Every ThreatRoundup story: what happened, what it means for you, and what defenders should do. https://threatroundup.com/feeds/roundup.atom 2026-10-29T20:13:09+00:00 ThreatRoundup.comhttps://threatroundup.com/ © 2026 ThreatRoundup.com https://threatroundup.com/wp-content/themes/tr/assets/icons/favicon.svg https://threatroundup.com/news/m365-revoke-sessions-graph-ews-90-minutes/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:48+00:00 ThreatRoundup.com

Eye Security found that revoking sessions or resetting a password leaves Graph, EWS and ActiveSync mail access open for up to 90 minutes; only disabling the account cuts it off immediately.

ThreatRoundup.com Eye Security Medium 4 0 https://threatroundup.com/news/edk2-pxe-uefi-flaw-cve-2026-97631/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:48+00:00 ThreatRoundup.com

CVE-2026-97631, a 9.5-rated overflow in EDK II's PXE driver dating to 2010, can let someone on the local network run code before Secure Boot on network-booting machines. Firmware updates are still pending.

ThreatRoundup.com The Hacker News Critical 0 1 https://threatroundup.com/news/sony-so-net-isp-breach-2-5-million/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:48+00:00 ThreatRoundup.com

Sony Network Communications says an Oct. 19 intrusion exposed 2.59 million So-net and Docomo Hikari customer records, plus 54,401 email addresses with passwords. No card data was taken.

ThreatRoundup.com BleepingComputer High 0 0 https://threatroundup.com/news/cyberdakait-android-banking-trojans-india/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:47+00:00 ThreatRoundup.com

Group-IB tracked seven Android trojan families behind fake bank 'protection plan' calls in India: nearly 18,000 phones infected and 7.6 million texts, including OTPs, intercepted.

ThreatRoundup.com Group-IB High 5 0 https://threatroundup.com/news/skyw4lker-device-code-phishing-m365/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:50+00:00 ThreatRoundup.com

ANY.RUN tracked the SkyW4lker kit across 173 domains: password-protected lures send Microsoft 365 users to the real device login page, where one typed code hands the attacker a token.

ThreatRoundup.com ANY.RUN High 5 0 https://threatroundup.com/news/qilin-ransomware-acronis-esxi-deep-dive/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:50+00:00 ThreatRoundup.com

Acronis TRU dissects Qilin's Rust encryptor, its password gate and the PowerShell routine that resets ESXi root passwords and encrypts every host, as the gang passes 900 claimed victims in 2026.

ThreatRoundup.com Acronis TRU High 6 0 https://threatroundup.com/news/yoba-fake-chatgpt-claude-installers-sideloading/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:50+00:00 ThreatRoundup.com

Check Point's Yoba campaign pairs genuine signed OpenAI and Anthropic installers with a sideloaded DLL on fake GitHub AI-app pages, installing a hidden XMRig miner via a Telegram-seeded DGA.

ThreatRoundup.com Check Point Research High 6 0 https://threatroundup.com/news/vmware-esx-logging-zero-day-warp-panda-kev/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:49+00:00 ThreatRoundup.com

CrowdStrike says China-nexus Warp Panda used CVE-2026-41709, a VMware ESX insufficient-logging flaw, as a zero-day against US law firms. CISA added it to KEV with a Nov. 11 deadline.

ThreatRoundup.com The Hacker News High 0 1 https://threatroundup.com/news/volt-typhoon-silent-train-zero-days-lumen/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:49+00:00 ThreatRoundup.com

Lumen ties Volt Typhoon's Silent Train covert network to zero-days in N-able, Cisco SD-WAN, VeloCloud and likely Quest KACE, while Cisco Talos details KeyDrift malware stealing SD-WAN keys.

ThreatRoundup.com Lumen Black Lotus Labs Critical 6 1 https://threatroundup.com/news/cisco-asa-ftd-vpn-dos-cve-2026-76418/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:49+00:00 ThreatRoundup.com

Cisco says attackers are exploiting CVE-2026-76418, an unauthenticated bug in the ASA and FTD SSL VPN that forces the firewall to reboot when secondary authentication is configured.

ThreatRoundup.com The Hacker News Critical 0 1 https://threatroundup.com/news/magento-cms-block-loader-953-stores/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:54+00:00 ThreatRoundup.com

Sansec found a JavaScript loader in Magento CMS blocks on 953 stores since July 2025; the newest version fingerprints visitors so scanners see nothing, and PolyShell is the main way in.

