An anonymous reader quotes a report from Ars Technica: Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere. PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10. "All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available," the advisory stated. "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild." The maintainers published the advisory following the leaking of purported details, which have yet to be confirmed. The report showed a video of an exploit tool dubbed PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9, all of which use PHP. A video depicting the tool has been reposted here. Attempts to locate the unconfirmed report were unsuccessful, but security firm watchTowr said it claimed to affect every PHP version from PHP 5, released in 2004, onward. The security firm went on to say it has confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real. Researchers from separate security firm Sansec said they "expect mass attacks to start within 15 minutes of the release." A third security firm, Webfence, also urged admins to prepare now. Huntress has also issued an advisory.

Read more of this story at Slashdot.

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom.

Hackers aligned with ShinyHunters have claimed credit for dozens of major data breaches since 2019, when the group was primarily operated by cybercriminals living in France. As those original members were arrested or jailed one by one, control over the ShinyHunters brand eventually passed to “Rey,” identified last year as a teenage hacker from Amman, Jordan. According to the FBI, ShinyHunters has extorted more than $70 million from victims so far this year.

In late September, ShinyHunters hacked the FBI recruitment website fbijobs.gov and taunted the agency by threatening to publish the stolen files, which reportedly included medical and psychological records, Social Security numbers and home addresses, and information about each employee’s unit and specialization.

The FBI jobs site hack has prompted the agency to move with uncommon speed to arrest, detain and question people who had any communications with Rey or other ShinyHunters suspects. Reuters reported on October 3 that Rey had been detained by Jordanian authorities and was cooperating with the FBI.

Rey was able to assume control over the hacking group because one of its alleged senior members had just been nabbed. On the evening of September 15, 2026, authorities in the Netherlands arrested convicted hacker and ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly used flash-bang grenades in an effort to stun and apprehend Van der Stap as he was logged in to various online accounts.

According to a source close to the investigation, the authorities arrested Van der Stap while he was using his Signal instant messaging account, which allowed them to read recent communications with frequent contacts — including ransomware negotiators based in Canada and the United States.

Multiple sources with knowledge of the matter told KrebsOnSecurity that Van der Stap’s messages were the key to unraveling a murder-for-hire plot that emerged immediately following his arrest. The Dutch news outlet RTL reported last month the two murders were allegedly to be committed abroad, and that there are indications Van der Stap gave the order for the attacks (there is no indication those orders were ever carried out).

On October 9, KrebsOnSecurity broke the news that the FBI arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the ShinyHunters investigation. Dubrovsky, who recently published a book on handling cyber extortion that recommended always engaging with the hackers, was charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion, according to court records. Politico reports prosecutors have asked that Dubrovsky remain in custody pending trial, and that records related to his case remain under seal.

A source close to the investigation told KrebsOnSecurity that Van der Stap’s Signal messages showed he had frequent conversations with Mr. Dubrovsky and with at least one executive at a large U.S.-based consulting firm, and that these executives often knew the details about new ShinyHunters victims before the victims themselves had even learned of the breach.

That source shared another potentially explosive finding by federal investigators: the Dutch hacker’s chats showed Mr. Dubrovsky knew ShinyHunters had stolen highly sensitive data from FBI servers, and that he never informed the bureau of the data breach prior to ShinyHunters threatening on Twitter/X to publish the agency’s deeply personal personnel files.

SHINYWIRE

KrebsOnSecurity has learned from two sources close to the ShinyHunters probe that FBI investigators believe at least one executive at a U.S.-based consulting firm played an active role in operating the now-defunct ShinyHunters victim extortion website “shinywire[.]com.” KrebsOnSecurity is not naming the U.S. company or the suspected executive(s) for now because they have not yet been charged with a crime, but it is a prestigious firm with more than 1,000 associates.

The Shinywire website was active from approximately May 3, 2026 until October 16 and had entries for nearly 100 organizations hacked by ShinyHunters. Each entry urged victims to engage with the cybercrime group and discuss terms for payment. The pages also included samples of stolen files and promised those files would be published online if the victim ignored their demands.

The following screenshot shows a cached portion of the Shinywire extortion page for Intuitive Surgical, an American medical technology company that was breached in March 2026 after an employee fell for a targeted phishing email.

Victim organizations that refused to engage or negotiate after seven days would find all of their stolen data published on the ShinyHunters victim shaming blog (a website that is only reachable via the anonymity network Tor).

