Cyber Security

Date saved: 2026-10-26 18:01 (PDT)

Sources: Reuters, KrebsOnSecurity, BleepingComputer, CERT, Senthorus, NetworkTigers, Palo Alto Networks Unit 42, Microsoft, AWS, CISA, Politico, Brandefense, Cybelangel, Wiz, The Big Newsletter, Yahoo News

Key findings

PHP2Shell: the vulnerabilities that threatened the web

• CERT / Previdian (October 26, 2026): Over the weekend, PHP2Shell exploitation escalated sharply - Previdian's telemetry recorded hundreds of exploitation attempts against CVE-2026-109618 from dozens of unique IP addresses, with the first confirmed event on October 21 at 1:05pm; SOCRadar found a complete exploit toolkit on an attacker-controlled server, including a Python script labeled a "one-click" exploit for PHP 8.4.26 under Apache mod_php; Palo Alto Networks Unit 42 initially linked PHP2Shell exploitation to a breach at a European government agency where attackers accessed MFA secrets and password hashes, with signs pointing to agentic AI tooling used in post-exploitation; more than 34.4 million PHP services remained assessed as vulnerable as of October 23, and neither CVE had appeared on CISA's Known Exploited Vulnerabilities catalog despite confirmed exploitation. (Source)

• BleepingComputer / Sergiu Gatlan (October 26, 2026): Two critical RCE vulnerabilities collectively tracked as PHP2Shell - CVE-2026-109618 and CVE-2026-109619 - have been successfully exploited in the wild; the PHP security team released emergency security patches on October 21; AWS Threat Intelligence says attackers began targeting the PHP2Shell flaws four days before security patches were released; the flaws affect all PHP installations serving web requests - PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed - and are present in every PHP version since PHP 5. (Source)

• Cybelangel (October 23, 2026): On October 21, 2026, the PHP security team shipped an emergency release covering CVE-2026-109618 and CVE-2026-109619, two critical unauthenticated remote code execution flaws in PHP core rated CVSS v4.0 9.2 each; the release landed 25 minutes ahead of schedule after a Hacker News leak broke the embargo the previous day; the flaws affect roughly 2.24 million internet-facing hosts; Cloudflare's CTO reported early attacks at 07:43 UTC on October 21, hours before the release; Sansec warned of mass exploitation within 15 minutes of the release; the flaws are present in every PHP version since PHP 5, affecting PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. (Source)

• Wiz / Calif / OpenAI (October 21, 2026): The two critical PHP flaws were discovered by AI-assisted research from teams at Wiz and Calif; OpenAI says its models "found these vulnerabilities before attackers did"; the vulnerabilities permit remote-code-execution scenarios against vulnerable PHP environments. (Source)

The AI-accelerated hack: one hacker, 100+ companies, AI agents

• Reuters / Kansas City Star (October 19, 2026): A cybersecurity researcher watched as a Chinese-speaking hacker broke into websites belonging to more than 100 companies, including farm equipment maker Deere, home appliance company SharkNinja, and engine manufacturer Cummins; the cybercriminal outsourced the hacking spree almost entirely to artificial intelligence, tasking AI agents with spending hours autonomously probing and breaking into targeted sites; the researcher, Snorre Fagerland, principal threat researcher at NorForge, found about two dozen instances of Cairn - an open-source AI problem-solving platform popular with hackers - being used for malicious activity beginning around October 2; one of the hackers stole a trove of credit card data; as of late last week, their agents had attempted to break into more than 1,200 sites; Reuters could not ascertain the degree to which the breaches resulted in unauthorized extraction of data; Deere said it had taken "necessary remediation actions" and had "no indication that sensitive information was accessed"; SharkNinja said the hack hit a standalone site carrying only product support information and that the threat had been contained; Cummins said it was "investigating the report of a potential cyber-attack on a website operated by one of our third-party vendors." (Source)

• Microsoft (October 21, 2026): A China-aligned group Microsoft calls Storm-0940 used the ARTEX AI framework to automate attacks against more than 2,250 Microsoft 365 organizations; some intrusions achieved privileged cloud access within three hours; a ConnectWise supply-chain compromise enabled unauthorized authentication to customer Microsoft 365 environments; Microsoft identified the group using the ARTEX AI framework to accelerate attack operations substantially. (Source)

Major data breaches: Capcom, Zeabur, Nikkei, Crime Stoppers, FBI

• Capcom (October 22, 2026): Unauthorized access to Capcom's CAPCOM ID service exposed information associated with 11,774,247 accounts; the company disclosed the breach on October 22 and forced password resets for impacted accounts. (Source)

• Zeabur (October 14-15, 2026): Development platform Zeabur disclosed its second significant security incident in roughly two months and subsequently announced that it would shut down; the October 14-15 intrusion ultimately gave the attacker access to the production database; approximately 321,810 accounts and more than 3.2 million environment-variable records were affected. (Source)

• Nikkei (October 19, 2026): Japanese media organization Nikkei disclosed a further breach involving approximately 1.83 million personal-information records, marking its third publicly reported security incident in around a month. (Source)

• CBC (October 2026): An exclusive CBC investigation revealed the extent of the Crime Stoppers data hack in Canada - more than 1.5 million tips submitted to Canadian Crime Stoppers programs over the last 25 years were exposed, along with tens of thousands of unredacted personal details; the information was stolen last March by hacktivist collective Internet Yiff Machine, who stated they wanted to disprove the company's claim that its platform was "anonymous" and "secure"; Navigate360 confirmed its database had been breached between November 2025 and March 2026, acknowledging this publicly seven months after the hack; Toronto, Halton, and Guelph are among the Ontario cities temporarily pausing Crime Stoppers tip programs. (Source)

• KrebsOnSecurity (October 19, 2026): U.S. federal investigators pursuing the ShinyHunters hacking group identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group; one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom; ShinyHunters hacked the FBI recruitment website fbijobs.gov and taunted the agency by threatening to publish the stolen files, which reportedly included medical and psychological records, Social Security numbers, home addresses, and information about each employee's unit and specialization; the FBI removed a contractor at Accenture over their failure to patch the FBI recruitment website; the FBI arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the ShinyHunters investigation; ShinyHunters has extorted more than $70 million from victims so far this year. (Source)

SafePay ransomware and the supply-chain compromises

• NetworkTigers (October 26, 2026): U.S. and international agencies warned that SafePay ransomware has affected at least 600 organizations since 2024; attackers exploit vulnerable VPNs, compromised credentials, and exposed systems to steal data and disrupt backups; SafePay pairs file encryption with data-theft pressure to force payouts and has been tied to attacks leveraging multiple vulnerabilities including CVE-2023-20269, CVE-2020-3259, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. (Source)

• LiteLLM compromise (October 2026): Attackers compromised LiteLLM's release pipeline and distributed malicious Python packages and Docker images containing an information stealer; version 1.107.0 exposed cloud credentials, API keys, and environment variables, requiring affected organizations to isolate systems, rebuild compromised environments, and rotate secrets. (Source)

• Arista VeloCloud (October 2026): Attackers are exploiting CVE-2026-114625, a critical SQL injection vulnerability affecting VeloCloud Orchestrator with a CVSS 9.9 rating; authenticated users can escalate to superuser privileges, potentially compromising SD-WAN management infrastructure; Arista released patches for affected on-premises deployments and confirmed hosted systems were already updated. (Source)

Other critical vulnerabilities: GitLab, Collabora, Plex, Node.js, Brotli

• GitLab (October 2026): GitLab issued security updates for CVE-2026-110264, carrying a CVSS 10.0 rating and potentially allowing unauthenticated remote code execution against self-managed GitLab environments under affected conditions; the flaw affects self-managed Community and Enterprise installations. (Source)

• Collabora Online (October 23, 2026): CISA added CVE-2026-110447 (CVSS 9.2) to its Known Exploited Vulnerabilities catalog - an operating-system command-injection vulnerability affecting the Collabora Online Built-in CODE Server used with Nextcloud that can provide remote code execution through proxy.php under affected conditions. (Source)

• Plex Media Server (October 17, 2026): Attackers began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, achieving unauthenticated remote code execution against exposed Plex servers; the chain combines four vulnerabilities to achieve full compromise. (Source)

• Google Brotli (October 2026): CVE-2026-111497 affects Google's Brotli decoder and can produce memory corruption when applications process malicious compressed content; the vulnerability affects Node.js and other software, with fixes delayed into October releases. (Source)

• Oracle / Cisco (October 2026): Oracle's October Critical Patch Update addresses 1,209 unique vulnerabilities, including 95 critical flaws; Fusion Middleware received 206 fixes, including 134 vulnerabilities that could be exploited remotely without authentication; Cisco released fixes for 34 vulnerabilities affecting Expressway, IOS XR, Snort 3, and Unified Communications products, with critical flaws that could enable root-level command execution and authentication bypass. (Source)

• Onamae Desktop Cloud (October 2026): Attackers compromised Onamae Desktop Cloud infrastructure and installed malware on customer servers, potentially affecting 26,739 systems; the provider suspended services while investigating possible data exposure. (Source)

Source links

• Reuters / Kansas City Star: Exclusive - How one hacker used AI agents and a few thousand dollars to break into scores of sites
• KrebsOnSecurity: FBI Arrests Executive at Ransomware Negotiation Firm
• BleepingComputer: PHP2Shell security flaws now successfully exploited in the wild
• CERT Uganda: PHP2Shell Escalates - Millions of Exploitation Attempts, Mirai Deployment Attempts
• Senthorus: Cybersecurity Week in Review: October 19-25, 2026
• NetworkTigers: Cybersecurity news weekly roundup October 26, 2026
• Cybelangel: php2shell + 4 More - Cyber Roundup Week of October 19
• Tech Newsday: AI assisted attackers breach European government via PHP2Shell
• Anik Das: AI Just Lit The Cyber World On FIRE!! PHP2Shell Mayhem
• Politico: US, allies warn of critical vulnerabilities in programming underlying 70% of the internet

Date saved: 2026-10-26 12:17 (PDT)

Sources: CISA, FBI, BleepingComputer, Nextgov, Forrester, Quantum, CSA Singapore, Expel, The Hacker News, Security Boulevard, Cyber.netsecops, Ars Technica, Register, SANS, InfoSecurity Magazine, Aviatrix, Bellingcat, CERT-FR

Key findings

PHP2Shell: critical PHP vulnerabilities under active exploitation

• CISA / Quantum / PHP Project (October 21, 2026): The PHP project disclosed two critical vulnerabilities in PHP core and released fixes. They are known publicly as PHP2Shell. CVE-2026-109618 is an out-of-memory error that can leave request memory uninitialized. CVE-2026-109619 is stale global state that can still point to freed request memory. Both can lead to unauthenticated remote code execution. Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the PHP web worker process, and to disclose memory. One crafted HTTP request can trigger it, before any application code runs. CVSS scores: 9.8 (CRITICAL) for both. Proof-of-concept exploit code is publicly available, and security researchers have reported early exploitation attempts against internet-facing PHP servers. As of this bulletin, neither CVE is listed in the CISA Known Exploited Vulnerabilities catalog. (Source)
• Nextgov / NSA / FBI / CISA (October 21, 2026): The NSA, FBI, and Cybersecurity and Infrastructure Security Agency urged organizations to fix two critical flaws in software that powers much of the web, warning that systems should be taken offline if they cannot be secured promptly. The flaws affect PHP, a programming language that works behind the scenes to run websites, process forms, and retrieve information. Hackers could exploit the flaws to run commands on an affected server without logging in, potentially allowing them to steal data, change a website's contents, or take control of it. While CISA has not observed exploitation as of the time of publication, they pose a risk to organizations if left unpatched. Cybersecurity company Wiz demonstrated successful attacks against WordPress, Drupal, and Joomla installations. PHP's developers also said all installations handling web requests are at risk. (Source)
• Forrester (October 22, 2026): The two flaws were leaked online on October 20, forcing the PHP team to follow up with an announcement of an emergency patch. PHP2Shell vulnerabilities have not been registered in the CISA Known Exploited Vulnerabilities catalog, but CISA released an alert urging organizations to patch immediately. Other KEV sources and vendors report that they have seen exploitation and probing attempts. (Source)
• CSA Singapore (October 21, 2026): Attackers can exploit multiple critical vulnerabilities in PHP to achieve unauthenticated remote code execution. Patch immediately. There have been reports of widespread exploitation attempts targeting these vulnerabilities, as well as the development of multiple proof-of-concept exploits. These vulnerabilities affect all versions of PHP. (Source)

SafePay ransomware: 600 critical infrastructure organizations compromised

• CISA / FBI / USSS / UK NCA / Germany LKA Rheinland-Pfalz (October 20, 2026): SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. Since August 2024, SafePay ransomware group's operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia. SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors. The group gets initial access by exploiting unpatched VPN and edge-device vulnerabilities, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766, and through brute-force credential attacks using Mullvad VPN exit nodes. Once inside, it disables security and backup services, resets network storage devices, encrypts files, and threatens to publish stolen data. SafePay is believed to be behind the November 2024 ransomware attack on U.S. business services firm Conduent, which resulted in a substantial amount of personal and healthcare data being exfiltrated. On October 16, 2026, Conduent agreed to pay $80 million to settle a class action lawsuit related to the data breach. (Source)
• BleepingComputer (October 21, 2026): CISA says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. Paying ransoms does not guarantee recovery of files encrypted in ransomware attacks, and victims are urged to report incidents to law enforcement. (Source)
• InfoSecurity Magazine (October 21, 2026): The SafePay ransomware group has compromised at least 600 critical infrastructure organizations, according to a joint advisory issued by government agencies from the U.S., Germany, and UK. SafePay is believed to be behind the November 2024 ransomware attack on U.S. business services firm Conduent. (Source)