ThreatRoundup.com Sansec High 0 2 https://threatroundup.com/news/aokigahara-infostealer-ai-coding-tools/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:54+00:00 ThreatRoundup.com

Check Point says the new Aokigahara infostealer has a dedicated module for AI assistant and coding-tool sessions, plus cloud configs, SSH keys, browsers and crypto wallets.

ThreatRoundup.com Check Point Research Medium 6 0 https://threatroundup.com/news/engie-france-customer-data-partner-marketing-tool/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:53+00:00 ThreatRoundup.com

ENGIE says attackers stole French customers' contact details and contract and meter numbers from a partner marketing platform; no banking data, and its own systems weren't hit.

ThreatRoundup.com BleepingComputer Medium 0 0 https://threatroundup.com/news/dreamhost-forced-password-resets-incident/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:53+00:00 ThreatRoundup.com

DreamHost is forcing email, FTP and SFTP password resets in an ongoing incident and telling owners to remove unknown forwarding rules, but hasn't said what happened.

ThreatRoundup.com BleepingComputer High 0 0 https://threatroundup.com/news/teams-fake-it-support-quick-assist-ransomware/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:56+00:00 ThreatRoundup.com

Arctic Wolf has seen more than 400 incidents where attackers mail-bomb a user, pose as IT on Microsoft Teams and get remote access via Quick Assist, a path to Black Basta, Cactus and Chaos ransomware.

ThreatRoundup.com Arctic Wolf High 0 0 https://threatroundup.com/news/dahua-cameras-hijacked-ukraine-p2p-cert-ua/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:56+00:00 ThreatRoundup.com

CERT-UA warns attackers are hijacking Dahua cameras and recorders in Ukraine through Easy4IP P2P access, guessable serials, weak passwords and old auth-bypass bugs.

ThreatRoundup.com The Hacker News High 0 2 https://threatroundup.com/news/asd-amadey-botnet-180000-disconnected/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:56+00:00 ThreatRoundup.com

Australia's ASD broke into an Amadey malware control panel and disconnected it from about 180,000 infected computers. Data already stolen is still out there.

ThreatRoundup.com The Hacker News Medium 0 0 https://threatroundup.com/news/unm-health-cyberattack-ambulance-diversion/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:55+00:00 ThreatRoundup.com

A cybersecurity incident forced UNM Health to divert ambulances from New Mexico's only Level 1 trauma center and cancel appointments at more than 30 clinics. The FBI is assisting.

ThreatRoundup.com SecurityWeek (AP) High 0 0 https://threatroundup.com/news/gmo-onamae-desktop-cloud-trading-accounts-extortion/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:55+00:00 ThreatRoundup.com

GMO Internet says an attacker who breached Onamae.com Desktop Cloud used stolen logins to trade in customers' brokerage accounts and is now demanding money. GMO won't pay.

ThreatRoundup.com GMO Internet Group High 0 0 https://threatroundup.com/news/apple-ios-18-7-11-coregraphics-zero-day-backport/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:55+00:00 ThreatRoundup.com

iOS and iPadOS 18.7.11 backport Apple's fix for CVE-2026-86950, a CoreGraphics zero-day Apple says may have been exploited against targeted individuals, to the iPhone XS, XR and older iPads.

ThreatRoundup.com BleepingComputer Critical 0 1 https://threatroundup.com/news/fbi-midterm-campaign-donation-scams/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:57+00:00 ThreatRoundup.com

The FBI warns of midterm scams promising guaranteed returns on campaign donations, fake PACs that keep the money, merchandise that never ships and fake voter-registration pages.

ThreatRoundup.com MoneyWise Info 0 0 https://threatroundup.com/news/tailworm-tailscale-ssh-root-flaws/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:57+00:00 ThreatRoundup.com

Cyberdione Labs' Tailworm report says flaws in Tailscale SSH's root-run forwarding let a permitted SSH user reach root-only sockets. Tailscale calls the issues serious and targets a patched client by Oct. 27.

ThreatRoundup.com Cyberdione Labs (Tailworm) High 0 0 https://threatroundup.com/news/gheist-github-tokens-actions-logs-secrets/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:57+00:00 ThreatRoundup.com

Wiz says the Gheist campaign used stolen GitHub tokens to plant 13,500+ branches across 850+ accounts, each running a workflow that dumps repository secrets into Actions logs and deletes the run.

