https://threatroundup.com/news/ Every ThreatRoundup story: what happened, what it means for you, and what defenders should do. en-us © 2026 ThreatRoundup.com ThreatRoundup.com Thu, 29 Oct 2026 20:13:09 +0000 30 https://threatroundup.com/wp-content/themes/tr/assets/icons/feed-logo.pnghttps://threatroundup.com/news/ https://threatroundup.com/news/m365-revoke-sessions-graph-ews-90-minutes/ https://threatroundup.com/news/m365-revoke-sessions-graph-ews-90-minutes/ Thu, 29 Oct 2026 12:45:00 +0000 Eye Security found that revoking sessions or resetting a password leaves Graph, EWS and ActiveSync mail access open for up to 90 minutes; only disabling the account cuts it off immediately. ThreatRoundup.com Eye Security Threat Level: Medium Hunt Leads: 4 CVEs: 0 ThreatRoundup.com Eye Security Medium 4 0 https://threatroundup.com/news/edk2-pxe-uefi-flaw-cve-2026-97631/ https://threatroundup.com/news/edk2-pxe-uefi-flaw-cve-2026-97631/ Thu, 29 Oct 2026 12:45:00 +0000 CVE-2026-97631, a 9.5-rated overflow in EDK II's PXE driver dating to 2010, can let someone on the local network run code before Secure Boot on network-booting machines. Firmware updates are still pending. ThreatRoundup.com The Hacker News Threat Level: Critical Hunt Leads: 0 CVEs: 1 ThreatRoundup.com The Hacker News Critical 0 1 https://threatroundup.com/news/sony-so-net-isp-breach-2-5-million/ https://threatroundup.com/news/sony-so-net-isp-breach-2-5-million/ Thu, 29 Oct 2026 12:45:00 +0000 Sony Network Communications says an Oct. 19 intrusion exposed 2.59 million So-net and Docomo Hikari customer records, plus 54,401 email addresses with passwords. No card data was taken. ThreatRoundup.com BleepingComputer Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com BleepingComputer High 0 0 https://threatroundup.com/news/cyberdakait-android-banking-trojans-india/ https://threatroundup.com/news/cyberdakait-android-banking-trojans-india/ Thu, 29 Oct 2026 12:45:00 +0000 Group-IB tracked seven Android trojan families behind fake bank 'protection plan' calls in India: nearly 18,000 phones infected and 7.6 million texts, including OTPs, intercepted. ThreatRoundup.com Group-IB Threat Level: High Hunt Leads: 5 CVEs: 0 ThreatRoundup.com Group-IB High 5 0 https://threatroundup.com/news/skyw4lker-device-code-phishing-m365/ https://threatroundup.com/news/skyw4lker-device-code-phishing-m365/ Thu, 29 Oct 2026 12:45:00 +0000 ANY.RUN tracked the SkyW4lker kit across 173 domains: password-protected lures send Microsoft 365 users to the real device login page, where one typed code hands the attacker a token. ThreatRoundup.com ANY.RUN Threat Level: High Hunt Leads: 5 CVEs: 0 ThreatRoundup.com ANY.RUN High 5 0 https://threatroundup.com/news/qilin-ransomware-acronis-esxi-deep-dive/ https://threatroundup.com/news/qilin-ransomware-acronis-esxi-deep-dive/ Thu, 29 Oct 2026 12:45:00 +0000 Acronis TRU dissects Qilin's Rust encryptor, its password gate and the PowerShell routine that resets ESXi root passwords and encrypts every host, as the gang passes 900 claimed victims in 2026. ThreatRoundup.com Acronis TRU Threat Level: High Hunt Leads: 6 CVEs: 0 ThreatRoundup.com Acronis TRU High 6 0 https://threatroundup.com/news/yoba-fake-chatgpt-claude-installers-sideloading/ https://threatroundup.com/news/yoba-fake-chatgpt-claude-installers-sideloading/ Thu, 29 Oct 2026 12:45:00 +0000 Check Point's Yoba campaign pairs genuine signed OpenAI and Anthropic installers with a sideloaded DLL on fake GitHub AI-app pages, installing a hidden XMRig miner via a Telegram-seeded DGA. ThreatRoundup.com Check Point Research Threat Level: High Hunt Leads: 6 CVEs: 0 ThreatRoundup.com Check Point Research High 6 0 