GoKawiil
Tech News
A hacker reportedly used a network of AI agents to break into systems tied to John Deere, SharkNinja and Cummins, according to The Verge. John Deere says it found no evidence sensitive data was accessed, Cummins says it is investigating a possible attack on a vendor-operated website, and SharkNinja says the breach hit only a standalone product-support site that has since been contained.
OpenCode, an open-source AI coding tool, disclosed a security breach affecting 1.4% of users of its OpenCode Console platform, where some store API keys for AI services. The company described it as a large-scale distillation attack and notified affected users by email, while developers reported unexpected charges on OpenAI, Anthropic and Google AI accounts, some exceeding $1,000. Anthropic and Google blocked exposed keys, OpenAI worked with OpenCode to restore access and refund credits, and OpenCode said refunds for unauthorized charges are underway.
Rank Math says some downloads of its paid SEO plugin, version 3.0.123, between October 15 at 20:02 UTC and October 16 at 07:12 UTC contained malware capable of implanting hidden backdoors once activated. The vendor pulled the affected files and issued a clean version, 3.0.124, while the free Rank Math SEO plugin used by over 4 million sites was not affected.
Attackers identified as UNC7017 compromised AOMEI's servers between April and July 2026, briefly altering configuration files used by AOMEI Backupper's promotional feature to distribute a new downloader called CROSSROAD and a backdoor called SHINYROAD, then restoring the files to cover their tracks. Researchers from ManageEngine's METAL team, Google's Threat Intelligence Group and Mandiant found affected organizations in the US, Australia, India, Singapore, Spain and Switzerland, spanning IT services, telecoms and higher education.
OpenCode, an open-source AI coding agent, disclosed that a security breach exposed stored API keys for 1.4% of its Console users who had linked external AI providers such as Anthropic, OpenAI and Google. The project maintainer said affected users were notified by email, and several reported unauthorized charges, including one case exceeding $1,700 overnight, along with suspended Google Cloud projects. Co-founder Dax Raad said the attack used AI agents against OpenCode's systems for at least 48 hours before being detected.
Citizen Lab researchers documented a zero-click technique, dubbed AdFection, that delivered Candiru spyware to Al Jazeera Media Network devices simply by rendering malicious online advertisements. The ads, placed through mainstream ad networks by Israeli firm Discover-Tech using its Controlium platform, contacted a 'NOAS' server that checked device details like IP address before deciding whether to push spyware-loading code to that specific target.
Ledger has directed resellers and distributors in Southeast Asia and Hong Kong to stop selling its hardware wallets and pull them from shelves while it investigates implanted chips found in devices sold by reseller CryptoBilis. The company's Donjon security team found a hidden microcontroller that reads recovery phrases and transmits them over LTE via an embedded eSIM, bypassing Ledger's normal integrity checks. Similar tampered units have also been reported from other sellers in Asia and Europe, including a Singapore airport retailer and MediaMarkt in Europe, which has already removed the product.
Ledger is overhauling its sales and anti-tampering policies following the 'Cryptobilis incident,' in which a physical hardware implant inserted somewhere in its supply chain led to $93 million in stolen crypto from user wallets. The breach, first detected October 9, affected wallets bought through CryptoBilis, an authorized reseller in Malaysia and Southeast Asia, prompting Ledger to halt all sales through that partner.
A Picus Security engineer outlines how agentic pentesting—where AI agents autonomously run reconnaissance, exploitation and reporting steps—has emerged as a faster alternative to scheduled automated pentests, citing Picus's own Swarm product as an example. The piece argues this approach can uncover exploit chains humans might miss, but notes it carries tradeoffs, including heavy token/compute usage, and identifies blind spots that need to be addressed.
Ledger confirmed that hardware implants planted in some Ledger Nano X wallets sold by Malaysian reseller CryptoBilis allowed attackers to steal roughly $102 million in crypto. Since then, a European buyer and other researchers have reported finding similar implants in Nano X, Flex and Stax devices purchased from a major German electronics chain, suggesting the tampering extends beyond the single reseller Ledger initially named.
Ledger has confirmed that a spy chip implant was responsible for a string of thefts from its crypto hardware wallets. The company has not yet detailed how many users or how much cryptocurrency was affected, or how the implant was introduced into affected devices.
A hobbyist describes using a Matrix CoolRunner Rev D 'glitcher' modchip, bought in 2017, to exploit the Xbox 360's hardware boot process rather than its software. The console's 1BL bootloader is embedded directly in the CPU silicon and verifies Microsoft-signed code at each stage, making conventional software hacks largely ineffective. The author explains that after years of work, the weak point exploited was a fundamental hardware timing flaw rather than any cryptographic key.