Author: anonymousmedia_tal70o

Ravie LakshmananOct 12, 2026Cybersecurity News / Hacking

Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That’s not much time to read the warning, let alone do something about it.

But speed is only part of the problem. A secure connection didn’t always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves. Malware got better at hiding its tracks. And some systems turned out to be easier to break into than anyone would like to admit. The odd part is how normal much of it looked until someone checked closer.

There’s more going on here than a few bad bugs and clever attacks. Some of the smaller stories are just as telling. This week’s full recap is worth a read, especially the bits that didn’t make the big headlines.

⚡ Threat of the Week

Atlassian Flaw Exploited in the Wild — Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions. The arbitrary file access flaw, tracked as CVE-2026-21589 (CVSS score: 9.3) affects multiple products, including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. The exploitation activity targeting its honeypot network is said to have begun two hours after watchTowr released additional technical details of the vulnerability.

🔔 Top News

• Ransomware Recovery CEO Charged for Secretly Paying Hackers — Zohar Pinhasi, the owner of Florida-based ransomware recovery firm MonsterCloud, was hit with wire fraud charges for allegedly falsely claiming he could help victims restore data without paying ransoms. Instead, prosecutors said Pinhasi simply paid ransoms and charged victims a fee that was significantly higher than the original ransom demand. MonsterCloud was also highlighted in a 2019 ProPublica investigation on companies defrauding ransomware victims by paying ransoms and charging exorbitant fees.
• New DarkSword Variant Detected — A previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword has been updated to support on-device keychain and crypto-wallet theft, and facilitate two-way C2 communication with the attacker’s infrastructure. The new variant is much better at hiding itself and cleaning up its behavior, rendering previous indicators of compromise (IOCs) ineffective. The changes indicate substantial work by the operators rather than simple modifications. The most important change is that it can extract Keychain data directly on the iPhone before sending it to the attackers, as opposed to copying the entire Keychain database for processing remotely. Evidence indicates that the exploit kit is distributed via malicious ads as part of watering hole attacks.
• UAC-0099 Continues to Update MATCHBOIL Malware — The Russia-aligned threat actor known as UAC-0099 is actively refining a malware downloader called MATCHBOIL, suggesting it intends to use the tool in future attacks. Over the past year, MATCHBOIL has evolved from a dropper that essentially executed once, contacted its C2 server, and downloaded and installed a next-stage payload, into one that’s run every two minutes. The change allows it to repeatedly contact its control server and fetch new or updated payloads.
• FBI Disrupts Hacking Tools and Domains Linked to Flax Typhoon — The U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon. While Microscan was used to conduct reconnaissance and computer vulnerability scanning, FishHub allegedly enabled the exploitation of computer networks through spear-phishing attacks and the deployment of follow-on payloads. CISA’s acting executive assistant director for cybersecurity, Chris Butera, said Chinese government hackers “continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing.” Integrity Technology is best known in China for developing the country’s cyber ranges and has publicly touted its extensive government funding in the past. Natto Thoughts research said the company was founded in 2010 by Cai Jingjing, a legendary hacker in China.
• Another ShinyHunters Arrest Made — FBI said it made a third arrest in connection with the ShinyHunters group, as the net closes around the notorious cybercrime group. “Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor,” FBI director Kash Patel said. Although the identity of the individual was not disclosed, court documents, POLITICO, and independent security journalist Brian Krebs said it was Edward Dubrovsky, a 54-year-old cybersecurity executive and investor based in Toronto. Dubrovsky has been charged with conspiracy to threaten to impair the confidentiality of information with the intent to extort money, and interference with commerce by threats. It is the third publicly announced arrest since news of ‌the ⁠breach came out in late September 2026. In a Telegram post, the group said, “We will not remain active on Telegram for much longer, as several of our members have reportedly been arrested by the FBI.”
• Attackers Hijack Three ccTLDs to Obtain Google Certificates — Google said unknown threat actors obtained unauthorized HTTPS certificates for several Google domains and hijacked domains in the country-code top-level domains (ccTLDs) for Ghana (.gh), American Samoa (.as), and Sierra Leone (.sl) after compromising third-party operators and modifying authoritative DNS records. “During these hijacks, attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains, as well as domains belonging to other organizations,” Google said. “Following our initial mitigation, Certificate Transparency (CT) log data revealed additional organizations, including several leading global brands and widely used online services, believed to have been impacted by the same attacks.” Chrome blocked the unauthorized certificates through CRLSets.
• GoBalance Flaw Can Be Used to Hijack TOR .onion Sites — A vulnerability in GoBalance, a load-balancing tool used by many darknet sites, can be abused to recover a site’s master signing scalar from its publicly available data, ultimately enabling site takeover and redirection. “Between 5 and 7 October, both onion addresses of Dread, a prominent darknet forum, were taken over and redirected to a rival platform, Conclave,” Searchlight Cyber said. “Several marketplaces using the same software were also affected. Dread’s operators initially attributed the incident to an accidental key leak; the evidence set out below indicates that the GoBalance flaw was the more likely cause, at least for the second address.”