https://threatroundup.com/news/vmware-esx-logging-zero-day-warp-panda-kev/ https://threatroundup.com/news/vmware-esx-logging-zero-day-warp-panda-kev/ Thu, 29 Oct 2026 12:45:00 +0000 CrowdStrike says China-nexus Warp Panda used CVE-2026-41709, a VMware ESX insufficient-logging flaw, as a zero-day against US law firms. CISA added it to KEV with a Nov. 11 deadline. ThreatRoundup.com The Hacker News Threat Level: High Hunt Leads: 0 CVEs: 1 ThreatRoundup.com The Hacker News High 0 1 https://threatroundup.com/news/volt-typhoon-silent-train-zero-days-lumen/ https://threatroundup.com/news/volt-typhoon-silent-train-zero-days-lumen/ Thu, 29 Oct 2026 12:45:00 +0000 Lumen ties Volt Typhoon's Silent Train covert network to zero-days in N-able, Cisco SD-WAN, VeloCloud and likely Quest KACE, while Cisco Talos details KeyDrift malware stealing SD-WAN keys. ThreatRoundup.com Lumen Black Lotus Labs Threat Level: Critical Hunt Leads: 6 CVEs: 1 ThreatRoundup.com Lumen Black Lotus Labs Critical 6 1 https://threatroundup.com/news/cisco-asa-ftd-vpn-dos-cve-2026-76418/ https://threatroundup.com/news/cisco-asa-ftd-vpn-dos-cve-2026-76418/ Thu, 29 Oct 2026 12:45:00 +0000 Cisco says attackers are exploiting CVE-2026-76418, an unauthenticated bug in the ASA and FTD SSL VPN that forces the firewall to reboot when secondary authentication is configured. ThreatRoundup.com The Hacker News Threat Level: Critical Hunt Leads: 0 CVEs: 1 ThreatRoundup.com The Hacker News Critical 0 1 https://threatroundup.com/news/magento-cms-block-loader-953-stores/ https://threatroundup.com/news/magento-cms-block-loader-953-stores/ Thu, 29 Oct 2026 12:45:00 +0000 Sansec found a JavaScript loader in Magento CMS blocks on 953 stores since July 2025; the newest version fingerprints visitors so scanners see nothing, and PolyShell is the main way in. ThreatRoundup.com Sansec Threat Level: High Hunt Leads: 0 CVEs: 2 ThreatRoundup.com Sansec High 0 2 https://threatroundup.com/news/aokigahara-infostealer-ai-coding-tools/ https://threatroundup.com/news/aokigahara-infostealer-ai-coding-tools/ Thu, 29 Oct 2026 12:45:00 +0000 Check Point says the new Aokigahara infostealer has a dedicated module for AI assistant and coding-tool sessions, plus cloud configs, SSH keys, browsers and crypto wallets. ThreatRoundup.com Check Point Research Threat Level: Medium Hunt Leads: 6 CVEs: 0 ThreatRoundup.com Check Point Research Medium 6 0 https://threatroundup.com/news/engie-france-customer-data-partner-marketing-tool/ https://threatroundup.com/news/engie-france-customer-data-partner-marketing-tool/ Thu, 29 Oct 2026 12:45:00 +0000 ENGIE says attackers stole French customers' contact details and contract and meter numbers from a partner marketing platform; no banking data, and its own systems weren't hit. ThreatRoundup.com BleepingComputer Threat Level: Medium Hunt Leads: 0 CVEs: 0 ThreatRoundup.com BleepingComputer Medium 0 0 https://threatroundup.com/news/dreamhost-forced-password-resets-incident/ https://threatroundup.com/news/dreamhost-forced-password-resets-incident/ Thu, 29 Oct 2026 12:45:00 +0000 DreamHost is forcing email, FTP and SFTP password resets in an ongoing incident and telling owners to remove unknown forwarding rules, but hasn't said what happened. ThreatRoundup.com BleepingComputer Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com BleepingComputer High 0 0 https://threatroundup.com/news/teams-fake-it-support-quick-assist-ransomware/ https://threatroundup.com/news/teams-fake-it-support-quick-assist-ransomware/ Thu, 29 Oct 2026 12:45:00 +0000 Arctic Wolf has seen more than 400 incidents where attackers mail-bomb a user, pose as IT on Microsoft Teams and get remote access via Quick Assist, a path to Black Basta, Cactus and Chaos