ThreatRoundup.com Wiz High 0 0 https://threatroundup.com/news/m365-token-replay-97-accounts-huntress/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:57+00:00 ThreatRoundup.com

Huntress tracked a campaign that replayed stolen Microsoft 365 sign-in tokens to take over 97 accounts at 79 organizations, then planted rogue Entra devices, swapped MFA methods and hid payroll mail.

ThreatRoundup.com Huntress High 6 0 https://threatroundup.com/news/fortinet-ai-found-flaws-patch-before-cves/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:56+00:00 ThreatRoundup.com

Fortinet patched critical flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator found by AI-assisted review, but won't publish CVEs until Nov. 10. Australia's ACSC says patch urgently.

ThreatRoundup.com Cyber Daily High 0 0 https://threatroundup.com/news/nefilim-hive-affiliate-stryzhak-70-months/ 2026-10-28T22:28:00+00:00 2026-10-29T20:12:51+00:00 ThreatRoundup.com

Artem Stryzhak, a Ukrainian affiliate who rented Nefilim and Hive ransomware to hit companies, law firms, a dental office and a healthcare provider, was sentenced to 70 months in US prison.

ThreatRoundup.com BleepingComputer Info 0 0 https://threatroundup.com/news/trust-graft-wordpress-admin-plugin-backdoor/ 2026-10-28T22:28:00+00:00 2026-10-29T20:12:52+00:00 ThreatRoundup.com

Securonix found JavaScript on hijacked sites that uses a logged-in WordPress admin's session to install a backdoored plugin that persists in mu-plugins and hides from the plugin list.

ThreatRoundup.com Securonix Medium 5 0 https://threatroundup.com/news/silent-ransom-group-leak-law-firms/ 2026-10-28T22:28:00+00:00 2026-10-29T20:12:52+00:00 ThreatRoundup.com

Ransom-ISAC's analysis of leaked Silent Ransom Group files shows callback-phishing extortion of mostly US law firms via AnyDesk, with at least $43.95 million confirmed received.

ThreatRoundup.com Ransom-ISAC High 4 0 https://threatroundup.com/news/convertr-plausible-magecart-checkout-skimmer/ 2026-10-28T22:28:00+00:00 2026-10-29T20:12:51+00:00 ThreatRoundup.com

Sansec says a Brazilian Magecart group planted a card skimmer in the Plausible analytics script every Convertr store loads, exposing checkouts at dozens of fashion brands Oct. 24 to 27.

ThreatRoundup.com Sansec High 4 1 https://threatroundup.com/news/microsoft-authenticator-android-authmask-token-theft/ 2026-10-28T22:28:00+00:00 2026-10-29T20:12:51+00:00 ThreatRoundup.com

Enclave's AuthMask bug let any Android app get work-account Microsoft Graph tokens from Authenticator by posing as Teams; Microsoft fixed it in 6.2606.4246 and says it wasn't exploited.

ThreatRoundup.com Enclave High 0 1 https://threatroundup.com/news/cisa-kev-polyshell-node2shell-exploit-traffic/ 2026-10-28T22:28:00+00:00 2026-10-29T20:12:51+00:00 ThreatRoundup.com

CISA added Adobe Commerce's PolyShell and the Brotli Node2Shell bug to its exploited-vulnerabilities list, due Nov. 10, as ELLIO logged the first Node2Shell exploit traffic.

ThreatRoundup.com The Hacker News Critical 0 2 https://threatroundup.com/news/php2shell-hunt-io-open-directory-iocs/ 2026-10-27T15:08:00+00:00 2026-10-29T20:13:01+00:00 ThreatRoundup.com

Hunt.io combed about ten attacker open directories full of PHP2Shell tooling and a Mirai-style botnet, and published attempt signatures and indicators defenders can search for today.

ThreatRoundup.com Hunt.io Critical 0 2 https://threatroundup.com/news/cyfirma-dprk-php2shell-staging/ 2026-10-27T15:07:00+00:00 2026-10-29T20:13:00+00:00 ThreatRoundup.com

CYFIRMA says Korean-speaking operators are quietly scanning 216 unpatched PHP hosts at governments, banks and logistics firms, with a moderate-confidence Lazarus link.

