Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Japanese Homeware Giant Iris Ohyama Says Cloud Breach at Its Online Store May Have Exposed Data of Up to 7.7 Million Shoppers

  Iris Ohyama, one of Japan's most recognized consumer goods manufacturers, has disclosed that a third-party cloud service used by its o...

All the recent news you need to know
Vulnerabilities and Exploits
Plex2Shell QNAP Security Patch Vulnerabilities and Exploits

QNAP Urges Immediate Plex2Shell Update and Remediation

 

QNAP has issued a security advisory concerning a vulnerability chain, collectively referred to as Plex2Shell, affecting Plex Media Server installations on QNAP NAS devices. The issue affects Plex Media Server version 1.43.2 and earlier and enables unauthenticated remote code execution when individual flaws are chained together. QNAP has therefore instructed administrators to update Plex Media Server immediately to version 1.43.3, build 1.43.3.10861 or later. 

Technical scope 

Plex2Shell comprises four vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Individually, each issue has a limited security impact, but an attacker can combine them to execute arbitrary code under the privileges assigned to the Plex Media Server process. The vulnerability resides in the third-party Plex application rather than in QTS or QuTS hero. Consequently, QNAP states that its operating systems are not directly affected, and a NAS that does not have Plex Media Server installed does not require remediation.

Affected administrators should navigate to App Center > My Apps > Plex Media Server and select Update. Once the update completes, they must verify in Plex Web under Settings > General that the installed version is 1.43.3.10861 or later. QNAP advises against delaying the update until a later release becomes available. If the update is not visible, administrators should refresh App Center and confirm that the NAS has outbound internet connectivity before attempting the installation again. 

Compromise assessment Updating Plex removes the exploitable condition but does not reverse an intrusion that has already occurred. QNAP states that systems running Plex 1.43.2 or earlier while remotely reachable should be treated as potentially compromised. This exposure applies when Plex Remote Access was enabled, TCP port 32400 was manually forwarded, or the port was exposed through UPnP or myQNAPcloud router configuration. In such cases, QNAP requires a clean reinstall, credential rotation, and a review for indicators of compromise. 

Administrators should inspect running processes for unfamiliar executables launched by Plex, including myawesomeproxy, mylovelyminer, or x12345. They should also examine the Plex Codecs directory for unrecognized .so or .dll files and monitor outbound traffic for connections to proxystream.st. Additional indicators include abnormal CPU utilization when no media is being played and detections produced by QNAP Malware Remover, including signature MR2104. QNAP warns that deleting suspicious files alone is insufficient, since persistence mechanisms may remain; affected systems should follow the full clean-reinstall procedure. 

Secure reinstallation 

For remediation, QNAP recommends preserving the Plex Logs directory if technical support may be required. Administrators should then remove Plex Media Server through App Center, reinstall version 1.43.3 or later, and avoid restoring the previous contents of the Codecs folder. Plex will automatically download required codec components after reinstallation. To reduce recurrence risk, QNAP advises disabling Plex Remote Access when unnecessary, removing port 32400 forwarding rules, disabling UPnP, and using a VPN for legitimate remote access. Administrators should also keep QTS or QuTS hero and all installed applications updated.
Read more »
Finance
AI Bank Banking Cyber Attacks Finance

Hackers Exploit Third-Party Provider to Steal $133 Million From French Bank


A major French banking group, Crédit Mutuel Arkéa, has suffered a sophisticated cyberattack that allowed hackers to carry out fraudulent financial transactions worth an estimated €118 million ($133 million). 

The attackers reportedly gained access to the bank's network through the platform of an external service provider.

The incident came to light on November 2, when blockchain investigator ZachXBT reported suspicious withdrawals involving several cryptocurrency exchange accounts. According to the investigator, the attackers had potentially stolen around €118 million and moved the funds through cryptocurrency platforms.

Crédit Mutuel Arkéa, one of France's major cooperative banking groups, officially acknowledged the cyberattack on November 4. The bank confirmed that attackers had gained unauthorized access to its systems and used an account belonging to the institution to initiate fraudulent transactions involving other banking organizations.