Ivanti Connect Secure zero-day exploitation, Plex vulnerabilities, Microsoft Mark of the Web bypass

• CISA (October 13, 2026): CISA is aware of Ivanti's disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure. CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities Catalog on October 13, 2026. CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version. (Source)
• SANS NewsBites (October 16, 2026): CVE-2026-96951, CVSS score 8.8, allows an unauthorized attacker to bypass the Mark of the Web security feature over a network by exploiting a command injection vulnerability in Windows Shell. Microsoft lists the flaw as exploited, and it has been added to CISA's Known Exploited Vulnerabilities catalog with a three-day mitigation window. On October 14, Cisco published a security advisory addressing a critical path traversal vulnerability in the Advanced Malware Protection feature of Cisco Secure Email Gateway (CVE-2026-76519, CVSS score 9.8). CISA added it to the KEV catalog on October 14 with a mitigation deadline of October 17. (Source)
• CISA (October 20, 2026): CISA added six known exploited vulnerabilities to the catalog, including four Plex Media Server vulnerabilities and one EG Secure Solutions SiteGuard vulnerability. (Source)

Broader landscape: Pentagon DMDC breach, Warlock ransomware, French supermarket refrigeration hack, Denmark CPR breach

• Aviatrix / Pentagon (October 2026): The Pentagon's Defense Manpower Data Center suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers and military records, discovered in July 2026 but ongoing since October 2025. North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from Bitget cryptocurrency exchange. International law enforcement successfully dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator. (Source)
• Security Boulevard (October 2026): The ransomware and extortion group n0n listed more than 40 port authorities, port operators, ship managers, and sea-shipping companies on its leak site on October 12. The likely way in was maritime IT services provider CyberLogitec. Half of the listed victims are known CyberLogitec customers. (Source)
• Cyber.netsecops (October 13, 2026): A cyberattack on refrigeration systems, linked to Danish provider Danfoss, caused significant food spoilage across hundreds of supermarkets in France, Belgium, and the Netherlands. Attackers manipulated the appliances' defrost mechanisms, causing them to reach temperatures of up to 50 degrees Celsius. The attack targeted devices from multiple vendors: Danfoss AK-SC and AK-SM series, and Copeland XWEB devices. The supermarket refrigeration controller cyberattack targeted devices from multiple vendors. (Source)
• The Hacker News (October 23, 2026): Hackers breached enterprise firewalls and VPNs, exposing over 70,000 credentials. Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. (Source)
• BleepingComputer (October 2026): Germany arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan. An international law enforcement operation dubbed Operation KillSwitch seized the KillSec ransomware gang's data leak site and servers, led to three arrests, and identified a 16-year-old as the group's alleged administrator. (Source)

Source links

• CISA: #StopRansomware: SafePay Ransomware Advisory AA26-293A
• Nextgov: US agencies urge fixes for programming language flaws putting millions of web systems at risk
• Forrester: PHP2Shell Leak Sends Security Teams Scrambling
• BleepingComputer: CISA: SafePay ransomware hit over 600 critical infrastructure orgs
• CISA: CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
• Quantum: PHP2Shell Vulnerabilities Security Bulletins
• SANS NewsBites: NewsBites Volume XXVIII - Issue 77
• Aviatrix: Major Cybersecurity Incidents Rock Week 40: Pentagon Breach, KillSec Takedown, and $387M Crypto Heist
• YouTube: CISA - SafePay Ransomware Advisory Briefing
• YouTube: BleepingComputer - PHP2Shell Critical PHP Vulnerabilities Explained

Date saved: 2026-10-26 03:01 (PDT)

Sources: CISA, FBI, SOCRadar, Group-IB, NyxLab, The Hacker News, BleepingComputer, The Verge, Security Affairs, PC Gamer, DW Documentary, CISA Known Exploited Vulnerabilities Catalog

Key findings

SafePay ransomware: CISA/FBI joint advisory, 600+ victims

• CISA / FBI / Joint Agencies (October 20, 2026): The CISA, FBI, U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency, and the UK's North West Regional Organised Crime Unit released a joint advisory on SafePay ransomware. Since August 2024, SafePay actors have targeted businesses and critical infrastructure across North America, South America, Europe, and Australia, affecting approximately 600 victim organizations. The advisory names five CVEs exploited by SafePay: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. SafePay actors gain access by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics. They then use legitimate system tools to move through networks, disable security protections, and encrypt files. Investigators collected TTPs and IOCs through August 2026. (Source)

• CISA press release (October 21, 2026): The FBI and partners are giving network defenders clear, actionable guidance to protect their organizations from one of 2026's most active ransomware groups. Public-facing devices with known vulnerabilities continue to be frequently targeted by threat actors like SafePay. CISA urges organizations to urgently patch the known exploited vulnerabilities in the advisory and conduct forensic triage. (Source)

AI-driven ransomware and firewall/VPN breaches

• SOCRadar / The Hacker News (October 23, 2026): Cybersecurity researchers discovered an artificial intelligence-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions as both an intrusion and data-extortion operator, as well as an infrastructure provider supporting different partners across the ransomware ecosystem. The operators exploited edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways, and used AI-managed knowledge bases to track victims, stolen credentials, and campaign progress. SOCRadar estimates the campaign targeted 62 organizations, with 36 located in the United States. (Source)

• Group-IB / NyxLab / The Hacker News (October 23, 2026): A large-scale campaign has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. Artifacts from the investigation indicate that operators have obtained access to numerous organizations worldwide and have attempted to further compromise some victims, resulting in persistent remote access and data exfiltration. (Source)

Capcom data breach: 11.7 million email addresses exposed

• Security Affairs (October 22, 2026): Capcom disclosed a data breach exposing 11,774,247 email addresses and account details after hackers accessed its CAPCOM ID service. The breach was discovered on October 19. For 43 cases, hackers exposed date of birth, gender, country/region, and nickname. Attackers illegally changed passwords on 196 accounts, and the company has already reset them. Credit card details were not affected. Capcom notified the police and Japan's Personal Information Protection Commission on October 21. (Source)

• The Verge (October 22, 2026): Capcom data breach leaks over 11 million email addresses. The breach was discovered on October 19th. 196 passwords were changed but no existing passwords were leaked. 43 cases involved date of birth, gender, country, and nicknames being revealed. (Source)

• BleepingComputer (October 22, 2026): Japanese gaming giant Capcom confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. Passwords for all other registered members have not been exposed. Credit card information remained unaffected. (Source)

Other major incidents: Japan emergency, Idaho schools, PHP2Shell, monster cloud fraud

• Breach Signal / Japan CERT (October 2026): Japan declared a cyberspace emergency as ransomware attacks exposed millions of records. The declaration follows a wave of AI-accelerated ransomware attacks that compromised personal data of over 14 million citizens and disrupted nearly 500 businesses. (Source)

• Cybernews / Breach Signal (October 2026): Hackers seized Idaho school cameras, locks, and HVAC systems, closing all schools for two days. District officials said attackers accessed student data and demanded a ransom that has not been disclosed. (Source)

• Google News (October 23, 2026): Critical PHP2Shell exploit code went public as hackers attempted to deploy botnet malware, enabling widespread exploitation of PHP-based web shells. (Source)

• The Hacker News (October 8, 2026): The U.S. Department of Justice announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly paying the attackers to obtain decryptors while claiming to use proprietary tools to recover their data. The MonsterCloud owner is accused of billing over $19 million while secretly paying ransoms. (Source)

• Spain / The Hacker News (October 1, 2026): Police in Spain arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group, which is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid. (Source)

Source links

• CISA: #StopRansomware: SafePay Ransomware Advisory AA26-293A
• CISA: CISA, FBI and Partners Warn Organizations of SafePay Ransomware
• The Hacker News: Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents
• The Hacker News: Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
• Security Affairs: Capcom Data Breach Exposes 11.7 Million Email Addresses
• The Verge: Capcom data breach leaks over 11 million email addresses
• BleepingComputer: Capcom confirms data breach affecting 11.7 million accounts
• DW Documentary: Cyberattacks, data encryption, extortion - How cybercriminals operate
• Ryan Doc: The Teenage Hacker the FBI Couldn't Catch - True Story Documentary
• Patriot Docs: The Hacker Who Accidentally Started A Cyber War

Date saved: 2026-10-25 18:01 (PDT)

Sources: CISA, FBI, Unit 42 Palo Alto Networks, TechCrunch, Medium, Verizon, ITRC, Capcom, Coinotag, Yahoo Finance, Xact Cybersecurity

Key findings

Major ransomware operations and critical infrastructure

• CISA / FBI / Germany / UK Joint Advisory (October 20, 2026): SafePay ransomware has compromised at least 600 organizations across critical infrastructure sectors since August 2024; the playbook uses initial access through vulnerabilities in VPNs, firewalls, and backup software, achieves data theft and encryption often within 24 hours of getting in, deliberately attacks backup systems to sabotage recovery, and exfiltrates data staged with 7-Zip and WinRAR archives to Backblaze B2 cloud storage using its legitimate b2.exe tool; Infosecurity Magazine notes SafePay may be a rebrand linked to LockBit, ALPHV/BlackCat, or INC affiliates and calls it one of 2026's most active groups. (Source)
• Xact Cybersecurity (October 22, 2026): CISA, the FBI, and international law enforcement partners released a joint advisory warning about SafePay ransomware; the advisory was developed by CISA, the FBI, the U.S. Secret Service, and law enforcement partners in Germany and the United Kingdom, and describes SafePay activity observed through investigations conducted as recently as August 2026. (Source)
• Palo Alto Networks Unit 42 (October 19, 2026): Multiple ransomware groups are actively exploiting the Palo Alto GlobalProtect authentication bypass CVE-2026-0257 in PAN-OS, even though it was patched in May; Rapid7 saw attacks from May 17, and Unit 42 named Qilin and Inc among the operators; once inside, attackers use legitimate IT management tools to move laterally, and Palo Alto's warning is that because access comes through the victim's own VPN, it can look like normal remote work. (Source)

PHP critical vulnerabilities and public exploit code

• Unit 42 Palo Alto Networks (October 23, 2026, updated October 25): CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems, allowing remote code execution; the threat brief was updated October 25 as exploitation activity continued. (Source)
• MSN / Google News (October 23, 2026): Critical PHP2Shell exploit code went public as hackers attempted to deploy botnet malware, a significant development given PHP's ubiquity in web infrastructure. (Source)

Major data breaches

• MSN (October 23, 2026): The Capcom data breach has been confirmed with around 11.7 million accounts thought to have been affected, making it one of the year's largest gaming-sector breaches. (Source)
• ITRC H1 2026 Data Breach Report: The Identity Theft Resource Center counted 1,803 compromises in the first half of 2026 and 471.2 million victim notices, already more than all of 2025; the record volume reflects the scale of supply-chain and ransomware attacks. (Source)
• Verizon 2026 Data Breach Investigations Report: 48% of breaches now start with software vulnerabilities, beating stolen passwords as the top way attackers get in; the report is the industry's most comprehensive annual accounting of breach patterns. (Source)
• FBI investigation (October 2026): The FBI is investigating a dark web service called Nexus that sold scans of more than 153 million U.S. and Canadian driver's licenses and other identity documents, with evidence suggesting near real-time exfiltration tied to IDscan.net before Nexus abruptly disappeared; a healthcare technology company also reported a data breach affecting more than 9.5 million patients. (Source)
• ASOS (October 2026): The UK fashion retailer confirmed a breach exposing customer names and contact details after attackers gained access to an employee account through impersonation. (Source)

Bitcoin and AI-hacking threat scenario

• Yahoo Finance / Benzinga (October 23, 2026): Billionaire investor Chamath Palihapitiya predicted Bitcoin will eventually be hacked and go to zero, arguing that recursively self-improving AI models could target Bitcoin's SHA-256 security and potentially crack Satoshi Nakamoto's wallet; Palihapitiya said a coordinated transition to quantum-resistant cryptography is "basically impossible" given how divided the Bitcoin community already is on basic coordination; the prediction was made on the Moonshots podcast and Palihapitiya noted an attacker could profit twice -- first by draining the wallet, then by shorting Bitcoin after revealing the hack publicly. (Source)
• Coinotag (October 25, 2026): Palihapitiya's zero call is a scenario, not a disclosure; SHA-256 hashing and wallet-signature security are distinct cryptographic layers, and no catastrophic protocol breach has occurred in Bitcoin's history, which is the fact any attack thesis must first overcome; the counterweight is that Jordi Visser has dismissed a similar zero-call, on-chain accumulation has continued with whales adding 243,000 BTC since July, and the argument will be settled by cryptographers, not by a forecaster who left the position years ago. (Source)

CISA workforce reductions and infrastructure targeting

• CISA (October 2026): The Cybersecurity and Infrastructure Security Agency ended six free critical-infrastructure cybersecurity assessments amid workforce reductions, raising concerns given recent targeting of U.S. water systems; in July, CISA observed malicious cyber activity targeting more than 100 internet-exposed water and wastewater systems across at least a dozen U.S. states. (Source)
• CISA / NSA / FBI Advisory AA26-251A (September 8, 2026): Six China-based AI labs -- DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI -- were named for industrial-scale API distillation against Claude, GPT, Gemini, and Grok; the alleged theft ran through premium subscriptions, transfer-station proxies, and millions of teacher-model queries rather than through breached servers. (Source)

