# IT Daily Roundup: October 8, 2026

> Oct 8, 2026 · #security #android #phishing #malware

Fake Cloudflare checks spread LunexStealer on 100+ compromised sites, Android patches 25 vulnerabilities including 7 critical, and Rejetto HFS CVE-2026-61500 (CVSS 9.3) is under active scanning.

## 1. Fake Cloudflare Verification Pages Spreading LunexStealer Across 100+ Compromised Sites

CERT-UA documented a campaign by threat cluster UAC-0277 that injected malicious JavaScript into more than 100 websites. When a Windows user visits one of these sites from a search engine result, they see a fake Cloudflare DDoS Guard page asking them to run a command via the Windows Run dialog to "confirm they're human." The command downloads an MSI package that installs LunexStealer (also called Psychedelic Stealer). The malware steals stored cookies, form-submitted credentials, and browsing history, then installs a malicious browser extension named LUNARAXE, disguised as "Microsoft Office Word Editor." Through that extension, the attacker gains remote control of the browser. A more aggressive variant also uses a vulnerable AMD driver to disable Windows Defender and add Defender exclusions. Attack infrastructure is loaded dynamically from a smart contract on the blockchain, making it harder to block by domain.

> **Why this matters:** This attack does not arrive through email. Employees encounter these fake verification pages during ordinary browsing, and most cannot tell them apart from legitimate Cloudflare pages. One sentence worth sharing with every person in the company: no website will ever ask you to run a command from the Windows Run dialog, no matter how convincing the reason. On the technical side, restricting MSI execution for standard users and monitoring msiexec.exe calls significantly reduces the risk. Anyone managing company browsers should audit which extensions are installed.

## 2. Android October 2026 Patches: 25 Vulnerabilities, 7 Critical

Google released security patches for Android on October 5 (patch level 2026-10-01). The update fixes 25 vulnerabilities across the Framework and System components, seven of which are rated critical. The most severe affects the System component and allows local privilege escalation without any user interaction. Google reports no active exploitation of any of the patched vulnerabilities. Pixel devices receive additional fixes in Bluetooth, GDMC, and GSA components, and Android Automotive OS is also updated.

> **Why this matters:** Pixel devices receive patches immediately after release. Other manufacturers follow their own timelines, sometimes with delays of several weeks. For organizations managing a company Android fleet, setting a minimum required security patch level in MDM policy gives you visibility into which devices are falling behind. For BYOD environments without MDM, notifying employees is at minimum a reasonable step.

## 3. Rejetto HFS CVE-2026-61500 Under Active Scanning Since October 1

Rejetto HTTP File Server versions 3.0.0 through 3.2.0 sign session cookies with a key derived from Math.random(), which is not a cryptographically secure function. The values needed to reconstruct the generator's state are exposed during the unauthenticated login handshake. An attacker collects a few server responses, reconstructs the generator state, and forges an administrator session. From there, the built-in server_code feature allows executing JavaScript directly on the server. The patch was released in July 2026 as version 3.2.1. VulnCheck recorded the first active scanning on October 1, the day after Horizon3.ai published technical details of the flaw. The activity is attributed to a Chinese threat actor and appears to be reconnaissance scanning so far.

> **Why this matters:** A public proof-of-concept appeared in late September and active scanning started the next day. Many companies use Rejetto HFS for quick document sharing, and many do not know which version is running. Check the version and update to 3.2.1. If you are not sure whether HFS is running anywhere in your environment, that is worth finding out.

---

© 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-10-08-it-daily-roundup.html