In a frequently asked questions section published after the incident, the bank explained that the attackers accessed its network directly through the platform of one of its service providers. However, the financial institution did not disclose the identity of the provider. It also clarified that its online banking subsidiary, Fortuneo, was not involved in the attack.

The attackers reportedly used the bank's own account rather than individual customer accounts to transfer the money. Blockchain investigators also tracked the movement of the stolen funds through cryptocurrency exchanges, where some of the money was reportedly converted into stablecoins such as USDC and USDT.

ZachXBT stated that approximately $30 million had already been laundered by November 3. Some of the stolen funds were reportedly blocked, although the complete amount recovered remains unclear. The bank has not independently confirmed the reported $133 million loss, describing the amount involved as significant while acknowledging that the final figure was still being assessed.

After the discovery, Crédit Mutuel Arkéa temporarily suspended certain operations as a precautionary measure while investigating the incident. The bank subsequently announced that the attack had been contained and that its operations were gradually returning to normal.

The financial institution reassured customers that their deposits and personal assets were not affected by the incident. However, some transfer transactions experienced delays because of the security measures introduced in response to the attack.

Arkéa also ruled out human error as the cause, describing the incident as a sophisticated external attack. It is now working with law enforcement agencies and judicial authorities to determine how the attackers gained access and carried out the fraudulent transactions.

Read more »
Hacker attack
Anti Malwares Cyber Security Developer Security GitHub GitHub malware Hacker attack

Hackers Infiltrate GitHub Projects to Infect Cybersecurity Developers With Advanced Malware

 

Cybercriminals are distributing malware through GitHub repositories designed to look like genuine development projects. Researchers at Doctor Web found malicious code in Microsoft Visual Studio projects, Python scripts and Go files. Over 2000 computers were reportedly infected with this malware. The campaign began around 2 years ago with the initial targets being cryptocurrency users. The repositories were themed around blockchain games, game bots and cheating tools. 

The repositories even included guidance for installing Visual Studio to make them seem more legitimate to less experienced developers. However the malware has now targeted information security professionals. The malicious code is hidden within repositories that claim to be for automated scanning, security testing and log analysis. The infected files have malicious code hidden in the configuration and source code of the repository. The malicious code is hidden with lots of white space. 

When the malicious project is downloaded, it runs PowerShell scripts that fetch further malicious files from external sources. This results in an archive being downloaded containing Microsoft.exe, which is a malware loader built with Electron. The malware has been identified as Trojan.Loader.3261. Once active, the malware gathers information about the system, creates persistence and downloads further payloads. It also tries to disable Windows Defender, User Account Control, alerts and recovery features. 

The malware uses various methods to avoid being monitored by security tools, hijack legitimate windows processes and avoid detection from endpoint detection systems. The malware includes payloads such as BackDoor.AsyncRAT.115 which allows the attacker to remotely access the infected computer. It also includes Trojan.InjectNET.14 which adds a cryptocurrency hijacker to the clipboard. This changes the copied wallet addresses to ones controlled by the attacker. 

It also takes screenshots of the infected system. The malware also includes JS.Stealer.191 which steals information from browsers, VPNs, messaging applications, gaming accounts, FileZilla and Discord. This information is zipped up and sent to the attacker via a Telegram bot. The malware tries to uninstall security tools from ESET, McAfee and Malwarebytes. It also changes the hosts file in windows to prevent access to certain anti virus domains. 

