Critical Linux Flaw, Telegram Hack & The Negotiator Who Helped the Hackers
Thursday, October 29, 2026 · 5-minute read
A pair of critical bugs in PHP — the programming language behind most of the web — are being actively exploited right now. Government websites in Europe and elsewhere went dark after the flaws were disclosed today. Cloudflare says it spotted attacks within hours and rushed out emergency firewall rules to protect sites it serves. PHP has issued an emergency patch, but with nearly 70% of websites running vulnerable code, expect a messy day online.
↗ Krebs on SecurityThe FBI's investigation into the ShinyHunters hacking group has taken a wild turn. Investigators found that executives at two ransomware negotiation firms — companies you'd hire to help you deal with hackers — were apparently helping the criminals operate their extortion website. One of those executives, Canadian cybersecurity consultant Edward Dubrovsky, has already been arrested. Prosecutors say he knew ShinyHunters had stolen data from the FBI's own servers and said nothing.
↗ Krebs on SecurityU.S. law enforcement seized the main domain of Virtualine, a bulletproof hosting service that rented server space to ransomware gangs and other cybercriminals. The service was openly advertised on criminal forums. Takedowns like this disrupt the infrastructure criminals rely on to stay online and evade detection.
↗ BleepingComputerCriminals are posting fake versions of popular AI tools — with names like "GPT-5.6 Sol," "GPT-6 Astra," and "Claude Opus" — on GitHub and fake landing pages designed to look legitimate. When you download and run one of these apps, it secretly installs crypto mining malware called YobaLoader. The trick works because the malware hides next to real, digitally signed files from OpenAI and Anthropic, using a technique called DLL sideloading to slip past security software. The fake projects also use SEO poisoning to appear near the top of search results.
Researchers found 319 Chrome browser extensions with a combined 13.4 million installs that were secretly redirecting users' searches through hidden tracking servers. Instead of your normal search results, the extensions quietly rerouted queries through Bing and Yahoo to earn advertising money for the attackers. The extensions looked harmless — things like productivity tools and utilities — making them easy to overlook.
A flaw deep inside the Linux kernel — the core software that runs Linux servers — lets a remote attacker with no username or password take complete control of a vulnerable machine. The bug is a race condition in the code that handles new network connections. It causes the kernel to read memory it has already deleted, a dangerous bug type called use-after-free. An AI model built by Anthropic wrote a working exploit for the flaw. CISA has warned federal agencies to patch urgently.
Status: No patch yet from Ubuntu or Red Hat as of today. Watch for kernel updates and apply them the moment they arrive.
A serious flaw in Telegram's Android app allowed an attacker to run malicious code on your phone the moment you answered a voice call from them. The attacker only needed a regular Telegram account — no special access required. Security firm NebuSec confirmed the bug works on ARM64 phones and affects every version of the app released between March 2022 and September 2026. Telegram quietly fixed the issue in version 12.10.4 in late September.
Status: Patch available — update Telegram for Android to version 12.10.4 or later immediately. Check your version under Settings → scroll to the bottom.
Attackers are actively exploiting a zero-day flaw in Cisco's firewall software. The bug lets an attacker remotely crash SSL VPN devices, knocking them offline entirely — a denial-of-service attack that could lock remote workers out of corporate networks. Cisco has released emergency security updates.
Status: Patch available — Cisco has issued updates for both ASA and FTD software. If your organization uses Cisco firewalls, alert your IT team today.
Google just launched Gemini 4 Carbon, its most capable AI model yet, and cybersecurity is one of its headline strengths. In benchmark tests, Carbon leads the pack at finding vulnerabilities (88.2% on SEC-bench Pro), exploiting them (54.8% on ExploitGym), and patching them (71.0% on CWE-bench) — beating rivals from Anthropic and OpenAI across all three. Google says Carbon is also twice as likely as previous models to generate secure code from the start, rather than code that needs fixing later. The same AI capabilities that help defenders find and fix bugs faster can also help attackers — so the race to deploy these tools on the right side of the fence is intensifying.
When a company gets hit by ransomware, one of the first calls they make is to a specialist who negotiates with the criminals. These consultants are supposed to be on the victim's side. But the FBI's investigation into the ShinyHunters hacking group has uncovered something deeply troubling: at least one senior executive at a ransomware negotiation firm appears to have been working both sides of the table simultaneously.
Here's how it unraveled. Dutch police arrested ShinyHunters suspect Pepijn van der Stap in September, catching him mid-session on his Signal messaging app. His chats revealed frequent contact with Edward Dubrovsky, a Canadian cybersecurity executive and published author on handling cyber extortion — and, according to prosecutors, an alleged participant in the very extortion schemes he was paid to help clients survive. Dubrovsky reportedly knew ShinyHunters had stolen sensitive data from FBI servers and said nothing. He has since been arrested and charged. Investigators also believe at least one executive at a large, unnamed U.S. consulting firm actively helped run ShinyHunters' victim-shaming website, shinywire.com.
For regular people and businesses, this is a sobering reminder that the cybersecurity industry — like any other — is not immune to bad actors. When a company is in crisis after a ransomware attack, they're vulnerable and often desperate. That desperation can be exploited. The alleged scheme here — where a negotiator secretly tips off criminals about victims before those victims even know they've been breached — is a form of insider betrayal that's extraordinarily hard to detect from the outside.
The FBI is moving fast on this one, partly because ShinyHunters stole data from the bureau's own recruitment website in late September, including medical records and home addresses of FBI employees. Watch for more arrests and, likely, new guidance on how companies should vet the firms they hire to handle ransom negotiations. In the meantime, if your organization ever faces a ransomware incident, it's worth asking your negotiator some hard questions about their past clients — and their past contacts.