Risky Bulletin: Intel ends paid bug bounties

0:03Intel removes cash rewards from its Bud bounty program. OpenAI agents probed dozens of organizations fraudsters scam 95 million euros from an Italian bank and BitGet is hacked for$350 million. This is the Risky Bulletin, prepared by Catalan Kimpano and read by me, Claire Aird. Today is the 28th of September and this podcast episode is brought to you by Port Swigger. In today's top story, American chipmaker Intel has removed cash rewards from its bug bounty program. In an update on the program's Integrity platform earlier this month, the company removed rewards of up to$100 ,000 for confirmed serious vulnerability reports.

0:50Intel started paying the bounties after the Spectre and meltdown disclosures in 2017 as a way to reward high-quality research. The company has not explained why it made the change and did not reply to a request for comment from risky business media. In other news, Citrix has released security updates for two zero-day vulnerabilities in its Netscaler product. The bugs have been exploited in the wild since last week. Some organisations had already taken their Netscaler systems offline amid rumours about the bugs being exploited in the wild. Citrix brought the release of the patches forward after news of attacks leaked online.

1:33American software company Kiteworks has told customers to take file transfer service offline. Last week, the company said it received credible threat intelligence from law enforcement that hackers were preparing to launch attacks against its products. More than 1 ,000 Kiteworks file transfer service are accessible over the internet. The CLOP Data Extortion Group targeted this file transfer software when it was known by its previous name of Accelion. Open AI has notified dozens of organizations that its agents probed their websites. The organizations included governments, universities and other public institutions.

2:12In America, the US SEC, the Census Bureau and the Department of Education were all on the list. Open AI says the probes didn't all involve hacking or exploiting security weaknesses. Meanwhile, a suspected AI agent has breached the internal systems of Dutch cybersecurity non-profit DIVD. The organisation helps Dutch security researchers disclose vulnerabilities to software vendors. DIVD says it's investigating the breach and will publish more details on Monday. The Pentagon has notified current and former military personnel that their data was exposed via a server misconfiguration at the U.S. Defense Manpower Data Center.

2:57The so-called data center is a central repository and human resources data hub for the United States Department of Defense. The Pentagon says unauthorized users gained access to the data, which included names, military information and social security numbers. The leak was traced back to a misconfigured file sharing system that was accessible between October 2025 and July 2026. Unauthorised parties accessed the data during the exposure window. Hackers have breached Polish healthcare software platform Medic and stolen the personal data of more than 5 million patients. The incident took place earlier this month.

3:37It's the second major healthcare breach to hit Poland this year, after hackers also stole 19 million patient records from the MyDoctor platform in August. According to Polish cybersecurity news sites, both platforms were breached by the same hackers. Fraudsters used AI to scam and steal 95 million euros from Fideuram, the private banking arm of Italy's largest bank, Interza San Paolo. In February, the scam has impersonated the bank's CEO in messages to Fideuram's chairman. The fraudsters also used AI to impersonate a lawyer and convinced the Fide Uram executive to approve the illegitimate CEO's transactions to Chinese and Hong Kong bank accounts.

4:22Intesa eventually recovered more than half of the funds, but 36 million euros is still missing. Hackers have stolen more than$350 million worth of cryptocurrency from Singapore-based crypto trading platform BitGet. The crypto was stolen from BitGet's hot wallets, a pool of money the company keeps on standby for customer transactions. The incident is the largest crypto heist so far this year. A hacking group is extorting customers of European grocery delivery service Flink. The group emailed a 10 euro ransom demand to every Flink customer last week and threaten to sell their data on the dark web if they don't pay up.

5:05The group claims to have data for more than one million users. The criminals have said they will delete Flink's data if the company pays a 100 Ether ransom or around$270 ,000. Flink operates in Germany and the Netherlands. A misconfigured database has been discovered storing three terabytes of data about people who checked into hotels in an unnamed country. According to security firm Threat Prevent, The database was left exposed online without a password and holds passport information of more than 32 million travellers. Threat Prevent says it will not publish the platform or country name until the database is secured.

5:46The Dutch government is creating its own national operating system based on Linux. The new OS will be called DAWO and will be based on Nix OS, a Linux distribution that started off as a research project at Utrecht University in the early 2000s. The OS will ship with open source office apps and will replace the American software used across the Dutch government. Pilots are currently running in eight Dutch municipalities. A former U.S. Army soldier has been sentenced to almost six years in prison for his role in hacking and extorting Snowflake cloud customers in 2024. Cameron John Waginius breached Snowflake accounts, stole sensitive data and extorted companies such as AT &T, Verizon and others.

6:33He went on hacking forums under the nickname of Kyber Phantom. GitHub accidentally triggered a fresh wave of mini Shaihalud NPM infections this month. The company re-enabled two GitHub actions that the worm was using to spread back in May. New mini Shaihalud infections were reported after just a few hours. GitHub has disabled the actions again. An AI-powered ransomware group is destroying Azure environments as part of its extortion campaigns. The Jade Puffer group was discovered in July and is the first known threat actor using AI to deploy ransomware across hacked environments. Microsoft says the group has recently started wiping Azure resources to put more pressure on victims.

7:22The Shiny Hunters hacking group has kicked off a fresh wave of attacks against Oracle PeopleSoft ERP servers. The group started targeting PeopleSoft servers with a zero-day exploit in June. Oracle patched the bug, but Google says the group is now targeting companies that only deployed firewall rules to protect their PeopleSoft instances. According to Google, the group has found a way around the firewall mitigations. A North Korean group has started using female remote IT workers to fool Western companies that are on the lookout for male scammers. The women are used as a front person in meetings and interviews, while male developers do the off-screen work.

8:02According to threat intel analyst Hayden McKenzie, at least three women were part of a group he was tracking. This remote IT worker cell operated from behind a US front company named Magehire. North Korea has launched new cyber espionage operations against Ukrainian targets. The new campaigns are gathering intelligence on the war and have been linked to a group known as CONI. The latest espionage activity comes after reports that North Korea is readying a fresh batch of troops to fight in Ukraine. Misconfigured servers have exposed an APT's hacking operations against Russian, Kyrgyz and Syrian government systems The open directories exposed offensive workspaces, tools and previous targets Security researchers at Control Alt Intel say Ukrainian language strings appeared through the exposed workplaces but they have no further details that would allow for a definitive attribution And finally, Russian IT giant Yandex is launching a cybersecurity division.

9:07The company has reportedly invested close to$90 million in setting it up. The Yandex security team will focus on protecting Russian cloud, hybrid and multi-cloud infrastructure. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Portswigger. Find them at portswigger.net. Thanks for your company.

9:30you