Cybersecurity News: Research Digest

Date saved: 2026-10-25 03:01 (PDT)

Sources: CISA, The Hacker News, SOCRadar, Group-IB, NyxLab, Security Boulevard, Risky Business, Becker's Hospital Review, BleepingComputer, Engadget, IGN, Help Net Security, GamesIndustry.biz, TechTarget

Key findings

Ransomware affiliates ran AI agents through live kill chains, left the evidence exposed

The Hacker News / SOCRadar (October 23, 2026): SOCRadar's Threat Research Unit uncovered an AI-driven intrusion operation run by affiliates of the INC and The Gentlemen ransomware groups, centered on a framework called Phantom, an Autonomous Red Team Kill Chain Framework. Researchers recovered the knowledge base, session logs, and source code from an exposed command-and-control server. The recorded sessions contain 8,257 messages across 133 sessions, with a running API bill exceeding $23,000. Phantom has 18 skill modules covering reconnaissance, binary reverse engineering, exploit research, steganography, telemetry assessment, and EDR fingerprinting. The operators targeted FortiClient EMS, SimpleHelp, cPanel, and VPN gateways at scale. In one case, a single reused password unlocked the VPN, servers, remote management, backup, and security platforms. The campaign came to light in late September 2026 after operational security failures left the source code, credentials, and session logs exposed. (Source)

CISA urges patching Ivanti Connect Secure zero-day exploited in the wild

CISA (October 13, 2026): CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13, 2026, after Ivanti disclosed a newly exploited vulnerability affecting Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. The vulnerability is a zero-day authentication bypass that allows remote, unauthenticated execution of arbitrary commands, and cyber threat actors are exploiting it to conduct credential theft and data exfiltration. CISA urged organizations to patch immediately. (Source)

CISA adds BeyondTrust Remote Support critical auth bypass to KEV catalog

CISA (October 16, 2026): CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16, 2026, after confirming active exploitation of a critical authentication bypass vulnerability affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Cyber threat actors are using the vulnerability to gain initial access, establish persistence, escalate privileges, and move laterally. Patches are available for supported versions 24.3.1 and later; organizations using older versions must upgrade first. (Source)

Hackers breach enterprise firewalls and VPNs, exposing over 70,000 credentials

The Hacker News (October 23, 2026): A large-scale campaign targeting exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls has exposed over 70,000 credentials, according to a joint investigation by Group-IB and NyxLab. The threat actor, known as k0t, also goes by the aliases CryptoFeel, Member19, and QazWsxShop. Artifacts from the investigation indicate the operators obtained access to numerous organizations worldwide and attempted to further compromise some victims, resulting in persistent remote access and data exfiltration. (Source)

Capcom confirms data breach exposing 11.7 million accounts

BleepingComputer / Engadget / IGN (October 23, 2026): Capcom confirmed that hackers breached its Capcom ID membership service, exposing 11,774,247 records worldwide containing email addresses along with account creation dates, last login times, login counts, and last-login IP addresses. For 43 accounts, the exposed data also included birth dates, gender, country or region, and nicknames. Attackers changed the passwords on 196 accounts without authorization. Credit card information was not affected. Capcom detected suspicious activity on October 19 and confirmed the intrusion the same day, reporting the incident to the Osaka Prefectural Police and Japan's Personal Information Protection Commission. The company warned users to beware of phishing emails using the stolen data. (Source)

CyberLogitec breach leads to 40+ ports and shipping firms extorted

The ransomware and extortion group n0n listed more than 40 port authorities, port operators, ship managers, and sea-shipping companies on its leak site on October 12, with the likely entry point being maritime IT services provider CyberLogitec. Half of the listed victims are known CyberLogitec customers, and the company's website had been down for weeks. The victims span 18 countries, and the group demanded a combined $1.2 billion. Most victims reportedly refused to pay after the October 19 deadline, and their data was posted to the leak site. (Security Boulevard / Risky Business, October 2026) (Source)

Quest Diagnostics learns of unauthorized access to lab services manager

Quest Diagnostics learned on October 21 of unauthorized access to its Quanum Lab Services Manager, a system clients use to place test orders and receive or look up results. The breach is part of a week in which supply chain abuse dominated, with attackers turning a cloud backup service, a maritime IT provider, an open source AI gateway, and a developer platform into ways to reach thousands of downstream organizations. (Security Boulevard, October 2026) (Source)

