CFToday Curated security signals.

Daily edition · 2026-10-28

Wednesday, 28 October 2026

59 items across 7 sections, selected from 5372 candidates over 6 runs. 118 carried the panel unanimously.

Show
Section

India

2

Indian organisations, regulators and infrastructure, pulled out of the sections below.

  1. False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps (opens in a new tab)

    Group-IB ·Threat Intel & Breaches ·fetched 28 Oct 2026, 11:37 UTC Must read Research agreed3/3

    Why readPrimary Group-IB research mapping seven distinct Android trojan families built to defraud customers of Indian banking apps, with attack chain and infrastructure detail.

    Seven separate Android trojan families are running coordinated fraud against the Indian banking sector, combining phishing overlays, credential theft and unauthorised cryptojacking on compromised handsets. The writeup breaks down the full chain from delivery through malware capability to the hosting infrastructure behind it. Useful for mobile fraud teams and anyone building detection for overlay and accessibility-abuse malware on Android.

    Indicators13
    Hashes
    0ad853b29a7b3677488018061b109bba59b1a518c8f33b48de31ec532be69856 1e60421e83a317cfbfce980fefa926a847964bcc7b047908db65161148d0f624 2fbde057c22b6cb517116d6c797c3474de2f4d3bda09037a9f043a6ad843982f 3b64eeacacb94d70d498988fe8c6dcc25b133bcaea37fb69dc6f0cc26bde9921 5a0cd09adb09a79071a85edc931e02c8d565d6cb7cb58e5b0bffd866e6a2ffb4 5f09a31e28b755aab00fbf3669a7369d1205ac5dea85f0b328cb7cd76472e456 7e631e9f7791f4648f776419c020ce6c33071c3e195669dd473f1423f098d39d 47ae095fd9e5143798a70805a23eb294fc072170dac19c1fa112beca186d844a 65e64e65678f849871257dca43fccf8941ee0ee35fe6b72e86a34fe84e752e68 80de49a3bd719d62f3b2f24d584a03e3fff3e6ac46ad8bea3c04c8a09071ed3a 431ae9a0569c52de8fb5abffcf12919b8d685a879f4e777602ae490dbc2a6baa 902803b40aa30d12e60a37680b113d5fc7c79695b7e1b72904fa7de06cf9b27b
    Addresses
    64[.]89[.]163[.]3

    group-ib.com → (opens in a new tab)

  2. Inside "MR ROBOT" - Anatomy of a Malware-as-a-Service Operation Targeting Indian Bank Customers (opens in a new tab)

    CloudSEK ·Threat Intel & Breaches ·fetched 28 Oct 2026, 07:40 UTC Research agreed3/3

    Why readTracks an Android banking-trojan rental operation aimed at Indian bank customers, with affiliate-level telemetry: 5,407 SMS intercepted across 153 infected devices.

    MR ROBOT is sold as a subscription service that lets affiliates order customised Android banking trojans targeting Indian bank customers. The builds harvest OTPs, card data, UPI PINs and credentials, and silently enable call forwarding so that bank verification calls never reach the victim. CloudSEK's tracking of one affiliate panel gives a concrete measure of reach, 153 compromised devices and 5,407 intercepted messages, which is the kind of figure usually missing from MaaS writeups.

    cloudsek.com → (opens in a new tab)

Threat Intel & Breaches

12

  1. Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN (opens in a new tab)

    Cisco Talos ·Cisco Talos ·fetched 28 Oct 2026, 23:37 UTC Must read Research CVE-2026-20127 EPSS 89.3% agreed3/3

    Why readPrimary Talos analysis of an APT exploiting CVE-2026-20127 (EPSS 0.89) on Cisco SD-WAN Catalyst Controllers to install a keying-material theft framework, with assessed infrastructure overlap with Volt Typhoon.

    UAT-11473 abused an authentication bypass in Cisco SD-WAN Catalyst Controller instances (CVE-2026-20127) and deployed KeyDrift, a multi-component framework built specifically for SD-WAN controller environments that acts as backdoor, intermediate C2 host, and automated exfiltration path for sensitive keying material. Targeting spans space and satellite services, defence and aerospace technology, and policy research. Talos assesses with high confidence that the actor's infrastructure overlaps substantially with Volt Typhoon's "Silent Train" covert access network, which raises the stakes for anyone running these controllers at the edge.

    blog.talosintelligence.com → (opens in a new tab)

  2. Managed for Malice: How Attackers Turn MDM into Remote Access (opens in a new tab)

    Huntress ·fetched 28 Oct 2026, 15:38 UTC agreed2/2

    Why readDetails how threat actors use social engineering to enroll enterprise devices in legitimate MDM platforms like Hexnode and Rippling.

    Huntress reports recent attacks where threat actors gain persistent privileged access by tricking users into enrolling devices in legitimate Mobile Device Management (MDM) software. Once enrolled, attackers use the MDM's administrative trust to deploy unauthorized remote monitoring and management (RMM) tools and establish external relay connections. Defenders should audit unexpected MDM enrollments and monitor new RMM service installations across endpoints.

    Indicators7
    Hashes
    c4ca4238a0b923820dcc509a6f75849b
    URLs
    hxxps://webdocusign[.]viewportal[.]es/Windows/download/index[.]php hxxps://teams-microsoftcom5d41402abc4b2a76b9719d911017c592[.]kiratham[.]com hxxps://teams-microsoftcom5d41402abc4b2a76b9719d911017c592[.]kiratham[.]com/teams hxxps://teams-microsoftcom5d41402abc4b2a76b9719d911017c592[.]kiratham[.]com/teams/14/enroll14[.]php
    Domains
    relay[.]bobdthjau[.]com relay[.]pronconetydesire[.]online

    huntress.com → (opens in a new tab)

  3. Attackers compromised 42 GitHub repositories by using files too large to be searched (opens in a new tab)

    CSO Online ·fetched 28 Oct 2026, 03:38 UTC Must read agreed3/3

    Why readAttackers hid payloads in blobs large enough to fall outside GitHub's search and API paths, compromising 42 repositories that carry execution hooks for AI coding assistants and IDEs.

    JFrog Security Research reports 42 compromised third-party GitHub repositories where polymorphic wrappers as large as 13.7MB all decoded to the same hidden CI-publisher payload, sized deliberately to evade the search and API routes defenders normally use to hunt this. A newer variant ships a compiled native addon containing no payload of its own, decrypting a file named .napi_cache at runtime to produce the real one, and the attacker-owned repository doubles as an encrypted sink receiving snapshot envelopes. The investigation also surfaced account hijacks, forged commit timelines, short-lived publishing branches and exposed npm credentials, with Shellpanel artefacts linking the cluster to previously reported GitHub Actions abuse.

