Quantum Cybersecurity & Associates @Postquantuminc

Christmas Eve 2008. Tesla closed a funding round in the final hour, days from bankruptcy. Elon Musk put in all his money & assets, borrowed from friends just to pay rent. If it missed, payroll would have bounced two days after Christmas.

Two Linux items this hour: a remote denial-of-service in rpcbind with fixes out, and 116 new unscored kernel CVEs. Nothing is known to be exploited, and CISA's list hasn't changed since the Oct 27 Brotli and Adobe Commerce entries. 1. CVE-2026-94640: rpcbind remote denial of service (CVSS 7.5) The flaw: A remote attacker with no login can flood rpcbind with many unique requests. rpcbind keeps per-request statistics in memory with no limit, so memory and CPU use keep growing until the service degrades. Fix: Update the rpcbind package. Red Hat shipped fixes, for example RHSA-2026:83561 and RHSA-2026:89197. See also the Red Hat CVE page. Mitigation: If a host doesn't need NFSv3 or NIS, disable rpcbind. In any case, block port 111 over TCP and UDP at the network edge. Detection: Watch rpcbind's memory use for steady growth, and look for large numbers of different RPC calls arriving on port 111.

Crypto Casino Gamdom Faces $15M Bitcoin Ransom After Multimillion-Dollar Hack

🚨 Hackers are probing a critical Oracle E-Business Suite vulnerability just days after it was patched. CVE-2026-101767 (CVSS 9.8) allows unauthenticated SQL injection that can lead to remote code execution. Exploit attempts were detected on decoy systems on October 27. What we know ↓ thehackernews.com/2026/10/hacker…

2. 116 new Linux kernel CVEs (CVE-2026-99101 through CVE-2026-99216), none scored yet
These are fixes already merged into the stable kernel branches. The ones most likely to be rated high: CVE-2026-99128: a remote SCTP peer can send a zero-length chunk that locks up the receive path. This only applies when SCTP-AUTH covers ASCONF. CVE-2026-99110: a heap overflow in the SMB client when setting a POSIX ACL (cifs_do_set_acl). CVE-2026-99138 and CVE-2026-99139: local use-after-free bugs in TCP getsockopt, triggered when a BPF program supplies the congestion control. Also worth noting: an SELinux BPF token permission race (CVE-2026-99129), several KVM fixes, a use-after-free in net/sched tcf_action, plus vsock, ksmbd and ntfs fixes. Apply your distro's next kernel update once it includes these fixes. Until then: SCTP: Block the module where you don't use it, with install sctp /bin/false in modprobe.d. BPF: Limit unprivileged use with kernel.unprivileged_bpf_disabled=1. Detection: Watch dmesg and journald for KASAN, oops or "soft lockup" messages, and alert on unexpected sctp module loads. The rest of this hour's new records were third-party products rather than core Windows or Linux. They include Dell PowerProtect Data Domain (CVE-2026-103780, up to 9.8), Acronis Cyber Protect (7.1 to 7.4) and a Norton, Avast and AVG Data Shredder privilege escalation on Windows (CVE-2026-6064, 7.3, fixed in 26.5.10933).

Case update from @FBIElPaso: Timothy France Johnson was sentenced to 51 months in federal prison along with a money judgement of $3,148,094.48 for running an 11-year Ponzi scheme in which he represented to investors that he would use their funds to promote NBA preseason games. Read more: justice.gov/usao-wdtx/pr/e…

🚨 Skyw4lker phishing campaign targets U.S. firms using Microsoft 365 device code phishing. No password theft required. Attackers use fake business documents and Google Sites to trick victims into authorizing access to their Microsoft 365 accounts. How the attack works ↓ thehackernews.com/2026/10/americ…

Wallet Potentially Linked to $40M UXLINK Hack Shows $6.54M in Unrealized ETH Gains A wallet suspected of belonging to the hacker behind last year’s roughly $40 million UXLINK theft holds a 30,282 ETH long on Hyperliquid, according to on-chain data. The position has an average entry price of $2,134.45 and is worth approximately $71.17 million, with $6.54 million in unrealized gains. A funding address associated with the position and a known UXLINK hacker address both transferred ETH held for gas fees to the same wallet on the same day. The trader began trading ETH on Hyperliquid in early August after consolidating roughly 11.55 million USDC from multiple sources, with five of six trades showing a profit.

Received a sudden flood of MFA login prompts on your phone? That’s MFA Fatigue, and it’s a trap. Scammers spam your device hoping you’ll tap "Approve" just to stop the buzzing. Deny the request and change your password. #NovacybersecurityInc #SecuringTheNext250 #CybersecurityAwarenessMonth

⚠️ Fake login pages aren't just stealing passwords anymore. AI makes phishing pages easier to clone and personalize. Some attacks go further, stealing MFA codes or hijacking authenticated sessions to access corporate accounts. How these attacks work and what stops them ↓

⚠️ A Gemini agent in a security test reportedly accessed 3 real companies, one by guessing a password. Anthropic says a fake “discounted Claude” reseller stole buyers’ credentials. Same weak point: a credential someone can guess, find, or steal.

Japan's cyberattacks are forcing companies to compensate customers. 🇯🇵 GMO Internet says intruders accessed its foreign-exchange trading service. It will cover customer losses, plus pay every customer five thousand yen, around 32 dollars. Then came an extortion demand, threatening to expose company and customer data. GMO refused. Park24 separately offered three thousand yen to eligible users after its car-sharing data breach. By October twentieth, Japan logged 723 cyber incidents, exceeding either of the previous two full years.