In a story published October 15, The Globe and Mail wrote that a few months before Edward Dubrovsky was arrested by the FBI, the Canadian cybersecurity executive alleged in court documents he had become collateral damage in a campaign by a former business partner to “destroy” another industry executive.

The story noted that Dubrovsky filed the lawsuit in Ontario this year against Daniel Tobok, the former chief executive of Cypfer, a cybersecurity firm founded in Toronto with offices in the U.S., Britain, the Netherlands, the United Arab Emirates, and Mexico. The two first became business partners in 2017 and later developed Cypfer together, where Mr. Dubrovsky was a managing partner and chief operating officer. But by 2024, the two had a falling out, with Dubrovsky accusing Tobok of gradually excluding him from business matters and making “increasingly capricious business decisions.”

Mr. Tobok reportedly denied the allegations and filed a counterclaim, accusing Mr. Dubrovsky of accessing confidential information and unfairly competing with Cypfer through work at another firm called CyberSteward Inc. He also said Mr. Dubrovsky has misrepresented himself as a Cypfer founder, and is not a shareholder.

GHOSTBYTE

According to interviews with several former colleagues of Mr. Tobok, as far back as eight years ago he was known to ransomware purveyors by a particular nickname: Ghostbyte. In 2018, a Canadian company was hacked by Dharma, a prolific Russian-language ransomware affiliate program that first surfaced in 2016. The victim company told the Dharma ransomware representative they were leaning toward paying because some of the files were unrecoverable after being locked, but that they needed a better guarantee that Dharma would keep their word if paid.

A redacted copy of the Dharma rep’s reply is pictured below, and it shows the ransomware group urged the victim to contact a person at a Canadian IT firm that helps companies seeking such guarantees. The Dharma rep recommended the victim contact the email address ghostbyte@tutanota.com.

“If you want guarantees, you can write to the IT company,” the Dharma reply advised. “Take the phone and negotiate with them. This IT company often solves such problems in Canada. You can contact them and sign a contract for services. You’ll still have to pay.”

It’s unclear if Mr. Tobok ever used that Ghostbyte address offered by the Dharma representative, and he has not responded to multiple requests for comment. However, the breach tracking service Constella Intelligence finds an email address Mr. Tobok has frequently used — dtobok@me.com — is associated with two online accounts where the chosen username was “ghostbyte,” including a Snapchat account.

Incidentally, Constella also finds the Dharma rep’s email address luckygoodlucky@tuta.io is associated with a cryptocurrency address that processed 38 transactions totaling 43 bitcoin, ~$3.5 million at today’s value (the most recent transaction for this wallet is dated February 2019).

In a statement shared on October 14, Cypfer said the company’s business does not include making or facilitating ransomware payments, and that Cypfer learned of Dubrovsky’s arrest when the news first broke in the media.

“We had no prior knowledge of Mr. Dubrovsky’s arrest,” a spokesperson told KrebsOnSecurity via email. “CYPFER has not received any outreach from law enforcement and, to our knowledge, is not the target of any law enforcement investigation.”

The statement said CyberSteward and Cypfer are separate companies with no officers, directors or employees in common, and that Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. In 2020, Aon aquired Cytelligence, a security consulting firm where Mr. Tobok was founder and CEO and Mr. Dubrovsky was a managing partner.

CONFLICTING INTERESTS

It is not illegal in the United States to pay hackers for an encryption key to unlock servers infected with ransomware, or in exchange for a promise to delete any stolen files and refrain from publishing them online. While victim organizations can land in legal hot water if they pay a ransom to a group that is sanctioned by the U.S. Treasury Department, ShinyHunters is not among the ransomware groups currently sanctioned by the United States or by any other government.

Experts say ransomware victims are typically directed by their insurance provider to work with a specific incident response firm. But not all cyber forensics and breach response companies will agree to facilitate payments to ransomware groups on behalf of their clients. As a result, once victim firms make a decision to pay, the firms that eschew rewarding extortionists are invariably replaced by companies that have no such qualms.

In December 2024, ShinyHunters began extorting the education technology company PowerSchool, stealing private information on 62 million students and 9.5 million teachers in the U.S. and Canada. PowerSchool reportedly paid a $2.85 million ransom demand, and a “frequently asked questions” statement (PDF) about the breach says PowerSchool was assisted in that effort by CyberSteward (ShinyHunters affiliate Matthew Lane, 20, of Sterling, Mass., was sentenced in November 2025 to four years in prison for his admitted role in the PowerSchool hack).