    Indicators2
    URLs
    hxxp://43[.]228[.]157[.]68:80
    Addresses
    43[.]228[.]157[.]68

    csoonline.com → (opens in a new tab)

  4. Camera Management Software Compromise Leads to Malware Deployment (opens in a new tab)

    Huntress ·fetched 28 Oct 2026, 07:40 UTC Research agreed3/3

    Why readCamera management software used as initial access, followed by WpcMon.exe DLL sideloading and Run key persistence, with the dropped filename named.

    Huntress saw multiple intrusions beginning with compromise of camera management platforms, which then served as a route into the wider Windows estate. Post-access the operators dropped rs.win32.exe, sideloaded malicious DLLs through the legitimate WpcMon.exe binary, set Run key persistence and beaconed to C2. The hunting advice follows directly: inventory and restrict camera management software, block execution from user-writable paths, and look for WpcMon.exe loading DLLs from unusual locations.

    Indicators5
    Hashes
    1fb4af4862643dcab1459872f723f574f1a588855b020916b600df5c20681144 8f8e88c54a9c56174974711eff99b4beb79536642fcca1902acdc3d4b1fd1035 70b2345302264c41504d59e6a63d6d908969740424b42b7373f10b4c8d74c87a
    Addresses
    144[.]172[.]116[.]37
    Domains
    3r-dataware[.]com

    huntress.com → (opens in a new tab)

  5. The Doorway Botnet: Inside a Large-Scale IoT and Network Device Compromise Campaign (opens in a new tab)

    CloudSEK ·fetched 28 Oct 2026, 15:38 UTC Research agreed2/2

    Why readUncovers 41 GB of operational data from the Doorway IoT botnet, detailing 59 exploit modules and automated credential attacks.

    CloudSEK analyzed exposed operational data from a global botnet targeting IoT devices, surveillance cameras, and servers. The dataset reveals 59 exploit modules and recorded 11,363 device joins in a single hour. The botnet systematically builds proxy infrastructure and automates credential spraying across enterprise and consumer hardware.

    cloudsek.com → (opens in a new tab)

  6. Hackers Infect 953 Online Stores With Scanner-Evading Code (opens in a new tab)

    Infosecurity Magazine ·fetched 28 Oct 2026, 03:38 UTC agreed3/3

    Why readA Magento skimmer loader that fingerprints the requester and serves scanners nothing, hiding in the cms_block table across 953 stores.

    Sansec tracked a JavaScript loader campaign active since July 2025 across five loader domains, with the newest domain registered on 6 October found in CMS blocks on 83 stores, 60 of which had carried an earlier variant. The loader lives in Magento's cms_block database table and fetches instructions at runtime; the server decides whether a request is a real shopper or a security scanner and returns nothing to scanners. Before October the operator used the Keitaro traffic distribution system to pick between payload, redirect and silence per visitor, which explains why periodic external scanning kept coming back clean.

    infosecurity-magazine.com → (opens in a new tab)

  7. Belarusian hackers increasingly acting as proxies for Russia amid war in Ukraine (opens in a new tab)

    The Record ·fetched 28 Oct 2026, 15:38 UTC agreed2/2

    Why readESET details operational convergence between Belarus-aligned group GhostWriter and Russian intelligence, including destructive attacks against Ukrainian manufacturing.

    Research from ESET indicates growing operational alignment between Belarus-linked threat actors and Russian intelligence priorities in Ukraine. Investigators documented an influx of co-aligned campaigns, culminating in a destructive cyberattack against a Ukrainian manufacturing firm in the transportation sector. The activity is primary attributed to GhostWriter, marking an escalation from disinformation toward destructive operational support.

    therecord.media → (opens in a new tab)

  8. RATatouille: Today’s Special: Impersonating Companies in Korea, Payments in Cryptocurrency (opens in a new tab)

    AhnLab ASEC ·ATCP ·fetched 28 Oct 2026, 03:38 UTC Research agreed3/3

    Why readValleyRAT infrastructure tracking surfaced a cluster of fake sites impersonating Korean firms including Doosan Robotics, using invitation codes and cryptocurrency payment flows.

    Pivoting on ValleyRAT infrastructure, AhnLab found sites reusing genuine logos, promotional video and copy from Korean companies such as Doosan Robotics and Cheonjeong to pose as official portals. The sites implement invitation-code registration, login, fee history lookup and VIP tiers, the standard furniture of an investment or task-scam platform, with payment taken in cryptocurrency. The crossover between a known China-nexus RAT's infrastructure and consumer-facing fraud branding is the useful part for anyone tracking either.

    asec.ahnlab.com → (opens in a new tab)

  9. CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies (opens in a new tab)

    CrowdStrike ·Counter Adversary Operations ·fetched 28 Oct 2026, 15:38 UTC agreed2/2

    Why readIntrusions against law firms nearly doubled from 2023 to 2026, driven by eCrime and Chinese state-sponsored actors.

    CrowdStrike's annual threat report on the legal sector documents a near-doubling of cyber intrusions between 2023 and 2026. The findings highlight persistent targeting by eCrime syndicates and state-sponsored adversaries, particularly from China, seeking access to sensitive financial data, M&A communications, and corporate IP.

    crowdstrike.com → (opens in a new tab)

  10. Malicious apps prey on Russians’ anxiety about fuel prices, drone strikes (opens in a new tab)

    The Record ·fetched 28 Oct 2026, 03:38 UTC agreed3/3

    Why readZloyRAT is being delivered through three themed Android lures aimed at Russian drivers: a traffic-police and fuel-station tracker, GosuVPN and Drone Radar.

    F6 researchers report an Android campaign exploiting Russian fuel shortages and drone-strike anxiety, with an app claiming to map police patrols, speed cameras and stations with fuel in stock instead dropping ZloyRAT, which harvests personal and financial data and reaches phone functions. The same trojan ships via GosuVPN, pitched as a free state-backed uncensored-internet service, and Drone Radar, which claims a live attack map. All three are promoted from a single website registered in early October 2026, a useful pivot point for anyone tracking the cluster.

    therecord.media → (opens in a new tab)

  11. Yet Another ClickFix Campaign, (Wed, Oct 28th) (opens in a new tab)

    SANS ISC Diary ·fetched 28 Oct 2026, 19:40 UTC agreed3/3

    Why readFresh indicators for an unnamed ClickFix campaign using a fake Cloudflare verification page that serves both macOS and Windows payloads.

    Observed on 2026-10-28, the lure fingerprints the visitor's OS and presents platform-appropriate paste-and-run instructions behind the familiar fake Cloudflare check. The analyst could not retrieve either payload: the Windows stage returned 403 Forbidden and the macOS distribution domain failed to resolve, so the write-up is URL chain and screenshots rather than malware analysis. Take the indicators for blocklists and hunting; the activity cluster is not yet attributed or named.

    Indicators3
    URLs
    hxxps://js-static[.]cfd/api/s/on hxxps://js-static[.]cfd/embed hxxps://js-static[.]cfd/static/fonts/jetbrains-mono-600[.]woff2

    isc.sans.edu → (opens in a new tab)

  12. US indicts Malaysian national after Madagascar scam operation uncovered (opens in a new tab)

    The Record ·fetched 28 Oct 2026, 03:38 UTC agreed3/3

    Why readDocuments where the industrial scam-compound ecosystem relocated after the Cambodian takedowns, with unusually direct evidence from inside the operation.