Source links

• CISA / FBI Joint Advisory: SafePay Ransomware Has Hit Hundreds of Organizations
• FBI probes 153 million driver's licence leak, Health data breach hits 9.5 million
• Palo Alto Networks Unit 42: Threat Brief -- Critical Vulnerabilities in PHP CVE-2026-109618, CVE-2026-109619
• Palo Alto Networks Unit 42: Active Exploitation of May 2026 PAN-OS CVE-2026-0257
• TechCrunch: The internet is having a very bad cybersecurity day
• Medium: The Week Trust Broke -- 8 Cyber Incidents That Made October 2026's Third Week Brutal
• Capcom data breach confirmed -- around 11.7 million accounts thought to have been affected
• Bitcoin Goes to Zero After a Hack, Chamath Palihapitiya Predicts

Date saved: 2026-10-25 03:01 (PDT)

Sources: CISA, The Hacker News, SOCRadar, Group-IB, NyxLab, Security Boulevard, Risky Business, Becker's Hospital Review, BleepingComputer, Engadget, IGN, Help Net Security, GamesIndustry.biz, TechTarget

Key findings

Ransomware affiliates ran AI agents through live kill chains, left the evidence exposed

• The Hacker News / SOCRadar (October 23, 2026): SOCRadar's Threat Research Unit uncovered an AI-driven intrusion operation run by affiliates of the INC and The Gentlemen ransomware groups, centered on a framework called Phantom, an Autonomous Red Team Kill Chain Framework. Researchers recovered the knowledge base, session logs, and source code from an exposed command-and-control server. The recorded sessions contain 8,257 messages across 133 sessions, with a running API bill exceeding $23,000. Phantom has 18 skill modules covering reconnaissance, binary reverse engineering, exploit research, steganography, telemetry assessment, and EDR fingerprinting. The operators targeted FortiClient EMS, SimpleHelp, cPanel, and VPN gateways at scale. In one case, a single reused password unlocked the VPN, servers, remote management, backup, and security platforms. The campaign came to light in late September 2026 after operational security failures left the source code, credentials, and session logs exposed. (Source)

CISA urges patching Ivanti Connect Secure zero-day exploited in the wild

• CISA (October 13, 2026): CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13, 2026, after Ivanti disclosed a newly exploited vulnerability affecting Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. The vulnerability is a zero-day authentication bypass that allows remote, unauthenticated execution of arbitrary commands, and cyber threat actors are exploiting it to conduct credential theft and data exfiltration. CISA urged organizations to patch immediately. (Source)

CISA adds BeyondTrust Remote Support critical auth bypass to KEV catalog

• CISA (October 16, 2026): CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16, 2026, after confirming active exploitation of a critical authentication bypass vulnerability affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Cyber threat actors are using the vulnerability to gain initial access, establish persistence, escalate privileges, and move laterally. Patches are available for supported versions 24.3.1 and later; organizations using older versions must upgrade first. (Source)

Hackers breach enterprise firewalls and VPNs, exposing over 70,000 credentials

• The Hacker News (October 23, 2026): A large-scale campaign targeting exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls has exposed over 70,000 credentials, according to a joint investigation by Group-IB and NyxLab. The threat actor, known as k0t, also goes by the aliases CryptoFeel, Member19, and QazWsxShop. Artifacts from the investigation indicate the operators obtained access to numerous organizations worldwide and attempted to further compromise some victims, resulting in persistent remote access and data exfiltration. (Source)

Capcom confirms data breach exposing 11.7 million accounts

• BleepingComputer / Engadget / IGN (October 23, 2026): Capcom confirmed that hackers breached its Capcom ID membership service, exposing 11,774,247 records worldwide containing email addresses along with account creation dates, last login times, login counts, and last-login IP addresses. For 43 accounts, the exposed data also included birth dates, gender, country or region, and nicknames. Attackers changed the passwords on 196 accounts without authorization. Credit card information was not affected. Capcom detected suspicious activity on October 19 and confirmed the intrusion the same day, reporting the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission. The company warned users to beware of phishing emails using the stolen data. (Source)

CyberLogitec breach leads to 40+ ports and shipping firms extorted

• The ransomware and extortion group n0n listed more than 40 port authorities, port operators, ship managers, and sea-shipping companies on its leak site on October 12, with the likely entry point being maritime IT services provider CyberLogitec. Half of the listed victims are known CyberLogitec customers, and the company's website had been down for weeks. The victims span 18 countries, and the group demanded a combined $1.2 billion. Most victims reportedly refused to pay after the October 19 deadline, and their data was posted to the leak site. (Security Boulevard / Risky Business, October 2026) (Source)

Quest Diagnostics learns of unauthorized access to lab services manager

• Quest Diagnostics learned on October 21 of unauthorized access to its Quanum Lab Services Manager, a system clients use to place test orders and receive or look up results. The breach is part of a week in which supply chain abuse dominated, with attackers turning a cloud backup service, a maritime IT provider, an open source AI gateway, and a developer platform into ways to reach thousands of downstream organizations. (Security Boulevard, October 2026) (Source)

CISA adds six vulnerabilities to KEV catalog including Plex Media Server

• CISA / NCSA Greece (October 20, 2026): CISA added six new vulnerabilities to its Known Exploited Vulnerabilities catalog on October 20, 2026, based on evidence of active exploitation. The additions include CVE-2026-96652 through CVE-2026-96656 affecting Plex Media Server (SSRF, improper neutralization of encoded URI schemes, and external control of file name or path vulnerabilities), CVE-2026-106931 affecting EG Secure Solutions SiteGuard Server Edition (OS command injection), and CVE-2026-110936 affecting Siemens Software Center (uncontrolled search path element). CISA also added CVE-2026-110447 for Collabora Online and CVE-2026-114625 for Arista VeloCloud Orchestrator in separate additions. (Source)

Critical PHP vulnerabilities require immediate patching, CISA warns

• CISA (October 21, 2026): CISA warned on October 21, 2026, that critical vulnerabilities in PHP require immediate patching, citing CVE-2026-109618 and CVE-2026-109619. The vulnerabilities are severe enough that CISA issued a dedicated alert demanding immediate action from affected organizations. PHP powers a large fraction of web infrastructure, and vulnerabilities of this severity typically see rapid exploitation after disclosure. (Source)

MonsterCloud owner charged with defrauding ransomware victims by $19 million

• The Hacker News (October 8, 2026): The US Department of Justice announced charges on October 8 against a 50-year-old US and Israeli national for allegedly defrauding ransomware victims by secretly paying attackers to obtain decryptors while claiming to use proprietary tools to recover their data. The MonsterCloud owner allegedly billed over $19 million while paying ransoms on the back end. (Source)

16-year-old arrested in Spain suspected of running KillSec ransomware group

• Police in Spain arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid. The arrest is part of a broader law enforcement push against ransomware operators that also includes the detention of a ShinyHunters suspect in Jordan who is helping the FBI identify group members. (The Hacker News, October 2026) (Source)

Source links

• CISA: Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
• CISA: Urges Patching Critical Vulnerability in BeyondTrust Remote Support
• The Hacker News: Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents
• BleepingComputer: Capcom confirms data breach affecting 11.7 million accounts
• Security Boulevard: Top 10 Breaches of the Week
• SOCRadar / ZeroHunt: Phantom - Ransomware Affiliates Ran AI Agents Through the Kill Chain
• CISO AI: Ransomware Crews Left Their AI Playbook Exposed
• Cyber.gov.gr: NCSA Newsletter October 20-23 2026
• DW Documentary: Cyberattacks, data encryption, extortion - How cybercriminals operate
• Ryan Doc: The Teenage Hacker the FBI Couldn't Catch - True Story Documentary

Date saved: 2026-10-24 18:01 (PDT)

Sources: CISA, Palo Alto Networks, The Hacker News, Security Affairs, Cyber Security News, SecureResearch, CISA KEV, Microsoft, Citrix, Quest Diagnostics

Key findings

Emergency CVEs and active exploitation

• CISA added CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support (CVSS 9.3), to its Known Exploited Vulnerabilities catalog after a China-linked espionage group exploited it for initial access and lateral movement. The flaw allows unauthenticated code writing, device takeover, and lateral movement. CISA mandated immediate patching for FCEB agencies. (Source)
• Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 on the CVSS v4.0 scale, triggered an out-of-band release from the PHP security team. CISA alerted organizations that the flaws allow unauthenticated remote code execution, and Palo Alto Networks confirmed the vulnerabilities affect PAN-OS and previously impacted two cloud services. (Source)
• Palo Alto Networks confirmed that CVE-2026-109618 and CVE-2026-109619 affect PAN-OS and previously impacted two cloud services, prompting planned firewall hotfixes and guidance to restrict access. (Source)
• CISA added eight new exploited CVEs across five vendors in one week, including Collabora, Arista, EG Secure Solutions, and Siemens, according to Senserva's updated catalog. (Source)

Ransomware and critical infrastructure

• The ransomware groups Qilin and INC are exploiting CVE-2026-0257, an authentication bypass in the PAN-OS GlobalProtect portal and gateway that lets an attacker establish an unauthorized VPN connection when Authentication Override cookies use a reused or shared certificate. Palo Alto patched it in May 2026, and CISA added it to KEV on May 29 with known ransomware use. (Source)
• The SafePay ransomware group has hit more than 600 critical infrastructure organizations, according to a CISA advisory that prompted urgent patching. (Source)
• The Warlock ransomware group, deployed by China-based threat actor Storm-2603, has now been confirmed to have targeted at least four U.S. critical infrastructure organizations, including water utilities and telecommunications providers, using old SharePoint vulnerabilities. The campaign previously hit Europe, Africa, and Latin America. (Source)
• Osaka Metropolitan University in Japan is experiencing widespread disruption from a suspected ransomware attack impacting around 500 servers and potentially compromising the personal data of over 130,000 individuals. (Source)

Supply chain and credential theft

• ConnectWise credential theft hit Microsoft 365 tenants as part of a supply-chain attack in which a China-linked actor used AI agents, according to SecureResearch. The PHP2Shell vulnerabilities are being exploited before patches as the actor uses ConnectWise access for initial compromise. (Source)
• PwC is the subject of an Everest ransomware group claim that the group stole 590.69 GB of data including human resources records, training materials, and internal documents. The claims are unverified, and PwC has not confirmed the breach. (Source)
• Quest Diagnostics disclosed a patient data breach, according to SecureResearch's daily briefing. (Source)
• The Defense Manpower Data Center experienced a data breach between October 2025 and July 16, 2026, after unauthorized users exploited a security vulnerability in a file-sharing system to access unencrypted personally identifiable information, affecting approximately 3.05 million people including 2.76 million living individuals. (Source)

Additional critical vulnerabilities

• Citrix disclosed CVE-2026-107406, a critical memory overflow vulnerability in NetScaler ADC and Gateway products with a CVSS score of 9.5 that could lead to remote code execution or denial of service, impacting appliances configured as a SAML Service Provider or Identity Provider. CISA urged customers to apply patches immediately. (Source)
• CISA urged immediate Ivanti Connect Secure updates after honeypots logged 105 exploit attempts against CVE-2026-104935, an authentication bypass (CVSS 8.6) impacting versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, allowing remote unauthenticated execution of arbitrary commands. CISA added the flaw to KEV, requiring FCEB agencies to apply fixes by October 16, 2026. (Source)
• Oracle issued an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital certificates, with a CVSS 3.1 score of 9.1. (Source)
• Denmark's Central Register of Persons (CPR) breach exposed 8.8 million records including names, addresses, and national ID numbers through a compromise at a private third-party supplier, according to Check Point Research. (Source)
• The Everest ransomware group claimed to have stolen 590 GB of data from PwC, and separately claimed 1.4 terabytes from Iron Mountain, though the Iron Mountain claim turned out to be far less than advertised. (Source)

Source links

• CISA KEV catalog additions via Senserva
• Cyber Security News: Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS
• SecureResearch: PHP2Shell Exploited Before Patches, China-Linked Storm-0940, ConnectWise Supply Chain
• What Got Pwned: Qilin and INC ransomware exploit PAN-OS GlobalProtect bypass
• The Hacker News: CISA Urges Immediate Ivanti Connect Secure Updates
• Cyber.netsecops: Healthcare and Government Data Breaches, Exploited Vulnerabilities
• Cyber.netsecops: Data Breaches and Critical Vulnerabilities Dominate Cybersecurity News
• Security Affairs: CISA Archives
• Hacking News Ep. 61: State Hackers Hit 37 Countries, BeyondTrust CVSS 9.9 RCE
• Cyber Threat Brief - October 05, 2026

Date saved: 2026-10-24 15:24 (PDT)

Sources: Google Cloud, Wiz, Cyber Security News, Tech-Critter, TechSpot, Kotaku, Futurism, Design Week, The Verge, The Synth Source, AP, The Register, Brussels Times, GitHub

Key findings

Emergency patches: PHP2Shell

• Google Cloud (Oct 21, 2026): CVE-2026-109618 and CVE-2026-109619, both scored 9.2 critical, let an unauthenticated attacker run code on any server answering PHP web requests; every release from PHP 5.4 through 8.5.11 is affected, fixes shipped in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and end-of-life PHP 8.1 and older will never get one. The flaws were found by Wiz Research and disclosed with the patches. (Source)
• Cyber Security News (Oct 21, 2026): Researchers demonstrated code execution against Apache mod_php before any application code even ran, Cloudflare reported early attack attempts, and proofs of concept began circulating within hours of the release. (Source)
• Tech-Critter (Oct 23, 2026): Amazon Threat Intelligence detected the first exploitation attempt against its honeypot on October 17, four days before the public disclosure, and saw broader attacks begin once the fix was out. (Source)