‎️‍🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-86360, CVE-2026-86361, CVE-2026-86362 (Dell System Update), CVE-2026-21589 (Atlassian), CVE-2026-93355 (LiteLLM), CVE-2026-106382, CVE-2026-106197, CVE-2026-106358, CVE-2026-106347 (Google Chrome), CVE-2026-102255 (SonicWall SMA 1000), CVE-2026-105192 (LMCache), CVE-2026-102406, CVE-2026-103008, CVE-2026-102404, CVE-2026-102413 (Elasticsearch), CVE-2026-104711, CVE-2026-104712, CVE-2026-104713, CVE-2026-104714 (Apache Struts), CVE-2026-91140 (Progress DataDirect), CVE-2025-64393, CVE-2026-58069 (Veeam Backup & Replication), CVE-2026-32740 (Next.js), CVE-2026-18397 (Thales SConnect), CVE-2026-84388 (Fortinet FortiPAM Chrome extension), CVE-2026-76464, CVE-2026-20328, CVE-2026-76454, CVEs, CVE-2026-76482, CVE-2026-76480, CVE-2026-76483, CVE-2026-76455, CVE-2026-76459, CVE-2026-76471, CVE-2026-76465, CVE-2026-76485, CVE-2026-76486, CVE-2026-76501, CVE-2026-76498, CVE-2026-76499, CVE-2026-76500 (Cisco), CVE-2026-76281, CVE-2026-76282, CVE-2026-76284, CVE-2026-76268 (Splunk), CVE-2026-85097 (Bricksforge WordPress plugin), CVE-2026-93836 (WPC Product Bundles for WooCommerce WordPress plugin), CVE-2026-94504 (Ninja Forms WordPress plugin), CVE-2026-105133, CVE-2026-105134 (AhsayCBS), CVE-2026-96940 (Microsoft Exchange Server), CVE-2026-63277 (LibreOffice), CVE-2026-59265 (Apache OpenOffice), and multiple vulnerabilities in WordPress.

🎥 Cybersecurity Webinars

• AI Attacks Move at Machine Speed. Can Your Identity Security Keep Up? → AI-powered attacks can now move from reconnaissance to privilege escalation faster than traditional security teams can investigate and respond. This webinar explains why identity is becoming the critical real-time control layer—and how runtime identity security can help organizations detect risky access, enforce decisions across cloud, SaaS, on-prem, and AI environments, and stop machine-speed attacks before they turn into breaches.
• AI Agents Have Too Much Access — Learn How to Control the Risk → AI agents are moving fast inside organizations, often with access to sensitive data, credentials, and business systems before security teams have full visibility or control. This webinar breaks down how shadow AI creates insider risk and shows how to govern AI access, reduce exposure, and enable safer adoption without slowing the business.