    The Justice Department indicted Malaysian national Chui Kok Wa and five co-defendants over a fictitious NFT investment scheme that drained $516,695 from 74 victim wallets across several US states. The indictment places the funding and coordination in China and says the operation moved to Madagascar last year specifically because of law enforcement pressure in Cambodia. An FBI unit that deployed in August obtained access to more than 3,000 devices, which is what let prosecutors tie individual US victim reports to named operators inside the compounds.

    therecord.media → (opens in a new tab)

Vulns & Exploits

12

  1. CVE-2026-46300: Linux Kernel, Linux Kernel Missing Initialization of a Variable Vulnerability (opens in a new tab)

    CISA KEV ·fetched 28 Oct 2026, 23:37 UTC Must read CVE-2026-46300 Exploited in the wild · patch by 2026-10-31 EPSS 10.2% agreed3/3

    Why readKEV addition with a 2026-10-31 federal deadline: a Linux kernel uninitialised-variable bug that chains with the two PHP RCEs to drop webshells and run as root.

    CVE-2026-46300 is a missing variable initialisation in the Linux kernel: the shared-fragment marker is not preserved during socket buffer coalescing, so ESP input processing decrypts shared fragments in place and lets page-cache-backed data be modified unintentionally. CISA lists it as exploited and ties it to chains with CVE-2026-109618 and CVE-2026-109619 that implant PHP webshells and execute commands as root. EPSS is only 0.10 but sits in the 95.6th percentile, and BOD 26-04 patching plus the forensics triage requirements apply with a 31 October due date.

    nvd.nist.gov → (opens in a new tab)

  2. Multiple vulnerabilities in Palo Alto Networks PAN-OS (opens in a new tab)

    translated Multiples vulnérabilités dans Palo Alto Networks PAN-OS (28 octobre 2026)

    CERT-FR (ANSSI) ·fetched 28 Oct 2026, 15:38 UTC CVE-2026-109618 EPSS 100.0% agreed2/2

    Why readPalo Alto Networks PAN-OS contains actively exploited remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.

    CERT-FR warns of multiple remote code execution flaws in Palo Alto Networks PAN-OS, specifically highlighting active exploitation of CVE-2026-109618 and CVE-2026-109619. Security updates address affected versions across PAN-OS 10.2, 11.1, 11.2, and 12.1 releases. Administrators should consult vendor advisories and apply available patches immediately.

    cert.cyber.gouv.fr → (opens in a new tab)

  3. CISA Warns of PHP2Shell Vulnerabilities Actively Exploited in Attacks (opens in a new tab)

    Cybersecurity News ·Abinaya ·fetched 28 Oct 2026, 11:37 UTC Must read CVE-2026-109618 EPSS 100.0% agreed3/3

    Why readCVE-2026-109618 and CVE-2026-109619 (PHP2Shell) are in CISA KEV with confirmed exploitation, EPSS at 0.99999, and a federal remediation deadline of 29 October under BOD 26-04.

    CISA added two PHP flaws to the Known Exploited Vulnerabilities catalog on 26 October after confirming real-world exploitation; together they allow unauthenticated remote code execution on web-facing PHP servers. CVE-2026-109618 is a memory corruption issue where PHP leaves internal request data in an unsafe state after an out-of-memory condition, and CVE-2026-109619 involves PHP retaining references to freed memory through stale internal request state. Federal civilian agencies must patch or pull affected systems by 29 October; everyone else running internet-facing PHP should treat the same deadline as theirs.

    cybersecuritynews.com → (opens in a new tab)

  4. Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges (opens in a new tab)

    The Hacker News ·The Hacker News ·fetched 28 Oct 2026, 07:40 UTC Must read CVE-2026-111497 EPSS 55.5% agreed3/3

    Why readCISA added Adobe Commerce PolyShell (CVE-2026-48356) and the Google Brotli decoder bug (CVE-2026-111497) to KEV, with hundreds of stores already breached.

    CVE-2026-48356 is an unrestricted dangerous-file-upload in Adobe Commerce and Magento (CVSS 9.3) leading to arbitrary code execution; Sansec reports attackers using it to breach hundreds of storefronts and inject a malicious loader. CVE-2026-111497 (CVSS 9.2) is an unchecked return value in Google's Brotli decoder that corrupts adjacent decoder state from a crafted compressed stream, allowing memory disclosure, denial of service or potentially code execution, and exploit traffic is now being seen. Both carry federal remediation deadlines, and the Brotli bug reaches far beyond Magento given how widely the library is embedded.

    Indicators1
    Addresses
    94[.]154[.]43[.]7

    thehackernews.com → (opens in a new tab)

  5. CISA warns of hackers now exploiting critical Node2Shell flaw (opens in a new tab)

    BleepingComputer ·Sergiu Gatlan ·fetched 28 Oct 2026, 11:37 UTC Must read agreed3/3

    Why readCVE-2026-111497, the Brotli out-of-bounds write known as Node2Shell, is in KEV with a federal patch deadline and confirmed in-the-wild exploitation.

    CISA confirmed active exploitation of the Brotli decoder out-of-bounds write and added it to the Known Exploited Vulnerabilities catalog. A crafted Brotli-compressed stream can cause crashes, memory disclosure or remote code execution; it surfaced first in Node.js but reaches any HTTP server or client linking a vulnerable Brotli implementation, and Microsoft shipped an emergency .NET update for a privilege escalation path on Sunday. Inventory everything that decompresses Brotli, not just Node deployments.

    Also covered bySophos Threat Research (opens in a new tab),Cybersecurity News (opens in a new tab),Zscaler ThreatLabz (opens in a new tab).

    bleepingcomputer.com → (opens in a new tab)

  6. ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws (opens in a new tab)

    The Hacker News ·The Hacker News ·fetched 28 Oct 2026, 07:40 UTC CVE-2026-35273 EPSS 96.7% agreed3/3

    Why readThe PeopleSoft bug ShinyHunters has exploited since May is actually three chained flaws, rooted in PeopleSoft trusting its own loopback address, and it is on KEV.

    ZDI's Bobby Gould reports that CVE-2026-35273, patched by Oracle in an out-of-band alert on June 10, bundles three distinct vulnerabilities across two PeopleSoft components. The chain starts from an SSRF that reaches an internal management interface because PeopleTools trusts 127.0.0.1 by default, giving unauthenticated remote code execution on PeopleTools 8.61 and 8.62 at CVSS 9.8. Separate CVEs are still pending, so asset owners tracking only the single June identifier may be underestimating what their patch actually covered.

    thehackernews.com → (opens in a new tab)

  7. U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog (opens in a new tab)

    Security Affairs ·Pierluigi Paganini ·fetched 28 Oct 2026, 11:37 UTC CVE-2026-48356 EPSS 30.6% agreed3/3

    Why readTwo KEV additions with federal patch deadlines: an unrestricted file upload in Adobe Commerce/Magento (CVE-2026-48356, CVSS 9.3) and a memory corruption bug in Google Brotli (CVE-2026-111497, CVSS 9.2).