Console security: Sony chasing its own patches

• TechSpot (Oct 21, 2026): A South Korean developer, Gezine, demonstrated a kernel-level exploit against PS5 firmware 14.10, the update Sony shipped to close the "Relapse" jailbreak that works on every console from firmware 7.00 to 13.60; Sony answered with firmware 14.20 days later, and the whole chase now runs alongside GTA 6's November 19 launch, which requires the newest firmware. (Source)
• Kotaku (Oct 21, 2026): Firmware 14.20 also patched a year-long exploit by the hacker Ark Sama that would have let pirated "fake PKG" files run natively. Reported through HackerOne, it can now legally be published under mutual-agreement disclosure rules, so the patch itself is what unlocks the release. (Source)

Adobe and Microsoft, re-engineered

• Futurism (Oct 14, 2026): The team that open-sourced ArtCraft, a free imitation of Adobe's Creative Cloud with clones of Photoshop, Lightroom and Premiere, followed up with free copies of Word, Excel and PowerPoint: GridCraft, DeckCraft and WordCraft. The developers say they rebuilt the programs without copying code. (Source)
• Design Week (Oct 7, 2026): ArtCraft pushed a suite's worth of code to GitHub in about a week; the developers describe a clean-room rebuild, while skeptics note that rebuilding from decompiled binaries would breach Adobe's license either way. (Source)

The firmware wave: music gear and other hardware

• The Verge (Oct 19, 2026): Custom firmware written with AI coding assistants has exploded across Roland's SP-404 MKII, Ableton's Push 3 and Move, Akai's MPC line, Arturia's MicroFreak and more; Elektron warns that mods can brick its machines, while maker M-VAVE has embraced the scene with an official open-source firmware and a flashing toolkit. (Source)
• The Synth Source (Oct 15, 2026): The M-VAVE FM-1 went from one custom firmware in late September to 63 tracked projects by October 17. The reverse-engineering project documents no ROM recovery path and the device has no recovery button, so a failed flash can leave it dead, and several builds have never been run on real hardware. (Source)
• GitHub Advisory (Oct 23, 2026): CVE-2026-55981 scores 9.6 critical: the firmware verification in Creative's Sound Blaster Katana can be fooled into accepting a modified image, letting an attacker push their own firmware onto the device. (Source)

Supply chain and critical infrastructure

• Wiz (Oct 21, 2026): A malicious LiteLLM 1.107.0 reached PyPI and the major container registries and drew roughly 49,000 downloads in under two hours, carrying credential stealers. The attackers used stolen GitHub CLI tokens that had leaked into logs from an internal deployment the company had accidentally exposed to the internet. (Source)
• Cyber Security News (Oct 21, 2026): Eight intermediate signing keys at certificate authority eMudhra were generated with such weak randomness that Mozilla found the private keys could be recovered almost instantly from the public certificates; Chrome and Android blocked the affected certificates without a user update. (Source)
• AP (Oct 13, 2026): Cyberattacks disrupted about 700 supermarkets in France, with hackers forcing refrigeration systems into continuous defrost cycles and pushing temperatures as high as 50C (122F), in the same week grocery infrastructure across Europe went under. (Source)
• The Register (Oct 19, 2026): Ahold Delhaize, parent of Food Lion, Stop & Shop, Giant, Albert Heijn and Delhaize, confirmed a cyberattack forced it to take websites and apps offline across most of its US and European brands, with no evidence so far that customer, associate or partner data was stolen. (Source)
• Brussels Times (Oct 19, 2026): In the Netherlands, Ahold shut its entire digital infrastructure after state broadcaster NOS reported unidentified traffic from servers in the US, Poland, Moldova and Turkey; distribution centers could not tell trucks where to go, and Albert Heijn shelves ran bare. (Source)

Source links

• Google Cloud: Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
• Cyber Security News: October 21 Cybersecurity Nightmare
• TechSpot: Sony's latest PS5 firmware got cracked, just in time for GTA 6's November release
• Kotaku: PS5 Exploit So Bad That Hacker Was Afraid To Release It Patched
• Futurism: Creator of Free Adobe Suite Strikes Again, Reverse Engineers Microsoft Office
• The Verge: Vibe coding is turning the music gear world upside down
• The Synth Source: Vibe-coded firmware and the M-VAVE FM-1
• AP: Cyberattack hits 700 supermarkets in France, sparking investigation
• NewsX World: PHP2Shell Alert: New York Warns Financial Institutions
• Gula Tech Adventures: PHP2Shell: Even the Fix Leaked. Almost No Exploit Worked

Date saved: 2026-10-24 03:01 (PDT)

Sources: The Hacker News, Aviatrix, Cyber Crime Files, Juan Romero SOCFortress, Cyber F.M., DOT Security

Key findings

Pentagon DMDC breach exposes 3 million records

• Aviatrix Threat Research (2026): Week 40 of 2026 witnessed the Pentagon's Defense Manpower Data Center suffering a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers and military records. The breach was discovered in July 2026 but has been ongoing since October 2025. The exposure was attributed to unencrypted data storage and inadequate access controls. (Source)

North Korean hackers steal $387 million from Bitget

• Aviatrix Threat Research (2026): North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from the Bitget cryptocurrency exchange. The attackers compromised Bitget's wallet infrastructure, escalated privileges through harvested credentials, moved laterally to production systems, maintained persistent command-and-control through web shells, and exfiltrated the cryptocurrency. (Source)

KillSec ransomware dismantled, teenage administrator arrested

• Aviatrix Threat Research (2026): International law enforcement successfully dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator. The takedown demonstrates the increasing involvement of younger cybercriminals in ransomware operations and the growing feasibility of international cybercrime cooperation. (Source)

Cisco FMC vulnerabilities exploited by ransomware and state actors

• The Hacker News (2026): Cisco revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center vulnerabilities. The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability in the web interface of FMC software that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. The second flaw under exploitation is CVE-2026-20316, which could allow an unauthenticated remote attacker to log in using a low-privilege account to access sensitive data. (Source)

Qilin ransomware breaches ATF investigation systems

• Juan Romero / SOCFortress (2026): The Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed a significant cyberattack attributed to the Qilin ransomware group. The breach targeted a standalone computer system containing sensitive details regarding investigative targets. The ATF disconnected the compromised environment to prevent further spread and initiated a formal forensic inquiry. The agency reported that the incident has not hindered its ability to carry out its law enforcement missions. (Source)

Russian FSB exploits eight-year-old Cisco vulnerability

• Cyber F.M. (2026): An 18-nation advisory led by the NSA detailed sustained Russian FSB Center 16 exploitation of CVE-2018-0171, an eight-year-old Cisco Smart Install vulnerability. The targeted sectors (defense, energy, healthcare, and government) are being hit not by cutting-edge zero-days but by basic hygiene failures: default credentials and legacy configurations left open for years. At the Department of Homeland Security, attackers breached the Homeland Security Information Network and remained undetected for weeks, with live attack activity misclassified as a false positive twice. (Source)

Healthcare and municipal breaches

• DOT Security (2026): July 2026 saw a ransomware attack that disrupted Coca-Cola's Fairlife dairy production operations in Ukraine, with the Anubis ransomware group claiming responsibility and alleging theft of approximately one terabyte of company data. Healthcare software provider Craneware confirmed a cybersecurity incident exposing the personal and protected health information of approximately 731,000 individuals. Accenture confirmed a security incident after a threat actor claimed to have stolen source code, configuration files, and access credentials. (Source)

Source links

• Aviatrix: Pentagon DMDC Breach, KillSec Takedown and $387M Bitget Heist: Week 40, 2026
• The Hacker News: Nation-State: Latest News, Reports and Analysis
• The Hacker News: ransomware: Latest News, Reports and Analysis
• Juan Romero / SOCFortress: Qilin Ransomware Gang Breaches ATF Investigation Systems
• Cyber F.M.: FRI | 4 SEPT 2026 | Cybersecurity Report
• DOT Security: Coca-Cola Fairlife Ransomware Attack, Craneware Data Breach, and Accenture Security Incident

Date saved: 2026-10-23 18:00 (PDT)

Sources: The Hacker News, Aviatrix Threat Research Center, BleepingComputer, WIRED, CISA, Department of Justice

Key findings

Pentagon DMDC breach exposes 3 million records

The Pentagon's Defense Manpower Data Center suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers and military records. The breach was discovered in July 2026 but has been ongoing since October 2025. Attackers exploited zero-day vulnerabilities in third-party security appliances and Oracle PeopleSoft systems to gain initial network access. (Source)

North Korean hackers steal $387 million from Bitget

North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to compromise Bitget's wallet infrastructure, escalated privileges through harvested credentials, moved laterally to production systems, maintained persistent command-and-control through web shells, and exfiltrated $387 million in cryptocurrency. (Source)

KillSec ransomware operation dismantled, 16-year-old arrested

International law enforcement successfully dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator. Police in Spain arrested the teenager, who is suspected of running the KillSec ransomware group. KillSec is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid. (Source)

Cisco vulnerabilities actively exploited by ransomware and state actors

Cisco revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks are exploiting two recently patched Secure Firewall Management Center vulnerabilities. The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability, and CVE-2026-20316. The clusters include Qilin affiliates and GRU-linked Sandworm, deploying Qilin ransomware, Cyclops Blink malware, and web shells. (Source)

CISA warns of actively exploited Ivanti zero-day

The US Cybersecurity and Infrastructure Security Agency issued an urgent warning about CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure being actively exploited as a zero-day since October 1, 2026. (Source)

GitLab discloses maximum-severity remote code execution flaw

GitLab disclosed CVE-2026-110264, a maximum-severity (CVSS 10.0) remote code execution vulnerability rooted in an integer overflow flaw within GitLab's Regular Expression Compiler engine. The company also released emergency patches for CVE-2026-85706, a CVSS 10.0 path traversal flaw allowing unauthenticated attackers to read arbitrary files from the server. (Source)

Conti ransomware developer sentenced to four years

Oleksii Oleksiyovych Lytvynenko, a Ukrainian national and developer for the Conti ransomware operation, was sentenced to four years in US prison after pleading guilty to conspiracy to commit wire fraud. Between 2020 and June 2022, Lytvynenko and accomplices deployed ransomware against over 1,000 victims worldwide, including critical infrastructure across 31 countries and 47 US states. The FBI estimated the Conti group received more than $150 million in ransom payments. (Source)

Iran-linked hackers sanctioned by Treasury

The Treasury Department sanctioned five Iranian nationals as part of a sweeping 'economic D-Day' campaign against Tehran, accusing four of them of running a hacking operation directed by Iran's Ministry of Intelligence and Security. The action is part of Operation Economic Outcast, amid a string of Iran-linked attacks on US targets including a breach of FBI Director Kash Patel's personal email and attacks on water utilities. (Source)

ShinyHunters breaches McKesson, steals 284 million records

The ShinyHunters extortion group stole roughly 284 million records, including names, Social Security numbers, Medicaid details, and medication information, from McKesson's Snowflake and Salesforce environments, demanding over $55 million. (Source)

First fully automated ransomware operation documented

JADEPUFFER, documented by Sysdig, is the first ransomware operation confirmed to run entirely without human operators, with no commands issued and no decisions made by a person at a terminal. (Source)

Source links

• Aviatrix TRC: Pentagon DMDC Breach, KillSec Takedown & $387M Bitget Heist - Week 40
• The Hacker News: Nation-State Attacks
• DMARC Report: Berlin Ransomware Extortion, McKesson Data Breach, Boston Scientific Disrupted
• WISEDaily: Weekly Review - BlueMoon exploit kit, Conti sentencing
• WANNACRY: The World's Largest Ransomware Attack - Documentary
• Colonial Pipeline Ransomware Attack - Cyber Crime Files Documentary

Date saved: 2026-10-23 03:00 (PDT)

Sources: Aviatrix Threat Research Center, The Hacker News, Verizon DBIR, BleepingComputer, CISA, SentinelOne, CoinDesk, Europol

Key findings

The Pentagon breach and the cryptocurrency heist

• Aviatrix Threat Research Center (Oct 15, 2026): The Pentagon's Defense Manpower Data Center suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers, names, birthdates, contact details, race, gender, and military assignment records (2.8 million living and 294,000 deceased service members) discovered in July 2026 but ongoing since October 2025; simultaneously, North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from Bitget cryptocurrency exchange; international law enforcement dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator. (Source)
• Defense.gov: The Pentagon DMDC breach notification confirmed the exposure of personal data of approximately 3.09 million individuals. (Source)

Ransomware and the Verizon DBIR

• Verizon 2026 Data Breach Investigations Report: Ransomware grew to 48% of all breaches, up from 44% the previous year; exploitation of vulnerabilities rose to 31% as the most common initial access vector, surpassing credential abuse at 13%; public administration is primarily targeted by a combination of financially motivated criminals and state-affiliated actors. (Source)
• The Hacker News (Sep 30, 2026): Police in Spain arrested a 16-year-old suspected of running the KillSec ransomware group; KillSec is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid; three people were arrested and police took control of the leak site. (Source)

Vulnerabilities and nation-state operations

• CISA / The Hacker News (Oct 2026): CISA added seven security flaws to its Known Exploited Vulnerabilities catalog, including CVE-2026-83548 (CVSS 10.0), a server-side request forgery vulnerability in SonicWall SMA 1000 Appliances allowing remote unauthenticated attackers to gain unauthorized access; CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure being actively exploited as a zero-day since October 1, 2026. (Source)
• The Hacker News / FBI (Sep 29, 2026): A suspected member of the ShinyHunters digital extortion group, "Rey" (Saif al-Din Khader), was allegedly detained by authorities in Jordan and is cooperating with the FBI; the FBI's cyber division also warned of a critical PHP vulnerability that could impact 70% of websites worldwide, allowing malicious actors to remotely execute code in PHP. (Source)
• Aviatrix (Oct 2026): FBI conducted Operation Lonestar Roundup, raiding 40 residences in Texas and seizing 187 laptops used by North Korean threat group Famous Chollima (WageMole) in fraudulent IT worker schemes; authorities arrested two U.S. nationals and charged 14 individuals total, including 12 Chinese defendants, in schemes affecting over 70 companies and generating approximately $3 million since 2019. (Source)