ThreatRoundup.com CYFIRMA Critical 0 2 https://threatroundup.com/news/oracle-java-emergency-update-emudhra-cve-2026-91403/ 2026-10-27T15:06:00+00:00 2026-10-29T20:12:59+00:00 ThreatRoundup.com

Oracle's out-of-band CVE-2026-91403 fix (CVSS 9.1) stops Java trusting eight eMudhra intermediate certificates with weak keys; a second update, CVE-2026-114820, removes the related roots.

ThreatRoundup.com Cyber Security News Critical 0 2 https://threatroundup.com/news/k0t-network-edge-intrusions-group-ib/ 2026-10-27T15:05:00+00:00 2026-10-29T20:13:02+00:00 ThreatRoundup.com

Group-IB and NyxLab say actor k0t exploited exposed FortiWeb, FortiGate and GlobalProtect devices through 2026, reached domain admin, and stole more than 70,000 credentials, likely as an initial access broker.

ThreatRoundup.com Group-IB High 0 5 https://threatroundup.com/news/node2shell-nodejs-brotli-rce-demo/ 2026-10-27T15:04:00+00:00 2026-10-29T20:13:02+00:00 ThreatRoundup.com

Imperva ran attacker code on an official Node.js 24.22.0 image by feeding it crafted Brotli data, through fetch() responses or Express 5 body parsers. Patch Node.js and rebuild images.

ThreatRoundup.com The Hacker News High 0 1 https://threatroundup.com/news/blackx-uefi-bootkit-baton-drop/ 2026-10-27T15:03:00+00:00 2026-10-29T20:13:02+00:00 ThreatRoundup.com

Kaspersky found BlackX, a UEFI bootkit used against Central Asian diplomats that bypasses Secure Boot via Baton Drop because Microsoft's revocation step was never applied. Medium-confidence link to APT41.

ThreatRoundup.com Kaspersky Securelist High 0 1 https://threatroundup.com/news/quest-diagnostics-patient-records-breach/ 2026-10-27T15:02:00+00:00 2026-10-29T20:13:00+00:00 ThreatRoundup.com

Quest Diagnostics says an intruder reached patient records through its Quanum Lab Services Manager platform. It hasn't said how many people are affected.

ThreatRoundup.com SecurityWeek (Associated Press) High 0 0 https://threatroundup.com/news/wiz-artex-storm-0940-expands-targeting/ 2026-10-27T15:01:00+00:00 2026-10-29T20:13:01+00:00 ThreatRoundup.com

Wiz says ARTEX AI agents tied to Storm-0940 spent October probing IT and software vendors' Okta, Entra ID and Cognito sign-ins. Most attempts failed.

ThreatRoundup.com Wiz Research High 0 0 https://threatroundup.com/news/popcorn-time-updater-rce-disabled/ 2026-10-27T15:00:00+00:00 2026-10-29T20:13:01+00:00 ThreatRoundup.com

Eye Security found Time4Popcorn's abandoned updater would run any file as SYSTEM or root, registered its domain and used it to switch the updater off. Android users remain exposed.

ThreatRoundup.com BleepingComputer High 0 1 https://threatroundup.com/news/loblaw-breach-2-million-credit-monitoring/ 2026-10-27T14:59:00+00:00 2026-10-29T20:12:58+00:00 ThreatRoundup.com

Loblaw's CEO has apologized to about two million customers whose names, addresses, birthdates and purchase details were taken in a February breach, and is offering two years of TransUnion monitoring.

ThreatRoundup.com CBC News High 0 0 https://threatroundup.com/news/asus-router-firmware-cve-2026-93489/ 2026-10-27T14:58:00+00:00 2026-10-29T20:12:59+00:00 ThreatRoundup.com

Asus fixed three High-rated router flaws, including CVE-2026-93489 (CVSS 8.7), that let someone on your network act as admin without a password. No attacks reported yet.

ThreatRoundup.com Notebookcheck High 0 3 https://threatroundup.com/news/litellm-leaked-master-key-release-hijack/ 2026-10-27T14:57:00+00:00 2026-10-29T20:12:58+00:00 ThreatRoundup.com

LiteLLM says a master key leaked on GitHub in May and never revoked let an attacker steal maintainer tokens and ship a backdoored 1.107.0 to PyPI, Docker Hub and GHCR.