ransomware. ThreatRoundup.com Arctic Wolf Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com Arctic Wolf High 0 0 https://threatroundup.com/news/dahua-cameras-hijacked-ukraine-p2p-cert-ua/ https://threatroundup.com/news/dahua-cameras-hijacked-ukraine-p2p-cert-ua/ Thu, 29 Oct 2026 12:45:00 +0000 CERT-UA warns attackers are hijacking Dahua cameras and recorders in Ukraine through Easy4IP P2P access, guessable serials, weak passwords and old auth-bypass bugs. ThreatRoundup.com The Hacker News Threat Level: High Hunt Leads: 0 CVEs: 2 ThreatRoundup.com The Hacker News High 0 2 https://threatroundup.com/news/asd-amadey-botnet-180000-disconnected/ https://threatroundup.com/news/asd-amadey-botnet-180000-disconnected/ Thu, 29 Oct 2026 12:45:00 +0000 Australia's ASD broke into an Amadey malware control panel and disconnected it from about 180,000 infected computers. Data already stolen is still out there. ThreatRoundup.com The Hacker News Threat Level: Medium Hunt Leads: 0 CVEs: 0 ThreatRoundup.com The Hacker News Medium 0 0 https://threatroundup.com/news/unm-health-cyberattack-ambulance-diversion/ https://threatroundup.com/news/unm-health-cyberattack-ambulance-diversion/ Thu, 29 Oct 2026 12:45:00 +0000 A cybersecurity incident forced UNM Health to divert ambulances from New Mexico's only Level 1 trauma center and cancel appointments at more than 30 clinics. The FBI is assisting. ThreatRoundup.com SecurityWeek (AP) Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com SecurityWeek (AP) High 0 0 https://threatroundup.com/news/gmo-onamae-desktop-cloud-trading-accounts-extortion/ https://threatroundup.com/news/gmo-onamae-desktop-cloud-trading-accounts-extortion/ Thu, 29 Oct 2026 12:45:00 +0000 GMO Internet says an attacker who breached Onamae.com Desktop Cloud used stolen logins to trade in customers' brokerage accounts and is now demanding money. GMO won't pay. ThreatRoundup.com GMO Internet Group Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com GMO Internet Group High 0 0 https://threatroundup.com/news/apple-ios-18-7-11-coregraphics-zero-day-backport/ https://threatroundup.com/news/apple-ios-18-7-11-coregraphics-zero-day-backport/ Thu, 29 Oct 2026 12:45:00 +0000 iOS and iPadOS 18.7.11 backport Apple's fix for CVE-2026-86950, a CoreGraphics zero-day Apple says may have been exploited against targeted individuals, to the iPhone XS, XR and older iPads. ThreatRoundup.com BleepingComputer Threat Level: Critical Hunt Leads: 0 CVEs: 1 ThreatRoundup.com BleepingComputer Critical 0 1 https://threatroundup.com/news/fbi-midterm-campaign-donation-scams/ https://threatroundup.com/news/fbi-midterm-campaign-donation-scams/ Thu, 29 Oct 2026 12:45:00 +0000 The FBI warns of midterm scams promising guaranteed returns on campaign donations, fake PACs that keep the money, merchandise that never ships and fake voter-registration pages. ThreatRoundup.com MoneyWise Threat Level: Info Hunt Leads: 0 CVEs: 0 ThreatRoundup.com MoneyWise Info 0 0 https://threatroundup.com/news/tailworm-tailscale-ssh-root-flaws/ https://threatroundup.com/news/tailworm-tailscale-ssh-root-flaws/ Thu, 29 Oct 2026 12:45:00 +0000 Cyberdione Labs' Tailworm report says flaws in Tailscale SSH's root-run forwarding let a permitted SSH user reach root-only sockets. Tailscale calls the issues serious and targets a patched client by Oct. 27. ThreatRoundup.com Cyberdione Labs (Tailworm) Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com Cyberdione Labs (Tailworm) High 0 0 https://threatroundup.com/news/gheist-github-tokens-actions-logs-secrets/ https://threatroundup.com/news/gheist-github-tokens-actions-logs-secrets/ Thu, 29 Oct 2026 12:45:00 +0000 Wiz says the Gheist campaign used stolen GitHub tokens