📰 Around the Cyber World

• The India-nexus adversary known as Dropping Elephant (aka Patchwork) has been observed targeting government, defense, naval, aerospace/UAV, academic, and other strategically significant sectors across Pakistan, Sri Lanka, China, and South Korea. “The group continues to use spear-phishing campaigns with malicious LNK attachments to deliver PowerShell-based malware, DLL sideloading payloads, and in-memory RAT,” Arctic Wolf said.
• Bitter, another threat actor assessed to be operating with interests aligned to India, targeted a European embassy in Asia in June 2026 with a spear-phishing email bearing a FIFA World Cup-themed lure to deliver BDarkRAT. “The attackers compromised a legitimate mailbox belonging to a diplomatic account from an African country to send the malicious message,” Trellix said. “The attack utilized a multistage delivery method beginning with a ZIP file attachment containing a VHDX disk image. Inside this image lay a shortcut (.lnk) masquerading as a PDF document. Upon execution, this shortcut initiated an obfuscated PowerShell and command-line sequence. This process established a scheduled task, deceptively named to appear like a system error to ensure persistence, and beaconed to a remote server. This initial connection facilitated reconnaissance by gathering system information and eventually downloading a second-stage MSI installer, which deployed the BDarkRAT remote-access trojan.”
• Let’s Encrypt said TLS certificate lifetimes are dropping from 90 to 64 days by default starting February 2027, in preparation for 45-day lifetimes planned for 2028.
• In a lengthy post on X, Microsoft’s CEO Satya Nadella called out the dangers posed by highly advanced AI models, stating AI can no longer be treated as a “set of nested black boxes” and urged building a more transparent system where models can be contained, observed, and leave behind “tamper-proof human-readable evidence.” Nadella added, “We must assume a model is compromised and contain it from the start. Think of it like an emergency brake. An authorized person should always be able to pause or shut down a model mid-task. More advanced models will require more advanced containment technologies that we need to standardize on.”
• Data from Comparitech showed that Q3 2026 saw the highest quarterly figures to date for ransomware attacks, with 2,627 incidents reported in total. This represents a 29% increase from Q2 2026, when 2,030 attacks were recorded and a 61% increase from Q3 2025, when 1,636 attacks took place. The median ransomware demand was $150,000 and the average was $602,400. The most prolific gangs were Qilin and The Gentlemen.
• Oleg Korniev, 42, a dual citizen of Ukraine and Russia, pleaded guilty in the U.S. to running a sophisticated international money laundering organization that laundered millions of dollars stolen from U.S. victims. The criminal organization recruited over 15,000 U.S.-based money mules to launder at least $10 million stolen by hackers from over 750 U.S. bank accounts. Korniev was one of the leaders of Your Mule Cashout (YMCO).
• A U.S. jury convicted Jonathan Spalletta (aka Cthulhon and Jspalletta), 36, of Maryland, of computer fraud and money laundering over two separate hacks of decentralized crypto exchange Uranium Finance in 2021. He faces up to 10 years in prison on the fraud count and 20 years on the money laundering count. “In the first hack, on April 8, 2021, Spalletta engaged in a deceptive series of transactions with Uranium’s smart contract that Spalletta used to withdraw far more ‘rewards’ in cryptocurrency than he was authorized to receive,” the Justice Department said. “He repeated those transactions over and over until he had drained the liquidity pool of nearly all its rewards tokens. In total, Spalletta successfully extracted cryptocurrency worth approximately $1.4 million in the first hack. In the second hack, on April 28, 2021, Spalletta exploited an error in the Uranium smart contract that governed how much cryptocurrency he could withdraw in a liquidity pool on Uranium. Spalletta exploited that issue across multiple separate Uranium liquidity pools, fraudulently obtaining approximately $53.3 million in cryptocurrency and causing Uranium to shut down due to lack of funds.” The stolen funds were eventually laundered through a complex series of cryptocurrency transactions, including by using the cryptocurrency mixer Tornado Cash.