The researchers found multiple variations of how the malware was deployed. They also found other incomplete components which indicates that the malware is still being developed. Future features could include auto reinstall, better persistence, managing applications when they open and updating software. This shows that even information security professionals can be vulnerable to malicious resources. The researchers recommend checking any files you download, keeping anti virus databases up to date and being cautious when cloning unknown GitHub repositories.
Read more »
Supreme Court Of India
Data protection law Digital Personal Data Protection Act DNPA Petition Investigative Journalism Journalism Rights Press Freedom Privacy Right To Information Supreme Court Of India

Publishers Move Supreme Court Against Key Provisions of Data Protection Law

 


Digital News Publishers Association (DNPA), representing 21 prominent news organizations, has filed suit with the Supreme Court challenging provisions of India's Digital Personal Data Protection Act, 2023, and the DPDP Rules, 2025. As a result of the current data protection framework, journalists could be restricted in their activities, investigative reporting may become complex, and public access to information may be limited. 

Upon receiving notices from the Union Ministry of Law and Justice and Ministry of Electronics and Information Technology (MeitY) on October 27, 2026, the Supreme Court requested the Centre's response to the challenge. This case emphasizes the conflict between preserving the right to maintain an individual's digital privacy and preserving the right to investigate and report issues of public interest for the press. 

Indian Parliament passed the DPDP Act in August 2023, the first comprehensive law specifically designed to protect digital personal data. It establishes rules for organizations and other entities that collect and process personal information. Under the Act, these entities are considered Data Fiduciaries and are required to obtain the consent of individuals before processing personal data, except for certain permissible purposes listed below Section 7. 

A significant financial penalty is also introduced in the legislation, with data protection violations resulting in fines as high as Rs 250 crore. On November 13, 2025, MeitY notified the DPDP Rules for setting up the operational framework, with phased implementation over a period of 18 months. However, news publishers contend that the legislation does not specifically exempt journalistic activities from its provisions. 

A clear provision for news reporting is not provided by Section 7, which identifies legitimate purposes for processing personal information, nor by Section 17, which lists exemptions from the Act. According to the DNPA, this omission may pose significant challenges for reporters investigating individuals, institutions, or organizations. 

While investigating issues involving public accountability, journalists often obtain personal information from public records, interviews, documents, and other sources. A lack of a journalistic exemption may raise questions about whether consent is required before such information may be collected or used. Further, the association emphasized that earlier versions of data protection legislation, drafted in 2018, 2019, and 2021, included exemptions for journalistic purposes. They have been removed from the final framework and are a key part of the legal challenge. 

Moreover, the dispute also involves amendments to the Right to Information Act (RTI Act), which raise concerns regarding the impact of the new provisions on transparency and access to government information. DPDP Rule 23 also presents a challenge, which provides the Central Government with the authority to request information from Data Fiduciaries and intermediaries through an authorized agent. Moreover, the rule prohibits these entities from disclosing the fact that a request has been made.

News publishers have expressed concern over the possibility that the provision could affect the confidentiality of journalistic sources and create confusion regarding the handling of information obtained during investigations. Moreover, the association has questioned the amendment to Section 8(1)(j) of the Right to Information Act, which was implemented by Section 44(3) of the DPDP Act. 

A public authority previously had the option of withholding personal information that had no connection to public activities or that could cause an unwarranted invasion of privacy. If a larger public interest justified the disclosure, information could be released. Information related to personal information has been broadly exempted from the amended provision. 

Publishers argue that this change could make it more difficult for them to obtain government records required for investigations of matters such as conflicts of interest, public appointments and the use of public funds. Those seeking information about welfare programs, recruitment processes, and government services can also benefit from such information. However, the amendment does not remove every route for disclosure. 

Information may be released in accordance with Section 8(2) of the RTI Act when the public interest outweighs the potential harm to protected interests. Despite the government's assertion that stronger privacy safeguards are necessary for preventing misuse of personal information, the current provision pertaining to public interest continues to protect transparency as it does today. In addition, the legal dispute involves constitutional protections of privacy.

In its 2017 Justice K.S. Puttaswamy decision, the Supreme Court recognized privacy as a fundamental right under Article 21, albeit clarifying that the right is not absolute. This case raises the question as to how that protection should be applied simultaneously with freedom of speech and information access rights for the public. After issuing notice to the Centre, the Supreme Court declined to grant an interim stay on the challenged provisions before hearing the government's response. 