to plant 13,500+ branches across 850+ accounts, each running a workflow that dumps repository secrets into Actions logs and deletes the run. ThreatRoundup.com Wiz Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com Wiz High 0 0 https://threatroundup.com/news/m365-token-replay-97-accounts-huntress/ https://threatroundup.com/news/m365-token-replay-97-accounts-huntress/ Thu, 29 Oct 2026 12:45:00 +0000 Huntress tracked a campaign that replayed stolen Microsoft 365 sign-in tokens to take over 97 accounts at 79 organizations, then planted rogue Entra devices, swapped MFA methods and hid payroll mail. ThreatRoundup.com Huntress Threat Level: High Hunt Leads: 6 CVEs: 0 ThreatRoundup.com Huntress High 6 0 https://threatroundup.com/news/fortinet-ai-found-flaws-patch-before-cves/ https://threatroundup.com/news/fortinet-ai-found-flaws-patch-before-cves/ Thu, 29 Oct 2026 12:45:00 +0000 Fortinet patched critical flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator found by AI-assisted review, but won't publish CVEs until Nov. 10. Australia's ACSC says patch urgently. ThreatRoundup.com Cyber Daily Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com Cyber Daily High 0 0 https://threatroundup.com/news/nefilim-hive-affiliate-stryzhak-70-months/ https://threatroundup.com/news/nefilim-hive-affiliate-stryzhak-70-months/ Wed, 28 Oct 2026 22:28:00 +0000 Artem Stryzhak, a Ukrainian affiliate who rented Nefilim and Hive ransomware to hit companies, law firms, a dental office and a healthcare provider, was sentenced to 70 months in US prison. ThreatRoundup.com BleepingComputer Threat Level: Info Hunt Leads: 0 CVEs: 0 ThreatRoundup.com BleepingComputer Info 0 0 https://threatroundup.com/news/trust-graft-wordpress-admin-plugin-backdoor/ https://threatroundup.com/news/trust-graft-wordpress-admin-plugin-backdoor/ Wed, 28 Oct 2026 22:28:00 +0000 Securonix found JavaScript on hijacked sites that uses a logged-in WordPress admin's session to install a backdoored plugin that persists in mu-plugins and hides from the plugin list. ThreatRoundup.com Securonix Threat Level: Medium Hunt Leads: 5 CVEs: 0 ThreatRoundup.com Securonix Medium 5 0 https://threatroundup.com/news/silent-ransom-group-leak-law-firms/ https://threatroundup.com/news/silent-ransom-group-leak-law-firms/ Wed, 28 Oct 2026 22:28:00 +0000 Ransom-ISAC's analysis of leaked Silent Ransom Group files shows callback-phishing extortion of mostly US law firms via AnyDesk, with at least $43.95 million confirmed received. ThreatRoundup.com Ransom-ISAC Threat Level: High Hunt Leads: 4 CVEs: 0 ThreatRoundup.com Ransom-ISAC High 4 0 https://threatroundup.com/news/convertr-plausible-magecart-checkout-skimmer/ https://threatroundup.com/news/convertr-plausible-magecart-checkout-skimmer/ Wed, 28 Oct 2026 22:28:00 +0000 Sansec says a Brazilian Magecart group planted a card skimmer in the Plausible analytics script every Convertr store loads, exposing checkouts at dozens of fashion brands Oct. 24 to 27. ThreatRoundup.com Sansec Threat Level: High Hunt Leads: 4 CVEs: 1 ThreatRoundup.com Sansec High 4 1 https://threatroundup.com/news/microsoft-authenticator-android-authmask-token-theft/ https://threatroundup.com/news/microsoft-authenticator-android-authmask-token-theft/ Wed, 28 Oct 2026 22:28:00 +0000 Enclave's AuthMask bug let any Android app get work-account Microsoft Graph tokens from Authenticator by posing as Teams; Microsoft fixed it in 6.2606.4246 and says it wasn't exploited. ThreatRoundup.com Enclave Threat Level: High Hunt Leads: 0 CVEs: 1 ThreatRoundup.com Enclave High 0 1 https://threatroundup.com/news/cisa-kev-polyshell-node2shell-exploit-traffic/ https://threatroundup.com/news/cisa-kev-polyshell-node2shell-exploit-traffic/ Wed, 28 Oct 2026 22:28:00 +0000 CISA added Adobe Commerce's PolyShell and the Brotli Node2Shell bug to its exploited-vulnerabilities list, due Nov. 10, as ELLIO logged the first Node2Shell exploit traffic. ThreatRoundup.com The Hacker News Threat Level: Critical Hunt Leads: 0 CVEs: 2 ThreatRoundup.com The Hacker News Critical 0 2 https://threatroundup.com/news/php2shell-hunt-io-open-directory-iocs/ https://threatroundup.com/news/php2shell-hunt-io-open-directory-iocs/ Tue, 27 Oct 2026 15:08:00 +0000 Hunt.io combed about ten attacker open directories full of PHP2Shell tooling and a Mirai-style botnet, and published attempt signatures and indicators defenders can search for today. ThreatRoundup.com Hunt.io Threat Level: Critical Hunt Leads: 0 CVEs: 2 ThreatRoundup.com Hunt.io Critical 0 2 https://threatroundup.com/news/cyfirma-dprk-php2shell-staging/ https://threatroundup.com/news/cyfirma-dprk-php2shell-staging/ Tue, 27 Oct 2026 15:07:00 +0000 CYFIRMA says Korean-speaking operators are quietly scanning 216 unpatched PHP hosts at governments, banks and logistics firms, with a moderate-confidence Lazarus link. ThreatRoundup.com CYFIRMA Threat Level: Critical Hunt Leads: 0 CVEs: 2 ThreatRoundup.com CYFIRMA Critical 0 2 https://threatroundup.com/news/oracle-java-emergency-update-emudhra-cve-2026-91403/ https://threatroundup.com/news/oracle-java-emergency-update-emudhra-cve-2026-91403/ Tue, 27 Oct 2026 15:06:00 +0000 Oracle's out-of-band CVE-2026-91403 fix (CVSS 9.1) stops Java trusting eight eMudhra intermediate certificates with weak keys; a second update, CVE-2026-114820, removes the related roots. ThreatRoundup.com Cyber Security News Threat Level: Critical Hunt Leads: 0 CVEs: 2 ThreatRoundup.com Cyber Security News Critical 0 2 https://threatroundup.com/news/k0t-network-edge-intrusions-group-ib/ https://threatroundup.com/news/k0t-network-edge-intrusions-group-ib/ Tue, 27 Oct 2026 15:05:00 +0000 Group-IB and NyxLab say actor k0t exploited exposed FortiWeb, FortiGate and GlobalProtect devices through 2026, reached domain admin, and stole more than 70,000 credentials, likely as an initial access broker. ThreatRoundup.com Group-IB Threat Level: High Hunt Leads: 0 CVEs: 5 ThreatRoundup.com Group-IB High 0 5 https://threatroundup.com/news/node2shell-nodejs-brotli-rce-demo/ https://threatroundup.com/news/node2shell-nodejs-brotli-rce-demo/ Tue, 27 Oct 2026 15:04:00 +0000 Imperva ran attacker code on an official Node.js 24.22.0 image by feeding it crafted Brotli data, through fetch() responses or Express 5 body parsers. Patch Node.js and rebuild images. ThreatRoundup.com The Hacker News Threat Level: High Hunt Leads: 0 CVEs: 1 ThreatRoundup.com The Hacker News High 0 1 https://threatroundup.com/news/blackx-uefi-bootkit-baton-drop/ https://threatroundup.com/news/blackx-uefi-bootkit-baton-drop/ Tue, 27 Oct 2026 15:03:00 +0000 Kaspersky found BlackX, a UEFI bootkit used against Central Asian diplomats that bypasses Secure Boot via Baton Drop because Microsoft's revocation step was never applied. Medium-confidence link to APT41. ThreatRoundup.com Kaspersky Securelist Threat Level: High Hunt Leads: 0 CVEs: 1 ThreatRoundup.com Kaspersky Securelist High 0 1 https://threatroundup.com/news/quest-diagnostics-patient-records-breach/ https://threatroundup.com/news/quest-diagnostics-patient-records-breach/ Tue, 27 Oct 2026 15:02:00 +0000 Quest Diagnostics says an intruder reached patient records through its Quanum Lab Services Manager platform. It hasn't said how many people are affected. ThreatRoundup.com SecurityWeek (Associated Press) Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com SecurityWeek (Associated Press) High 0 0 