    CISA added CVE-2026-48356, an unrestricted file upload in Adobe Commerce and Magento allowing arbitrary code execution as the current user, and CVE-2026-111497, an unchecked return value in Google Brotli that lets an unauthenticated attacker corrupt decoder memory via a crafted compressed stream. The Brotli entry is the awkward one: it is a compression library embedded across browsers, web servers and CDNs rather than a single patchable product, so inventory work follows the patch. EPSS on the Magento bug sits at 0.306, in the 98th percentile.

    securityaffairs.com → (opens in a new tab)

  8. Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (opens in a new tab)

    Cisco PSIRT ·fetched 28 Oct 2026, 23:37 UTC agreed3/3

    Why readUnauthenticated remote attackers can bypass peering authentication on Cisco Catalyst SD-WAN Controller, Manager and Validator and gain a high-privileged account with NETCONF access to the whole fabric.

    The peering authentication mechanism in vSmart, vManage and vBond (now Catalyst SD-WAN Controller, Manager and Validator) does not work correctly, so crafted requests let an attacker log in as an internal non-root but high-privileged user. From there NETCONF is reachable, which means configuration control over the SD-WAN fabric itself. Cisco has shipped fixed software and states there are no workarounds, so patching is the only path.

    sec.cloudapps.cisco.com → (opens in a new tab)

  9. Hackers Start Probing Fresh Oracle EBS Vulnerability (opens in a new tab)

    SecurityWeek ·Ionut Arghire ·fetched 28 Oct 2026, 11:37 UTC CVE-2026-101767 EPSS 0.6% agreed3/3

    Why readCVE-2026-101767 in Oracle E-Business Suite is an unauthenticated SQL injection reaching remote code execution, and attackers are already scanning for it.

    Probing has begun against a fresh Oracle EBS flaw that requires no authentication and can be driven to code execution. EPSS currently sits at 0.006, which lags reality when scanning has only just started, and Oracle EBS has a recent history of mass exploitation campaigns against exposed instances. Inventory internet-facing EBS and patch now rather than waiting for the EPSS curve to catch up.

    securityweek.com → (opens in a new tab)

  10. Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws (opens in a new tab)

    SecurityWeek ·Eduard Kovacs ·fetched 28 Oct 2026, 07:40 UTC agreed3/3

    Why readTailscale SSH flaws dubbed Tailworm went public over the weekend with no patch available, so anyone running Tailscale SSH is exposed on disclosed details right now.

    Details of the Tailscale SSH vulnerabilities were released without coordination, ahead of any fix, and Tailscale is now rushing patches. The report does not yet carry CVE identifiers or affected version ranges. Given Tailscale's footprint as a mesh VPN inside corporate and homelab networks alike, treat this as a watch-and-patch item and consider restricting Tailscale SSH until fixed builds ship.

    securityweek.com → (opens in a new tab)

  11. CVE-2026-111103 (CVSS 8.2): Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-con (opens in a new tab)

    NVD ·fetched 28 Oct 2026, 15:38 UTC CVE-2026-111103 CVSS 8.2 EPSS 0.6% agreed2/2

    Why readPatch an HTTP/2 handler flaw in Bandit that allows remote unauthenticated attackers to bypass per-connection request limits.

    Bandit versions 1.9.0 through 1.13.1 contain an error-handling bug in the HTTP/2 frame processor. When a stream error occurs mid-chunk, state rollbacks drop subsequent frame processing without updating connection stream counters, enabling attackers to execute concurrent Plug calls beyond configured limits.

    nvd.nist.gov → (opens in a new tab)

  12. CVE-2026-112345 (CVSS 8.6): TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attac (opens in a new tab)

    NVD ·fetched 28 Oct 2026, 23:37 UTC CVE-2026-112345 CVSS 8.6 EPSS 0.2% agreed3/3

    Why readA hardcoded defaultKey in the TTLock Android app and lock firmware lets anyone in Bluetooth range recover the pairing session key and open the lock, add fingerprints, or create access codes.

    TTLock Android builds before v9.8.260718 and the matching smart-lock firmware embed a static AES key used to protect the per-pairing session key during BLE pairing. An attacker who observes the pairing exchange decrypts that session key with the embedded defaultKey, then forges authenticated BLE requests: unlock, enrol fingerprints, add access codes, and perform administrative actions with no user interaction. TTLock firmware is white-labelled across a large number of consumer and short-let lock brands, so the affected population is far wider than the brand name suggests.

    nvd.nist.gov → (opens in a new tab)

Defense & AppSec

3

  1. This Shit is Hard: Nobody has ever been pwned by Helvetica…or have they? (opens in a new tab)

    Chainguard ·fetched 28 Oct 2026, 19:40 UTC Must read Research agreed3/3

    Why readDocuments a real supply-chain blind spot: every major from-source distro, Chainguard included, ships fonts as prebuilt upstream TTF/OTF blobs verified only by hash.

    A September 2026 audit of Chainguard OS found that of more than 10,000 package definitions, roughly 1% in the OS tier reach upstream as compiled artifacts, and once drivers, partner binaries and deliberately bit-identical Gradle distributions are excluded, fonts are the largest remaining class: 19 source packages, 129 APKs, 2,379 font files and 3.2 million glyphs. Debian, Fedora, Arch, Alpine, openSUSE, Gentoo and NixOS all do the same thing, because fonts fall between the toolchain owners and the content owners and nobody claims them. The argument is that hash-verified binary fonts are an unreviewed input to every desktop and container image, and the audit method is reproducible against your own distro.

    chainguard.dev → (opens in a new tab)

  2. Measuring Users' Security and Privacy Concerns About Third-Party Community Bots on Discord (opens in a new tab)

    arXiv cs.CR (AI) ·Kofi Ampomah, Tu Le ·fetched 28 Oct 2026, 23:37 UTC Research agreed3/3

    Why readPuts numbers on what users actually object to in third-party platform bots, which is useful if you are writing policy for Discord, Slack or Teams app installs.

    Researchers classified 183,142 reviews across 23,102 third-party Discord bots over five years, retaining 8,832 as security and privacy relevant after manual validation of the full classifier-positive set. Data sharing at 30.5 percent and data collection dominate the complaints, which is consistent with the structural problem the paper identifies: one member installs a bot and every other member of the server inherits its access to messages, profiles and metadata. The AI here is method, a distilled DeBERTa classifier, not subject; the finding is that platform app ecosystems have no standard way to surface third-party access to the people affected by it.

    arxiv.org → (opens in a new tab)

  3. Microsoft releases out-of-band Windows fixes with certificate updates (opens in a new tab)

    The Register Security ·fetched 28 Oct 2026, 11:37 UTC agreed3/3

    Why readIf you run Windows devices that cannot reach Microsoft's certificate-update service, this is the release that refreshes their trust list, and it fixes none of October's known breakages.

