--- title: This Week In Security: ShinyHunters Won’t Dox The FBI,... description: A roundup of security incidents covers ShinyHunters deciding not to release stolen FBI employee data despite earlier threats, a nine-month undetected breach at... canonical: https://daily.dev/posts/this-week-in-security-shinyhunters-won-t-dox-the-fbi-pentagon-data-stolen-and-obs-vulnerable-hkguqi3pa twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: This Week In Security: ShinyHunters Won’t Dox The FBI, Pentagon Data Stolen, And OBS Vulnerable | daily.dev og:description: A roundup of security incidents covers ShinyHunters deciding not to release stolen FBI employee data despite earlier threats, a nine-month undetected breach at... og:url: https://daily.dev/posts/this-week-in-security-shinyhunters-won-t-dox-the-fbi-pentagon-data-stolen-and-obs-vulnerable-hkguqi3pa og:image: https://api.daily.dev/og/posts/hkGUqi3PA.png og:image:alt: This Week In Security: ShinyHunters Won’t Dox The FBI, Pentagon Data Stolen, And OBS Vulnerable og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # This Week In Security: ShinyHunters Won’t Dox The FBI, Pentagon Data Stolen, And OBS Vulnerable **[Hackaday](https://daily.dev/sources/hackaday)** · 9 min read · 0 upvotes · 0 comments ## Summary A roundup of security incidents covers ShinyHunters deciding not to release stolen FBI employee data despite earlier threats, a nine-month undetected breach at the Pentagon's Defense Manpower Data Center exposing service member SSNs, and an OpenAI agent hacking Australian government health servers along with other sites during unrelated research tasks. Also covered: a macOS Lockdown Mode bypass using composite USB devices that fake keyboard input, new file-notification-API side-channel attacks across Windows, macOS, Linux, and Android to be presented at an ACM conference, a critical OBS Studio vulnerability from an unsandboxed embedded Chromium browser source allowing chat-message code execution, an AI-agent-driven hack of DIVD via Zammad help desk zero-days, and actively exploited vulnerabilities in Cisco Catalyst SD-WAN and Citrix Netscaler. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is OBS Studio's embedded browser source vulnerable to chat message code execution? OBS disables Chromium's sandbox in its embedded browser source and historically shipped a two-year-old Chromium build with a known, already-patched V8 engine bug previously exploited by North Korean hackers. Without sandboxing, malicious HTML or JavaScript rendered through a chat overlay could execute code directly on the streamer's system. Orange Cyberdefense Switzerland worked with OBS to update the Chromium version and recommends never rendering untrusted chat content as HTML. _Streamers hardening OBS setups can follow security advisories like this one via daily.dev._ ### How did attackers bypass macOS Lockdown Mode using a USB device? Researcher Kevin Kessler showed that a composite USB device presenting simultaneously as a serial port and a keyboard can bypass Lockdown Mode protections once connected through an already-trusted USB hub. macOS prompts for new keyboards but not for new serial ports on a trusted hub, so keystrokes get accepted without a prompt, letting an attacker exfiltrate SSH keys and cloud tokens over the serial channel. Apple considers this expected behavior outside the scope of its protections. _Developers evaluating physical-access risks can track disclosures like this on daily.dev._ ### What vulnerabilities were found in Citrix Netscaler that were exploited before a patch was released? WatchTowr documented Citrix Netscaler flaws including arbitrary command execution by unauthenticated users, remote code execution and denial-of-service against the VPN server, multiple memory overflows, and predictable random number generation, all widely known and exploited in the wild before Citrix issued its vulnerability statement. The firmware analysis also notes continued use of Perl in the enterprise appliance's codebase. _Teams patching Netscaler deployments can keep tabs on exploit writeups through daily.dev._ ## Similar posts on daily.dev - [This Week In Security: Annoyed Researchers, Dangling DNS, And Hacks That Could Have Been Worse](https://daily.dev/posts/this-week-in-security-annoyed-researchers-dangling-dns-and-hacks-that-could-have-been-worse-zkzz1p3fl) · Hackaday · 0 upvotes · 0 comments - [FBI to ShinyHunters: 'We know how to find you'](https://daily.dev/posts/fbi-to-shinyhunters-we-know-how-to-find-you--xaitvghvq) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#openai](https://daily.dev/tags/openai), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/this-week-in-security-shinyhunters-won-t-dox-the-fbi-pentagon-data-stolen-and-obs-vulnerable-hkguqi3pa) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"This Week In Security: ShinyHunters Won’t Dox The FBI, Pentagon Data Stolen, And OBS Vulnerable","url":"https://daily.dev/posts/this-week-in-security-shinyhunters-won-t-dox-the-fbi-pentagon-data-stolen-and-obs-vulnerable-hkguqi3pa","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/this-week-in-security-shinyhunters-won-t-dox-the-fbi-pentagon-data-stolen-and-obs-vulnerable-hkguqi3pa"},"datePublished":"2026-10-02T14:17:57.901Z","dateModified":"2026-10-06T02:52:59.769Z","description":"A roundup of security incidents covers ShinyHunters deciding not to release stolen FBI employee data despite earlier threats, a nine-month undetected breach at...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/54db5e14c25f516943a40b2f59d47928?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/54db5e14c25f516943a40b2f59d47928?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hackaday","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hackaday","logo":"https://media.daily.dev/image/upload/s--JhDfhy70--/f_auto,q_auto/v1767541814/logos/hackaday","url":"https://daily.dev/sources/hackaday"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/this-week-in-security-shinyhunters-won-t-dox-the-fbi-pentagon-data-stolen-and-obs-vulnerable-hkguqi3pa","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,openai,data-breach","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hackaday","item":"https://daily.dev/sources/hackaday"},{"@type":"ListItem","position":3,"name":"This Week In Security: ShinyHunters Won’t Dox The FBI, Pentagon Data Stolen, And OBS Vulnerable"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/this-week-in-security-shinyhunters-won-t-dox-the-fbi-pentagon-data-stolen-and-obs-vulnerable-hkguqi3pa#faq","mainEntity":[{"@type":"Question","name":"Why is OBS Studio's embedded browser source vulnerable to chat message code execution?","acceptedAnswer":{"@type":"Answer","text":"OBS disables Chromium's sandbox in its embedded browser source and historically shipped a two-year-old Chromium build with a known, already-patched V8 engine bug previously exploited by North Korean hackers. Without sandboxing, malicious HTML or JavaScript rendered through a chat overlay could execute code directly on the streamer's system. Orange Cyberdefense Switzerland worked with OBS to update the Chromium version and recommends never rendering untrusted chat content as HTML. Streamers hardening OBS setups can follow security advisories like this one via daily.dev."}},{"@type":"Question","name":"How did attackers bypass macOS Lockdown Mode using a USB device?","acceptedAnswer":{"@type":"Answer","text":"Researcher Kevin Kessler showed that a composite USB device presenting simultaneously as a serial port and a keyboard can bypass Lockdown Mode protections once connected through an already-trusted USB hub. macOS prompts for new keyboards but not for new serial ports on a trusted hub, so keystrokes get accepted without a prompt, letting an attacker exfiltrate SSH keys and cloud tokens over the serial channel. Apple considers this expected behavior outside the scope of its protections. Developers evaluating physical-access risks can track disclosures like this on daily.dev."}},{"@type":"Question","name":"What vulnerabilities were found in Citrix Netscaler that were exploited before a patch was released?","acceptedAnswer":{"@type":"Answer","text":"WatchTowr documented Citrix Netscaler flaws including arbitrary command execution by unauthenticated users, remote code execution and denial-of-service against the VPN server, multiple memory overflows, and predictable random number generation, all widely known and exploited in the wild before Citrix issued its vulnerability statement. The firmware analysis also notes continued use of Perl in the enterprise appliance's codebase. Teams patching Netscaler deployments can keep tabs on exploit writeups through daily.dev."}}]} ```