FBI arrests Canadian cyber executive Edward Dubrovsky in ShinyHunters extortion case

FBI arrests Canadian cyber executive Edward Dubrovsky in ShinyHunters extortion case

Federal investigators pursuing ShinyHunters, the group that hacked the FBI recruitment site fbijobs.gov, arrested 54-year-old Canadian cybersecurity executive Edward Dubrovsky on October 9. He is charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion, and prosecutors asked that he remain in custody. The FBI says ShinyHunters has extorted more than $70 million from victims this year. Investigators believe at least one executive at a large U.S.-based consulting firm played an active role operating the now-defunct Shinywire extortion site, which listed nearly 100 hacked organizations. Signal messages from detained suspect Pepijn van der Stap showed negotiators often knew about new victims before the victims did.

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site – Krebs on Security →

Topics: ShinyHuntersCybercrime arrests

Chinese crime ring hacked Staples to issue millions in fraudulent gift cards

A Chinese organized crime group hacked into Staples and used that access to fraudulently issue millions of dollars worth of gift cards for retailers including Target and Sephora, then went on a nationwide shopping spree, according to a review of court records. Much of the stolen electronics and other merchandise was shipped back to China as part of a large-scale retail theft operation that included entire warehouses dedicated to housing the goods. The Staples hack had not been previously reported. The case adds to a growing picture of organized retail crime run through compromised corporate systems rather than individual store theft.

How a Massive Chinese Crime Ring Hacked Staples to Steal Millions →

Rank Math PRO WordPress plugin backdoored in supply-chain attack

Some downloads of the Rank Math PRO WordPress plugin from the vendor’s official website carried malware that planted hidden backdoors in a supply-chain attack. Users who downloaded version 3.0.123 between October 15 at 20:02 UTC and October 16 at 07:12 UTC received compromised files that could infect their websites upon activation. Rank Math said it removed the affected files and released a clean version, 3.0.124. The malware establishes persistent access, communicates with rank1cdn[.]com, and recreates backdoors when someone visits an infected site. It can expose database credentials, API keys and cloud secrets. Only the PRO version was affected; the free plugin, active on more than 4 million websites, was not.

WordPress SEO plugin Rank Math compromised to backdoor websites →

Topics: Supply chain attacks

F5 patches three critical NGINX flaws allowing code execution

F5 released out-of-band security patches for multiple NGINX web server flaws, including three critical-severity vulnerabilities that can allow attackers to execute code. The critical flaws are in the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205) and the NGINX map directive (CVE-2026-93479). Unprivileged remote attackers can exploit them to launch denial-of-service attacks or gain code execution on NGINX systems with non-default configurations, causing a heap-based buffer overflow or use-after-free in the worker process. Patches cover NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric and NGINX Instance Manager. F5 has not flagged these issues as exploited in the wild.

F5 releases out-of-band patches for critical NGINX vulnerabilities →

Topics: Patch Tuesday & security updates

iVerify finds P7 DarkSword iPhone spyware stealing passwords and photos

Security researchers at mobile security company iVerify discovered a new variant of iPhone spyware called P7 DarkSword while investigating an infected iPhone in August 2026, according to an October 8 report. The spyware can collect sensitive information and communicate with attackers who can issue additional commands remotely. Capabilities identified in its code include extracting data from the iPhone keychain, which stores passwords and other credentials, searching for wallet applications including imToken, retrieving recent photos, copying Notes databases and inventorying installed apps. Its command-and-control system can check for instructions every 15 seconds. Apple said it patched the underlying vulnerabilities in 2025 and that known DarkSword exploits do not work on devices with Lockdown Mode enabled.

New iPhone spyware can steal passwords and photos →

Topics: Spyware