by sig9
Hacker Wars - October 12, 2026
Your daily dose of infosec chaos
The edge is on fire again, this time courtesy of SonicWall and a pre-auth bug that went from advisory to active exploitation in days. Elsewhere, AI coding agents are officially part of the attacker toolkit, 8.7 million karaoke fans learned their sing-along data got exposed, and the ShinyHunters saga added a plot twist nobody scripted. Pour something strong.
SonicWall Pre-Auth Flaw Exploited Days After Disclosure
CVE-2026-102255, a pre-authenticated SSRF vulnerability in SonicWall gear, is already being exploited in the wild just days after it was disclosed. Edge appliances are the new front door, and crews scan for fresh CVEs faster than most orgs schedule maintenance windows.
What to do: Patch affected SonicWall devices immediately and hunt your logs for unexpected outbound requests from management interfaces.
CyberXero Wields Claude Code To Steal 628,000 Ukrainian Records
A campaign dubbed CyberXero paired commodity tooling like Cobalt Strike with Claude Code to hit WordPress sites, e-commerce platforms, and critical infrastructure in Ukraine, lifting over 628,000 records. Offensive AI is no longer a conference slide - initial access operations are now augmented with coding agents that build and adapt malware at conversational speed.
What to do: Lock down internet-facing CMS installs, and assume AI-generated payloads will dodge signature detection - behavioral monitoring is your friend.
Karaoke Breach Sings 8.6 Million Records Into The Wild
A malware infection at Nippon Columbia, a contractor for entertainment giant Daiichi Kosho, exposed more than 8.7 million customer and employee records. Your data’s security is only as good as your least-monitored contractor, and attackers increasingly start their journeys one supply chain hop away from the big target.
What to do: Map your third-party data flows, require incident notification clauses with real teeth, and assume vendor compromise when scoping your own detection.
P7 DarkSword iOS Kit Adds Wallet Theft And Two-Way Control
Researchers surfaced a new DarkSword iOS exploit kit variant, P7, that shrinks its on-device footprint while adding keychain and crypto wallet theft plus two-way C2 communication. iOS is not the safe harbor your users think it is - the kit steals secrets straight from the keychain and now takes remote commands, not just payloads.
What to do: Get MDM-enforced iOS patch levels, block sideloading and rogue profiles, and warn wallet users that “it’s an iPhone” is not a security control.
Cybersecurity Executive Arrested In Alleged ShinyHunters Extortion Case
Canadian security exec Edward Dubrovsky was arrested in Pennsylvania over alleged extortion activity tied to the FBI’s ongoing ShinyHunters crackdown. When the person selling you protection is allegedly on the other side of the ransom note, the industry’s background-check problem becomes everyone’s problem.
What to do: Vet your security vendors and hires properly, and make sure privileged access comes with oversight - trust is not an identity control.
That’s the chaos for today. Stay sharp out there.
Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown
This bulletin is provided for informational purposes. Contact us for tailored security analysis.