• OpenAI disclosed it disrupted two influence operations from Russia (Dark Clark) and Iran (Bogus Bylines) that used ChatGPT and other AI tools to create “false front” entities, such as seven fake journalist personas and covert think tanks, that successfully planted stories and narratives in mainstream news publications. “They used those entities to launder geopolitical, conflict-related messaging into their target audiences,” OpenAI said. “Both operations were multi-dimensional, trying a range of different tactics to achieve their goals. As well as long-form articles, the Iranian operation generated batches of social media comments, generally on topics related to the US-Iran war. As well as controlling the ‘think tank,’ the Russian operation created fake ‘leaked’ documents and audio scripts, some of which we identified as being spread online.” Some of the outlets that published the articles, however, had substantial audiences, including one with 2 million Facebook followers.
• Threat actors are embedding “AI-Analysis Evasion” (aka A3) capabilities in malware by embedding natural-language instructions to influence automated analysis. Such techniques have been detected against four malware families: FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE, per Cisco Talos. This includes anti-analysis comments in source code, in some cases generating them from a template and incorporating intimidation notes that instruct the model that it is a monitored honeypot. “What began as a direct-instruction technique has evolved to target multiple models through template spraying,” Talos said. “Malware authors are also attempting to establish multiple analysis-bypass conditions by using direct or indirect deterrence instructions aimed at the model.”
• A brand deal scam is targeting YouTube creators by impersonating Hollyland, a legitimate manufacturer of wireless transmission and audiovisual equipment. The phishing emails lead to a fake website that instructs them to sign in with their Google account with an aim to harvest their credentials. “The attackers who hijack your account could use it to access other linked services or impersonate them to contact your followers or collaborators,” ESET said. “The compromised account can also be misused to spread malicious links and peddle other scams.”
• A high-severity flaw in NVIDIA’s DCGM Exporter GPU monitoring tool (CVE-2026-47483, CVSS score: 8.2) could be abused by unauthenticated attackers to flood its profiling endpoints with concurrent unauthenticated requests to exhaust resources and crash the service, potentially slowing AI workloads running on the same host. Lava Security said it found roughly 2,100 hosts exposing the exporter to the internet without authentication between March and May 2026, leaking telemetry data from more than 12,000 GPUs. The hosts belonged to about 300 organizations, with the GPUs representing about $100 million in hardware. The flaw has been addressed in version 4.8.2 or later. “As AI infrastructure scales, organizations need to protect every layer of the stack and know exactly what they are responsible for versus what their provider is responsible for,” Lava said.
• Raheim Hamilton, 30, a Virginia man who co-created and operated Empire Market, a dark web marketplace that peddled illegal goods and services, was sentenced to 40 years in federal prison. Raheim pleaded guilty in January 2026.
• Three new malware loaders have been spotted in the wild: 2CLoader, which delivers Vidar, Remus Stealer, and XWorm RAT, AvisLoader, which is delivered via ClickFix lures and communicates via Fox, an encrypted peer-to-peer (P2P) messaging network, to fetch commands and additional payloads from the operator, and Sauron Loader, which offers loader-type functionality exclusively to Russian-speaking cybercriminals.
• Details have emerged about two Zammad flaws that were exploited as zero-days to breach the Dutch Institute for Vulnerability Disclosure (DIVD). According to Horizon3.ai and Sysdig, CVE-2026-102489 is a remote code execution flaw affecting versions 6.3.0 to 6.5.4, while CVE-2026-102490 is a local privilege escalation (LPE) flaw affecting all versions from 1.5.0 to 7.1.0-alpha. On October 2, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaws to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fixes by October 5, 2026.
• An investigation into a September 2026 Akira ransomware attack undertaken by Huntress found that “the threat actor behind the attack accessed the endpoint via Remote Desktop Protocol (RDP), disabled antivirus, and deployed Rclone for data exfiltration, before deploying the ransomware. The actor also deployed a GOST tunneling tool, likely for persistence.”

