Security Roundup: Internet Archive 31M Breach, Qualcomm FastRPC Zero-Day, Casio Ransomware, Palo Alto Expedition RCE (Weekend Edition - October 12, 2026)

Executive Summary: The weekend of October 9–12, 2026, unleashed a devastating confluence of nation-state cyberespionage, catastrophic consumer database exfiltrations, targeted commercial spyware zero-days, and critical infrastructure intrusions. Headlining this weekend's alerts, the Internet Archive (archive.org) fell victim to a catastrophic multi-vector attack: a 31-million user account database theft enabled by an exposed GitLab developer token, a high-profile JavaScript defacement mocking security posture, and days of sustained DDoS barrage claimed by hacktivist cluster SN_BlackMeta. In mobile and hardware security, Google Project Zero and Amnesty International disclosed active in-the-wild zero-day weaponization of CVE-2024-43047—a high-severity use-after-free vulnerability in the Qualcomm FastRPC DSP driver exploited by commercial spyware vendors, triggering an emergency CISA KEV mandate. Simultaneously, Palo Alto Networks and CISA sounded the alarm on critical vulnerabilities in the Expedition firewall migration suite (CVE-2024-9463 & CVE-2024-5910), where unauthenticated command injection allows attackers to extract master firewall configurations and PAN-OS API keys. Across the corporate landscape, Japanese electronics leader Casio confirmed a 200 GB data breach and logistics disruption by the Underground ransomware group, wealth management giant Fidelity Investments notified 77,099 customers of SSN leaks via fraudulent account creation, ESET exposed GoldenJackal's sophisticated USB malware bridging air-gapped diplomatic enclaves in Europe, and American Water severed customer IT billing platforms following an active network intrusion. Here is your definitive weekend threat intelligence briefing and technical architectural review.

Key Threat Disclosures at a Glance

1. Internet Archive Multi-Vector Breach: 31M Accounts Leaked & Defaced

Over the weekend, visitors to the Internet Archive (archive.org) were greeted by a rogue JavaScript alert stating: "Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!" The breach exposed 31,081,179 unique user records containing email addresses, screen names, and bcrypt-hashed passwords. Forensic investigations revealed that the threat actors compromised an exposed GitLab access token on an internal development server, allowing unauthorized extraction of database connection secrets. Concurrently, hacktivist syndicate SN_BlackMeta pummeled the Wayback Machine with terabit-scale DDoS waves, followed by attackers abusing unrotated Zendesk API tokens to taunt support staff.

2. Qualcomm FastRPC DSP Use-After-Free Zero-Day (CVE-2024-43047)

Qualcomm issued an emergency security bulletin alongside Google Project Zero and Amnesty International Security Lab disclosing CVE-2024-43047 (CVSS 7.8). The flaw is a critical use-after-free bug in the Qualcomm FastRPC driver while maintaining memory mappings of high-level operating system (HLOS) memory inside the Digital Signal Processor (DSP). Google’s Threat Analysis Group (TAG) confirmed that commercial spyware developers have weaponized this vulnerability in the wild to achieve local privilege escalation and escape Android sandbox constraints on targeted mobile devices. CISA swiftly added CVE-2024-43047 to the Known Exploited Vulnerabilities catalog under BOD 22-01.

3. Palo Alto Networks Expedition Critical RCE Chain (CVE-2024-9463 & CVE-2024-5910)

Palo Alto Networks issued urgent advisories for its Expedition migration tool (PAN-SA-2024-0010). Attackers can chain CVE-2024-5910 (an authentication bypass allowing administrative account takeover) with CVE-2024-9463 (a CVSS 9.9 unauthenticated OS command injection) to execute arbitrary code as root. Because Expedition is used by network architects to import configurations, firewall rules, and API keys from legacy third-party firewalls into PAN-OS and Panorama, compromising this tool provides adversaries with the crown jewels of enterprise network topology and cleartext credentials. CISA ordered immediate federal remediation.

4. Casio Computer Ransomware Attack: 200 GB Exfiltrated by Underground

Japanese consumer electronics powerhouse Casio Computer Co. confirmed a major system failure across its corporate headquarters, supply chain logistics, and shipment operations. The Underground ransomware collective claimed responsibility, publishing proof of over 200 GB of exfiltrated data including employee records (6,456 personnel), partner credentials (1,931 suppliers), and sensitive legal and sales agreements. While customer credit cards and cloud platforms (CASIO ID, ClassPad.net) remained segregated, Casio rejected ransom demands and initiated manual shipping fallbacks.

5. Fidelity Investments Discloses Breach of 77,000 Customer Accounts

In regulatory filings submitted over the weekend, Fidelity Investments revealed that an unauthorized third party established two fraudulent customer accounts between August 17 and August 19, 2024, and exploited a flaw in an internal relationship database to view and exfiltrate document images belonging to other customers. The breach compromised the names, addresses, and Social Security numbers of 77,099 customers. While core brokerage portfolios and transaction engines were unaffected, the incident exposes severe authorization gaps in client document retrieval microservices.

