Cybersecurity

A New Mexico district court judge ordered Meta to pay $25 billion in civil penalties, CNBC reports, in a case stemming from the Cambridge Analytica scandal. In September a Santa Fe jury found the company liable for misleading state residents about how it collects and protects user data, finding more than 43 million violations of the state's Unfair Practices Act, each carrying a penalty of up to $5,000.

According to the filing, the state was awarded $219.5 billion, reduced to $25 billion. Judge Francis Mathew wrote that the number and duration of willful violations, the involvement of senior Facebook leadership and the "intentional and systematic nature" of the misstatements supported the maximum per-violation penalty. Interest accrues at 15% a year until the fine is paid.

Attorney General Raúl Torrez said the order shows such violations "carry real consequences." Meta chief legal officer C.J. Mahoney said the company is confident it will prevail on appeal and that the ruling "makes it all but impossible to do business in the state of New Mexico."

A Savannah, Georgia, police officer was fired after giving her husband, an Immigration and Customs Enforcement agent, her login to the department's Flock license plate reader system, according to documents obtained by WJCL. The records say he did not have his own Flock account through the Department of Homeland Security.

An internal audit flagged an unusually high number of searches on Amber Harpe's account between January and July 2026: 983 search entries involving 97 identifiable plates from six states, most from South Carolina. Department documents noted that most registered owners identified in the audit were Hispanic. Harpe told investigators her husband did most of the searches and that she understood she was not allowed to share access.

Her husband, identified in interview audio as ICE agent Tyler Harpe, told investigators he used the account for about four months to locate people who already had active arrest warrants, and denied any personal use. The department concluded she had compromised safeguards meant to track who uses law-enforcement data.

Researchers at security firm Claroc say they found 6,800 links that users of Meta's Muse AI agent had created to share conversations, and that opening a few hundred turned up material clearly not meant to be public, Ars Technica reports. Examples include a candidate's notes for a confidential call with a frontier AI lab, a company's internal revenue review, a small-business loan application and a staff vacation calendar.

The cause, Ars says, is that Muse puts the conversation title in the link's subdomain on a single Meta domain. When a recipient opens the link, the name passes through DNS and can end up in commercial passive-DNS databases that anyone can search. Claroc calls these "GhostShares." "It took one query," the researchers wrote.

Claroc's CTO says he reported the issue through Meta's bug bounty on October 8. Meta told Ars it has paused the sharing feature while it reviews the report and considers changes to how links can be discovered.

Burger King Japan disclosed that attackers accessed the system that manages member information for its official smartphone app, leaking 11.18 million customer records, BleepingComputer reports. The company says it determined on October 13 that unauthorized access took place between October 2 and October 7, and that it blocked the source as soon as it learned of it.

The exposed data includes names, dates of birth, gender, email addresses, phone numbers and order history. The company says credit card numbers were not stored on the server and it found no evidence that login credentials were accessed, and that no secondary damage such as fraudulent use had been confirmed.

Burger King Japan has reported the breach to Japan's Personal Information Protection Commission and warns customers about emails, texts and calls impersonating it. BleepingComputer notes a run of attacks on major Japanese companies this year; a Macnica researcher has logged 119 incidents involving personal data theft or exposure.

U.S. investigators pursuing the ShinyHunters hacking group have identified executives at two ransomware negotiation firms with unusually close relations to the group, KrebsOnSecurity reports, citing sources close to the investigation. ShinyHunters, which the FBI says has extorted more than $70 million this year, hacked the FBI's recruitment site fbijobs.gov in late September.

According to Krebs's sources, Signal messages on the phone of a Dutch suspect arrested in September showed frequent conversations with Edward Dubrovsky, a Canadian cybersecurity executive the FBI arrested earlier this month and charged with extortion-related offenses, and with at least one executive at a large U.S. consulting firm. The sources say these executives often knew of new victims before the victims did, and that investigators believe a U.S. executive helped operate the group's extortion site, Shinywire, which listed nearly 100 victims between May and October 16.

Krebs is not naming the U.S. firm or executive because no charges have been filed.

Version 1.107.0 of LiteLLM, a popular open-source Python gateway for calling AI models, was published to PyPI and Docker registries with malware on October 21, according to SafeDep and BleepingComputer. LiteLLM confirmed the compromise and says the release pipeline was hijacked; SafeDep says LiteLLM believes the attacker took three developers' GitHub CLI credentials from the logs of an internet-exposed internal deployment.

All seven wheels for Linux, macOS and Windows added three files that run whenever Python starts, even if litellm is never imported. One steals SSH keys, cloud and CI/CD credentials, AI tool tokens, browser passwords and stored model-provider keys; another checks in hourly and downloads and runs more code. The PyPI release was live from 11:39 to 13:23 UTC; Docker Hub and GHCR tags pointed to bad images for a couple of hours. Versions 1.106.2 and the 1.107.0 release candidates are clean.