Conclusion

A few arrests and takedowns brought some good news this week. But the bigger picture is less comforting. Attackers keep finding new ways in, old mistakes still work, and even the systems meant to help or protect people aren’t always what they seem.

That’s it for this edition. Not every story here needs your attention, but a few might deserve a closer look. Especially the ones that sound a little too familiar to your own setup. Better to spot the problem in someone else’s story than become part of the next one. See you next week.

Tens of thousands of people in India have taken to the streets in recent days to protest the deletion of 130 million names from the voter rolls, a large majority of which are believed to be opposed to Narendra Modi’s ruling BJP party. The demonstrations, joined by leaders from India’s opposition parties, are being led by students and the youth-led “Cockroach” movement. Tens of thousands of security forces, including paramilitary and police, were out on the streets over the weekend cracking down on the uprising, detaining protesters en masse, including lawyers, journalists and protest leaders.

The demonstrations “represent an outpouring of anger, of frustration at what many Indians feel is the fact that their democracy has been taken away,” says Shoaib Daniyal, political editor of Scroll, who was arrested on Saturday along with 7,000 other protesters. He points out that “the deletions have affected Muslims far more than they have affected other Indians.”

On Monday, in one of largest recent protests in India’s capital of New Delhi, India’s main opposition leader, Rahul Gandhi of the Congress Party, led a march to the Supreme Court of India. “This march has become a people’s march, with all of them heading towards this constitutional authority, which they feel should safeguard the rights of Indian people, especially this very basic right to vote,” says Jahnavi Sen, managing editor of The Wire.

TRANSCRIPT

This is a rush transcript. Copy may not be in its final form.

ANJALI KAMAT: In India, the right-wing government of Narendra Modi is facing its biggest challenge yet in 12 years in power, as tens of thousands of people have taken to the streets to protest what they call vote theft. At issue is the deletion of 130 million names from the voter rolls, and the vast majority of those deletions are believed to be opposed to Prime Minister Modi’s ruling BJP party.

The protests are being led by students and the youth Cockroach movement and joined by leaders from the opposition parties. They’re demanding the resignation of the chief election commissioner, Gyanesh Kumar, and an overhaul of the electoral system. The Cockroach movement started after the chief justice of India’s Supreme Court compared unemployed youth to cockroaches earlier this year.

Today, in one of largest recent protests in India’s capital of New Delhi, India’s main opposition leader, Rahul Gandhi of the Congress Party, is leading a march to the Supreme Court of India. Speaking to reporters earlier today, Gandhi reiterated the call for the election commissioner to resign.

RAHUL GANDHI: Narendra Modi is blocking the whole town, is putting 30,000-40,000 police people outside. For what? Because the opposition is asking one question: Prove to us that you have not cheated in the election. Prove to us that you’ve not cheated in the election.

AMY GOODMAN: The Modi government put New Delhi in lockdown ahead of Saturday’s protests, canceling trains to the city, shutting down metro stations, even suspending mobile internet in large parts of Delhi. Tens of thousands of security forces, including paramilitary and police, were mobilized across the city, and at least 7,000 people were detained Saturday alone, including protest leaders, lawyers and journalists. This is a protester speaking to reporters from inside a van where he was detained.

PROTESTER: [translated] The Modi government is scared of us. That is why we have been picked up from halfway. We didn’t even know where they were trying to bring us. [in English] This is just fear. And they are afraid of us because they have done something wrong, and you cannot do something wrong with the people of this country, man.

AMY GOODMAN: Several Cockroach movement leaders were also arrested right off the plane as they arrived in Delhi for the protest Saturday morning. After being released the next morning, Saurav Das, one of the leaders of the Cockroach People’s Party, vowed protests would continue.

SAURAV DAS: The protests are on. The protests will go on. [translated] The youth of the country have woken up. The youth of the country are asking for accountability. The peaceful protests will go on until they fix accountability. And now the protests will not only happen in Delhi, but in the whole country.

ANJALI KAMAT: On Saturday, the United Nations human rights spokesperson expressed concern over the mass detentions in India. In response, the Indian Mission in Geneva responded on X that the U.N.’s concerns were, quote, “misplaced and constitute an unwarranted interference in the internal affairs of India,” asserting that “India is the world’s largest democracy.”

AMY GOODMAN: For more, we’re joined by two guests in Delhi. Jahnavi Sen is the managing editor of The Wire, an independent news website in India. And joining us from the streets of New Delhi, Shoaib Daniyal, political editor of Scroll, another Indian independent news website.

Shoaib, you were arrested on Saturday. You are out now. Describe what’s happening in the streets and why these massive protests are happening, and also the response to thousands being arrested.