But that ransom payment did not stop future extortion attempts using the same stolen data. By May 2025, individual school districts were reportedly receiving separate ransom demands using samples of the same stolen files. While nobody has alleged ShinyHunters was behind the second wave of extortion against PowerSchool users, the incident drives home the reality that there is no technical way to verify the threat actors have deleted the stolen data as promised, or prevent others from abusing the same records.

A number of leading cyber incident response firms, including Coveware and Unit 221B, have consistently warned victims against paying ShinyHunters, noting that “destroyed” victim data is often kept, resold or used to extort the company’s clients directly later on.

The FBI echoed those sentiments in an alert on May 15, 2026 advising victims against paying the ShinyHunters group. Meanwhile, ShinyHunters members have been harassing and threatening employees at Coveware and Unit 221B for offering this advice.

The following screenshots show just how annoyed the ShinyHunters leaders were with Coveware’s relentless advice against paying the group. The first image is from a conversation on May 6, 2026 that took place between the group’s main account on Telegram and a co-conspirator. In that chat, snippets of which were shared with KrebsOnSecurity by a trusted source, ShinyHunters complained that Coveware was harming the group’s payment rates.

“Go on my website, majority of those companies would’ve paid if it weren’t for Coveware giving them misinformation,” the ShinyHunters account wrote. “Someone (100% Coveware) is going out of their way to make sure i am not paid.”

In another conversation on April 11, 2026, the ShinyHunters Telegram account privately said they were trying to “eliminate the problem,” which they said was Coveware. Coveware declined to comment for this story.

“I’m sure the company will pay but in this specific case I am aware of Coveware and their involvement, and I’ve probably been not getting a lot of other negotiations mostly likely because Coveware keeps getting involved,” the ShinyHunters account bemoaned.

Mark Camillo is chief executive at CyberAcuView, an industry group founded in 2021 by a consortium of major cyber insurance carriers. Camillo said some firms charge a flat retainer fee, while those that specialize in helping companies negotiate a ransom payment tend to charge a percentage of the total ransom amount paid.

That latter dynamic, he said, is an inherent conflict of interest, as the negotiator has every incentive to make things more favorable to the attackers because they are financially incentivized to negotiate and pay out, and to not negotiate down on the price.

“It has come to the industry’s attention that many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed,” Camillo said. “This makes no sense if they are also the negotiator. There needs to be more transparency in the process as no one in the ecosystem should be profiting purely on the size of the ransomware transaction or payment itself.”

Camillo said the firms doing this work would argue the fees are needed because there may be unexpectedly higher costs to secure larger quantities of cryptocurrency or more risk carrying the float, and because cryptocurrency exchanges may charge higher fees for high risk transactions.

“There definitely needs to be more visibility around the transaction and clarity on the increasing value of the crypto and the exchange’s percent in the transaction to get to the bottom of this and remove any misaligned incentives,” he said.

In recent months, the U.S. Department of Justice has prosecuted a number of ransomware negotiators alleged to have conspired with cybercriminals to defraud their clients. On October 7, the DOJ charged MonsterCloud CEO Zohar Pinhasi, 50, with wire fraud and conspiracy for allegedly charging customers to remediate ransomware attacks without paying the hackers. According to charging documents, Pinhasi secretly went behind his customers’ backs and paid hackers anyway, paying ransomware groups $8 million while charging customers $19 million.

In July, Angelo Martino, a 41-year-old ransomware negotiator from Land O’Lakes, Florida, was sentenced to 70 months in prison for conspiring with the Blackcat/ALPHV ransomware group to extort multiple victims. According to the DOJ, Martino was paid by BlackCat attackers to provide confidential information about the negotiating position and strategy of his employer’s clients and enable the ransomware actors to maximize the ransoms paid by the victims.

"Mozilla reps tell me they've met with Microsoft about their concerns," reports PC Magazine, "but that the company wasn't responsive." "They'll do the minimum the law requires to respect user choice," explains Kush Amlani, Mozilla's counsel overseeing global competition and regulatory work... Mozilla recently marked 100 days since it released an 87-page report detailing the ways in which Microsoft pushes Edge on Windows PCs.... One example is how Windows often displays a "Let's finish setting up your PC" pop-up after an OS update. This screen has an enabled-by-default option to "use recommended browser settings," which makes Edge the default web browser. However, that screen doesn't appear in Europe. European laws now force Microsoft to make Windows more respectful of user choices. For instance, in European countries, the Start menu opens links in your default web browser rather than in Edge, as it does everywhere else. Amlani says Mozilla wants Microsoft to release the European version of Windows to the rest of the world. However, he thinks this will require government action. As he puts it, "Microsoft can do better when it's forced." The last line of the article sums up Mozilla's main point. "No one should have to fight their OS this hard on something as simple as a browser preference."