ThreatRoundup.com The Hacker News High 0 0 https://threatroundup.com/news/amazon-clickfix-finger-malware/ 2026-10-27T14:56:00+00:00 2026-10-29T20:13:02+00:00 ThreatRoundup.com

Huntress says a sponsored Google result led to a fake Amazon login and a ClickFix CAPTCHA that used finger.exe to install the Lumma infostealer and NetSupport remote access.

ThreatRoundup.com Huntress Medium 0 0 https://threatroundup.com/news/keystealth-device-code-phishing-kit/ 2026-10-27T14:55:00+00:00 2026-10-29T20:13:03+00:00 ThreatRoundup.com

ADAMnetworks details how a device code phishing kit let an operator register rogue Entra devices, sit in a company's Microsoft 365 account for seven weeks and attempt payment fraud.

ThreatRoundup.com ADAMnetworks Medium 0 0 https://threatroundup.com/news/prince-of-persia-iran-apt-us-c2/ 2026-10-27T14:54:00+00:00 2026-10-29T20:13:00+00:00 ThreatRoundup.com

Semperis says Iran-linked Prince of Persia (Infy) rebuilt its infrastructure after a February exposure and is now running a Tornado C2 server in the US for the first time in a decade.

ThreatRoundup.com Semperis Medium 0 0 https://threatroundup.com/news/etherrat-teams-fake-it-support-ethereum-c2/ 2026-10-27T14:53:00+00:00 2026-10-29T20:12:59+00:00 ThreatRoundup.com

A Teams caller posing as IT talks victims into installing remote-access tools, then drops EtherRAT, a Node.js backdoor that looks up its command server in an Ethereum smart contract.

ThreatRoundup.com bluecyber.hashnode.dev Medium 0 0 https://threatroundup.com/news/vbscript-malware-brazil-portugal-trusted-tools/ 2026-10-27T14:52:00+00:00 2026-10-29T20:12:59+00:00 ThreatRoundup.com

WatchGuard details three Brazil-linked campaigns, Overlord RAT, Lampion and a newdev.dll RAT, that start with VBScript and lean on built-in Windows tools and signed programs to stay hidden.

ThreatRoundup.com WatchGuard Medium 0 0 https://threatroundup.com/news/johns-hopkins-bayview-patient-data-ai-tool/ 2026-10-27T14:51:00+00:00 2026-10-29T20:12:58+00:00 ThreatRoundup.com

Johns Hopkins Bayview is notifying 3,182 patients after an employee uploaded a spreadsheet of their records, including medications and record numbers, to an unapproved public AI tool.

ThreatRoundup.com Hoodline Medium 0 0 https://threatroundup.com/news/php2shell-exploited-before-disclosure-madpot/ 2026-10-22T11:31:00+00:00 2026-10-29T20:13:03+00:00 ThreatRoundup.com

Amazon says a PHP2Shell exploit hit its MadPot honeypots on Oct. 17, four days before PHP disclosed CVE-2026-109618 and CVE-2026-109619. It now calls exploitation broad.

ThreatRoundup.com Amazon Threat Intelligence (AWS Security Blog) Critical 7 2 https://threatroundup.com/news/storm-0940-artex-connectwise-supply-chain/ 2026-10-22T11:30:00+00:00 2026-10-29T20:13:03+00:00 ThreatRoundup.com

Microsoft ties the ConnectWise Cloud Backup supply-chain attack to China-aligned Storm-0940, which used ARTEX AI agents to try sign-ins to more than 2,250 Microsoft 365 tenants at up to 2,900 a minute.

ThreatRoundup.com Microsoft Threat Intelligence Critical 7 0 https://threatroundup.com/news/gitlab-cvss-10-unauthenticated-rce/ 2026-10-22T11:29:00+00:00 2026-10-29T20:13:04+00:00 ThreatRoundup.com

GitLab fixed CVE-2026-110264, a CVSS 10.0 flaw in its bundled Ruby regex engine that could let unauthenticated attackers run code on self-managed servers as old as version 7.0. No exploitation seen yet, and no workaround.

ThreatRoundup.com The Hacker News Critical 0 4 https://threatroundup.com/news/cisa-safepay-ransomware-advisory-aa26-293a/ 2026-10-22T11:28:00+00:00 2026-10-29T20:13:04+00:00 ThreatRoundup.com

A joint FBI, CISA and USSS advisory says SafePay ransomware has hit at least 600 victims since August 2024, getting in through stolen or guessed VPN logins and old Cisco ASA, SonicWall and Veeam flaws, then wiping backups before it encrypts.

