UK — The Register

Japanese virtual desktop cloud hacked so hard it asks to be banned

SecurityOctober 27, 20261 min read

Japanese internet company GMO Internet says hackers broke into its Onamae.com Desktop Cloud, a cloud service used for foreign exchange trading. The company admits its security had holes and was slow to fix them.

What happened

GMO Internet runs a cloud desktop service called Onamae.com Desktop Cloud. A cloud desktop is a computer screen that runs on remote servers, and you reach it over the internet. Attackers installed harmful programs on some customers' servers. Some customers then saw trades in their accounts that they did not make. Attackers may also have seen people's trading passwords.

Key numbers and facts

The attacker asked for $50 million and threatened to publish information about GMO and its customers.
GMO says 26,739 virtual desktop servers may have been hit.
GMO is offering all users a 5,000 yen (about $32) condolence payment.
GMO will provide a free alternative environment for six months.

Some background

Many people use online trading apps to buy and sell money in different currencies. This is called foreign exchange, or FX, trading. GMO recommended its cloud desktops as a safe place to run these trading apps. That makes this breach especially serious, because the service was meant to protect trading work.

Why it matters

This story shows how a weak security system can put people's money at risk. GMO says it will not pay the attacker, because paying would not promise that stolen data is deleted. Customers must also change passwords and end active sessions in their trading apps. The CEO admits the company's response was not fast or deep enough.

What to watch

Whether the attacker publishes stolen customer information.
How much money GMO pays customers for trading losses.
What GMO finds about how the attack began.
Whether trading apps end old sessions as GMO has asked.

Glossary

GMO Internet: A Japanese internet company that offers web services, including the Onamae.com Desktop Cloud.
Desktop Cloud: A service that lets you use a full computer screen run on remote servers over the internet.

JR Smart EX and Express Reservation member email addresses possibly leaked, about 170,000 records, after unauthorized access to Yumilink

JR Tokai, JR West, and JR Kyushu announced on October 26 that some member email addresses, member IDs, names in katakana, and membership types for their Express Reservation and Smart EX services may have leaked. The number of affected records is still being confirmed, but they have reportedly received a preliminary figure of about 170,000. The leak stems from unauthorized access to Yumilink, the provider of the mail delivery service, and JR Tokai has not confirmed any leak from its own systems for either service.

SecurityITmediaOct 27

NEC's Aterm Routers Not Affected by PHP Vulnerabilities; ".php" in Settings Page URL Is Unrelated

NEC's Aterm Wi-Fi and mobile router information site announced on October 26 that it confirmed Aterm products and services are not affected by the PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) published on the 22nd. Some Aterm models display "/index.php" in the URL of the "Quick Setup Web" settings page, but this only contains the string ".php" and the product does not use PHP, so the vulnerabilities have no impact. Any new information will be posted on the same page.

SecurityThe RegisterOct 27

LiteLLM supply chain attack started with an exposed master key

LiteLLM traced last week's supply chain attack to a master key it accidentally committed to a public GitHub repository in May, which was not revoked after the commit was removed. The attacker used the key to access the company's AI agent platform and steal a GitHub CLI OAuth token, gaining owner-level access to its GitHub repositories. A poisoned version (1.107.0) of the package, which contained an infostealer and a remote access trojan, was available on PyPI for under two hours and was downloaded about 49,000 times, according to Wiz.

SecurityZDNet KoreaOct 27

"Threatening the Entire Server Ecosystem"... After PHP, Security Vulnerability Found in Node.js Too

A critical vulnerability dubbed "Node2shell" (CVE-2026-111497) has been found in Node.js, the JavaScript server runtime, following a similar PHP flaw. AI offensive security firm Theori says it reproduced and verified the flaw, which stems from an out-of-bounds write in the Brotli decompression module and can allow denial of service or remote code execution without authentication. Node.js versions 22.x, 24.x, and 26.x without the latest security patches are affected, and Theori urges immediate updates to 22.23.4, 24.22.1, or 26.12.1 or later.