← All threat briefs

Daily Cybersecurity Brief — 2026-10-28

SECURITY // 2026-10-28

Daily Cybersecurity Brief — 2026-10-28

Threat Intelligence & Malware Analysis

  • Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach — Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand. The reward program opened on October 28 and pays only if a tip helps lead to an... (Source: The Hacker News)
  • Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vul... (Source: The Hacker News)
  • CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets — Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, which analyzed three exposed server environments... (Source: The Hacker News)
  • Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption — The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Rus... (Source: The Hacker News)
  • Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers — A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and c... (Source: The Hacker News)
  • Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento — An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece of code to the store's pages th... (Source: The Hacker News)
  • Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware — Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. "A consistent ... (Source: The Hacker News)
  • Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses — Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform, connects individual alerts into one timeline, and it feeds the defensive system... (Source: The Hacker News)
  • uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts — A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or wh... (Source: The Hacker News)
  • Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations — Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed ... (Source: The Hacker News)
  • Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs — An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environme... (Source: The Hacker News)
  • Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware — A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week. The company caught the attempt on a real customer's machine an... (Source: The Hacker News)
  • PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity — In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws. "What researchers saw was an attack against a European government a... (Source: The Hacker News)
  • External Teams Chats Anchor 15-Minute Malware Delivery — Main bombing sis getting a new look with a wide-scale, ongoing social engineering campaign that might be tied to the Black Basta ransomware gang. (Source: Dark Reading)
  • SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack — A recent Shai-Hulud attack shows defenders need real-time visibility into production code and affected services to respond to supply chain compromises. (Source: Dark Reading)
  • 'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants — The malware's focus on AI tools expands the traditional infostealer playbook to expose a forest of AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint. (Source: Dark Reading)
  • 'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets — An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories. (Source: Dark Reading)
  • Breach victims discover their data was held by companies they’ve never heard of — Nearly seven in ten people affected by data breaches handled by Kroll were exposed through an outside supplier, according to its Data Breach Outlook 2026. Businesses rely on outside providers to store information, process transactions and operate software. A breach at one of t... (Source: Help Net Security)
  • Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support — Threat actors are flooding employees’ inboxes with spam and then contacting them on Microsoft Teams as IT support, offering to fix the problem they created, Arctic Wolf has found. The security company documented more than 400 incidents in which the external chat feature in Tea... (Source: Help Net Security)
  • Tricks from the Past deployed via signed ChatGPT and Claude binaries — Key Points Check Point Research discovered a campaign we track as Yoba where attackers abuse the popularity of AI tools such as ChatGPT and Claude, creating fake GitHub projects that pretend to be desktop applications like GPT-5.6 Sol , GPT-6 Astra , and Claude Opus . The malw... (Source: Check Point Research)
  • 26th October – Threat Intelligence Report — For the latest discoveries in cyber research for the week of 26th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japanese cloud hosting provider Onamae Desktop Cloud has confirmed a cyberattack in which intruders compromised its infrastruct... (Source: Check Point Research)
  • Introducing the Cloudflare PHP Capture the Flag challenge — Last week was one for the Internet security history books. First, eight eMudhra intermediate certificates were compromised , creating the possibility of forged certificates that could be used to impersonate servers. Then came php2shell : serious vulnerabilities in PHP, the run... (Source: Cloudflare Blog (security tag))
  • Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang — On September 8, 2026, we were alerted by a security researcher, Gadi Evron from Knostic , to a tenant isolation issue affecting the GLM-5.3 Workers AI model ( @cf/zai-org/glm-5.3 ) starting on August 27, 2026. We have remediated the issue, and we restored the model on Septembe... (Source: Cloudflare Blog (security tag))
  • Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles — An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements. (Source: Wiz Blog)
  • Varonis' Takeaways from Forrester’s 2026 Email, Messaging, and Collaboration Security Solutions Landscape Report — Forrester published a new report, The Email, Messaging, And Collaboration Security Solutions Landscape, Q4 2026, on October 23. Varonis Interceptor is among Forrester's overview of 26 notable vendors. The report comes at a time when email security is experiencing a fundamental... (Source: Varonis Blog)