SHOAIB DANIYAL: The protests are happening over one issue, Amy, which is the rigging of the voter rolls that Anjali pointed out. A hundred and thirty million Indians have got kicked off the voter rolls in a process that could, at best, be described as arbitrary. The deletions have affected Muslims far more than they have affected other Indians, so there is a very, very racial element in what this program represents. And these protests are coming after months of this exercise going on, and they represent an outpouring of anger, of frustration at what many Indians feel is the fact that their democracy has been taken away. We fought really hard for our democracy in 1947, and it feels like the right to vote has been taken away, and really everything else is downstream from that.

On Saturday, we saw something unprecedented in India. Delhi was locked down, as you very correctly phrased it. There were tens of thousands of policemen, paramilitary forces on the streets. The entire city was barricaded. The entire city center was barricaded. Internet was shut off. The police unleashed violence on these — you know, most of the protesters are actually kids. It’s very much a Gen Z protest in many ways. The bulk of the protesters are young kids. I just met a couple of kids who are 18, who are in first year in college. They’ve come here. And again, they were brutalized. They were arrested. This happened yesterday and the day before.

And today, we’ve had a kind of turning of the tide, so to speak, where the Congress Party, which is in the main opposition, has actually put its bulk, has actually put its strength, got its strength out onto the street. And we’ve seen some pretty remarkable scenes of — the very same parts of Delhi which were completely barricaded, which were completely blocked off, which were completely empty, they’re filled with protesters today. And the police today have not or cannot do anything about it.

ANJALI KAMAT: I want to bring Jahnavi Sen into the conversation, managing editor of The Wire, another independent news website in India. Jahnavi, you’ve also been out in the streets. Can you explain why protesters are marching to the Supreme Court of India right now?

JAHNAVI SEN: This began by a call from the leaders of the opposition who wanted to submit a memorandum to the chief justice of India about their concerns with what’s happening within the Election Commission of India. And as you were mentioning earlier, you know, one of the chief demands — though, of course, not the only demand — has been the resignation of the chief election commissioner, and the opposition has been trying to go to different constitutional authorities about this. They first tried to meet the Election Commission itself. They were underway. They have had a meeting with the president of India, Droupadi Murmu. And then they wanted to go to the chief justice of India, who sits in the Supreme Court, to submit a memorandum to him. He has denied them a meeting. And that is why now this march has become a people’s march, with all of them heading towards this constitutional authority, which they feel should safeguard the rights of Indian people, especially this very basic right to vote.

ANJALI KAMAT: And, Jahnavi, there’s also concerns about excessive brutality from police and other security forces who were on the streets over the weekend, particularly on Saturday. Can you talk a little bit about this? And you were on the streets, as well. What you witnessed?

JAHNAVI SEN: No, absolutely. I think it was, in fact, both on Saturday and Sunday, very heavy-handed behavior from the police, police and the paramilitary of different kinds, detaining people, putting them into police buses. And then, they were — several people were hit. They were mistreated. Women were manhandled. There were also allegation — not even not just allegations; we saw this happen — women protesters being taken into buses where there were no women constables, which is illegal, women protesters being detained after dark, which is also illegal. And then, another tactic that the police has now perfected is to detain protesters and then to drive them around in these buses for hours and drop them off in extremely far-flung corners of the city, from where it’s very difficult to make it back. Often it’s difficult to contact people that you know. They have also tried to take people’s phones and make them delete footage.

One of the very concerning things that we’ve been seeing is also the detentions of journalists. You were mentioning how Shoaib, too, was detained. On Saturday, my colleagues and I almost faced a similar situation. And so many journalists, both yesterday and today, despite wearing press cards, saying again and again that they’re from the media and they’re here to cover what’s happening, have been treated in this way, as have senior leaders of opposition parties. There were very stark and troubling visuals yesterday of a member of Parliament from one of the left parties, the CPIM, John Brittas, who was — who said he was pinned down by paramilitary personnel inside one of these detention buses, and then had trouble breathing. He had to be taken to the hospital.

So, really, yes, we have been seeing very heavy-handed behavior on the side of the police and the paramilitary forces. And they seem to be able to do this despite the Supreme Court having a hearing early yesterday morning, where they said that, you know, no illegal detentions should take place; journalists and lawyers doing their job should not be detained. Despite that, we have not seen a change in that behavior over Sunday, as well.

