Capcom's 11.7 Million Accounts Exposed

Capcom — the Japanese studio behind Resident Evil, Street Fighter, and Monster Hunter — confirmed this week that its CAPCOM ID membership system was accessed without authorisation, according to Bleeping Computer. CAPCOM ID is the shared login platform players use to access Capcom's web services and online games.

Suspicious activity was detected on October 19. By October 20, the company confirmed customer data had been taken. Two days later, the incident was reported to Japanese police and the country's data protection authority.

For the vast majority of the 11.7 million affected accounts, the exposed information includes email addresses, account creation dates, last login timestamps, login counts, and the IP address used at last login. Passwords were not exposed for most users, and no payment card data was affected.

For a smaller subset of 43 accounts, additional personal details — dates of birth, gender, nicknames, and country — were also taken. In 196 cases, attackers actually changed account passwords to lock owners out; Capcom has since reset those.

How the attackers first got in has not been disclosed. The company says its online services remain operational.

This is Capcom's second significant breach in recent years. In 2020, the Ragnar Locker ransomware gang claimed to have stolen 1 TB of data in a separate attack, later traced to an old, unpatched VPN device.

What to do: Check your email for official communication from Capcom. Be suspicious of any message claiming to be from Capcom that asks for personal information or contains links — the company has warned users to expect phishing attempts following this breach. If you reused your CAPCOM ID password anywhere else, change it on those accounts now.

Researchers at SOCRadar uncovered an intrusion operation tied to affiliates of the INC and The Gentlemen ransomware groups that uses an AI framework called Phantom to automate attacks, as reported by The Hacker News.

The structure works like this: a human operator gives the AI a target and approves each step, while Phantom handles the actual execution — scanning systems, moving laterally (spreading through a network after initial access), stealing credentials, and staging files for exfiltration (removal from the victim's systems).

One detail stands out. In several recorded intrusions, a single reused password gave attackers access to VPNs, servers, backup systems, and security tools simultaneously.

Exposed logs from the operation recorded 8,257 messages across 133 attack sessions.

What to do: Use a unique password for every account, especially anything work-related. A password manager makes this practical.

What Pillow is: Pillow is the most widely used Python library for processing images — it handles uploads, thumbnail generation, PDF pipelines, and image conversion across millions of web applications and machine-learning projects, downloaded roughly 436 million times per month.

What it is: When Pillow opens an EPS image file, it passes the filename to Ghostscript (a separate program that renders the image). It does not check that filename first. An attacker who controls the filename can craft it as a command rather than a path, causing Ghostscript to execute arbitrary operating system instructions on the server.

Who's at risk: Any web application using Pillow to open EPS images on a host where Ghostscript is installed. Upload endpoints that preserve or derive filenames from user input are the realistic target. The flaw only triggers when Ghostscript is present — it is required to open EPS files at all.

CVSS: 9.2 (Critical — patch today.)

Root cause: Pillow passes the filename directly to Ghostscript without sanitising or validating it. The weakness is not in the image content but in the filename itself. Think of it like a librarian who fetches a book by reading the title aloud — if the title is itself an instruction, the system obeys it instead of looking up a book.

Attack vector: An attacker submits a file with a maliciously crafted filename to an upload endpoint. Pillow passes that filename to Ghostscript during processing. Ghostscript interprets the crafted name as a command and executes it, giving the attacker remote code execution (RCE — the ability to run arbitrary commands on the server) without needing to exploit anything inside the image file itself.

Detection strategies: Look for unexpected shell processes spawned from your Python web application process. Review server logs for unusual child processes originating from image processing jobs. Monitor for unexpected outbound network connections following image upload events.

Recommended actions:

1. Upgrade Pillow to version 13.0.0 immediately — this is the patched release.
2. If you cannot upgrade now, disable EPS file handling or block EPS uploads at the application layer.
3. Audit upload endpoints to ensure filenames from user input are never passed unsanitised to external programs.

Google has upgraded Chrome's Enhanced Protection mode with server-side AI scam detection, as covered by Bleeping Computer.

The updated feature analyses page content, brand signals, and site intent to catch scam pages before you engage with them. It now also detects ClickFix attacks — a technique where malicious pages trick users into copying and running dangerous commands themselves by disguising them as routine troubleshooting steps.

If Chrome spots a suspicious command in your clipboard from this type of attack, it strips identifying information from it and checks it against Google's Safe Browsing service. If it flags as dangerous, you see a warning before anything runs.

Google states page content is processed temporarily and never stored or used for model training.

What to do: In Chrome, go to Settings → Privacy and Security → Security → and select Enhanced Protection. It takes about 10 seconds.

The FCC has barred two consumer devices — a wireless video transmitter and a dashboard camera — from the US market because they contain chips made by HiSilicon, a Huawei subsidiary, according to The Record. New rules that took effect October 13 prohibit devices containing components from companies on the agency's national security "covered list." HiSilicon was already on that list. For everyday consumers, this signals that regulators are now actively enforcing component-level scrutiny on connected devices, not just the brands on the box.