The Dangote Refinery IPO closes today, and it has reportedly already hit its target. Bloomberg says domestic and retail investors alone have committed $1.5 billion to $1.6 billion. Applications came from 119 countries, including all 54 African countries. Think about that for a second. The same Nigerians people say don’t trust the stock market may have funded Africa’s biggest IPO almost by themselves. Demand could be so strong that some international investors get squeezed out, and Dangote may sell part of his own stake to those who miss out. The money will go towards expanding the refinery to 1.4 million barrels a day by 2029.

HE STOLE $947,000 IN 51 SECONDS. 4 MINUTES AFTER HIS WALLET WENT PUBLIC, HE MOVED EVERYTHING. THEN HE FROZE. AND NOW OTHER SCAMMERS ARE HUNTING HIM. this is the Bloom drain, rebuilt from 73 on-chain transactions. timestamps are UTC, and every one of them is public. > CHAPTER 1: THE KNOCK (00:59) first move: 1 lamport out of the biggest victim wallet. that's $0.0000001. he isn't stealing yet. he's checking whether the door is open. > CHAPTER 2: THE ROLL CALL (01:02) ten more wallets each send 0.001 SOL to the same address, about one every 2 seconds. a person doesn't do that. a script is checking which wallets it controls. > CHAPTER 3: THE 51 SECONDS (01:03:50 → 01:04:41) 41 wallets emptied in 51 seconds. 1,636 SOL, then 1,039, then 1,021, then 765. every drain was signed by the victim's own wallet, which paid its own fee. no brute force. no phishing link. the wallets simply said yes. > CHAPTER 4: HE CAME BACK FOR MORE (01:28) 24 minutes later he sends 0.02 SOL back into one drained wallet. why give money back? that wallet still held ~$49k in USDC, and it had no SOL left to pay fees. he tests it with 0.000001 USDC transfers. the $49k never reaches him. > CHAPTER 5: SPOTTED (04:26 → 04:30) 04:26:10: Onchain Lens posts his address. 04:30:56: all 9,408.21 SOL leaves in one transaction to a brand-new wallet. 4 minutes 46 seconds. he was watching X too. > CHAPTER 6: THE FREEZE since then that wallet hasn't moved. no bridge, no swap, no exchange. almost $1M, parked in plain sight for 10 hours and counting. > CHAPTER 7: THE SCAVENGERS this is the part nobody's talking about. lookalike wallets start showing up, copying the first and last characters of real addresses, and they send dust to the drainer so a fake shows up in his history. then they go after the hacker's new wallet with copies of his own address, hoping he pastes the wrong one when he cashes out. scammers trying to scam the scammer. > BLOOM'S SIDE Bloom: a third-party module had a remote code execution bug. no private keys leaked. 9 users, 49 wallets, 100% refund. on-chain: every drain was signed by the victims' own wallets. both can be true. if you can run code on the machine that signs, you never need the key. you just ask it to sign. by 12:41 Bloom was publicly offering to negotiate. so let's recap: • 1 lamport to knock • 10 test transfers • 41 wallets in 51 seconds • 4m46s from exposure to exit • 10+ hours frozen • a crowd of scammers waiting for him to make one copy-paste mistake he doesn't have to outsmart anyone. he just has to outwait you. we don't get bored. we're watching 6nYy…moe9.

🇺🇸 NEW: The US DOJ is appealing a federal judge’s ruling that lifted the government’s ban on agencies using Anthropic’s AI, escalating the fight over the Pentagon’s supply-chain risk label on the company, per Bloomberg.

keyboard_arrow_left Previous keyboard_arrow_right Next

Ethereum Delays Glamsterdam Hoodi Fork Over EIP-8037 and EIP-8038 Risks Ethereum researcher Toni Wahrstätter said the planned Glamsterdam fork on the Hoodi testnet has been delayed after ChainSecurity identified compatibility risks in EIP-8037 and EIP-8038. The gas changes could break contracts that assume gas usage only decreases or cause failed sub-calls to behave unexpectedly. ChainSecurity has found 13 real-world cases, and developers are reviewing whether the upgrade specification needs changes.

⚠️ Fake login pages aren't just stealing passwords anymore. AI makes phishing pages easier to clone and personalize. Some attacks go further, stealing MFA codes or hijacking authenticated sessions to access corporate accounts. How these attacks work and what stops them ↓ thehackernews.com/2026/10/ai-gen…

Strive Adds 6,182 BTC as Holdings Reach 43,000, Opens $1B SATS ATM According to SEC filings, Strive purchased 6,182 BTC between October 17 and 23 at an average price of about $82,732, bringing total holdings to 43,000 BTC. The company also entered into an at-the-market program to sell up to $1 billion of its SATS perpetual preferred stock, with proceeds potentially used for additional Bitcoin purchases, working capital, income-generating investments and share repurchases.

Hyperliquid: Kraken Parent Payward Plans to Become First CFTC-Regulated HIP-3* Deployer Hyperliquid announced that Kraken parent Payward plans to become the first CFTC-regulated HIP-3* deployer, using Hyperliquid infrastructure to offer perpetual futures markets to U.S. clients. Subject to regulatory approval, Payward's CFTC-regulated DCM and DCO, Bitnomial, would serve as the deployer, managing the markets and clearing and settling contracts, while its CFTC-registered FCM, NinjaTrader Clearing, would carry client accounts. HIP-3* will introduce optional onchain allowlists for permissioned markets without affecting existing HIP-3 markets. The initial version is available on testnet, with specifications subject to change.

🚨 Microsoft Teams IT support scams are leading to malware and ransomware attacks. Researchers tracked hundreds of cases where attackers flood inboxes with emails, impersonate IT staff on Teams, and trick employees into granting remote access. How the attacks work ↓