and bypass security protections.
• DarkSword: Uses several stages to move beyond the browser and reach other iOS system processes.

The Coruna chain includes CVE-2022-48503, which involves a WebAssembly-related Safari vulnerability. After gaining access, its components attempt to reach deeper parts of the operating system.

DarkSword follows a different route. It reportedly moves from browser execution through the GPU process and into a system service called mediaplaybackd.

Stolen Data and Hidden Malware Activity

The researchers examined DarkSword on an iPhone running iOS 18.6.2. During testing, the device contacted an attacker-controlled server 144 times and downloaded seven additional modules.

Some of these components were designed to collect information stored on the device.

The investigation found evidence of capabilities involving:

• Reading Telegram’s local application data.
• Collecting the Apple Notes database.
• Gathering information about installed applications.
• Communicating with remote attacker-controlled servers.

The malware also uses techniques to make investigation harder. These include removing certain crash records and Safari browsing data.

Researchers have also identified other ways the exploits are being distributed. SafeDep found Coruna-related malicious code inside a compromised npm package called art-template. Websites using affected package versions could unknowingly serve the malicious code to their visitors.

Another case involved a fake jQuery file hosted on a domain designed to look like Google’s infrastructure.

These findings show that attackers can spread mobile threats through compromised websites and software dependencies, not just suspicious links.

How iPhone Users and Organizations Can Stay Protected

Apple has released security fixes for the vulnerabilities used in these attack chains. Users should install the newest iOS version available for their devices rather than continuing to use older software.

Recommended precautions include:

• Install security updates: Check Settings and update your iPhone to the latest supported iOS release.
• Use Lockdown Mode: People at higher risk, including journalists, activists, and business executives, should consider enabling this protection.
• Avoid suspicious websites: Be careful with unexpected links and requests to open pages in Safari.
• Review mobile devices: Organizations should ensure that company-managed and personal devices used for work receive security updates.
• Monitor suspicious activity: Security teams should investigate unusual crashes, unexpected system behavior, and signs of compromised applications.
• Check website dependencies: Website owners should review third-party scripts and software packages for malicious changes.

The identity of the operators behind these campaigns has not been confirmed. Researchers also caution that code comments or language found in recovered files are not enough to identify the people responsible.

The main concern is that a normal website visit can become an entry point for a serious mobile attack. Keeping devices updated and checking the security of websites and software dependencies are important steps in reducing this risk.

IoCs

The post Coruna and DarkSword Exploits Put iPhone Data at Risk appeared first on First Hackers News.