Source links

• Aviatrix: Pentagon DMDC Breach, KillSec Takedown & $387M Bitget Hack, Week 40 2026
• Verizon: 2026 Data Breach Investigations Report
• The Hacker News: Nation-State Latest News
• White Hat Wes: 81 Million Azure Logins, Qilin's Rise, AI Photo Abuse, and Accenture's Breach
• VIEH Group: 6.6M Accounts Breached! Japan Ransomware, 400K Health Records Exposed & AI Infostealers
• VIEH Group: 5.79TB Berlin Data Stolen! Claude AI Hack, Aurora Ransomware & China Cyberattack
• CYBER FM: RINGCENTRAL DATA LEAK, HYUNDAI RANSOMWARE & POWER PLANT HACK

Date saved: 2026-10-22 18:00 (PDT)

Sources: BleepingComputer, The Hacker News, Data Breaches Digest, Nextgov, ThreatClaw, Reuters, CNN

Key findings

Record ransomware quarter and AI as a force multiplier

• Q3 2026 set a new record of 2,627 claimed ransomware attacks, the highest quarter ever recorded, per Cleartext's Week in Review. (Source)
• 84% of ransomware attacks now involve AI as cybercriminals escalate their tactics, according to Data Breaches Digest; the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024, CISA says. (Source)
• CISA warned federal agencies that ransomware gangs are exploiting a critical JetBrains TeamCity vulnerability patched in July and a critical VMware vCenter vulnerability patched in July; the FBI is warning that FortiBleed attacks targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways are still ongoing. (Source)

Law enforcement crackdowns and arrests

• INTERPOL's Operation Serengeti III disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people across Africa, netting over $105 million; the operation targeted business email compromise, ransomware, and other cybercrimes. (Source)
• Germany arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan; Spanish police arrested a 16-year-old suspected of running the KillSec ransomware group and seized its data leak site and servers as part of Operation KillSwitch. (Source)
• The FBI arrested Edward Dubrovsky, a Canadian cybersecurity executive and ransomware negotiator, in the Philadelphia area on October 8, 2026, in connection with the ShinyHunters investigation; a suspected member of ShinyHunters known as "Rey" was detained in Jordan on September 29 and is cooperating with the FBI to identify other group members. (Source)
• A suspected ShinyHunters leader was arrested by Dutch police in Amsterdam on September 15, 2026, on suspicion of playing a role in the group; sources suggest the group may already have a new leader. (Source)

Major breaches: FBI, Capcom, and critical infrastructure

• ShinyHunters claimed responsibility for breaching the FBI's jobs portal (FBIjobs.gov) and gaining access to the personal data of thousands of current and former FBI employees; the FBI has told employees to assume their data was compromised and to watch for suspicious calls and AI-generated voicemail scams; the breach reportedly went undetected for months. (Source)
• Capcom confirmed a data breach has affected over 11 million people, 11,774,247 Capcom ID accounts were accessed by a third party on October 19, 2026, exposing email addresses and login details. (Source)
• The MonsterCloud owner, Zohar Pinhasi, was charged with two counts of wire fraud and one count of wire fraud conspiracy for allegedly defrauding ransomware victims by secretly paying attackers for decryptors while claiming to use proprietary technology; the DOJ says he billed over $19 million. (Source)
• The FBI and DOJ seized seven domains supporting Microscan and FishHub hacking tools linked to China's Integrity Technology Group, a sanctioned firm operating the Flax Typhoon cyber operation; CISA added five Flax Typhoon-exploited CVEs to its Known Exploited Vulnerabilities catalog with an October 11 federal patch deadline. (Source)

Source links

• BleepingComputer: Latest Ransomware news
• The Hacker News: Ransomware and cybercrime latest news
• Data Breaches Digest: Week 43 2026
• Nextgov: Data Breaches: FBI arrests another ShinyHunters suspect
• Cleartext: Week in Review October 10, 2026
• FBI Casebook: FBI Cyber Team Dismantles Ransomware Crew Inside a Real Hosting Firm
• Case Uncut: The Ransomware Negotiator Arrested: FBI Cuffs ShinyHunters Suspect

Date saved: 2026-10-22 03:00 (PDT)

Sources: Rapid7, The Hacker News, SecurityWeek, CISA, BleepingComputer, TechTarget, Check Point Research, Aviatrix, Cyber.netsecops

Key findings

The vulnerability-to-exploitation window keeps shrinking

• Rapid7 / SecurityWeek (Q3 2026): High-severity flaws are exploited faster; ransomware remains the dominant threat; the US is the world's most targeted country, and attacks increasingly involve the use of AI (but largely manually rather than autonomously). During Q3, high-severity vulnerabilities were exploited within an average of three days from disclosure, with 71% exploited during the first seven days. 79% of these vulnerabilities are classed by Rapid7 as "holy grail" flaws (remote and requiring neither credentials nor local user involvement). The most targeted sectors in Q3 were business services, manufacturing, and healthcare. The US was the most targeted nation (60% of attacks), followed by Germany (7%), Italy (5%), and Canada (5%). The most successful ransomware groups were The Gentlemen (342 claimed incidents) and Qilin (339). (Source)
• The Hacker News (2026): Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability in the web interface of FMC software that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. The second flaw under exploitation is CVE-2026-20316 (CVSS score: 5.3). (Source)
• BleepingComputer (2026): The CISA says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced through an unpatched Grav CMS flaw, an unauthenticated path traversal vulnerability. CISA warned federal agencies that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched in July and a critical VMware vCenter vulnerability patched in July. (Source)

Major breaches: Pentagon DMDC, Denmark CPR, Bitget $387M, Japan universities

• Aviatrix Threat Research Center (Week 40, 2026): The Pentagon's Defense Manpower Data Center suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers and military records, discovered in July 2026 but ongoing since October 2025. Simultaneously, North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from Bitget cryptocurrency exchange, while international law enforcement successfully dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator. (Source)
• Cyber.netsecops (Oct 13, 2026): Denmark's National Population Register was breached (a third-party supplier compromise exposed 8.8 million records from Denmark's Central Register of Persons (CPR), including sensitive personal data, increasing the risk of identity theft and fraud. US seized hacking tools linked to China; allied nations issued advisories on China-based Integrity Technology Group, detailing new tactics used by Flax Typhoon and Red Juliett, targeting critical infrastructure across North America, Southeast Asia, and Africa. Warlock Ransomware exploits SharePoint flaws; confirmed to have targeted at least four US critical infrastructure organizations including water utilities and telecommunications. Citrix disclosed a critical NetScaler RCE flaw (CVE-2026-107406, CVSS 9.5)) a memory overflow vulnerability. Japanese karaoke giant Daiichi Kosho announced a major data breach from a third-party supplier exposing ~8.7 million customers. Osaka Metropolitan University hit by a major suspected ransomware attack impacting ~500 servers and 130,000 students, faculty, and staff. (Source)
• Check Point Research (Oct 12, 2026): Reconfirmed the catastrophic data breach of Denmark's Central Register of Persons (CPR). The incident exposed 8.8 million records including names, addresses, and national ID numbers, caused by a compromise at a private third-party supplier. (Source)

Ransomware-as-a-service, zero-day handoffs, and critical infrastructure targeting

• TechTarget (Summer 2026): Ransomware demonstrated that traditional threats remain just as disruptive. An attack on dairy producer Fairlife shut down US production for 11 days. The Anubis ransomware group claimed responsibility and alleged it stole 1 TB of data. Threat actors reportedly linked to Iran targeted programmable logic controllers at 12 US water facilities. Internet-connected PLCs can expose operational technology to attacks when security controls are weak, creating consequences that extend beyond data loss or downtime. (Source)
• Fragment Zero (Aug 10, 2026): In May 2026, the Ransomware gang "The Gentlemen" (one of the most active operations on earth), was breached itself through its own hosting provider. Check Point Research pulled down internal chat logs, an organizational roster, ransom negotiation transcripts, tooling discussions, and the victim-management system. The chats read like an intrusion playbook: credential abuse, Fortinet appliance access, NTLM relay, and a category of software with an unusually honest name, EDR killers, built to disable the security products a company installed specifically to catch this. (Source)
• DW Documentary (Apr 7, 2026): Ransomware poses an existential threat to businesses, a highly professional industry where criminals operate like a business by infiltrating systems, encrypting data, and extorting money. Cybersecurity analyst Jon DiMaggio managed to infiltrate one of the most notorious ransomware gangs: Lockbit, engaging with the group's mysterious leader "LockbitSupp" and ultimately unmasking his identity. (Source)
• Cyber Crime Files (Jun 23, 2026): The Colonial Pipeline ransomware attack (one of the most significant cyberattacks in US history) showed how a single compromised password allowed cybercriminals to infiltrate critical infrastructure, disrupt fuel supplies across the East Coast, and trigger a nationwide emergency. The FBI tracked millions of dollars in cryptocurrency ransom payments; the DOJ successfully located and recovered 63.7 of the extorted Bitcoin. (Source)

Nation-state campaigns: Russia, China, North Korea, Pakistan, Iran

• Rapid7 (Q3 2026): During Q3, researchers tracked 15 separate nation-state (APT) and cybercrime groups. Noteworthy examples include ENERGETIC BEAR, Void Blizzard, and Sandworm, all Russia linked. APT31 is China linked, Lazarus is North Korea, and Operation C-Major is Pakistan. Government organizations are the core target for APT groups; other sectors include defense, transportation, media, healthcare, aerospace, finance, energy, and technology. A previously undocumented Linux toolkit (a backdoor named 'ted' compiled into a trojanized HAProxy build, an SSH keylogger, and a curl-based RAT) was disclosed, used by the DPRK against South Korean organizations since early 2025. (Source)
• Cyber.netsecops (Oct 13, 2026): An 18-nation advisory led by the NSA details sustained Russian FSB Center 16 exploitation of CVE-2018-0171, an eight-year-old Cisco Smart Install vulnerability. US seizes hacking tools linked to China; allied nations issued advisories on China-based Integrity Technology Group detailing new tactics used by Flax Typhoon and Red Juliett. The Warlock ransomware group exploits "ToolShell" SharePoint vulnerabilities, confirmed targeting at least four US critical infrastructure organizations including water utilities and telecommunications providers. (Source)
• SecurityWeek / Rapid7 (Q3 2026): During Q3, high-severity vulnerabilities were exploited within an average of three days from disclosure. The most successful ransomware groups were The Gentlemen (342 claimed incidents) and Qilin (339). INC Ransom was third with 99, followed by DeadLock (98), and Krybit (95). (Source)

Source links

• SecurityWeek: High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
• Aviatrix: Pentagon DMDC Breach, KillSec Takedown & $387M Bitget Heist (Week 40, 2026)
• Cyber.netsecops: Data Breaches & Critical Vulnerabilities Dominate Cybersecurity News (Oct 13, 2026)
• TechTarget: Threat Summer 2026: Editors Discuss Top Cyber Incidents
• DW Documentary: Cyberattacks, data encryption, extortion, How cybercriminals operate
• Cyber Crime Files: Colonial Pipeline ransomware attack documentary
• Fragment Zero: A Ransomware Gang Got Hacked. Their Internal Chats Show What They Really Charge.
• Ryan Doc: The Teenage Hacker the FBI Couldn't Catch | True Story Documentary (Hellcat/Pryex)
• CodeDark: Why MOVEit Was the Perfect Target for the Cl0p Ransomware Gang
• The Hacker News: Nation-State attacks: Cisco FMC flaws exploited by ransomware and state clusters

Date saved: 2026-10-21 18:00 (PDT)

Sources: Krebs on Security, Aviatrix Threat Research Center, The Hacker News, CERT-EU, TechTarget, DW Documentary, IBM, CISA, FBI

Key findings

Pentagon DMDC breach: 3 million military personnel and veterans exposed

Week 40 of 2026 saw the Pentagon's Defense Manpower Data Center suffer a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers and military records. The breach was discovered in July 2026 but had been ongoing since October 2025. Attackers exploited zero-day vulnerabilities in third-party security appliances and Oracle PeopleSoft systems to gain initial network access. A zero-day vulnerability in Oracle PeopleSoft allows remote code execution through authentication bypass, enabling unauthorized access to sensitive data. (Source)

North Korean hackers steal $387 million from Bitget via zero-day exploit

North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from the Bitget cryptocurrency exchange. The attackers exploited zero-day vulnerabilities in third-party security appliances and Oracle PeopleSoft systems to gain initial network access. This incident demonstrates the convergence of nation-state attacks targeting critical infrastructure and the evolving sophistication of cryptocurrency heists. (Source)

KillSec ransomware operation dismantled; 16-year-old arrested

International law enforcement successfully dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator. Police in Spain arrested a 16-year-old on September 30 whom investigators suspect of running the KillSec ransomware group, which is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid. Police also took control of the leak site. Three people were arrested total. The detail that a teenager was running a ransomware operation should unsettle anyone who assumes these operations are run by seasoned criminal syndicates. (Source)