    Microsoft shipped a non-security out-of-band update for Windows 10, Windows 11 and Windows Server 2025 whose purpose is to refresh the certificate trust list on devices where automatic CTL updates are disabled or the update service is unreachable. Most estate devices will not need it, since the CTL normally arrives through the update service. It rolls up the October 13 content, so the VPN problems, the on-premises Exchange Server change, and the reported Smart App Control, audio and non-admin Remote Desktop oddities all come with it unresolved.

    theregister.com → (opens in a new tab)

AI Security

12

  1. Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness (opens in a new tab)

    arXiv cs.CR (all) ·Igor Shilov, Xiaoxue Yang, Alexander Panfilov, Evgenii Kortukov ·fetched 28 Oct 2026, 03:38 UTC Must read Research agreed3/3

    Why readLearned per-head attention gates cut black-box RL-Hammer attack success on GPT-OSS-20B from 97% to 10% without the utility hit of finetuning defenses.

    Heads of Security enforces instruction-data separation by learning how each attention head should redistribute weight between trusted and untrusted tokens, so a model can reason over injected content without obeying it. Evaluated on Llama-3.3-70B-Instruct and GPT-OSS-20B against SecAlign++ and the architectural defense ASIDE, it holds RL-Hammer to 10% ASR where undefended GPT-OSS-20B reaches 97% and SecAlign 85%, while matching standard utility and agentic injection benchmark performance. The white-box Claudini attack, strengthened against HoS, needs roughly three times the FLOPs to reach equivalent ASR.

    arxiv.org → (opens in a new tab)

  2. Blindfold: Keeping the Audit Coin Secret from LLM Agents (opens in a new tab)

    arXiv cs.CR (AI) ·Wei Zhu, Meiyun Zuo, Huiping Sun ·fetched 28 Oct 2026, 11:37 UTC Must read Research agreed3/3

    Why readShows that audit-based certification of LLM agents silently breaks when the audit sampling decision leaks, and demonstrates the leak through tool-call timing.

    The paper formalises pre-commit noninterference, the requirement that the defender's audit coin not influence the agent's view before an action commits, and proves worst-case certificate bias of (1-ε)D_A against an adaptive agent. On a monitor the authors built, a silent audit changes no output but adds latency visible in tool timestamps, and the agent can deliberately widen that gap; raising the audit rate does not restore validity. Anyone sampling agent actions for compliance assurance should assume the sampling itself is a side channel.

    arxiv.org → (opens in a new tab)

  3. In a pickle: Why every pickle defense in machine learning is bypassed the same way (opens in a new tab)

    Sysdig ·fetched 28 Oct 2026, 19:40 UTC Must read agreed3/3

    Why readExplains why six separate CVE bypasses of PyTorch, Keras and commercial model scanners all exploit the same structural property of pickle, and reports measured detection results against two engines.

    Sysdig's threat research team pulled apart every public pickle bypass on record and found they share one pattern, which is why PyTorch's restricted loader, Keras safe mode and at-rest model scanners each fell to the same class of trick rather than to six independent flaws. The post ranks model formats by danger and reports what happened when the team ran malicious model loads against two detection engines. Takeaway for anyone hosting third-party models: treat scanner verdicts as advisory and put runtime controls around the load, because the static layer is structurally defeatable.

    webflow.sysdig.com → (opens in a new tab)

  4. OpenAI Compaction Flaw Exposed AI Reasoning to Researchers (opens in a new tab)

    Infosecurity Magazine ·fetched 28 Oct 2026, 07:40 UTC Must read agreed3/3

    Why readA technique called compaction smuggling let researchers pull raw chain-of-thought out of OpenAI's frontier models through the API, bypassing the summarisation OpenAI uses to withhold it.

    Xint found that OpenAI's context compaction feature, which compresses long conversations into an encrypted item the user cannot read, could be used to hide one model's reasoning inside a compaction and have a second model return it in the clear. OpenAI confirmed the issue, shipped a fix on 23 October and paid a $6,000 bounty; the research was published on 26 October. The exposure matters because raw reasoning traces, including abandoned approaches, are far better distillation material than final answers, and the same pattern applies to any provider that treats an opaque context blob as trusted.

    infosecurity-magazine.com → (opens in a new tab)

  5. When AI Guardrails Expose Vulnerabilities (opens in a new tab)

    CrowdStrike ·Jonathan Bar Or - D'Angelo Gonzalez ·fetched 28 Oct 2026, 19:40 UTC Research agreed3/3

    Why readA frontier model's refusal to explain a function is itself a vulnerability oracle: CrowdStrike turned guardrail behaviour into a bug-finding signal.

    Researchers asked a model to explain each function in a small C web server; it handled every one except the single function where a max had been swapped for a min, creating an out-of-bounds write. The model never named a vulnerability, but the behavioural change on that chunk of code pinpointed where the bug was, a one-character logic inversion of the kind pattern-matching scanners miss. The technique, guardrail-based vulnerability discovery, inverts safety alignment into a detector and works without the model ever being asked a security question.

    crowdstrike.com → (opens in a new tab)

  6. CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets (opens in a new tab)

    The Hacker News ·The Hacker News ·fetched 28 Oct 2026, 03:38 UTC agreed3/3

    Why readGives you a measured look at where offensive AI tooling actually sits on the autonomy curve, drawn from attacker servers that were left exposed rather than from vendor speculation.

    TrendAI examined three exposed operator environments behind intrusions against Japanese organizations and found a spectrum of AI involvement, from skilled humans using AI as an assistant through to a platform of 44 agents running reconnaissance, exploitation and command and control end to end. One campaign abused CyberStrikeAI, an open-source penetration testing tool previously seen in attacks on Fortinet FortiGate appliances, and the activity is described as distinct from earlier ARTEX-based operations against South Korea and Japan. The captured target lists, logs and command histories are the useful part: they show what these agents actually attempted, not what the frameworks claim they can do.

    thehackernews.com → (opens in a new tab)

  7. Trusting Unsloth’s trust setting could mean executing malicious code (opens in a new tab)

    CSO Online ·fetched 28 Oct 2026, 15:38 UTC CVE-2026-93348 EPSS 0.4% agreed2/2

    Why readCVE-2026-93348 allows arbitrary code execution during Unsloth model loading even when trust_remote_code is disabled.