BleepingComputer says affected systems should be isolated and rebuilt and all exposed secrets rotated, and warns that running Python or pip to investigate also triggers the malware.

Cloud hosting platform Railway disclosed on October 21 that it detected anomalous activity in systems that store customer environment variables. Its investigation so far indicates an unauthorized third party may have accessed encrypted environment variables and, for some, obtained the decrypted contents. Those variables can hold API keys and database and registry credentials.

Railway says it believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and that it has asked those upstream providers to revoke keys proactively. While the impact may be limited to a subset of users, it recommends that all customers immediately rotate every environment variable and private registry credential stored on Railway and check logs for unusual activity.

All deployments were paused during the investigation, so customers could not roll out new versions until builds resumed. Railway says it will email affected customers directly; on October 22 it published follow-up guidance on checking for anomalous AWS and Google Cloud access.

The Administrative Office of the U.S. Courts said on October 15 that a cybersecurity incident hit BAE Systems IT and the websites that support the Bankruptcy Noticing Center, which produces and sends bankruptcy notices for all federal bankruptcy courts. BAE operates those systems for the judiciary.

The courts said all access to the center's systems was unavailable, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service, and that production and distribution of bankruptcy notices had stopped. A BAE Systems spokesperson told Reuters the company is aware of "a security incident that is isolated to the BNC system" and is coordinating with the courts.

Neither the courts nor BAE has said what caused the incident or whether data was taken.

Capcom, the publisher behind Resident Evil, Monster Hunter and Street Fighter, says a third party broke into CAPCOM ID, the shared account it uses for its web services and some online games. According to the company's October 22 notice, 11,774,247 email addresses leaked worldwide, along with account creation dates, last-login times, login counts and the IP address of the last login.

For 43 of those accounts, dates of birth, gender, country or region and nicknames were also exposed. On 196 accounts the attacker changed the password; Capcom says it has reset them. The company says passwords that customers set themselves were not exposed and credit card information was not involved.

Capcom says it found signs of unauthorized access on October 19, confirmed the leak on October 20 and reported it to police and Japan's Personal Information Protection Commission on October 21. Games and CAPCOM ID services keep working. Capcom warns members to watch for emails impersonating the company and will contact affected customers in stages.

GMO Internet's Onamae.com Desktop Cloud, a Japanese virtual private server service marketed for running automated FX trading software, says a third party gained unauthorized access and installed malicious programs in some customers' server environments. Its notice lists 26,739 servers as possibly affected.

To prevent further damage, the company began shutting down customer servers from 04:00 local time on October 21, affecting all Desktop Cloud plans, with no restart date given. BleepingComputer reports the company says data stored on the servers may have been exposed but it has not confirmed misuse, and that payment details are kept on separate infrastructure.

Customers who stored passwords or other secrets on their servers are advised to change them, and the company warns of phishing that may exploit the incident, saying it will never ask for passwords or card numbers by email or phone.

CISA, the FBI, the U.S. Secret Service and partners in Germany and the UK released a joint advisory on October 20 about SafePay, which CISA calls one of the most active ransomware groups. It says SafePay has affected businesses and critical infrastructure in North America, South America, Europe and Australia, including at least 600 critical-infrastructure organizations since August 2024.

The advisory says SafePay gets in through exposed credentials, brute-force password attacks and VPN access, particularly from IP addresses of the VPN provider Mullvad, and by exploiting known flaws in edge devices. BleepingComputer adds that SafePay works without affiliates, steals data before encrypting it and threatens to leak it, and may delete shadow copies and reset backup storage to hamper recovery.

The agencies recommend multifactor authentication, limiting admin tools and privileges, and patching VPNs, firewalls and other edge devices, and say paying a ransom does not guarantee files come back.

CISA warned on October 21 that attackers are actively exploiting four vulnerabilities in Plex Media Server, the popular software people use to stream their own movies, music and photos. Chained together as "Plex2Shell," they let an attacker obtain the owner's admin token and run code with elevated privileges, BleepingComputer reports.

Researcher Zach Main reported the flaws to Plex on July 27, published technical details on October 16 and a proof-of-concept exploit three days later. Reports of exploitation began on October 17, at first against Plex honeypots to install a cryptominer. The researcher rates the full chain 9.8 out of 10.

Plex Media Server versions before 1.43.3.10861, released August 4, are affected. CISA gave federal agencies until October 23 to patch. In the same update CISA added exploited flaws in Siemens Software Center and the SiteGuard Server Edition web application firewall to its catalog.