Read more of this story at Slashdot.

One reason plastics are used so often is that they’re chemically inert, meaning bags, food containers, and cups don't react with what we put in them. Yet they can still break down into microplastics, which turn up in drinking water, human blood, arteries, and brains. The consequences of that are uncertain.

“Whether microplastics can directly cause human disease is still being researched,” said Wei Min, a chemist at Columbia University. In a new Nature study, Min's team took a step toward answering this question by demonstrating that microplastics are likely not as chemically inert as we might expect.

Microdroplet chemistry

Min's lab has spent years working on microdroplet chemistry, studying how water broken into tiny droplets behaves at its boundary with air. These droplets have been reported to generate reactive oxygen species, or ROS, a family of harmful, oxygen-containing molecules. “ROS will essentially bump into proteins, lipids, DNA, and cause damage,” Min said. “You could break a DNA strand into segments. You could mutate DNA; you could misfold proteins.”

Many animal studies have tied microplastic toxicity to oxidative stress, which is caused by ROS. So the team wondered if the boundary between water and plastic might do something similar. “We got inspired by that field,” Min said.

In the first test, the team stirred polystyrene powder into water containing methyl orange, a yellow dye that ROS break apart. Over 10 days, the solution faded almost to colorless, losing nearly 90 percent of the dye. In ethanol or other solvents, the dye stayed intact. Min and his colleagues concluded that whatever chemistry polystyrene was undergoing needed water to happen. So they ran more tests.

Water under stress

First was electron spin resonance, a technique that directly detects radicals—atoms or molecules with an unpaired electron that makes them particularly reactive. The polystyrene powder and water mixture contained hydroxyl radicals, a highly reactive ROS.

Next, the team used a fluorescent sensor that lights up only when it reacts with hydroxyl radicals. “You don't see it, but once it reacts with local ROS, it turns into a bright color,” Min said. Under a microscope, the glow concentrated on the surfaces of the plastic particles and kept building over time.

The effect was not unique to polystyrene either. Scientists tested six common plastics—polyethylene, polypropylene, polystyrene, PVC, PET, and acrylic—and all of them generated radicals. The most water-repellent plastics, polyethylene and polypropylene, were the most active, while PET and acrylic, which contain chemical groups that attract water, were the least.

“The simplest answer is the most water-repellent ones change the water structure the most,” Min said. In ordinary, or bulk, water, each molecule is held in a network of hydrogen bonds with its neighbors. But a few layers of water molecules pressed against a water-repellent surface lose some of those partners. “Their structure is no longer the regular water structure. They are perturbed, and their energy is also significantly increased,” Min said.

Water always contains a small number of hydroxide ions, and turning one into a hydroxyl radical requires stripping away an electron. In bulk water, that costs a lot of energy. But simulations run by the group showed that, at a polyethylene surface, hydroxide ions short on hydrogen bonds needed far less energy to form radicals. On top of that, the plastic surfaces build up a negative electric charge in water, which further lowered the energy cost.

But Min’s team still had doubts to address before making any conclusive claims.

Ruling out the dirt

Min’s earlier work on microdroplet chemistry has drawn a lot of criticism, with some researchers arguing that the reported reactive chemicals come from contamination or measurement artifacts.

To avoid similar objections, Min and his colleagues used several independent detection methods. They also added a detergent-like surfactant that coats the plastic and disrupts the water layer at its surface. They found that the more surfactant they added, the weaker the plastic's electric charge became and the fewer radicals it produced. “We only change one parameter while keeping all the rest [the same],” Min said. “We're using exactly the same plastics, the same water, the same everything.”

Impurities, Min explained, are typically stable molecules with no reason to spontaneously generate radicals. He is careful not to overstate it, though. “To be absolutely clear, we cannot 100 percent rule out the involvement of impurities,” he said. “But our controls and our theoretical computation studies highly suggest that this is intrinsic to the microplastic-water interface.”

Finally, the team tested if this interface chemistry matters for biological molecules. And it most likely does.

Proteins and blood cells

Proteins and DNA can gather on plastic surfaces, and lysozyme, a common test protein, also began clumping into aggregates there. Adding caffeine, which mops up radicals, largely stopped the clumping, pointing to the radicals as the cause.