    Pillar Security disclosed a high-severity arbitrary code execution vulnerability (CVE-2026-93348, CVSS 8.6) in Unsloth's AI model loading mechanism. Unsloth constructs Python import statements directly from configuration model-type values and executes them via Python's exec() function without proper validation. Disabling Hugging Face's trust_remote_code setting does not protect against this vulnerability, allowing crafted model files to steal API keys, tokens, and credentials.

    csoonline.com → (opens in a new tab)

  8. ZDI-26-818: (0Day) Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability (opens in a new tab)

    ZDI Published Advisories ·fetched 28 Oct 2026, 23:37 UTC Research CVE-2026-118619 agreed3/3

    Why readUnpatched path traversal to code execution in Ultralytics, one of the most widely vendored computer vision packages, disclosed as a 0-day after the GitHub report went unanswered.

    CVE-2026-118619 sits in Ultralytics' handling of Google Drive downloads, where a user-supplied path is used in file operations without validation, so a crafted asset can write outside the intended directory and achieve execution in the context of the calling process. Exploitation needs the victim to fetch malicious content, which in practice means a poisoned model or dataset link, a very normal thing for an ML pipeline to do automatically. ZDI reported in August and published in October with no fix available, and the recommended mitigation is to restrict use of the library.

    zerodayinitiative.com → (opens in a new tab)

  9. PrivacyEvalClaw: A Tool-Augmented Deliberative Agent for Auditing Privacy Leakage in LLM Jailbreak Responses (opens in a new tab)

    arXiv cs.CR (AI) ·Krishna Kanth Nakka, Yujun Wang, Shijie Zhou, Tu Nguyen ·fetched 28 Oct 2026, 15:38 UTC Research agreed2/2

    Why readIntroduces a deliberative agent framework that uses tool-augmented analysis to accurately audit indirect privacy disclosures in LLM jailbreak outputs.

    Researchers developed PrivacyEvalClaw, a training-free framework designed to address high evaluator disagreement when detecting privacy leaks in LLM jailbreak responses. The agent dynamically gathers evidence, executes targeted analysis modules, and reconciles conflicting signals to judge contextual or obfuscated disclosures. The tool improves automated red-teaming reliability where single-pass LLM-as-Judge models fail.

    arxiv.org → (opens in a new tab)

  10. The Envelope Layer: An Underestimated Surface of LLM Agent Defense (opens in a new tab)

    arXiv cs.CR (AI) ·Yuelin Han ·fetched 28 Oct 2026, 07:40 UTC Research agreed3/3

    Why readMeasures when wrapping untrusted content in a labelled envelope actually reduces agent hijacking, and shows weak labels can be worse than no label at all.

    Using the A2A-TIBA attack as a test vehicle, the authors run a two-by-two factorial experiment over label strength and envelope authenticity plus a memory condition, scoring results by semantic breach rate with semantic refusal rate as a check. Strong labels reliably cut breach rate when the envelope cannot be forged; once forgery is possible the benefit shrinks and its direction flips between frontends, and prior memory influences outcomes more than label choice. Practical consequence for anyone building agent scaffolds: envelope labelling only helps if the envelope itself is authenticated.

    arxiv.org → (opens in a new tab)

  11. AI Guardrails Aren’t Stopping Criminal Hackers (opens in a new tab)

    WIRED Security ·Lily Hay Newman ·fetched 28 Oct 2026, 07:40 UTC agreed3/3

    Why readConcrete evidence that model guardrails are not holding against ordinary criminal crews, drawn from four live campaigns whose AI tooling was left exposed on the open web.

    CrowdStrike analysed attacks run between May and August by four previously unreported groups operating in Chinese, Spanish and English, Indonesian, and Russian, all of whom built agentic AI into their campaigns and found ways around safety controls. Two of the groups ran sophisticated harnesses, the scaffolding that steers a model through a task; the other two were technically weaker but still compromised multiple targets. Every group left its AI infrastructure reachable on public web servers, which is how researchers recovered the prompts, harnesses, and model choices, mostly Claude variants and open weight DeepSeek builds. This is WIRED's write up of the vendor report rather than the report itself, so treat the detail as secondhand.

    wired.com → (opens in a new tab)

  12. LABScon26 Replay | Keynote: A Sober Analysis of AI Impact (opens in a new tab)

    SentinelLabs ·LABScon ·fetched 28 Oct 2026, 15:38 UTC agreed2/2

    Why readEvaluates current AI capex trends against safety risks like sandbox escapes and model opacity.

    In a keynote address at LABScon 26, Harvard professor James Mickens analyzes the economic and security implications of massive AI investment. He highlights emerging risks including AI model sandbox escapes at OpenAI and growing opacity as parameter counts scale, arguing for a broader focus on security and safety research.

    sentinelone.com → (opens in a new tab)

Governance, Risk & Compliance

6

  1. European digital rights nonprofit noyb sues Scale AI for ‘invasive’ worker surveillance (opens in a new tab)

    The Record ·fetched 28 Oct 2026, 19:40 UTC agreed3/3

    Why readFive GDPR complaints filed in four countries against Scale AI over keystroke and mouse tracking of data-labelling freelancers plus mandatory biometric submission, a template for how AI data-supply pipelines get regulated.

    noyb filed complaints in France, Italy, the Netherlands and Austria alleging Scale AI's Outlier platform records freelancers' clicks and keystrokes every few seconds, collects IP addresses, contact details and unique identifiers, and illegally requires biometric data. Scale has used more than 900,000 workers to produce training data for customers including Google, Meta and OpenAI; Meta owns close to half of Scale. The filings put worker-monitoring inside the AI training-data supply chain squarely in front of four DPAs at once.

    therecord.media → (opens in a new tab)

  2. Court strikes down West Virginia law barring disclosure of public officials’ personal data (opens in a new tab)

    The Record ·fetched 28 Oct 2026, 23:37 UTC agreed3/3

    Why readThe 4th Circuit struck down West Virginia's Daniel's Law analogue on First Amendment grounds, a ruling that narrows how far states can push data brokers to scrub officials' addresses.

    A federal appeals court upheld an August 2025 district court decision voiding West Virginia's version of Daniel's Law, finding it imposes content-based speech restrictions and holds data brokers liable in too many circumstances. The opinion distinguishes West Virginia's statute from similar laws in more than a dozen other states, so the immediate reach is limited, but it gives brokers a template for challenging the rest. Relevant to anyone running executive protection or data-broker removal programmes that assumed these statutes would hold.

    therecord.media → (opens in a new tab)

  3. Politicians in U.S. and E.U. Say Targeted Ads Are a Security Risk (opens in a new tab)

    Citizen Lab ·Anna Mackay ·fetched 28 Oct 2026, 15:38 UTC agreed2/2

    Why readLawmakers in the EU and US are pressing for regulatory action on commercial targeted advertising used to deliver zero-click spyware.

    Following disclosures from Citizen Lab, European Parliament members and US senators are urging regulatory scrutiny into adtech ecosystems. Lawmakers argue that commercial online advertising infrastructure is actively being leveraged by spyware vendors to deliver zero-click exploits to targeted individuals.

    citizenlab.ca → (opens in a new tab)

  4. Privacy Commissioner of Canada to investigate data breach involving Crime Stoppers (opens in a new tab)

    DataBreaches.net ·Dissent ·fetched 28 Oct 2026, 03:38 UTC agreed3/3

    Why readA federal privacy regulator formally taking on a third-party platform provider, which is the part of the breach that will set precedent.

