The Hack Sheet #009

Tuesday, November 3, 2026 · 6 stories

  1. Crypto BTCPay Server hot wallets drained on 2.4.1 and older: upgrade to 2.4.7 and move to a fresh server

    Attackers stole Bitcoin and Litecoin from hot wallets on BTCPay Server 2.4.1 or earlier, using a new way to exploit the bug fixed in 2.4.2 back in August; reports started around Nov 1. BTCPay says there are no credible reports of drains on 2.4.7. If you're on 2.4.1 or older, move to a fresh server with a new wallet even if nothing looks stolen, treat every secret on the old box as compromised, and keep only operating funds in a hot wallet.

    source: thehackernews.com

  2. Security Synology warns of C3RB3R ransomware hitting NAS boxes on old DSM

    Attackers are encrypting NAS devices through a vulnerability Synology patched in December 2024 (advisory SA 24:20); victims find files renamed with a .L0CK3D extension and a ransom note pointing to a dark web portal. Shadowserver counts 380,000+ internet-exposed Synology NAS devices, though not how many are unpatched. Update DSM, turn on automatic updates, and block the DSM admin interface from the internet.

    source: isec.news

  3. Security Over 1,000 GitLab servers still exposed to the exploited CVSS 10 CI/CD bug

    Update to Sunday's story: Shadowserver is tracking more than 1,000 internet-facing instances still vulnerable to CVE-2026-97229, the unauthenticated RCE GitLab patched Oct 12 and CISA added to KEV. A crafted regex in a CI/CD config is enough to run code on the server, which puts pipeline secrets, API tokens and cloud keys in reach. Patch self-managed GitLab now, then rotate the credentials your runners and pipelines hold.

    source: scworld.com

  4. Crypto Premia exploit: PeckShield puts the loss at ~$464K and traces it to BTC via Chainflip and NEAR Intents

    Update to Sunday's story: the attacker who drained Premia v3 option vaults on Arbitrum with empty option pools and flash loans bridged the funds to Ethereum, then swapped them into Bitcoin through Chainflip and NEAR Intents, per PeckShield, which revised the loss up from Blockaid's early ~$400K. No private key was stolen; it was a logic flaw in how vault collateral could be locked into attacker-created pools.

    source: crypto.news

  5. IT Microsoft 365: forwarded mail arriving twice, blank Teams/Outlook contacts, Copilot Chat history

    If a helpdesk sees duplicate tickets or alerts from a mailbox that forwards to an outside address, that's Microsoft bug EX1490154, with a fix rolling out. Contacts still show blank for some Teams and Outlook users (MO1489432, over 99.5% restored), and the Copilot Chat missing-replies issue (CW1530567) is fixed in nearly every region. Copilot image creation works again. More: chasms.com morning brief.

    source: chasms.com

  6. Gaming Phantom Blade Zero sells 4M+ copies in three days, Steam's biggest launch of the year

    The action game passed four million copies sold in its first three days, making it the largest Steam launch of 2026 so far. Usual reminder for a hot release: grab it from the official store, not "free" cracks or trainers, which are a favorite way to ship infostealers.

    source: newswire.games

// tool_of_the_day

CrowdSec · MIT license

CrowdSec reads your server and app logs, spots attacks like brute-force logins and vulnerability scans, and blocks the offending IPs through firewall or web-server bouncers, with an optional community blocklist of known-bad addresses. It's for sysadmins running internet-facing Linux, Windows, Docker or Kubernetes hosts, such as a self-hosted GitLab, NAS or payment server, who want a free fail2ban-style layer with shared threat intel.

Verified Nov 3, 2026: repo loads, actively maintained (last push Nov 3), MIT.

← back to the front page