CISA adds Citrix NetScaler, Zammad, FortiMail vulnerabilities to KEV catalog

CISA's Known Exploited Vulnerabilities catalog added three separate entries: a Citrix NetScaler memory-corruption bug, two Zammad vulnerabilities involving session fixation and privilege management, and a FortiMail path traversal flaw. CISA also flagged CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure being actively exploited as a zero-day since October 1, 2026. CISA added eight new NetScaler vulnerabilities, two of which are already being exploited in the wild and were immediately added to the KEV catalog. (Source)

ShinyHunters suspect detained in Jordan, cooperating with FBI

A suspected member of the ShinyHunters digital extortion group, who goes by the online alias "Rey," was allegedly detained by authorities in Jordan on September 29, 2026. Rey, whose real name is Saif al-Din Khader, is said to be cooperating with the FBI and law enforcement to identify other members of the group. The arrest is tied to the investigation into ShinyHunters' breach of FBI data. Brian Krebs reported the development as one of the most significant ransomware enforcement actions of the year. (Source)

Qilin ransomware operative arrested and extradited to Germany

Japan confirmed the arrest and extradition of a Qilin ransomware operative to Germany. Qilin has been one of the more prolific ransomware-as-a-service operations in recent years. The arrest is a reminder that international cooperation against ransomware gangs, while slow, is producing real results, peeling off individual operatives chips away at the operational security these groups rely on. (Source)

OpenAI engineering lead arrested for planting recording device

In October 2026, Abdulrahman Alfozan, a 35-year-old Saudi national and OpenAI engineering lead, was arrested by the FBI for allegedly planting a sophisticated recording device in an executive conference room at OpenAI's San Francisco offices. The arrest raises questions about insider threats at AI companies and the physical security of the organizations building frontier AI systems. (Source)

U.S. Army soldier sentenced to 70 months for AT&T/Verizon breach

A U.S. Army soldier was sentenced to 70 months in prison for hacking into AT&T and Verizon systems and stealing metadata on more than 100 million customers. The case is a reminder that insider threats and compromised credentials remain a primary attack vector even in the age of sophisticated nation-state operations. (Source)

Conti ransomware operative sentenced to 4 years in U.S. prison

A Ukrainian national was sentenced to four years in a U.S. prison for his role in the Conti ransomware operation, which hit more than 1,000 victims before shutting down in 2022. The sentencing is part of a broader international enforcement push against ransomware operators that has seen arrests and extraditions across multiple jurisdictions. (Source)

Manchester Airports Group breach exposes 8.7 million customers

A breach at Manchester Airports Group exposed data belonging to 8.7 million customers, though the company says most of what was accessed was limited to email addresses. The breach adds to a growing list of large-scale data exposures affecting travel and transportation infrastructure. (Source)

Cisco FMC vulnerabilities exploited by ransomware and state-sponsored clusters

Cisco revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability in the web interface of FMC software that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. The second flaw under exploitation is CVE-2026-20316 (CVSS score: 5.3). (Source)

Source links

• Krebs on Security: Cybersecurity weekly roundup
• Aviatrix Threat Research Center: Pentagon DMDC Breach, KillSec Takedown & $387M Bitget Heist
• The Hacker News: ransomware
• The Hacker News: Nation-State
• DW Documentary: Cyberattacks, data encryption, extortion - How cybercriminals operate
• Ryan Doc: The Teenage Hacker the FBI Couldn't Catch | True Story Documentary
• Cyber Crime Files: Colonial Pipeline ransomware attack
• CERT-EU: Cyber Brief 26-09 - August 2026
• TechTarget: Podcasts

Date saved: 2026-10-21 03:00 (PDT)

Sources: The Hacker News, CISA, FBI, Cyber.netsecops.io, Verizon DBIR, Sophos, IBM, SecurityWeek, Citrix, Palo Alto Networks, aviatrix.ai

Key findings

Ransomware surge and healthcare targeting

• A new report indicates a 64% surge in ransomware attacks against the U.S. healthcare sector in Q3 2026, with over 600,000 patient records compromised. (Source)
• The Rhysida ransomware gang claimed responsibility for an August 2026 cyberattack on Anne Arundel County, Maryland, alleging theft of 2.6TB of data including medical, payroll, and jail records, and demanding a $2 million ransom (25 BTC); the county has confirmed the data theft. (Source)
• A Semperis report indicates AI is exploited in 84% of ransomware attacks; a SecurityHQ/Datadog study highlights an "accountability gap" in AI governance creating new attack vectors. (Source)
• IBM's 2026 Cost of a Data Breach report put the global average at $4.99 million (up 12%, an all-time high); in the U.S. it is $11.5 million; ransomware hit 39% of breached organizations, up from 24% in 2023; threatening brand reputation is now the most common pressure tactic at 41%, ahead of encrypting data at 23%. (Source)

Nation-state campaigns and tool seizures

• The FBI and Justice Department, with allied nations, seized two hacking tools ("Microscan" (a vulnerability scanner) and "FishHub" (a spear-phishing and data exfiltration tool)) used by the China-linked Integrity Technology Group, which has targeted critical infrastructure globally; a joint advisory expanded the identified target regions to North America, Southeast Asia, and Africa. (Source)
• CISA added CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support, to its Known Exploited Vulnerabilities catalog with confirmed active exploitation for initial access and lateral movement by a China-linked group, mandating immediate patching for FCEB agencies. (Source)
• The Russia-linked APT28 (aka BlueDelta, Fancy Bear, Forest Blizzard) has been attributed to attacks targeting two NATO member states, including a breach of a NATO naval shipbuilder. (Source)
• A joint advisory from CISA, FBI, NSA, and allied nations highlighted the global threat posed by China-based Integrity Technology Group, detailing new TTPs employed by threat actors like Flax Typhoon, including Living-off-the-Land techniques and use of compromised VPN infrastructure for persistence. (Source)

Major breaches and vulnerabilities

• Denmark's Central Register of Persons (CPR) breach exposed 8.8 million records including names, addresses, and national ID numbers, caused by a compromise at a private third-party supplier; Check Point Research reconfirmed the scale on October 12. (Source)
• The Pentagon's Defense Manpower Data Center suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers and military records, discovered in July 2026 but ongoing since October 2025. (Source)
• Osaka Metropolitan University in Japan was hit by a major suspected ransomware attack impacting approximately 500 servers and affecting the personal data of at least 130,000 students, faculty, and staff. (Source)
• Japanese karaoke giant Daiichi Kosho announced a major data breach originating from a third-party supplier, Nippon Columbia Group, caused by malware on a supplier employee's PC, potentially exposing personal information of approximately 8.7 million customers. (Source)
• Warlock ransomware group is confirmed to have targeted at least four U.S. critical infrastructure organizations (including water utilities and telecommunications) using old SharePoint vulnerabilities (ToolShell). (Source)
• Qilin and INC ransomware groups are exploiting a now-patched Palo Alto Networks flaw (CVE-2026-0257, CVSS 7.8) to bypass MFA and set up unauthorized VPN connections; the flaw was patched in May 2026 and added to CISA's KEV catalog on May 13. (Source)
• Citrix released a security advisory for CVE-2026-107406, a critical memory overflow vulnerability (CVSS 9.5) in NetScaler ADC and Gateway products that could lead to remote code execution or denial of service; exploitation attempts now include shellcode indicating active pursuit of RCE. (Source)

Verizon DBIR 2026: the structural shift

• The 2026 Verizon Data Breach Investigations Report found vulnerability exploitation jumped to 31% of initial access while credential abuse dropped to just 13%, completely flipping years of security thinking; the median time-to-exploit for available vulnerabilities dropped from 21 days to 1.6 days; ransomware was involved in 48% of confirmed breaches, up from 44%. (Source)
• The DBIR analyzed over 22,000 confirmed breaches; organizations had 50% more critical vulnerabilities to patch this year, and median remediation time increased from 32 to 43 days despite initially getting faster at patching. (Source)

Source links

• The Hacker News: Nation-State: Russian APT28 breaches NATO naval shipbuilder
• The Hacker News: Cyber Attack: Qilin and INC ransomware exploit Palo Alto Networks flaw to bypass MFA
• Cyber.netsecops.io: Data Breaches & Critical Vulnerabilities Dominate Cybersecurity News (Oct 13)
• Cyber.netsecops.io: Healthcare & Government Data Breaches, Exploited Vulnerabilities Highlighted (Oct 17)
• Cyber.netsecops.io: AI Risks Escalate, Major Breaches Hit Energy, Retail, and Courts (Oct 15)
• Cyber.netsecops.io: Ransomware Surges, Critical Exploits Patched, and State-Sponsored Tools Seized (Oct 9)
• Galactic Advisors: Unauthorized Opinions 03: Cost of a Data Breach 2026 (IBM report breakdown)
• SecurIT360: What 22,000 Breaches Reveal About How Hackers Are Getting In Right Now | 2026 Verizon DBIR

Date saved: 2026-10-20 23:15 (PDT)

Sources: Cybersecurity Daily, Aviatrix, The Hacker News, Datapath, Beckers Hospital Review, DW Documentary, Verizon DBIR

Key findings

Pentagon DMDC breach exposed 3 million records

Aviatrix reported that the Pentagon's Defense Manpower Data Center suffered a breach exposing personal data of 3 million military personnel and veterans (including Social Security numbers and military records) discovered in July 2026 but ongoing since October 2025. The exposure resulted from unencrypted data storage and inadequate access controls. (Aviatrix Threat Research Center)

North Korea steals $387 million from Bitget

Aviatrix reported that North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from the Bitget cryptocurrency exchange. The attackers compromised Bitget's wallet infrastructure, escalated privileges through harvested credentials, moved laterally to production systems, and maintained persistent command-and-control through web shells. (Aviatrix)

Healthcare ransomware jumps 64% in a single quarter

Becker's Hospital Review reported that ransomware attacks and unverified claims targeting U.S. healthcare organizations increased 64% in Q3 2026 from Q2, per an October 15 Comparitech report. The U.S. accounted for 185 of 306 healthcare ransomware incidents tracked worldwide between July and September. Globally, healthcare ransomware incidents more than doubled from 151 during the same period in 2025. Saber Healthcare Group had the largest reported breach, affecting 427,084 people. (Becker's Hospital Review)

Verizon DBIR: ransomware in 48% of all breaches

DeepStrike reported that the Verizon DBIR 2026 found ransomware appears in 48% of all data breaches (a record high) and that 31% of breaches now start with software vulnerability exploitation, overtaking stolen credentials as the top entry point. Public-sector ransomware attacks rose 65% year-over-year in the first half of 2026 (208 confirmed incidents). (DeepStrike)

Microsoft's record Patch Tuesday and active exploitation

Datapath reported that Microsoft fixed 421 security flaws in September 2026 (the largest Patch Tuesday ever recorded) including a flaw in the afd.sys kernel driver already being actively exploited by criminals before the fix was available. That flaw allowed an attacker with limited access to escalate privileges to full SYSTEM-level control. In August, Zoom patched a zero-click remote code execution vulnerability allowing complete computer takeover during a Zoom session without any user action. (Datapath)

Russian state actors exploiting old Cisco vulnerability

Cybersecurity Daily reported that an 18-nation advisory led by the NSA details sustained Russian FSB Center 16 exploitation of CVE-2018-0171, an eight-year-old Cisco Smart Install vulnerability. Separately, Palo Alto Networks disclosed ongoing exploitation of CVE-2026-0257 (CVSS 7.8), an authentication bypass in PAN-OS and Prisma Access by ransomware actors, and Cisco revealed three threat clusters (ransomware and state-sponsored) exploiting CVE-2026-20079 (CVSS 10.0), an authentication bypass in Secure Firewall Management Center that grants root access. (Cybersecurity Daily)

KillSec ransomware dismantled, 16-year-old arrested

Aviatrix reported that international law enforcement successfully dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator. The operation demonstrated increasing involvement of younger cybercriminals in ransomware operations and the growing possibility of international cooperation against ransomware groups. (Aviatrix)

Source links

• DW Documentary (YouTube): Cyberattacks, data encryption, extortion: How cybercriminals operate
• Breach Anatomy (YouTube): 8 Weeks Inside: How Ransomware Took Down an Entire Health Service
• Cybersecurity Daily: Cybersecurity Daily: News & Threats (podcast)
• Aviatrix: Pentagon DMDC Breach, KillSec Takedown & $387M Bitget Heist
• Datapath: September 2026 Cybersecurity Newsletter
• Becker's Hospital Review: Ransomware attacks targeting US healthcare jump 64%
• DeepStrike: Government Cyber Breach Statistics 2026

Date saved: 2026-10-20 18:00 (PDT)

Sources: Verdice News, Aviatrix Threat Research Center, The Hacker News, SentinelOne, CISA, Europol, CoinDesk, Defense.gov, BleepingComputer

Key findings

Pentagon DMDC breach: 3 million military records exposed

• Aviatrix Threat Research Center / Defense.gov (Week 40, 2026): The Pentagon's Defense Manpower Data Center (DMDC) suffered a breach exposing personal data of 3.09 million military personnel and veterans, including 2.8 million living and 294,000 deceased service members. Exposed data includes Social Security numbers, names, birthdates, contact details, race, gender, and military assignment records. The breach was discovered in July 2026 but was ongoing since October 2025. Notification was issued via Defense.gov Release Article 3598234. The exposure was attributed to unencrypted data storage and inadequate access controls. The breach also affected FBI recruitment platform administrative records and special agent personal data. (Source)

North Korean $387M cryptocurrency heist

• Aviatrix / CoinDesk (Oct 15, 2026): North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from Bitget cryptocurrency exchange. The attack path: exploitation of zero-day vulnerabilities in third-party security appliances and Oracle PeopleSoft systems for initial access, privilege escalation through harvested credentials, lateral movement to production systems, persistent C2 via web shells, and exfiltration of $387M in cryptocurrency. CVE-2024-47575 (CVSS 9.8) (a zero-day in Oracle PeopleSoft allowing remote code execution through authentication bypass) was exploited in the wild. (Source)

