ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories
DreamHost is now the target of an action by law enforcement.
Attackers have later displayed less caution over losing an access to achieve an objective, as the cost to replace is minimal." An analysis of roughly 383,000 CVEs disclosed from 1999 through September 2026 determined that the median time to patch a vulnerability exceeds a year for network appliances.
Victims of the scheme included educational institutions in New York, Tennessee, North Carolina, and Massachusetts." Cybersecurity researchers have detailed an encryptionless extortion attack involving PAYLOAD ransomware targeting a manufacturing organization in the Middle East.
Anyone who holds the commitment, the prompt, and the reply can check it, without the weights and with limited compute power, and be convinced that the committed weights, run on this prompt, produce exactly these tokens." DreamHost has warned of a data breach after an unauthorized third party gained access to the server that runs its web-based File Manager at files.dreamhost.com between August and October 23, 2026.
Cybersecurity researchers have uncovered encryption weaknesses in the updated HYFLOCK ransomware builds.
The maintainers of Apache OFBiz have addressed 46 security flaws , including CVE-2026-68524, which could result in pre-authentication remote code execution, and CVE-2026-109928, which enables full account takeover due to an incorrect authentication algorithm implementation.
That gap is the threat actor's window, widest on the critical systems that stay exposed the longest." the company also said threat actors disproportionately target flaws that maximize impact and exposure and enable system takeover, particularly remote code execution, privilege escalation, and authentication bypass.
We believe this was a deliberate attack, and our team worked around the clock to contain it." DreamHost said the attacker may have accessed the credentials used to access the File Manager or webmail, along with the contents of emails and files in the FTP/SFTP server.
The ransomware operation began to publicly name victims in October 2026, although evidence indicates that the group first appeared in underground forums in March 2026.
The only ransomware we found in this incident was a PAYLOAD sample targeting ESXi on Linux servers." The attack represents a convergence of two trends: Living-off-the-land abuse of trusted AD infrastructure and a surge in extortion-only incidents.
Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws, allowing researchers to earn $250,000 for Root-in-Cloud bugs, including tenant-isolation bypasses and complex cross-service logic flaws that let attackers gain full administrative control over arbitrary Google Cloud organizations.
What happened
Attackers have later displayed less caution over losing an access to achieve an objective, as the cost to replace is minimal." An analysis of roughly 383,000 CVEs disclosed from 1999 through September 2026 determined that the median time to patch a vulnerability exceeds a year for network appliances.
Victims of the scheme included educational institutions in New York, Tennessee, North Carolina, and Massachusetts." Cybersecurity researchers have detailed an encryptionless extortion attack involving PAYLOAD ransomware targeting a manufacturing organization in the Middle East.
What changed
Anyone who holds the commitment, the prompt, and the reply can check it, without the weights and with limited compute power, and be convinced that the committed weights, run on this prompt, produce exactly these tokens." DreamHost has warned of a data breach after an unauthorized third party gained access to the server that runs its web-based File Manager at files.dreamhost.com between August and October 23, 2026.
Cybersecurity researchers have uncovered encryption weaknesses in the updated HYFLOCK ransomware builds.
Who is affected
The maintainers of Apache OFBiz have addressed 46 security flaws , including CVE-2026-68524, which could result in pre-authentication remote code execution, and CVE-2026-109928, which enables full account takeover due to an incorrect authentication algorithm implementation.
That gap is the threat actor's window, widest on the critical systems that stay exposed the longest." the company also said threat actors disproportionately target flaws that maximize impact and exposure and enable system takeover, particularly remote code execution, privilege escalation, and authentication bypass.
Why it matters
We believe this was a deliberate attack, and our team worked around the clock to contain it." DreamHost said the attacker may have accessed the credentials used to access the File Manager or webmail, along with the contents of emails and files in the FTP/SFTP server.
The ransomware operation began to publicly name victims in October 2026, although evidence indicates that the group first appeared in underground forums in March 2026.
Technical details
The only ransomware we found in this incident was a PAYLOAD sample targeting ESXi on Linux servers." The attack represents a convergence of two trends: Living-off-the-land abuse of trusted AD infrastructure and a surge in extortion-only incidents.
Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws, allowing researchers to earn $250,000 for Root-in-Cloud bugs, including tenant-isolation bypasses and complex cross-service logic flaws that let attackers gain full administrative control over arbitrary Google Cloud organizations.
These servers transmitted malware and mining software to victim computers and stored stolen login credentials.
Response
And while new tools are helping find security holes faster, some important systems are still taking months, sometimes over a year, to get patched.
Both have been charged with conspiracy to obtain information from a protected computer and to cause damage to a protected computer, obtaining information from a protected computer, and intentional damage to a protected computer, which carry a maximum penalty of 10 years in prison and a $250,000 fine.
What security teams should do
A vulnerability impacting Docker Sandboxes (CVE-2026-103916) could have been exploited to bypass file access restrictions, potentially exposing cloud credentials and other sensitive files on a developer's machine through a routine copy command.
Additionally, an organisation’s internal patching and testing processes will need to evolve to meet the pace of accelerating vulnerability discovery.
Attribution
The Hacker News: And while new tools are helping find security holes faster, some important systems are still taking months, sometimes over a year, to get patched.
What to watch next
Watch for updated vendor guidance and fixed-version details.