Mouse red blood cells that touched polystyrene particles broke into fragments, and the damage from each type of plastic tracked how many radicals it produced. The effect also persisted in blood serum.

Min stressed, though, that this indicates that microplastics make people sick by generating ROS. While animal studies often point to ROS as possible roots of oxidative stress and chronic inflammation, ROS can be produced in many ways, including through basic metabolic activity.

Min admitted comparing the magnitude of this effect to the impact of ROS our own cells make is rather tricky.

A local problem

“If you are really at the interface, you could be significantly affected by this effect, whereas if you are just a few microns away, you don't feel it anymore," Min said. Exposure is another unknown here. Min also emphasized that no one can yet say how many microplastics an average person takes in each year from food, water, and air.

The plastics in the study were mostly fresh, lab-bought powders, unlike weathered particles we encounter in the environment. In the team's tests, older particles with more oxidized surfaces produced somewhat weaker signals. “This aging process is very heterogeneous,” Min said. “Some microplastic particles were made 50 years ago, some were made five days ago.” Finally, there is the question of size.

Microplastics are usually defined as particles smaller than five millimeters, while the minimum cutoff varies between 100 and 1,000 nanometers. Min’s team did not test how variation in microplastic particle size affects water-interface chemistry, but the researchers suspect it might play a role. The same mass of plastic broken into nanoparticles has far more surface area, which might make the effect larger. "This may be another reason for nanoplastics to be more dangerous," Min said.

The researchers argue that if water-repellent surfaces drive the water interface chemistry, plastics could be designed to be less water-repellent, either by changing their molecular structure or including additives. First, though, the team wants to focus on the question their study left open. “We definitely want to see how much this effect is directly contributing to disease or biological problems in animals and humans,” Min said.

Nature, 2026. DOI: 10.1038/s41586-026-11141-y

Read full article

Comments

The collaborative reverse-engineering site decomp.dev is shutting down, with its administrator saying AI has made game decompilation so fast and accessible that the community's human-driven model has effectively broken down. "The administrator of the website said that it has become impossible to keep track of which projects are primarily human-led and which ones are done by AI," reports 404 Media. From the report: "Historically, matching decompilation has been a brutally difficult, time consuming task, on the scale of years for any moderately-sized game with a number of active contributors," the pseudonymous admin of decomp.dev, who goes by Encounter, wrote on the site. But recent frontier AI models like GPT-6-Astra have made it trivially easy to decompile a game: "They are significantly better at following complex directions, cross-referencing resources for symbols or debug information, and writing natural code with enough guidance," Encounter wrote. "It is now clear that, with the right guidance, human input, and code reviews, AI can expedite the decompilation process in a significant way. What is also now clear is that the community aspect of decompilation has been broken."

Read more of this story at Slashdot.

An anonymous reader quotes a report from Scientific American: Microplastics are a source of extreme concern for health: the presence of these tiny pieces of plastic has been linked to heart attacks, stroke, dementia and brain tumors. But what drives these associations is unclear. Now a study published in Nature offers a tantalizing clue: microplastics interact with water, generating highly reactive molecules. When microplastics come into contact with water, the water near their surface can become chemically active, generating highly reactive species that can modify nearby substances, including biologically important molecules. As plastics wear down to microscopic sizes, their surface-to-volume ratio increases dramatically. For example, when a credit card is fragmented into particles some 10 microns in diameter, there is a more than 200-fold increase in its surface area, says Wei Min, a chemist at Columbia University and one of the senior authors of the study. As a result, any chemical activity is amplified. Min and his colleagues examined various microplastics -- including polystyrene, polyethylene, polyvinyl chloride, polypropylene and polyethylene terephthalate. Plastic surfaces are hydrophobic, meaning they repel water, Min says. Thus, water molecules cannot form the hydrogen bonds they maintain in liquid form. That changes molecular arrangements, and, in turn, the change influences the local electrical environment and chemical reactivity. The presumed chemical inertness of bulk plastics overlooks the toxicity of their fragmented microscale forms. "For microplastics, this is especially important because fragmentation creates enormous amounts of new surface area," Min says. In past research, microplastics have been shown to cause inflammation, oxidative stress and decreased mitochondrial activity. The new study provides a possible mechanism for this, showing that plastic-water interfaces can perturb proteins, cell membranes, and more. How this might contribute to damage in living tissues in humans is still unclear, Min says. "Ultimately, we hope to connect fundamental interfacial chemistry with quantitative measurements of biological effects, which would help us better understand potential health risks," he adds.

Read more of this story at Slashdot.