KillSec ransomware takedown and teen arrests

• Europol / The Hacker News / Aviatrix: International law enforcement successfully dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator. Police in Spain arrested the 16-year-old, who was one of three people arrested on September 30, 2026, when police also took control of KillSec's leak site. KillSec was accused of stealing data from organizations and threatening to publish it unless ransom was paid. Operation KillSwitch was the coordinated law enforcement action. (Source)
• The Hacker News: A suspected member of the ShinyHunters digital extortion group, "Rey" (real name Saif al-Din Khader), was detained by authorities in Jordan on September 29, 2026, and is cooperating with the FBI and law enforcement to identify other group members. (Source)

Verizon/CISA Ivanti zero-day warning

• CISA: Issued an urgent warning about CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure (ICS), being actively exploited as a zero-day since October 1, 2026. (Source)

Cisco Secure Firewall vulnerabilities actively exploited

• Cisco / The Hacker News: Three distinct threat clusters linked to ransomware and state-sponsored attacks are exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. CVE-2026-20079 (CVSS 10.0) is an authentication bypass vulnerability in the FMC web interface allowing unauthenticated remote attackers to execute script files and obtain root access. CVE-2026-20316 (CVSS 5.3) allows unauthenticated remote attackers to log in using a low-privilege account to access sensitive data. (Source)

Broader threat landscape, identity attacks dominate

• Verdice News (July 27, 2026 intelligence briefing): The center of gravity in cyber threats has shifted from technical exploitation to identity compromise and AI-enabled deception. The dominant lesson of 2026 incident data: "attackers did not break in; they logged in" (credential theft, SSO token phishing, and inherited vendor access drive nearly every major intrusion. 87% of CEOs identify AI-related vulnerabilities as the fastest-growing cyber risk (Global Cybersecurity Outlook 2026, Amtivo). Government ransomware incidents reached 187 in H1 2026, a 13% global increase, with "The Gentleman" the most active group. The Colonial Pipeline lesson), a single inactive account without MFA enabled a national crisis, remains largely unlearned across operational technology environments. (Source)
• ShinyHunters group: Responsible for the January 2026 Match breach and the June 2026 NAIC (National Association of Insurance Commissioners) credit-rating compromise that forced suspension of investment-risk designations. FBI recruitment platform was breached by ShinyHunters. (Source)
• Nation-state blurring: CSIS documented the June 2026 Tata Electronics breach implicating Apple and Tesla data, with Russia's FSB responding by opening a criminal investigation but providing no technical evidence or specific country attribution, illustrating how state agencies use attribution claims as narrative instruments. (Source)
• 14 charged in cybercrime schemes: Authorities arrested two U.S. nationals and charged 14 individuals total, including 12 Chinese defendants, in schemes affecting over 70 companies and generating approximately $3 million since 2019. (Source)

Source links

• Aviatrix Threat Research Center: Pentagon DMDC Breach, KillSec Takedown & $387M Bitget Hack, Week 40 2026
• Verdice News: Strategic Intelligence Briefing: Cybersecurity (July 27, 2026)
• The Hacker News: Nation-State Attacks: Latest News & Analysis
• The Hacker News: Ransomware: Latest News & Analysis
• SentinelOne: The Good, the Bad and the Ugly in Cybersecurity: Week 40 2026
• Europol: Operation KillSwitch Dismantles KillSec Ransomware Gang

Date saved: 2026-10-20 11:00 (PDT)

Sources: SecurityWeek, Nextgov, BleepingComputer, The Hacker News, CISA

The Defense Manpower Data Center kept unencrypted Social Security numbers, dates of birth and military records for roughly 3 million people on a file-sharing server that unauthorized users could reach, and nobody inside the Pentagon noticed for about nine months. Access began in October 2025. The vulnerability was found on July 16, 2026 (SecurityWeek).

The people affected found out from a notification letter dated September 18, signed by DMDC Director Katie Griffin, not from any public announcement; Nextgov obtained the letter, and Military Times first reported it on September 24. The exposed population is 2.76 million living people and 294,000 deceased individuals, a defense official told CNN (SecurityWeek).

Nine months of unencrypted records

The data varied by person but could include Social Security numbers, names, dates of birth, contact details, demographic data and military occupational specialties, all stored unencrypted on a server inside an agency that holds more than 60 million records and helps manage identity for military personnel, government employees and contractors (BleepingComputer).

DMDC patched the flaw and restored the system after discovery, and is offering 12 months of free credit monitoring and identity restoration through IDX, with enrollment closing August 19, 2027 (BleepingComputer). The letter says the department has no indication the information has been misused.

The patch treadmill, and who it does not bind

The same pattern runs through this month's vulnerability disclosures. Cisco's Secure Firewall Management Center bugs are being exploited by three distinct threat clusters: one deploying JSP web shells to harvest credentials (UAT-12197), one carrying a variant of the Sandworm-linked Cyclops Blink implant (UAT-11823), and one using the low-privilege flaw for initial access before deploying Qilin ransomware (UAT-11988) (The Hacker News, September 11). The FMC is the console administrators use to configure the firewalls themselves: in each case the device whose job is watching the network was the way in.

CVE-2026-20079 scores a maximum 10.0 and hands an unauthenticated remote attacker root access (NVD). Cisco first published the advisory on March 4, 2026, and only revised it on September 9 to say active exploitation had been observed since August (Severity Daily). CISA added it to the Known Exploited Vulnerabilities catalog the same day with a three-day deadline of September 12, a deadline that binds federal agencies only (CISA KEV catalog). Its partner flaw, CVE-2026-20316, had already been added in late July. Everyone outside the federal estate patches on Cisco's timetable, not CISA's.

Kept adding since: a FortiMail path traversal bug, CVE-2026-104286 (October 1), two Zammad flaws, CVE-2026-102489 and CVE-2026-102490 (October 2), and a Citrix NetScaler bug, CVE-2026-88779 (October 4) (weekly KEV update).

What the official story leaves out

"At this time, DoW does not have any indications of misuse of the accessed information" is a statement by the agency that failed to detect the access for nine months (SecurityWeek). A notification letter cannot see criminal use of Social Security numbers traded outside its systems, and credit monitoring detects fraud after it is already underway rather than preventing it.

Likewise, DMDC's assurance that it followed Office of Management and Budget and department guidelines describes a checklist, not an outcome: every control it complied with was in place while the exposure ran from October 2025 to July 2026. And the binding deadlines in this story apply to federal agencies. Everyone else (hospitals, schools, the businesses that hold your records) depends on a vendor deciding when to tell you, as Cisco's six-month gap between advisory and exploitation notice shows.

What readers can do

• If you served, or are a military family member: find the DMDC letter dated September 18 and enroll in the IDX monitoring offer before August 19, 2027, the window closes whether or not you have seen fraud yet.
• Freeze your credit with all three bureaus using the FTC's steps at identitytheft.gov; a freeze stops new accounts being opened in your name, which monitoring does not.
• Request an IRS Identity Protection PIN at irs.gov, an SSN alone is no longer enough to file a fraudulent return in your name.
• If you run a Cisco Secure FMC: apply the hotfixes for CVE-2026-20079 and CVE-2026-20316 now. Cisco states there are no workarounds (Cisco advisory).
• If you run FortiMail, Zammad or Citrix NetScaler: check the KEV catalog against your inventory; those three additions are from the first week of October.

Source links

• SecurityWeek - Pentagon Personnel Agency Data Breach Impacts 3 Million People
• Nextgov - Pentagon personnel breach undetected for months renews cyber standard scrutiny
• BleepingComputer - Hackers stole Pentagon personnel records of over 3 million people
• The Hacker News - Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
• NVD - CVE-2026-20079
• Cisco - Secure FMC Authentication Bypass Advisory
• CISA - Known Exploited Vulnerabilities Catalog
• Severity Daily - Cisco FMC exploitation confirmed, KEV due September 12

Date saved: 2026-10-20 03:00 (PDT)

Sources: The Hacker News, Aviatrix Threat Research, Krebs on Security, Cisco, Reuters

Key findings

KillSec ransomware takedown and arrests

• The Hacker News (September 30, 2026): Police in Spain arrested a 16-year-old suspected of running the KillSec ransomware group, one of three people arrested when police also took control of KillSec's leak site. KillSec is accused of stealing data from organizations and threatening to publish it unless they paid. In a separate development, a suspected member of the ShinyHunters digital extortion group known as "Rey" (real name Saif al-Din Khader) was detained in Jordan on September 29 and is cooperating with US authorities. (Source)

Pentagon DMDC breach, 3 million records exposed

• Aviatrix Threat Research (Week 40, 2026): The Pentagon's Defense Manpower Data Center suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers and military records. The breach was discovered in July 2026 but has been ongoing since October 2025, a full year of exposure. Simultaneously, North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from the Bitget cryptocurrency exchange. (Source)

Cisco firewall vulnerabilities being actively exploited

• The Hacker News (2026): Cisco revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks are exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. CVE-2026-20079 (CVSS 10.0) is an authentication bypass vulnerability allowing unauthenticated remote attackers to execute script files and obtain root access. CVE-2026-20316 (CVSS 5.3) allows low-privilege account login to access sensitive data. Multiple espionage-motivated threat clusters have also been found deploying a previously undocumented exploit kit called BlueMoon that chains vulnerabilities in Microsoft Windows and Google Chrome. (Source)

Ransomware negotiation fraud and international crackdowns

• Krebs on Security (2026): Brian Krebs reported the arrest of a ransomware negotiation firm's founder, tied to the investigation into ShinyHunters' breach of FBI data. Japan confirmed the arrest and extradition of a Qilin ransomware operative to Germany, a rare example of international cooperation against ransomware gangs. An Iranian national accused of breaching American universities to steal academic data and IP was extradited from Montenegro. A US Army soldier was sentenced to 70 months for hacking into AT&T and Verizon systems and stealing metadata on more than 100 million customers. (Source)
• Cisco / The Hacker News (2026): The international seizure of tools used by Integrity Tech, the firm behind the Flax Typhoon campaign, represents a notable multinational effort to disrupt Chinese state-linked hacking infrastructure. CISA's Known Exploited Vulnerabilities catalog added three entries: a Citrix NetScaler memory-corruption bug, two Zammad vulnerabilities (session fixation and privilege management), and a FortiMail path traversal flaw. (Source)

Source links

• The Hacker News: Ransomware latest news
• Aviatrix Threat Research: Pentagon DMDC Breach, KillSec Takedown & $387M Crypto Heist (Week 40)
• Krebs on Security via Baruch CUNY: Cybersecurity roundup
• The Hacker News: Nation-State latest news

Date saved: 2026-10-19 18:00 (PDT)

Sources: Senthorus, IT Security News, Aviatrix, CyberBreachNet, TechTarget

Key findings

Major Data Breaches

• Senthorus (Oct 5-11, 2026): The US Department of Defense's Defense Manpower Data Center (DMDC) confirmed a massive breach affecting over 3 million military personnel and veterans. Unauthorized users accessed unencrypted personnel records via a file-sharing vulnerability between October 2025 and July 2026, exposing names, Social Security numbers, birth dates, contact details, and military occupational information. (Source)
• Senthorus (Oct 5-11, 2026): Japanese car-sharing service Times Car disclosed a breach impacting 6.6 million accounts, with identity-verification documents including driver's licenses leaked for 1.6 million users. Fakturownia, a Polish online invoicing platform used by over 600,000 businesses, suffered a breach exposing account and company information, password hashes, bank account details, and authentication tokens. Arizona's state court system was compromised after an employee clicked a malicious link, exposing backup files containing protective-order records and over 150,000 Foster Care Review Board reports. (Source)
• IT Security News (Oct 15, 2026): Eight major 2026 data breaches have affected organizations including Medtronic, Canvas, and DentaQuest, demonstrating continuous vulnerability of sensitive healthcare records. Retailer TFG London experienced a cyber incident forcing several IT systems offline and disrupting online orders across brands like Hobbs and Whistles. (Source)

Critical Vulnerabilities & Zero-Days

• IT Security News (Oct 15, 2026): CISA issued an urgent warning about CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure being actively exploited as a zero-day since October 1, 2026. Microsoft released a record 1,415 security fixes in its October update, addressing actively exploited zero-days and critical remote code execution bugs. A critical Linux kernel bug dubbed PwnEscape allows virtual machine guests to read host memory, bypassing core hypervisor isolation boundaries. (Source)
• CyberBreachNet (Oct 19, 2026): A Broadcom Wi-Fi flaw dating back to 2010 allows attackers within Wi-Fi range to execute code on vulnerable routers without authentication. A Rust-based bot named CikaBika turns Discord into a command center, using fake documents to infect Windows systems, then abusing Discord and Ngrok to execute commands, spy on victims, and steal files. (Source)
• TechTarget (Oct 2026): An AI audit of Curl unearthed a 25-year-old authentication flaw in code powering 20 billion devices, proving heavily scrutinized legacy libraries still harbor hidden risks. CISA added actively exploited flaws in Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway to its Known Exploited Vulnerabilities catalog. (Source)

