In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit
Roundup covers ICS-Sniper, an XWorm panel RCE, an 11-million-record Burger King Japan breach, and a $250,000 Chrome chain.
SecurityWeek’s roundup leads with University of British Columbia’s ICS-Sniper proof of concept, which uses VPN packet size, direction, and timing to drop critical SCADA packets, delaying pumping by about 15 minutes in SWaT tests. An unauthenticated remote-code-execution flaw in XWorm panels through version 7.4 is reportedly exploited on a limited scale, while Previdian honeypots recorded attempts against critical Langflow flaw CVE-2026-105740. BK Japan disclosed unauthorized access from October 2–7 exposing roughly 11 million Burger King app member records, without card numbers or evidence that passwords were taken. XBOW also described a now-fixed three-bug Chrome full chain, built with GPT-5.6 Sol, that earned a $250,000 bounty.