6. GoldenJackal APT Infiltrates European Diplomatic Air-Gapped Networks

Cybersecurity researchers at ESET published a ground-breaking technical exposé documenting how Russian-aligned threat actor GoldenJackal successfully compromised air-gapped governmental systems across European embassies between 2022 and 2024. The threat actors deployed an elaborate USB bridge framework: GoldenDealer infects connected hosts and silently writes malicious binaries to removable USB drives; once inserted into physically isolated machines, GoldenAce and GoldenHowl execute, harvesting sensitive diplomatic cables, PGP keys, and encrypted emails, staging them on the USB drive for exfiltration once reconnected to the internet.

7. American Water Halts Billing & IT Systems Following Network Intrusion

American Water, the largest regulated water and wastewater utility in the United States serving over 14 million people across 14 states, disclosed an active cyber intrusion. The utility executed emergency containment procedures, shutting down customer billing portals and its MyWater interface while pausing late payment fees. Critical operational technology (OT) and SCADA water treatment facilities remained isolated and fully functional, demonstrating the efficacy of physical network segmentation between enterprise IT and industrial control environments.

Dedicated Technical Deep Dives in This Series

• Internet Archive Under Multi-Vector Siege: 31M User Accounts Leaked via Compromised GitLab Token and DDoS Campaign: Forensic breakdown of the Internet Archive multi-stage intrusion, GitLab token discovery, JavaScript popup injection, and Zendesk token hijacking.
• CVE-2024-43047: Qualcomm FastRPC DSP Memory Corruption Zero-Day Exploited in Targeted Spyware Campaigns: Low-level kernel analysis of CVE-2024-43047: Qualcomm FastRPC HLOS memory unmapping, DSP privilege escalation, and commercial spyware exploit chains.
• Palo Alto Networks Expedition RCE Chain: CVE-2024-9463 & CVE-2024-5910 Expose Enterprise Firewall Secrets: Exploit mechanics of the Palo Alto Networks Expedition RCE chain (CVE-2024-9463 & CVE-2024-5910) and perimeter credential extraction.
• Casio Computer Hit by Underground Ransomware: 200 GB Exfiltrated in Supply Chain and Operations Interruption: Post-mortem of Casio Computer’s ransomware breach: Underground gang operations, logistics paralysis, and cloud enclave isolation.
• Fidelity Investments Discloses Security Breach: 77,000 Customer Records and SSNs Compromised via Rogue Accounts: Architectural autopsy of Fidelity Investments’ document database breach: identity creation abuse and object-level authorization failures.
• GoldenJackal APT Infiltrates Air-Gapped Diplomatic Networks: ESET Exposes Custom USB Bridge Toolset: Decompilation of GoldenJackal’s air-gap hopping malware suite: GoldenDealer, GoldenAce, and covert USB storage staging.
• American Water Cyber Intrusion: Precautionary IT Disconnection and Billing Pause Protects Physical SCADA Enclaves: Critical infrastructure defense review: American Water’s IT/OT air-gap defense, billing system shutdown, and SCADA protection.
• Enterprise Hardening Blueprint: Air-Gapped Network Isolation, Migration Appliance Security & Kernel DSP Mitigations: Enterprise Hardening Blueprint: eBPF USB filtering rules, PAN-OS API key revocation workflows, Android DSP patch verification, and zero-trust document security.

Weekend Action Checklist for CISOs & SecOps Engineers

1. Decommission or Isolate Palo Alto Networks Expedition: Expedition is an internal migration appliance and must never be exposed to external networks. Update immediately to Expedition 1.2.92+, restrict access via VPN/bastion hosts, and rotate ALL PAN-OS and Panorama API keys, firewall admin passwords, and SNMP secrets stored in Expedition.
2. Audit CI/CD Developer Tokens & Webhook Access: Scan public and internal code repositories (GitLab, GitHub) for exposed personal access tokens (PATs), cloud service keys, and support desk API secrets (e.g., Zendesk, Jira). Enforce mandatory token rotation and token-scanning pre-commit hooks.
3. Audit Android & Mobile Fleet for Qualcomm CVE-2024-43047: Verify that mobile device management (MDM) policies enforce the latest Android security patch level across all corporate smartphones, specifically targeting high-risk executives and overseas personnel.
4. Enforce USB Removable Media Lockdown in High-Security Enclaves: Deploy endpoint protection rules and eBPF kernel hooks disabling USB mass storage drivers on classified, air-gapped, or sensitive workstations to eliminate GoldenDealer-style bridging attacks.
5. Verify IT/OT Segmentation in Industrial & Utility Deployments: Ensure strict unidirectional data diodes or air-gaps separate corporate enterprise networks (billing, customer web portals) from operational SCADA and industrial automation equipment.
6. Implement Object-Level Authorization (BOLA) in Document Retrieval APIs: Review financial and customer portals to verify that authenticated accounts cannot retrieve document images or PII belonging to other users simply by incrementing document IDs or exploiting relationship schemas.