Vulnerabilities & Exploits

  • Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits — An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report. The exploits were built in the lab after the model was prompted, not seen in any... (Source: The Hacker News)
  • Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers — A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker ... (Source: The Hacker News)
  • ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws — The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side reque... (Source: The Hacker News)
  • Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads — Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary c... (Source: The Hacker News)
  • Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens — Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Auth... (Source: The Hacker News)
  • CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring sys... (Source: The Hacker News)
  • PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw — PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the ... (Source: The Hacker News)
  • ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More — This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. (Source: The Hacker News)
  • Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes — Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say. An attacker would first need a vulnerable Wasmtime build to comp... (Source: The Hacker News)
  • OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication — OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models. "Based on the current state of alignment research, monitoring systems, and the ... (Source: The Hacker News)
  • So Many AI Security Benchmarks, But None Tell the Whole Story — Measuring AI model security gets complex, fast, thanks to a growing patchwork of benchmarks targeting different variables in the equation. But none replace testing against your own code and workflows. (Source: Dark Reading)
  • In-the-Wild Attack Abuses AI Agents' Trust in Markdown — A new AI agent prompt injection technique exploits how coding assistants consume local instruction files, blurring the line between text documents and executable actions. (Source: Dark Reading)
  • 10 Software Security Practices Built for the Next 250 Years — This Cybersecurity Awareness Month's theme, "Securing the Next 250," asks us to look beyond vulnerabilities and consider what will make our digital systems resilient for generations. (Source: Dark Reading)
  • Bellini Capital CISO on AI security governance and the limits of patching faster — In this Help Net Security interview, Brian Blakley, CISO at Bellini Capital and ConnectSecure, explains why AI makes finding vulnerabilities faster while fixing them still takes time. He argues that “patch faster” is not enough and that teams need to cut exposure while remedia... (Source: Help Net Security)
  • AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records — AbuseBox is a free, open-source tool that checks IP addresses and domains against 60 DNS blacklists, pulls reputation scores from AbuseIPDB, inspects DNS, SSL and email-authentication records, and sends an alert when something changes. A DNS blacklist, or DNSBL, is a list that... (Source: Help Net Security)
  • NIST starts the countdown to retire quantum-vulnerable encryption — The National Institute of Standards and Technology (NIST) has released a roadmap for moving to post-quantum cryptography (PQC), with earlier deadlines for certain sensitive federal systems. The report, Transition to Post-Quantum Cryptography Standards (NIST IR 8547), explains ... (Source: Help Net Security)
  • Brotli bug reaches far beyond Node.js (CVE-2026-111497) — A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. About CVE-2026-111497 Alternatively known as “Node2Shell”, “Broccoli2Shell” and “Brotli2Shell”, CVE-2026-111497 is a remotely exploitable out-of-bound... (Source: Help Net Security)
  • PHP2Shell: Exploitation Attempts and Remediation Trends — Wiz research has been monitoring PHP2Shell exploitation attempts, but none have succeeded so far. We examine the techniques used, what prevented the attacks from completing and how observed exposure has changed since disclosure. (Source: Wiz Blog)
  • Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability — Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution. (Source: Wiz Blog)

AI/ML Security

  • AI-Generated Fake Login Pages Are Making Account Takeovers Easier — Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations. Some fake login pages go beyon... (Source: The Hacker News)
  • OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections — OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service norma... (Source: The Hacker News)
  • 3 Frameworks to Protect CISOs & Orgs Against AI Liability — Cyber leaders can get ahead of AI liability with rigorous documentation, transparency, and smart contract negotiations with AI vendors. (Source: Dark Reading)
  • Beware the Slasher: AI Could Kill Off Cybersecurity Pros' Skills — Nathan Hamiel outlines potential SecOps horror in the AI midst, as core technical capabilities go the way of reading an atlas or remembering phone numbers. (Source: Dark Reading)
  • Risks & Rewards: How AI Is Redefining the CISO's Role — Nvidia security executive Mark Weatherford says CISOs must help business leaders weigh AI's pros and cons, and ensure those deploying it own the risks. (Source: Dark Reading)
  • Socure links AI agents to verified people and businesses — Socure has launched Agent Intelligence, a suite that detects AI agents, scores whether they should be trusted, and ties each agent to the verified person or business that authorized it. Agent Intelligence includes three layers in one platform designed to go beyond simple Know ... (Source: Help Net Security)
  • DNSFilter LUMINATE unifies DNS security, AI controls and remote work protection — DNSFilter has launched LUMINATE by DNSFilter, a security platform that allows organizations to deliver five security solutions from one agent, one console and one policy. Shadow AI is now one of the fastest-growing risks in business. Employees are adopting AI tools and agents ... (Source: Help Net Security)
  • FireMon Agentic AI helps teams investigate access and prepare policy changes — FireMon has announced FireMon Agentic AI, changing how enterprises investigate network access, make policy decisions, and prepare security changes. Built into FireMon’s network security management solutions, the new agentic AI capabilities makes agents first-class citizens alo... (Source: Help Net Security)

Cloud & Infrastructure Security

  • GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption — The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-... (Source: The Hacker News)
  • Sekoia introduces self-hosted deployment for organizations with strict data controls — Sekoia has introduced Sekoia Self-Hosted, a deployment model that brings the Sekoia SOC platform into the customer’s own infrastructure. Designed for large organizations, including government agencies, defense organizations, critical infrastructure operators and highly regulat... (Source: Help Net Security)

Law Enforcement & Takedowns

  • FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering — The U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine. The move was in response to the service being used to commit and facilitate prolific criminal activity, including "the adver... (Source: The Hacker News)
  • Third Serengeti Sweep Tops 1,400 Arrests as Investigations Mature — Interpol's annual Operation Serengeti, now on its third iteration, led to 1,462 arrests across 20 African countries and the US, recovering $105 million in stolen funds. (Source: Dark Reading)

IoT & OT Security

  • Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key — An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a ... (Source: The Hacker News)
  • Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses — The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuratio... (Source: The Hacker News)
  • The Pwn Request Reckoning: What Still Works Against GitHub Actions — GitHub's 2026 Actions changes make pull_request_target attacks harder, but not impossible. Here's the residual attack surface and how to audit for it. (Source: Wiz Blog)