    Privacy Commissioner Philippe Dufresne has opened an investigation into Navigate360, the commercial vendor that runs the tip management platform used by Crime Stoppers chapters across Canada, following a cybersecurity incident involving submitted tips. The Commissioner initiated this himself rather than acting on a complaint, and the target is the processor rather than the chapters that fed it data. Anonymous tip data carries unusual harm potential if attributed, so the outcome is worth watching by anyone operating a vendor platform that holds sensitive submissions on behalf of many small organisations.

    databreaches.net → (opens in a new tab)

  5. ADLC compliance: Mapping agentic development to NIST SSDF, OWASP, and the EU AI Act | Endor Labs (opens in a new tab)

    Endor Labs ·fetched 28 Oct 2026, 07:40 UTC agreed2/3

    Why readA ready made crosswalk for anyone who has to show auditors that agentic coding work sits inside an existing secure development and AI governance regime.

    Endor Labs walks the agentic development lifecycle stage by stage and maps each stage to NIST SSDF practices, the OWASP LLM and Agentic Top 10 risk categories, and EU AI Act obligations, noting the evidence each control expects to see. The value is the mapping artifact itself rather than any new finding, since there is no original research or measurement behind it. Useful if you are standing up governance for AI assisted development and want a starting structure; skip it if your control mapping already exists.

    endorlabs.com → (opens in a new tab)

  6. CyberSN Jobs Report as CIOs and CISOs are Unaccountable and Unprepared for AI - BSW #471 (opens in a new tab)

    Security Weekly ·fetched 28 Oct 2026, 11:37 UTC agreed2/3

    Why readOne usable number for anyone building an AI governance case: only 7 percent of CISOs at large companies own it.

    The leadership segment of this episode covers CyberSN's cybersecurity jobs report through September 2026 alongside a finding that AI governance ownership sits with the CISO at just 7 percent of large companies. The blurb cites the figures without the underlying methodology, sample or definitions, so the 7 percent number is quotable but not yet defensible in a board paper. Useful mainly as a pointer to the primary CyberSN report and as a framing device for the accountability gap between CIO, CISO and whoever actually signs off agentic deployments.

    podcast.securityweekly.com → (opens in a new tab)

Business & Boardroom

12

  1. Japan's GMO urges customers to shut down PCs amid ransomware threat (opens in a new tab)

    BleepingComputer ·Bill Toulas ·fetched 28 Oct 2026, 03:38 UTC Must read agreed3/3

    Why readA major Japanese registrar and VPS host is telling customers to physically power down machines, which is about as severe as a provider-side advisory gets.

    GMO Internet detected an intrusion into Onamae Desktop Cloud on October 20 that may have planted malware on as many as 26,739 customer servers, and the intruder then threatened to detonate ransomware. GMO shut down servers, cut service availability and advised customers to disconnect from the internet and power off; it has since confirmed that both corporate and customer data has been published online. Payment data is said to be unaffected, but MT4 and MT5 trading credentials and account details may be compromised, so anyone with a tenant there should rotate credentials and kill active sessions on the assumption of full host compromise.

    Also covered byInfosecurity Magazine (opens in a new tab).

    bleepingcomputer.com → (opens in a new tab)

  2. China-Linked Cyberattack Forces Tampa’s ConnectWise to Shut Down Services (opens in a new tab)

    Google News: incidents · TBBW ·fetched 28 Oct 2026, 19:40 UTC Must read agreed3/3

    Why readConnectWise has shut down services after a China-linked attack, and anyone whose MSP or internal IT runs its remote-management stack needs to know today.

    ConnectWise, whose remote monitoring and management tooling sits inside thousands of MSPs and their downstream customers, has taken services offline following an attack attributed to China-linked actors. The report reaching us is headline-level only, with no detail on entry vector, affected products or whether customer environments were reached. The supply-chain shape is the point: ConnectWise outages and compromises propagate to every client estate its tooling administers, so confirm your exposure and check for vendor guidance.

    news.google.com → (opens in a new tab)

  3. Boston Scientific Warned You. It Slashed Earnings Guidance After Cyberattack Hit Its Business. (opens in a new tab)

    Google News: incidents · Barron's ·fetched 28 Oct 2026, 11:37 UTC Must read agreed3/3

    Why readBoston Scientific cut earnings guidance because of a cyberattack, turning an incident into a disclosed hit to forecast revenue.

    The medical device maker reduced its earnings guidance after a cyberattack disrupted its business, having previously warned investors of the impact. This is the outcome boards ask about: an incident that moves a public company's numbers rather than just its security posture. Expect the comparison to be raised in medtech and manufacturing risk discussions this week.

    Also covered byWSJ (opens in a new tab).

    news.google.com → (opens in a new tab)

  4. UNM Health ransomware attack disrupts patient care, surgeries (opens in a new tab)

    BleepingComputer ·Bill Toulas ·fetched 28 Oct 2026, 07:40 UTC Must read agreed3/3

    Why readA statewide health system diverted ambulances and suspended outpatient surgery after a cyberattack, the kind of operational impact a healthcare board will ask about this week.

    The University of New Mexico Health Sciences Center disclosed an attack that forced UNM Health to limit new admissions, divert ambulances and cancel outpatient surgeries and appointments from Monday, with health sciences classes cancelled and nonessential staff told to stay home. UNM Hospital, which runs New Mexico's only Level I trauma center and handles over a million patient visits a year, remained open and clinics resumed Tuesday. UNM has not named the attack type or claimed data theft, so the current fact is the continuity impact rather than the actor.

    Also covered byThe Register Security (opens in a new tab),Help Net Security (opens in a new tab),KRQE (opens in a new tab),UNM HSC Newsroom (opens in a new tab).

    bleepingcomputer.com → (opens in a new tab)

  5. Insurance industry fears potential impacts stemming from PHP2Shell (opens in a new tab)

    Cybersecurity Dive ·David Jones ·fetched 28 Oct 2026, 19:40 UTC agreed3/3

    Why readCyber insurers are treating PHP2Shell as a potential systemic-loss event, which is the framing your board and your broker will use when they ask about it this week.

    AM Best and risk analytics firm CyberCube both published this week warning that PHP2Shell, the pair of critical RCE vulnerabilities the PHP Foundation and multiple governments flagged in a language used by over 70% of websites, could trigger the accumulation scenario insurers have long modelled nervously. CyberCube calls it a "watershed moment" for understanding how AI-assisted discovery of software flaws changes aggregate risk. Expect renewal questions, possible model repricing and pressure to evidence PHP patching status across the estate.

    cybersecuritydive.com → (opens in a new tab)

  6. Data breach at Sony-owned internet provider compromises 2.6 million customer records (opens in a new tab)

    Help Net Security ·Sinisa Markovic ·fetched 28 Oct 2026, 11:37 UTC agreed3/3

    Why readThe plaintext-recoverable email passwords for 54,401 accounts, not the 2.58 million record count, is the part that creates downstream credential risk.