Ransomware, Nation-State Attacks & Arrests

• Aviatrix (Oct 2026): North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from the Bitget cryptocurrency exchange. International law enforcement dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator. CISA added five security flaws exploited by the China-linked Flax Typhoon group to its KEV catalog, requiring federal agencies to patch or discontinue affected software by October 11. (Source)
• Senthorus (Oct 5-11, 2026): South Africa's air navigation provider was hit by ransomware, disrupting operational technology supporting aviation weather services. Citrix issued urgent patches for critical NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) actively exploited in the wild, attackers leveraged these flaws to gain remote access, deploy web shells, steal credentials, and move laterally. The FBI arrested a suspected co-conspirator of the ShinyHunters extortion group, which had claimed responsibility for high-profile breaches including the FBI's jobs portal. (Source)
• IT Security News (Oct 15, 2026): Cisco disclosed a critical authentication bypass vulnerability (CVSS 9.8) in Catalyst SD-WAN Manager allowing unauthenticated remote attackers to gain administrator access with active exploitation reported but no patch available. Apple released emergency patches for a CoreGraphics memory corruption vulnerability exploited in targeted attacks. Fortinet disclosed active exploitation of a critical FortiMail vulnerability (CVSS 9.8). Cisco Talos and Recorded Future exposed Silent Lynx, a Kazakhstan-nexus threat group conducting cyber espionage against Russian energy and government sectors. (Source)

Source links

• Senthorus: Cybersecurity Week in Review: October 5-11, 2026
• IT Security News: IT Security News Roundup: 2026-10-15 Evening
• Aviatrix: Defense/Space Cyber Threats & Breach Reports
• CyberBreachNet: 16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a Password
• TechTarget: Historic Curl flaw shows AI risk to legacy supply chain

Date saved: 2026-10-19 03:00 (PDT)

Sources: Aviatrix Threat Research Center, The Hacker News, Security Boulevard, FBI, CISA, Google Mandiant

Key findings

Pentagon DMDC breach, 3 million military records exposed

• Aviatrix Threat Research Center (2026): The Pentagon's Defense Manpower Data Center (DMDC) suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers and military records. The breach was discovered in July 2026 but has been ongoing since October 2025. The exposure was attributed to unencrypted data storage and inadequate access controls. (Source)

North Korean heist and ransomware takedown

• Aviatrix / The Hacker News (2026): North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from the Bitget cryptocurrency exchange, escalating privileges through harvested credentials and maintaining persistent C2 through web shells. Simultaneously, international law enforcement successfully dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator in Spain. Police in Spain arrested the suspected administrator and main operator of KillSec on September 30, taking control of the group's leak site and servers. KillSec is accused of stealing data from organizations and threatening to publish it unless they paid. (Source)

• The Hacker News (October 1, 2026): The 16-year-old arrested in Spain was identified by Hamburg police as KillSec's suspected administrator and main operator. He was one of three people arrested. (Source)

CISA zero-day warning, Ivanti Connect Secure

• The Hacker News (2026): The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent warning about CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure (ICS) being actively exploited as a zero-day since October 1, 2026. The flaw (CVSS score: 8.6) impacts ICS versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, allowing a remote unauthenticated attacker to execute arbitrary commands. CISA added the flaw to its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to apply fixes by October 16, 2026. The agency said cyber threat actors are exploiting the zero-day "to conduct credential theft and data exfiltration." (Source)

FBI operations and ShinyHunters arrests

• Aviatrix (2026): In October 2026, the FBI conducted Operation Lonestar Roundup, raiding 40 residences in Texas and seizing 187 laptops used by North Korean threat group Famous Chollima (WageMole) in fraudulent IT worker schemes. Authorities arrested two U.S. nationals and charged 14 individuals total, including 12 Chinese defendants, in schemes that affected over 70 companies and generated approximately $3 million since 2019. In a separate case, Abdulrahman Alfozan, a 35-year-old Saudi national and OpenAI engineering lead, was arrested by the FBI for allegedly planting a sophisticated recording device in an executive conference room at OpenAI's San Francisco offices. (Source)

• Security Boulevard (October 2026): The FBI arrested Canadian cybersecurity expert Edward Dubrovsky, accusing him of conspiring with ShinyHunters in the breach of the agency's systems. The attack exposed sensitive information of thousands of FBI employees, including job details, specializations, and medical records, after hackers exploited an unpatched Oracle PeopleSoft vulnerability (CVE-2026-35273). ShinyHunters, a prolific extortion group, has breached more than 140 organizations since 2025 and extorted $70 million. Dubrovsky was arrested at a cybersecurity conference in Pennsylvania and is being charged in Texas with conspiracy to commit extortion. The FBI has also arrested other ShinyHunters associates including a Canadian citizen in Pennsylvania, Pepijn Van der Stap in the Netherlands, and teenager Saif al-Din Khader ("Rey") in Jordan, who is cooperating with law enforcement. (Source)

China-linked espionage and HAFNIUM rewards

• The Hacker News (2026): Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in six other countries said on October 8. The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM. Zhang remains at large. (Source)

• The Hacker News (October 9, 2026): FBI Director Kash Patel announced the arrest of another suspected co-conspirator of ShinyHunters, a Canadian citizen arrested in Pennsylvania. (Source)

Source links

• Aviatrix Threat Research Center: Pentagon DMDC Breach, KillSec Takedown & $387M Bitget Heist
• Aviatrix: Defense/Space Cyber Threats & Breach Reports
• The Hacker News: Nation-State latest news
• The Hacker News: Data breach latest news
• Security Boulevard: Cybersecurity Expert Tied to ShinyHunters FBI Data Breach

Date saved: 2026-10-18 18:00 (PDT)

Sources: Aviatrix Threat Research Center, The Hacker News, SentinelOne, BleepingComputer, Europol, CoinDesk, Department of Defense

Key findings

Pentagon DMDC breach exposes 3 million records

• Aviatrix Threat Research Center (Oct 15, 2026): The Pentagon's Defense Manpower Data Center (DMDC) suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers, names, birthdates, contact details, race, gender, and military assignment records. The breach affected 2.8 million living and 294,000 deceased service members. It was discovered in July 2026 but has been ongoing since October 2025. The exposure resulted from unencrypted data storage and inadequate access controls. An additional FBI recruitment platform was also compromised, exposing special agent personal data. (Source)

North Korean $387M cryptocurrency heist

• Aviatrix Threat Research Center (Oct 15, 2026): North Korean state-sponsored hackers (DPRK APT) exploited third-party zero-day vulnerabilities in security appliances and Oracle PeopleSoft systems (CVE-2024-47575, CVSS 9.8) to compromise Bitget cryptocurrency exchange's wallet infrastructure. Attackers escalated privileges through harvested credentials, moved laterally to production systems, maintained persistent command-and-control through web shells, and exfiltrated $387 million in cryptocurrency. The attack demonstrated sophisticated supply chain exploitation through third-party vulnerabilities. (Source)

• CoinDesk (Oct 15, 2026): Bitget exchange suffered a $387 million cryptocurrency heist, with North Korean actors suspected. The breach occurred through zero-day vulnerabilities in third-party security infrastructure. (Source)

KillSec ransomware dismantled, 16-year-old arrested

• Aviatrix / Europol (Oct 2026): International law enforcement successfully dismantled the KillSec ransomware operation under "Operation KillSwitch," arresting key members including a 16-year-old administrator. Police in Spain arrested the teenager on September 30, 2026, along with two others, and took control of KillSec's leak site. KillSec was accused of stealing data from organizations and threatening to publish it unless ransom was paid. (Source)

• The Hacker News (Sep 2026): Police in Spain arrested a 16-year-old suspected of running the KillSec ransomware group. The 16-year-old was one of three people arrested on September 30 when police also took control of the group's leak site. (Source)

ShinyHunters suspect detained in Jordan

• The Hacker News / Reuters (Sep 2026): A suspected member of the ShinyHunters digital extortion group, known by the alias "Rey" (real name Saif al-Din Khader), was detained by authorities in Jordan on September 29, 2026, and is cooperating with the FBI and law enforcement to identify other group members. (Source)

Ransomware fraud charges and other arrests

• The Hacker News (2026): The US Department of Justice charged Zohar Pinhasi (aka Zack Silver/Zack Green), a 50-year-old US and Israeli national, with two counts of wire fraud and one count of wire fraud conspiracy for allegedly defrauding ransomware victims by secretly paying attackers to obtain decryptors while claiming to use proprietary tools. (Source)

Nation-state threats and US responses

• The Hacker News (2026): The US DOJ charged 14 people and seized about 187 computers and KVM devices as part of efforts to disrupt North Korea's fraudulent remote IT worker scheme, affecting more than 70 US companies. The State Department is offering up to $10 million for information leading to Zhang Yu, a Chinese national charged in connection with the 2021 Microsoft Exchange Server attacks (HAFNIUM). The Salt Typhoon Chinese state-sponsored threat group continues to target critical organizations despite remediation of last year's telecom breaches. Cisco revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks are exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. (Source)

• BleepingComputer (2026): The FBI recruitment platform was breached by the ShinyHunters group. The Pentagon DMDC breach notification was formally released by the Defense Department. (Source)

Vulnerabilities and zero-days

• Aviatrix (Oct 2026): Palo Alto Networks disclosed CVE-2026-0322, a high-severity remote code execution vulnerability in PAN-OS management interface enabling authenticated attackers to execute arbitrary code with root privileges. A zero-day vulnerability in Cleo's managed file transfer products is being exploited. A vulnerability called "SneakPeek" exposes critical AI development tool security gaps in Anthropic's Claude Code desktop. (Source)

Source links

• Aviatrix: Pentagon DMDC Breach, KillSec Takedown & $387M Bitget Hack (Week 40)
• The Hacker News: ransomware latest news
• The Hacker News: Nation-State latest news
• BleepingComputer: FBI recruitment platform breached by ShinyHunters
• Europol: Operation KillSwitch Dismantles KillSec Ransomware Gang
• Department of Defense: DMDC Data Breach Notification

• The CyberHub Podcast: Pentagon Breach Hits 3M Military Records, ShinyHunters Hacker Arrested for Murder Plot, Spectre v2

Date saved: 2026-10-18 14:33 (PDT)

Sources: The Hacker News, BleepingComputer, Infosecurity Magazine, Cyber Security News

Ransomware

• Q3 2026 set a new record: Comparitech counted 2,627 claimed ransomware attacks in Q3 2026, finance, technology, education, healthcare saw significant increases (Oct 9).
• Physical violence threats rising: Ransomware gangs increasingly threaten employees, executives, and their families to force payment, beyond file encryption and data theft (Infosecurity, Oct 16). (Source)
• Silent Ransom Group: Leaked chat logs suggest $206.95M extorted from 27 firms in ~6 months without encrypting files (Oct 9).
• MonsterCloud CEO charged (Oct 8): DOJ charged Zohar Pinhasi with wire fraud for billing victims $19M+ while secretly paying attackers for decryptors, claiming proprietary recovery tools.
• Backup targeting: Ransomware groups increasingly target backup infrastructure to eliminate recovery options (Kaseya advisory).

Major breaches / incidents

• FBI / ShinyHunters crackdown: Group claimed a breach of the FBI jobs portal (data on nearly all agents/applicants). Multiple arrests: a Canadian cybersecurity executive (Edward Dubrovsky) arrested in Pennsylvania; suspect "Rey" detained in Jordan, cooperating with FBI; Dutch police arrested an alleged leader; FBI Director Kash Patel urging members to surrender. ShinyHunters also allegedly hacked Clop's own leak site, defacing it and stealing onion service private keys.
• KillSec dismantled, "Operation KillSwitch": International operation seized leak site/servers, 3 arrests; alleged admin is a 16-year-old arrested in Spain.
• Berlin state government: Confirmed extortion attempt (Rhysida gang listed it) after August compromise of the state administrative network; refuses to pay.
• Japan: Ransomware hit IDCF Cloud (IDC Frontier), data center outage affecting east Japan; Keio Corporation railway hit; Daiichi Kosho karaoke chain breach exposed 8M+ customers (supply chain).
• UK Legal Aid Agency: Hackers stole records dating back to 1978 (April 2025 breach disclosed Oct 15, 2026).
• KFC named in Gentlemen ransomware group's breach claim (Oct 10).
• Advantest (semiconductor test firm) confirming PII stolen in ransomware attack.
• ASOS data breach linked to stolen employee credentials (Oct 8).

Threats / vulnerabilities

• FortiBleed (FBI warning): Ongoing attacks on exposed Fortinet FortiGate firewalls & SSL VPN gateways locking out legitimate admins.
• Palo Alto GlobalProtect CVE-2026-0257: Months-old auth-bypass flaw in PAN-OS GlobalProtect/Prisma Access actively exploited by multiple ransomware groups for stealthy VPN access (ReliaQuest).
• China-nexus attacks: Actor exploiting Microsoft SharePoint flaws to deploy Warlock ransomware against essential services/public sector; Chinese hacker used AI in a campaign against South Korean banks; UK + allies warned of cyber threat from China's Integrity Technology Group.
• Kimsuky deploying Funhouse ransomware via malicious résumé documents.
• ClickFix + Python tunnels used to stage systems for ransomware (Oct 15).
• Aoki Infostealer targeting AI coding assistant credentials (Oct 15); separately, a ransomware affiliate used an AI coding assistant as an attack channel inside enterprise networks (Oct 6).
• Microsoft disrupted the "Yam" phishing network, one billion phishing messages (Oct 15).
• Luna Moth leaks shed light on ransomware group internals (Oct 12).

Policy / other

• G7: Planning tabletop exercises simulating AI cyberattacks on banks.
• New Aoki Infostealer and Socradar's new white-label threat-intel API suite for MSSPs (industry note).

Source links

• The Hacker News: Ransomware latest
• BleepingComputer: Ransomware tag
• Infosecurity Magazine: Data breaches
• Cyber Security News: Ransomware
• The Hacker News: Data breach latest
• BleepingComputer: Data theft tag