CISA adds six vulnerabilities to KEV catalog including Plex Media Server

CISA / NCSA Greece (October 20, 2026): CISA added six new vulnerabilities to its Known Exploited Vulnerabilities catalog on October 20, 2026, based on evidence of active exploitation. The additions include CVE-2026-96652 through CVE-2026-96656 affecting Plex Media Server (SSRF, improper neutralization of encoded URI schemes, and external control of file name or path vulnerabilities), CVE-2026-106931 affecting EG Secure Solutions SiteGuard Server Edition (OS command injection), and CVE-2026-110936 affecting Siemens Software Center (uncontrolled search path element). CISA also added CVE-2026-110447 for Collabora Online and CVE-2026-114625 for Arista VeloCloud Orchestrator in separate additions. (Source)

Critical PHP vulnerabilities require immediate patching, CISA warns

CISA (October 21, 2026): CISA warned on October 21, 2026, that critical vulnerabilities in PHP require immediate patching, citing CVE-2026-109618 and CVE-2026-109619. The vulnerabilities are severe enough that CISA issued a dedicated alert demanding immediate action from affected organizations. PHP powers a large fraction of web infrastructure, and vulnerabilities of this severity typically see rapid exploitation after disclosure. (Source)

MonsterCloud owner charged with defrauding ransomware victims by $19 million

The Hacker News (October 8, 2026): The US Department of Justice announced charges on October 8 against a 50-year-old US and Israeli national for allegedly defrauding ransomware victims by secretly paying attackers to obtain decryptors while claiming to use proprietary tools to recover their data. The MonsterCloud owner allegedly billed over $19 million while paying ransoms on the back end. (Source)

16-year-old arrested in Spain suspected of running KillSec ransomware group

Police in Spain arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid. The arrest is part of a broader law enforcement push against ransomware operators that also includes the detention of a ShinyHunters suspect in Jordan who is helping the FBI identify group members. (The Hacker News, October 2026) (Source)

The headline this week is that ransomware operators have built a working AI-driven intrusion ecosystem and left it exposed, giving researchers a complete record of how commercial AI models are being used to run kill chains against real organizations. SOCRadar recovered 8,257 messages across 133 sessions from an exposed command-and-control server operated by affiliates of the INC and The Gentlemen ransomware groups. The framework, called Phantom, is an autonomous red-team kill-chain tool with 18 skill modules that plans reconnaissance, selects techniques, generates commands, triages stolen data, and drafts extortion reports. The operators used a human-approved, AI-executed structure: a person writes a victim-specific prompt and reviews every step, while commercial AI models carry out the actual intrusion work through OpenCode with OpenRouter-hosted models. The API bill for the recorded sessions topped $23,000. This is not a vendor marketing claim about AI-powered attacks. It is the actual message log of a working intrusion operation.

The CISA alerts this week cover the serious vulnerabilities being actively exploited in the wild: Ivanti Connect Secure CVE-2026-104935, a zero-day authentication bypass allowing remote unauthenticated command execution; BeyondTrust Remote Support CVE-2026-102764, a critical authentication bypass being used for initial access and lateral movement; and six vulnerabilities added to the KEV catalog on October 20 covering Plex Media Server, EG Secure Solutions SiteGuard, and Siemens Software Center. CISA added two critical PHP vulnerabilities on October 21 demanding immediate patching. The Fortinet and Palo Alto firewall campaign attributed to threat actor k0t has exposed over 70,000 credentials and given operators access to numerous organizations worldwide.

The consumer-facing breaches are enormous: Capcom confirmed a data breach exposing 11.7 million Capcom ID accounts, with email addresses, login history, IP addresses, and for 43 accounts birth dates, gender, and nicknames. The attackers changed passwords on 196 accounts. Quest Diagnostics learned of unauthorized access to its Quanum Lab Services Manager on October 21. Burger King Japan's server held 11.18 million records that leaked. CyberLogitec, a maritime IT provider, was the likely entry point for a campaign that extorted more than 40 port authorities, port operators, and shipping companies across 18 countries, with a combined demand of $1.2 billion. The throughline is that the tools for running intrusions at scale are getting cheaper and more capable, the vulnerabilities in edge devices are being exploited within days of disclosure, and the largest breaches are hitting consumer platforms people trust with their accounts and payment data.