ThreatRoundup.com CISA High 9 5 https://threatroundup.com/news/nodejs-brotli-decoder-rce/ 2026-10-22T11:27:00+00:00 2026-10-29T20:13:04+00:00 ThreatRoundup.com

Node.js fixed an out-of-bounds write in its bundled Brotli decoder (CVE-2026-111497) that it says could allow remote code execution on 22.x, 24.x and 26.x. End-of-life versions get no patch.

ThreatRoundup.com The Hacker News High 0 10 https://threatroundup.com/news/lazarus-operation-flashhole/ 2026-10-22T11:26:00+00:00 2026-10-29T20:13:04+00:00 ThreatRoundup.com

Kaspersky says Lazarus abused South Korea's mandatory INISAFE CrossWeb EX security plug-in to break into at least three firms, using fake résumé sites, GitHub-based C2 and a post-quantum key exchange.

ThreatRoundup.com Kaspersky Securelist High 9 0 https://threatroundup.com/news/papercut-attacker-ai-toolkit-second-rce/ 2026-10-22T11:25:00+00:00 2026-10-29T20:13:05+00:00 ThreatRoundup.com

Hunt.io found the PaperCut mass-exploitation crew's AI agent prompts, exploit variants, credential stealers and victim access kits on an open server, plus a second RCE route through the XML-RPC API.

ThreatRoundup.com Hunt.io High 0 2 https://threatroundup.com/news/slaiclind-clickfix-etherhiding/ 2026-10-22T11:24:00+00:00 2026-10-29T20:13:05+00:00 ThreatRoundup.com

Stormshield says hacked WordPress sites read C2 addresses from a Polygon smart contract, then show Windows visitors a fake Cloudflare check that leads to a stealer loaded through the Deno runtime.

ThreatRoundup.com Stormshield Medium 7 0 https://threatroundup.com/news/vasilek-backdoor-vmware-tools-russian-healthcare/ 2026-10-22T11:23:00+00:00 2026-10-29T20:13:05+00:00 ThreatRoundup.com

Solar 4RAYS says Partisan Zmiy spent about two years in a Russian healthcare network, hiding the Telegram-controlled Vasilek backdoor and a fake service in an unmonitored VMware Tools directory.

ThreatRoundup.com The Hacker News Medium 0 0 https://threatroundup.com/news/russian-hackers-wipe-ukrainian-grain-firm/ 2026-10-22T11:22:00+00:00 2026-10-29T20:13:05+00:00 ThreatRoundup.com

ESET says UAC-0099 phished into a Ukrainian grain logistics company and handed access to Sandworm, which wiped data, while a new Go backdoor hid its C&C inside the Yggdrasil mesh network.

ThreatRoundup.com The Record Medium 6 0 https://threatroundup.com/news/africa-cybercrime-networks-disrupted/ 2026-10-22T11:21:00+00:00 2026-10-29T20:13:06+00:00 ThreatRoundup.com

An Interpol-led operation across 21 countries arrested 1,462 suspects, dismantled 10,909 malicious networks and recovered more than $105 million from BEC, scam and ransomware crews, BleepingComputer reports.

ThreatRoundup.com BleepingComputer Medium 0 0 https://threatroundup.com/news/chrome-gemini-scam-detection-clickfix/ 2026-10-22T11:20:00+00:00 2026-10-29T20:13:06+00:00 ThreatRoundup.com

Chrome's Enhanced Protection now checks copied commands for ClickFix scams, uses server-side Gemini to spot scam pages, and adds a softer suspicious-site warning.

ThreatRoundup.com BleepingComputer Info 0 0 https://threatroundup.com/news/pan-os-cve-2026-0257-qilin-inc-mfa-bypass/ 2026-10-21T12:47:44+00:00 2026-10-29T20:13:07+00:00 ThreatRoundup.com

Unit 42 says the Qilin and INC ransomware groups are using CVE-2026-0257, a GlobalProtect authentication bypass patched in May, to open VPN sessions without MFA and then move on to vCenter, ESXi and Veeam.

ThreatRoundup.com The Hacker News Critical 0 2 https://threatroundup.com/news/plex-media-server-exploited-cryptominer/ 2026-10-21T12:46:44+00:00 2026-10-29T20:13:07+00:00 ThreatRoundup.com

Attackers are chaining four Plex Media Server bugs, now on CISA's exploited list, to drop a cryptominer and a traffic-relay proxy on servers that never got September's fix.