    Sony Network Communications has confirmed unauthorized access to the member database of So-net, its Japanese ISP, exposing personal data on more than 2.58 million current and former subscribers. The disclosure also covers email account passwords for 54,401 users, which makes this a credential incident as well as a personal data one. No intrusion detail, dwell time or actor attribution has been published, so the operational read for now is reuse exposure for anyone with a So-net address in their identity estate.

    helpnetsecurity.com → (opens in a new tab)

  7. Belgium's finance and tax agency hit by cyberattack, filing deadlines (opens in a new tab)

    Google News: incidents · Euronews.com ·fetched 28 Oct 2026, 23:37 UTC agreed3/3

    Why readBelgium's federal finance and tax administration was hit by a cyberattack with knock-on effects on filing deadlines, a national-government disruption with a statutory consequence.

    Belgium's finance and tax agency suffered a cyberattack that affected filing deadlines. Only the Euronews headline reached us, so the intrusion method, duration and data impact are unstated. Significant as a European public-sector incident that directly interferes with a legal obligation on taxpayers.

    news.google.com → (opens in a new tab)

  8. Navigate360’s lack of transparency is catching up with them; More organizations tell people NOT to use their tiplines. (opens in a new tab)

    DataBreaches.net ·Dissent ·fetched 28 Oct 2026, 07:40 UTC agreed3/3

    Why readMultiple Ontario Crime Stoppers chapters have suspended use of Navigate360 and US state education departments are jointly pressing it, showing customers abandoning a vendor over incident response rather than over the breach itself.

    Following the Navigate360 breach, Toronto and other Ontario Crime Stoppers organisations have stopped using the tipline platform, and US state education departments are coordinating to demand answers the vendor has not given. The trigger was reporting by Valérie Ouellet and Michelle Allan on exposed Crime Stoppers tip data. The case is a clean example of post-breach opacity costing a vendor its customer base, and a reference point for anyone drafting a disclosure posture.

    databreaches.net → (opens in a new tab)

  9. Cyberattack concealed political spending by big donors before US midterm elections (opens in a new tab)

    Google News: incidents · Reuters ·fetched 28 Oct 2026, 23:37 UTC agreed3/3

    Why readA cyberattack obscured large-donor political spending disclosures ahead of the US midterms, an election-integrity incident a board or comms team will be asked about.

    Reuters reports that a cyberattack concealed political spending by major donors in the run-up to the US midterm elections. The item reached us as a headline with no body text, so the targeted system, the actor and the mechanism are not established here. Worth tracking to the primary Reuters piece given the election-period timing and the disclosure-transparency angle.

    news.google.com → (opens in a new tab)

  10. Times Car reporting ¥5.5 billion loss has firms bracing for data breach fallout (opens in a new tab)

    Google News: incidents · The Japan Times ·fetched 28 Oct 2026, 11:37 UTC agreed3/3

    Why readA ¥5.5 billion loss booked against a single data breach, which is the number peers in the sector will be asked about.

    Times Car has reported a ¥5.5 billion loss tied to its data breach, and other Japanese firms are reportedly preparing for similar fallout. The figure gives a concrete anchor for breach cost modelling in a market where disclosed loss numbers are rare. Short wire coverage with no technical detail on the intrusion.

    news.google.com → (opens in a new tab)

  11. Risky Bulletin: Moldovan public services crippled by cyberattack (opens in a new tab)

    Risky Business News ·fetched 28 Oct 2026, 07:40 UTC agreed3/3

    Why readA European government pulled more than 80 public services offline in response to a single intrusion, which is the clearest recent example of what national-scale containment actually costs.

    Moldova took over 80 public digital services down after a cyberattack, choosing mass service suspension as its containment posture rather than selective isolation. The same bulletin covers a new White House cybersecurity pilot, South Korean arrests in an AI-assisted cybercrime ring, and an Electrum wallet patch for a fund-stealing bug. Treat it as a roundup: the Moldova item is the one with planning value, the rest are tracking notes.

    risky.biz → (opens in a new tab)

  12. Columbia Opens Claims for $16 Million Data Breach Settlement (opens in a new tab)

    Google News: incidents · Bloomberg.com ·fetched 28 Oct 2026, 15:38 UTC agreed2/2

    Why readColumbia University opens claims for a $16 million class action settlement following a major data breach.

    Columbia University has opened the claim process for a $16 million settlement resolving litigation from a past data breach. Eligible affected individuals can receive payouts, marking the final financial resolution of the breach.

    Also covered byColumbia Daily Spectator (opens in a new tab).

    news.google.com → (opens in a new tab)

Ransomware watch

25

Unverified claims posted by extortion groups on their own leak sites, not confirmed breaches. Listing is the group's assertion; many named organisations have not disclosed an incident, and some entries are false or recycled. Leak sites are never linked from here.

Claimed victimGroup SectorCountry Seen
Santiam Hospital & Clinics anubis Healthcare US 28 Oct 2026
Lowenstein Sandler LLP SilentRansomGroup Professional Services US 28 Oct 2026
Cyrious Software pear Technology US 28 Oct 2026
Fortrex Wallstreet Manufacturing US 28 Oct 2026
Morrison Foerster SilentRansomGroup Professional Services US 28 Oct 2026
T... E... SilentRansomGroup - - 28 Oct 2026
S... H... SilentRansomGroup - - 28 Oct 2026
A&B Lab genesis - US 28 Oct 2026
The Anglican International School Global Secret Group Education IL 28 Oct 2026
PQE Group Panzer Professional Services - 28 Oct 2026
L... SilentRansomGroup - - 28 Oct 2026
Noelker and Hull rhysida Professional Services US 28 Oct 2026
Hauhinco payload Manufacturing DE 28 Oct 2026
Marbre Design payload Manufacturing - 28 Oct 2026
Trulife akira Healthcare - 28 Oct 2026
Roberts Consulting Services akira Professional Services - 28 Oct 2026
EWM Group aurora - GB 28 Oct 2026
Insurance Services akira Financial Services - 28 Oct 2026
Femern Link Contractors Barracuda Transportation DK 28 Oct 2026 press coverage (opens in a new tab)
Broadstreet HEOR rhysida Professional Services - 28 Oct 2026
Meleghy Automotive & Cie. GmbH aurora Manufacturing DE 28 Oct 2026
Company #112 N0n - MY 28 Oct 2026
wagyu.xyz unfairness Whitearmor - - 28 Oct 2026
Echo.com Whitearmor Technology DE 28 Oct 2026
Ryder Whitearmor Transportation US 28 Oct 2026
How this edition was made
Candidates fetched
5372
New after deduplication
720
Kept by the panel
173
Published
126
Generated
28 Oct 2026, 23:37 UTC