According to the bench, a blanket restriction on disclosure of digital personal information is not necessary, but a more proportionate approach is required. Additional hearings will be held on November 17, 2026 in regards to this matter. An examination by the court may have broader implications for how the privacy laws in India apply to news organizations, investigative reporting, and the public's right of access to public records.

It is expected that the Supreme Court's decision in this case will have a significant impact on the balance between individuals' rights to privacy, freedom of the press, and access to information for the general public. Its findings may also affect the way news organizations handle personal data when conducting investigations in India.
Read more »
Vulnerabilities and Exploits
SAML Security Patch SonicWall Vulnerabilities and Exploits

SonicWall Patches Exploited VPN Authentication Flaw

 

SonicWall has released security updates addressing a high severity vulnerability in SonicOS that could allow attackers to bypass SAML authentication and its associated multifactor authentication requirements. Tracked as CVE-2026-19868, the flaw affects the SSL VPN component of the operating system used by SonicWall firewalls. The company disclosed the issue alongside six other vulnerabilities in an advisory published on November 6, 2026. Its security team investigated a report indicating potential exploitation, raising concerns for organizations relying on affected appliances to secure remote connections. 

The vulnerability does not allow anyone to enter without credentials. Instead, an attacker must possess valid credentials for an alternative authentication method. Those credentials could then be used to bypass SAML authentication controls, potentially avoiding multifactor authentication enforced through SAML. According to SonicWall, exposure exists only when SAML login is enabled for the SSL VPN. The flaw received a CVSS severity score of 7.1 and was reported by Ryan Harris of The Electronic Office, distinguishing it from an unrestricted authentication bypass affecting every configuration. 

Affected products include Gen7 TZ, NSa, NSsp, and NSv firewalls running SonicOS 7.3.3-7015 or earlier. Gen8 TZ, NSa, and NSv firewalls running SonicOS 8.2.2-8015 or earlier are also vulnerable. SonicWall addressed the issue in SonicOS versions 7.3.4-7013 and 8.2.3-8015, respectively. The company said no workarounds are available and strongly urged customers to upgrade promptly. For administrators, the immediate priority is therefore identifying affected firewall models, checking their installed software versions, and applying the appropriate fixed release rather than relying on an unverified temporary configuration change. 

The United States Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog on November 6. Under Binding Operational Directive 26-04, federal agencies must address it by November 20. However, public information about exploitation remains limited. Neither SonicWall nor CISA disclosed details about the suspected attacks, their targets, or their impact. It also remains unclear whether attackers exploited the weakness before a patch became available. That distinction matters because the available reporting does not establish that this was a zero-day. 

The remaining six vulnerabilities broaden the advisory’s significance, although SonicWall did not identify them as exploited. Two management interface flaws, each rated 8.8, could permit unauthorized actions under certain circumstances without authentication. Three pre-authentication buffer overflows affect the SSL VPN service and TACACS+ authentication client, potentially causing application denial of service. A weak password hashing issue affects virtual appliances but requires highly privileged local access. Together, these findings make the updates relevant beyond the SAML bypass alone, while keeping each vulnerability’s prerequisites and consequences distinct.
Read more »
US Healthcare
AI Systems Artificial Intelligence discrimination LAPD Law Enforcement Policing Technology US Healthcare

AI in Policing Risks Amplifying Racial Bias, Researchers Warn

 




When the Los Angeles Police Department started feeding decades of arrest records into predictive algorithms, it believed it was upgrading how it approached crime. What it actually did, researchers now argue, was automate its existing prejudices.

The growing use of artificial intelligence in law enforcement is raising alarms among criminologists and legal scholars who say these systems absorb the biases already embedded in historical police data and repeat them at scale. Far from offering a neutral, data-driven view of crime, the tools risk entrenching the same inequalities they claim to transcend.

