Critical Infrastructure Attacks, PhantomSub WhatsApp Infiltration, Denmark Data Breach

Critical Infrastructure Under Siege: Multiple Zero-Days Rock Security World

Last week saw an unprecedented wave of critical security incidents affecting enterprise infrastructure, cloud platforms, and personal data. From a third consecutive Citrix NetScaler zero-day exploit hitting organizations within days to the arrest of a major extortion group leader and the exposure of millions of government records across Europe, this week underscored how quickly threats can cascade across interconnected systems. These incidents highlight the urgent need for advanced email authentication and threat detection across all organizational layers.

PhantomSub campaign secretly adds developers to WhatsApp groups via 101 malicious npm packages

The OX Research team identified 101 npm packages as part of a malicious WhatsApp group subscriber campaign dubbed PhantomSub. The malicious packages abuse the “Baileys” WhatsApp open source project to add the victims to groups without their consent. Most packages in this report were first published in August and September 2026, and most are still live on npm.

101 npm packages in PhantomSub abuse Baileys to add WhatsApp users to groups without consent, with 490,000 downloads in total. Three variants of malware were identified: one fetches channel IDs from GitHub at runtime, another embeds them in cleartext within its source code, and the third uses encoded and obfuscated channel IDs. PhantomSub: Malicious npm Campaign Secretly Adds Users to WhatsApp Spam Channels - OX Security +2

Denmark suffers massive data breach exposing 8.8 million citizens’ personal records

Denmark has confirmed a major data breach involving its Central Population Register, known as CPR, after unauthorized parties accessed personal records belonging to about 8.8 million people. The exposed information includes names, addresses, and CPR numbers (personal identification numbers). Christina Egelund, Danish digitalisation minister, has described the breach as a “serious incident”. The CPR administration became aware of unusual system behavior on Friday evening, October 2.

Over the following weekend, officials established that unauthorized parties had accessed information covering approximately 8.8 million registered people. The breach occurred after unidentified individuals misused a private Danish company’s legitimate access to search the Central Person Register, known as CPR. Denmark Data Breach Exposes Personal Records of 8.8 Million People +3

Hackers claim to have millions of Airbnb, Uber, and Google records for sale

A hacker called Marx claims to sell 54 million records tied to Airbnb, Uber, PayPal, Booking.com, and Google. The attackers boast of live access to a trove of data. Marx’s earliest known forum activity dates back to the beginning of this October, when the actor advertised 11 million records allegedly connected to Mastercard transaction data.

The number of records correlates to the number of SMS messages, with longer messages split across multiple database records, meaning that a claim involving millions of “records” does not necessarily translate into millions of individual customers. Third-party SMS provider breach may expose Airbnb, Uber, PayPal users +2

OpenSSL patches high-severity DTLS flaw that can leak heap memory unencrypted

A High-severity OpenSSL flaw can leak heap memory to the other side of a DTLS connection or crash the program. The flaw, tracked as CVE-2026-84782, is fixed in OpenSSL 4.0.3, 3.6.5, 3.5.9 and 3.4.8. The wrongly labeled message can carry heap memory to the other side as unencrypted handshake data. If the read reaches unmapped memory, the program crashes.

The weakness is classified as CWE-125, an out-of-bounds read, and its main security impact is unintended disclosure of heap memory to the remote DTLS peer. openssl fixes high severity dtls flaw +2

Google suspends open-source bug bounty program amid flood of AI-generated submissions

Google has paused its Open Source Vulnerability Rewards Program due to a flood of AI submissions. The temporary suspension came as researchers began submitting numerous AI-generated vulnerability reports that did not meet the program’s standards. Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports as the company temporarily stopped accepting product vulnerability reports through its Open Source Software Vulnerability Reward Program (OSS VRP). infosecurity-magazinehelpnetsecurity

ClingSTUN malware turns unpatched IoT devices into proxy nodes

ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes. ClingSTUN exploits known IoT flaws and abuses public STUN servers to keep proxy access to devices. The malware leverages existing vulnerabilities in IoT systems rather than relying on zero-days, making patching and vulnerability management critical for IoT deployments. infosecurity-magazine

Minecraft players’ personal data surfaces in alleged 18-million record breach

Records allegedly belonging to 18 million Minecraft players have surfaced online this week, with attackers claiming access to user accounts, email addresses, and related personal information. The incident highlights continued security challenges in the gaming and online entertainment sectors.https://cybernews.com/security/minecraft-players-data-breach/

US federal government arrests tech executive over alleged $300 million GPU diversion to China

US arrests tech executive over alleged $300M GPU diversion to China, highlighting ongoing concerns about technology supply chain security and illegal export controls violations. cybernews

Frontline Education breach impacts K-12 school district staff

A breach at school software provider Frontline Education has exposed employee data at multiple K-12 school districts. The incident raises concerns about the security of educational technology platforms that handle sensitive school and staff information. infosecurity-magazine

Apple tightens macOS disk access controls as AI agents become increasingly powerful

Apple tightens macOS disk access as AI agents become more powerful, implementing enhanced security controls to prevent autonomous AI systems from accessing sensitive disk resources without proper authorization. helpnetsecurity

Researcher demonstrates critical zero-day allowing VM escape and root access on KVM hosts

A cyber professionabreacl has discovered a critical KVM guest-to-host escape vulnerability, breaking out of a virtual machine and gaining root access on the host system. This type of vulnerability is particularly dangerous for cloud infrastructure and virtualized environments. cybernews

Dutch police arrest 24-year-old in connection with ShinyHunters cybercriminal group

Following up on the Jordan arrest of Rey, Dutch authorities have confirmed that they arrested a 24-year-old man from Amsterdam in connection with the ShinyHunters group. This shows ongoing international law enforcement coordination against major cybercriminal organizations. Wiu

These incidents reinforce the importance of strong cybersecurity practices, including DMARC, SPF, and DKIM, to help protect organizations from phishing, email spoofing, and other evolving cyber threats.