ThreatRoundup.com boredhackerblog Critical 0 4 https://threatroundup.com/news/netscaler-cve-2026-88771-88779-chained-intrusions/ 2026-10-21T12:45:44+00:00 2026-10-29T20:13:07+00:00 ThreatRoundup.com

Rapid7 details intrusions where attackers chained CVE-2026-88771 and CVE-2026-88779 to get root on NetScaler ADC and Gateway, then planted HA-aware persistence and stole the appliance's credentials and keys.

ThreatRoundup.com Rapid7 Critical 0 2 https://threatroundup.com/news/php-cve-2026-109618-109619-critical-rce/ 2026-10-21T12:44:44+00:00 2026-10-29T20:13:07+00:00 ThreatRoundup.com

PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21 to fix two critical bugs nicknamed php2shell, after details leaked early. Updated Oct. 25: Amazon says both bugs are now broadly exploited.

ThreatRoundup.com BleepingComputer Critical 0 2 https://threatroundup.com/news/ovhcloud-cli-glassworm-backdoor/ 2026-10-21T12:43:44+00:00 2026-10-29T20:13:07+00:00 ThreatRoundup.com

An attacker used a hijacked developer account to swap the binaries on five OVHcloud CLI releases for a build that steals cloud keys, SSH keys and AI-tool data. OVHcloud ties it to GlassWorm and says about 250 downloads happened in the 94-minute window.

ThreatRoundup.com OpenSourceMalware High 0 0 https://threatroundup.com/news/rank-math-seo-plugin-backdoor/ 2026-10-21T12:42:44+00:00 2026-10-29T20:13:08+00:00 ThreatRoundup.com

Rank Math PRO 3.0.123, served from the vendor's own site for about 11 hours on Oct. 15-16, carried a backdoor that creates hidden admins and rebuilds itself. Updating alone doesn't clean it.

ThreatRoundup.com BleepingComputer High 0 0 https://threatroundup.com/news/connectwise-cloud-backup-supply-chain-attack/ 2026-10-21T12:41:44+00:00 2026-10-29T20:13:08+00:00 ThreatRoundup.com

An attacker used ConnectWise Cloud Backup's own app credential to sign in to 173 partner and customer Microsoft 365 tenants, per Huntress. ConnectWise has taken the service offline and disabled seven app identities.

ThreatRoundup.com Truesec High 0 0 https://threatroundup.com/news/apt28-nato-naval-shipbuilder-reflective-loader/ 2026-10-21T12:40:44+00:00 2026-10-29T20:13:08+00:00 ThreatRoundup.com

Symantec says Russia's APT28 breached a naval shipbuilder, a law enforcement agency and an aircraft-engine maker in two NATO countries, using the HOOKEDGE backdoor and a previously unseen reflective loader.

ThreatRoundup.com The Hacker News High 0 0 https://threatroundup.com/news/armory-castle-beyondtrust-exploitation/ 2026-10-21T12:39:44+00:00 2026-10-29T20:13:08+00:00 ThreatRoundup.com

Google and Mandiant say suspected Chinese espionage group ARMORY CASTLE has exploited a BeyondTrust Remote Support zero-day since late August. Once inside, it took root, dumped stored credentials and used the support tool to reach internal machines.

ThreatRoundup.com Google Threat Intelligence Group / Mandiant Critical 8 1 https://threatroundup.com/news/ahold-delhaize-cyberattack-us-europe/ 2026-10-21T12:38:44+00:00 2026-10-29T20:13:09+00:00 ThreatRoundup.com

Ahold Delhaize, parent of Food Lion, Stop & Shop, Hannaford and Giant, is restoring websites and apps after a cyberattack disclosed Oct. 12. Stores are open and no data theft has been found so far.

ThreatRoundup.com BleepingComputer High 0 0 https://threatroundup.com/news/unit42-ai-espionage-government-linux/ 2026-10-21T12:37:44+00:00 2026-10-29T20:13:09+00:00 ThreatRoundup.com

Unit 42 says a cluster it calls CL-UNK-1211 spent six months in government Linux servers using AI-generated scripts, a new Go RAT and fake red-team markers, going after databases, mailboxes and linked social media accounts.

ThreatRoundup.com Palo Alto Networks Unit 42 High 12 2