ANJALI KAMAT: Shoaib, I wanted to get your reaction to what the Indian Mission in Geneva posted on X in response to criticism from the U.N. Human Rights Office expressing concern over the mass detention of protesters. And the response began by saying, “India is the world’s largest democracy,” and “the right to peaceful assembly is guaranteed by our Constitution and safeguarded by robust institutions, an independent judiciary and a free media.” Do the people on the streets agree with this?

SHOAIB DANIYAL: I think now increasingly, what was a banal fact about India is now not true. And this is exactly what the protest’s about. We’re seeing, I think — and I think this is true for democracies across the world. We have — India still maintains a veneer of democracy. We’re still wearing the clothes of democracy. But inside, there is something rotten. So, elections are held. The elections are multiparty elections. On paper, everybody has a right to contest. But, of course, we are seeing right from things which are actually legal, which I think are there in other democracies, like the U.S. also, the fact that the BJP has so much money. So, even if everything were above the board, the BJP just starts, you know, a hundred meters ahead on the starting line when the race starts, just on money. They have so much money. But they also now have institutions.

You know, you asked why people are marching to the Supreme Court today. Now, these voter roll deletions were contested in the Supreme Court as they were happening, and the Supreme Court just did not do anything. It spun this incredibly legal, complex lawyer’s web, but eventually it did not do anything to stop it. It gave a carte blanche to the Modi government. And there is a lot of anger actually on the streets against the Supreme Court. As you pointed out, you know, this is one of the greatest ironies, is that the Cockroach movement actually arises from a stray comment made by the chief justice of India. So, there is anger against the Supreme Court for not doing its job. The Supreme Court is the guardian of the Constitution. It’s meant to protect our rights. And again, like in other democracies — I think American viewers would also empathize — the Supreme Court is just not seen to be doing their job. And the SIR, the voter roll revision, is seen to be a really egregious part of that. So, in a way, this march to the Supreme Court is really, really interesting, because Rahul Gandhi and other protesters are trying to politicize the Supreme Court’s role in this matter.

AMY GOODMAN: You know, it’s really interesting, what’s happening around the world, Jahnavi. You have these mass protests in France, led by the youth, around issues of affordability and education. You have mass protests in Spain that have led the prime minister to call for a snap election November 29th, and he’s dissolved the parliament. And now you have these mass protests in India. I’m wondering what you think this means for the Modi government.

JAHNAVI SEN: I think these protests are going to be impossible for the government to ignore, even though it seems to be trying really hard. All the messaging we’ve seen coming from leaders of Modi’s party — that’s the Bharatiya Janata Party — have been attempts to show that this is just the opposition trying to get — trying to make this an anarchic situation, that they don’t have an agenda, that they’re just, you know, trying to create chaos. But it’s not sitting. And I think one of the reasons why we also saw the targeting of journalists was that they realized that building that narrative is not working.

We have a chief election commissioner who faced some pretty damning — a pretty damning exposé in a very big newspaper about the way he was functioning. And since then, we have heard absolutely nothing from him. We don’t know where he is. And, of course, this is in a country where the prime minister has not given a press conference ever since he was elected as the prime minister of this country, so perhaps the chief election commissioner is simply following in his footsteps by quickly disappearing from public sight when things become a little difficult.

But I think, yes, this tactic of ignoring, this tactic of trying to suppress narratives and suppress people has not been working. We are seeing how today so many more people have gathered. The rally that Shoaib is at right now is —

AMY GOODMAN: We have 10 seconds.

JAHNAVI SEN: — very, very large. And so, I think, you know, no matter what narrative they try to build, this is not going to go away.

AMY GOODMAN: Jahnavi Sen of The Wire, Shoaib Daniyal from the Scroll, both independent news websites in India. Daniyal was one of those thousands arrested on Saturday. And we’ll continue to cover these protests.

Coming up, it’s Indigenous Peoples’ Day. We’ll speak with the Native American activist Leonard Peltier, who spent almost 50 years behind bars. Stay with us.

[break]

AMY GOODMAN: Sonny Singh in our Democracy Now! studio.