The Hacker Who Mocked the FBI Is Now Helping Catch His Own Crew
Tuesday, October 13, 2026 · 5-minute read
Norway's data protection watchdog slapped Microsoft-owned ad company Xandr with an $9.6 million fine — the largest it has ever issued. Between 2018 and 2020, Xandr acted as a middleman that passed Grindr users' sensitive personal data, including information revealing their sexual orientation, to potentially thousands of advertisers — without ever getting those users' consent. Xandr reportedly tried to blame Grindr for the consent failure, but regulators weren't buying it.
↗ BleepingComputerAttackers remotely took control of refrigeration systems at multiple French supermarket chains, intentionally defrosting the units overnight. The attack reportedly targeted industrial control systems made by Danfoss. This is a sharp reminder that cyberattacks can spill out of computers and into the physical world — spoiling food and costing real money.
↗ BleepingComputerAhold Delhaize — the company behind Stop & Shop, Food Lion, and other major grocery chains — confirmed it suffered a cyberattack and had to shut down some of its systems in response. The company didn't say which systems were affected or whether customer data was at risk. When a retailer this size pulls systems offline, it can disrupt store operations, online orders, and supply chains across multiple countries.
↗ BleepingComputerHackers chained three zero-day vulnerabilities in Ivanti Connect Secure, a popular VPN appliance used by businesses to let employees work remotely. The attack started October 3 on a fully up-to-date device. By chaining an authentication bypass, a remote code execution flaw, and a privilege escalation bug together, the attacker gained complete, unrestricted control — known as root access. Ivanti has patched two of the three flaws. A fix for the third is still pending. Security firm Volexity, which discovered the attack, says exploitation is happening right now in the wild.
Ledger confirmed that some of its hardware cryptocurrency wallets sold through a Southeast Asian reseller called CryptoBilis contained a hardware implant — a tiny spy chip secretly added during distribution. The implant silently drained users' crypto wallets. This is a supply chain attack at the hardware level, which is especially nasty because even security-conscious users buying a "secure" device had no way to know it was already compromised.
This is as bad as it gets — a perfect 10 out of 10 severity score. A flaw in SAP's Cloud SDK for Python can trick an application into sending its login credentials (OAuth2 client credentials) straight to a server the attacker controls. Any attacker who can influence the tenant name used in a request can pull this off. That means they could then impersonate the application and access whatever services it was authorized to use.
Status: Patch available — version 0.45.2 of the SDK fixes the issue. However, The Hacker News found that six later releases partially reintroduce the problem, so organizations should confirm exactly which version they're running.
This is actually two flaws counted together — an authentication bypass and a remote code execution bug — both found in Ivanti's Connect Secure VPN product. Together they let an attacker run commands on the device without logging in at all. A third related flaw then hands the attacker full root-level control. All three are being actively exploited right now against real targets, including on fully patched devices running the latest software version at the time of the attack.
Status: Patches available for two of the three flaws. The fix for the privilege escalation flaw is still pending. Ivanti says customers on affected versions should "act immediately."
Docker Hub had a critical flaw that let attackers access another user's container repositories using just a personal access token — even one that didn't belong to that repository's owner. An attacker could view, tamper with, or replace software images that other developers trust and use in their own projects. This is a significant software supply chain risk.
Status: Docker has disclosed the vulnerability. Check Docker's official advisory for patch and mitigation details.
GitHub quietly fixed a serious flaw in npm's "trusted publishing" system that left over 1,500 packages vulnerable to hijacking. The problem: an attacker could take over a repository or project name that a trusted publishing configuration pointed to, then push malicious updates to packages they didn't own — no stolen password required. GitHub's fix automatically expires unvalidated publishing configurations after 48 hours. A configuration only becomes permanent after its first successful, legitimate publish. It's a small change with a big impact — it cuts off a sneaky avenue for supply chain attacks before developers even realize they're exposed.
This week's ShinyHunters story has everything: a teenage hacker in Jordan, stolen FBI data, a spy game of fake arrests, and now a Canadian cybersecurity executive in handcuffs at a Philadelphia hotel conference. The ShinyHunters hacking group — responsible for some of the biggest data thefts in recent memory — is being dismantled piece by piece, and the story of how is genuinely remarkable.
ShinyHunters first grabbed headlines by exploiting a zero-day vulnerability in Oracle's PeopleSoft platform (CVE-2026-35273) to break into dozens of organizations, including the FBI's own systems. The group's leader, a 19-year-old from Jordan going by the handle "Rey," was brazen about it — posting mocking memes on Twitter aimed at the FBI while simultaneously stealing their data. But by late September, Dutch police arrested one of his associates. Rey tried to frame the arrested man for additional crimes by embedding his avatar in taunting posts. It didn't work. Jordanian authorities detained Rey on October 3, and he is now reportedly cooperating with the FBI to identify other ShinyHunters members.
Then came the twist that sounds like a TV script: this week, FBI agents arrested a Canadian cybersecurity executive — Edward Dubrovsky, who specialized in ransomware negotiations — at a cyber insurance conference in Philadelphia. Court records show he's charged with conspiracy to extort and interference with commerce by threats. His case has been moved to Texas, which sources say is now the FBI's command center for the entire ShinyHunters investigation. The irony is stark: a professional who built a career helping companies respond to cybercriminals may have been working with them all along.
For regular people, the takeaway is this: the cybercrime ecosystem is more interconnected than it looks. "Legitimate" security firms, ransomware gangs, and data theft crews can overlap in ways that are hard to see from the outside. Expect more arrests as Rey cooperates. And watch the Oracle PeopleSoft vulnerability closely — ShinyHunters found a way to bypass the firewall rules designed to stop it, meaning organizations that thought they were protected may not be.