At the core of the problem is how these systems learn. AI tools for predictive policing are trained on past arrest and crime records, which means they begin with a picture of crime shaped by previous policing decisions rather than by crime itself. Areas that received heavier patrol in earlier decades show more recorded incidents. The algorithm reads that density as a future risk signal and directs officers back to those same neighborhoods. More arrests follow. The data is updated. The cycle repeats.

Sarah Brayne, a sociologist at the University of Texas at Austin, spent time inside the LAPD studying how the department used big data systems. In research published in the *American Sociological Review*, she found the department was increasingly using data to predict crime rather than respond to it. The data flowing into those systems was skewed from the start: crimes in public places were more likely to be recorded, and patrol resources were disproportionately concentrated in Black neighborhoods. Once that history was absorbed by the algorithm, Brayne wrote, "the predictions appear impartial." They were not. The models, she concluded, create "a feedback loop in which they not only predict events such as crime or police contact, but also contribute to their future occurrence."

The problem sharpens when that underlying data was produced under conditions of institutional misconduct. Researchers at New York University's AI Now Institute studied 13 jurisdictions across the US and found that in nine of them, police departments had trained predictive systems on records gathered during documented periods of unlawful or biased policing. Chicago is the starkest case. The city's police department was under federal investigation for discriminatory practices at the same moment it adopted a risk-flagging algorithm to identify people likely to be involved in shootings. The residents federal investigators had identified as targets of biased policing overlapped substantially with those the algorithm flagged. The list eventually grew to more than 400,000 names, 56 percent of them Black men.

Chicago shut down the program in 2019 after its own inspector general raised concerns about its effectiveness. Los Angeles scrapped a similar initiative, Operation LASER, the same year. A 2023 analysis of Geolitica, formerly known as PredPol, one of the most widely deployed predictive policing tools in the country, found a success rate below half a percent across more than 23,000 predictions made in Plainfield, New Jersey.

Not everyone in the field believes the technology is fundamentally broken. Dr. Dimitrios Kollias, an associate professor in multimodal artificial intelligence at Queen Mary University of London, argues that modern AI systems do not simply replay their training data. "They can combine learned information in new ways and generate outputs that were not explicitly present in those examples," he told the BBC. He acknowledges dirty data is a genuine concern but argues systems can be tested for unfair outcomes and redesigned when they fail. As those systems grow more autonomous, he adds, ensuring they remain under meaningful human control becomes a priority in its own right.

The consequences of algorithmic bias run well beyond law enforcement. A 2019 study published in the journal Science examined a healthcare AI tool used to allocate additional patient support across US hospitals. The system measured patient need by predicting the cost of their care. Because less was already being spent on Black patients than on equally sick white patients, often due to poorer access to care, the algorithm systematically directed resources toward white patients. When researchers recalibrated it to predict illness directly rather than cost, the share of Black patients selected for extra support would have risen from roughly 18 percent to 47 percent. The fix was straightforward once someone looked for the problem. That is precisely the case researchers make for independent oversight.

Legislators are beginning to respond. In January 2024, seven US Congress members asked the Justice Department to pause grant funding for predictive policing programs until their discriminatory impact could be assessed. A White House policy from March 2024 requires federal agencies to independently test rights-impacting AI tools, though the mandate does not extend to state and local police departments. In Britain, 17 civil society organizations called the same year for a full ban on predictive policing.

Dr. Carolyn McKay, an associate professor in digital justice at the University of Sydney Law School, says cleaning up biased data is not a matter of removing a few stray errors. The corrupted records are not sitting at the edges of an otherwise sound dataset. They run through the foundation the algorithm was built on. Even systems redesigned to flag locations rather than individual people can produce the same outcomes, she warns, because the neighborhoods they target were shaped by years of concentrated policing long before any algorithm got involved.

The root of the problem, most researchers agree, is not the machine. It is the human judgment baked into the data the machine inherited. The algorithm did not decide what suspicious behavior looked like, or which crimes were worth recording. People did. Until those decisions are independently examined, AI will keep reflecting them back.



Read more »
Subscribe to: Posts (Atom)

Featured