ThreatWire: Bot Activity Falls After Strikes on Yandex Data Centers

Summary

ThreatWire covers a reported 90% drop in Yandex Cloud traffic after strikes on Yandex data centers, bot-account removals and security stories including an OpenCode API-key breach, a Plex RCE chain, LLM poisoning research and a Linux KVM flaw.

Key points

X said it removed more than 13,000 bot accounts involved in foreign influence operations targeting U.S. politics.
Ukraine carried out drone strikes on three Yandex data centers between October 7 and 11. Cloudflare measured Yandex Cloud traffic at one point as 90% below its baseline; the transcript cautions that this traffic measurement does not establish a decline in misinformation bots. Zelenskyy said the strikes affected disinformation bot activity.
OpenCode console reportedly suffered a breach that resulted in unauthorized use of LLM API keys belonging to 1.4% of its users.
Researchers disclosed the Plex to Shell exploit chain, which reportedly chains four CVEs to achieve unauthenticated remote code execution on Plex media servers; the CVE identifiers are not given.
A research study found that about 250 poisoned training documents could cause issues in LLMs regardless of parameter size.
Researchers described CVE-2026-99999 as a Linux KVM memory-disclosure flaw. They reported a repeatable 32-byte disclosure and said they achieved further escalation on a test machine, but the complete escalation chain was not disclosed. The transcript describes a fix that checks checksum processing before allowing the deferred write.
The host reported a U.S. government ban on agency use of DeepSeek LLMs and said an OpenAI engineer was believed to have ties to Saudi Arabian threat intelligence; the transcript does not establish that affiliation.

Article Details

Topics: [00:15] X removes bot accounts linked to foreign influence operations
[00:33] Yandex data center strikes and reported changes in bot traffic
[01:57] Security headlines: DeepSeek agency ban, listening devices, and OpenCode API-key breach
[02:38] Plex to Shell exploit chain
[03:14] LLM data-poisoning research
[04:18] Linux KVM flaw CVE-2026-99999 and reported memory disclosure