https://threatroundup.com/news/wiz-artex-storm-0940-expands-targeting/ https://threatroundup.com/news/wiz-artex-storm-0940-expands-targeting/ Tue, 27 Oct 2026 15:01:00 +0000 Wiz says ARTEX AI agents tied to Storm-0940 spent October probing IT and software vendors' Okta, Entra ID and Cognito sign-ins. Most attempts failed. ThreatRoundup.com Wiz Research Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com Wiz Research High 0 0 https://threatroundup.com/news/popcorn-time-updater-rce-disabled/ https://threatroundup.com/news/popcorn-time-updater-rce-disabled/ Tue, 27 Oct 2026 15:00:00 +0000 Eye Security found Time4Popcorn's abandoned updater would run any file as SYSTEM or root, registered its domain and used it to switch the updater off. Android users remain exposed. ThreatRoundup.com BleepingComputer Threat Level: High Hunt Leads: 0 CVEs: 1 ThreatRoundup.com BleepingComputer High 0 1 https://threatroundup.com/news/loblaw-breach-2-million-credit-monitoring/ https://threatroundup.com/news/loblaw-breach-2-million-credit-monitoring/ Tue, 27 Oct 2026 14:59:00 +0000 Loblaw's CEO has apologized to about two million customers whose names, addresses, birthdates and purchase details were taken in a February breach, and is offering two years of TransUnion monitoring. ThreatRoundup.com CBC News Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com CBC News High 0 0 https://threatroundup.com/news/asus-router-firmware-cve-2026-93489/ https://threatroundup.com/news/asus-router-firmware-cve-2026-93489/ Tue, 27 Oct 2026 14:58:00 +0000 Asus fixed three High-rated router flaws, including CVE-2026-93489 (CVSS 8.7), that let someone on your network act as admin without a password. No attacks reported yet. ThreatRoundup.com Notebookcheck Threat Level: High Hunt Leads: 0 CVEs: 3 ThreatRoundup.com Notebookcheck High 0 3 https://threatroundup.com/news/litellm-leaked-master-key-release-hijack/ https://threatroundup.com/news/litellm-leaked-master-key-release-hijack/ Tue, 27 Oct 2026 14:57:00 +0000 LiteLLM says a master key leaked on GitHub in May and never revoked let an attacker steal maintainer tokens and ship a backdoored 1.107.0 to PyPI, Docker Hub and GHCR. ThreatRoundup.com The Hacker News Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com The Hacker News High 0 0 https://threatroundup.com/news/amazon-clickfix-finger-malware/ https://threatroundup.com/news/amazon-clickfix-finger-malware/ Tue, 27 Oct 2026 14:56:00 +0000 Huntress says a sponsored Google result led to a fake Amazon login and a ClickFix CAPTCHA that used finger.exe to install the Lumma infostealer and NetSupport remote access. ThreatRoundup.com Huntress Threat Level: Medium Hunt Leads: 0 CVEs: 0 ThreatRoundup.com Huntress Medium 0 0 https://threatroundup.com/news/keystealth-device-code-phishing-kit/ https://threatroundup.com/news/keystealth-device-code-phishing-kit/ Tue, 27 Oct 2026 14:55:00 +0000 ADAMnetworks details how a device code phishing kit let an operator register rogue Entra devices, sit in a company's Microsoft 365 account for seven weeks and attempt payment fraud. ThreatRoundup.com ADAMnetworks Threat Level: Medium Hunt Leads: 0 CVEs: 0 ThreatRoundup.com ADAMnetworks Medium 0 0 https://threatroundup.com/news/prince-of-persia-iran-apt-us-c2/ https://threatroundup.com/news/prince-of-persia-iran-apt-us-c2/ Tue, 27 Oct 2026 14:54:00 +0000 Semperis says Iran-linked Prince of Persia (Infy) rebuilt its infrastructure after a February exposure and is now running a Tornado C2 server in the US for the first time in a decade. ThreatRoundup.com Semperis Threat Level: Medium Hunt Leads: 0 CVEs: 0 ThreatRoundup.com Semperis Medium 0 0 https://threatroundup.com/news/etherrat-teams-fake-it-support-ethereum-c2/ https://threatroundup.com/news/etherrat-teams-fake-it-support-ethereum-c2/ Tue, 27 Oct 2026 14:53:00 +0000 A Teams caller posing as IT talks victims into installing remote-access tools, then drops EtherRAT, a Node.js backdoor that looks up its command server in an Ethereum smart contract. ThreatRoundup.com bluecyber.hashnode.dev Threat Level: Medium Hunt Leads: 0 CVEs: 0 ThreatRoundup.com bluecyber.hashnode.dev Medium 0 0 https://threatroundup.com/news/vbscript-malware-brazil-portugal-trusted-tools/ https://threatroundup.com/news/vbscript-malware-brazil-portugal-trusted-tools/ Tue, 27 Oct 2026 14:52:00 +0000 WatchGuard details three Brazil-linked campaigns, Overlord RAT, Lampion and a newdev.dll RAT, that start with VBScript and lean on built-in Windows tools and signed programs to stay hidden. ThreatRoundup.com WatchGuard Threat Level: Medium Hunt Leads: 0 CVEs: 0 ThreatRoundup.com WatchGuard Medium 0 0 https://threatroundup.com/news/johns-hopkins-bayview-patient-data-ai-tool/ https://threatroundup.com/news/johns-hopkins-bayview-patient-data-ai-tool/ Tue, 27 Oct 2026 14:51:00 +0000 Johns Hopkins Bayview is notifying 3,182 patients after an employee uploaded a spreadsheet of their records, including medications and record numbers, to an unapproved public AI tool. ThreatRoundup.com Hoodline Threat Level: Medium Hunt Leads: 0 CVEs: 0 ThreatRoundup.com Hoodline Medium 0 0 https://threatroundup.com/news/php2shell-exploited-before-disclosure-madpot/ https://threatroundup.com/news/php2shell-exploited-before-disclosure-madpot/ Thu, 22 Oct 2026 11:31:00 +0000 Amazon says a PHP2Shell exploit hit its MadPot honeypots on Oct. 17, four days before PHP disclosed CVE-2026-109618 and CVE-2026-109619. It now calls exploitation broad. ThreatRoundup.com Amazon Threat Intelligence (AWS Security Blog) Threat Level: Critical Hunt Leads: 7 CVEs: 2 ThreatRoundup.com Amazon Threat Intelligence (AWS Security Blog) Critical 7 2 https://threatroundup.com/news/storm-0940-artex-connectwise-supply-chain/ https://threatroundup.com/news/storm-0940-artex-connectwise-supply-chain/ Thu, 22 Oct 2026 11:30:00 +0000 Microsoft ties the ConnectWise Cloud Backup supply-chain attack to China-aligned Storm-0940, which used ARTEX AI agents to try sign-ins to more than 2,250 Microsoft 365 tenants at up to 2,900 a minute. ThreatRoundup.com Microsoft Threat Intelligence Threat Level: Critical Hunt Leads: 7 CVEs: 0 ThreatRoundup.com Microsoft Threat Intelligence Critical 7 0 https://threatroundup.com/news/gitlab-cvss-10-unauthenticated-rce/ https://threatroundup.com/news/gitlab-cvss-10-unauthenticated-rce/ Thu, 22 Oct 2026 11:29:00 +0000 GitLab fixed CVE-2026-110264, a CVSS 10.0 flaw in its bundled Ruby regex engine that could let unauthenticated attackers run code on self-managed servers as old as version 7.0. No exploitation seen yet, and no workaround. ThreatRoundup.com The Hacker News Threat Level: Critical Hunt Leads: 0 CVEs: 4 ThreatRoundup.com The Hacker News Critical 0 4 https://threatroundup.com/news/cisa-safepay-ransomware-advisory-aa26-293a/ https://threatroundup.com/news/cisa-safepay-ransomware-advisory-aa26-293a/ Thu, 22 Oct 2026 11:28:00 +0000 A joint FBI, CISA and USSS advisory says SafePay ransomware has hit at least 600 victims since August 2024, getting in through stolen or guessed VPN logins and old Cisco ASA, SonicWall and Veeam flaws, then wiping backups before it encrypts. ThreatRoundup.com CISA Threat Level: High Hunt Leads: 9 CVEs: 5 ThreatRoundup.com CISA High 9 5 https://threatroundup.com/news/nodejs-brotli-decoder-rce/ https://threatroundup.com/news/nodejs-brotli-decoder-rce/ Thu, 22 Oct 2026 11:27:00 +0000 Node.js fixed an out-of-bounds write in its bundled Brotli decoder (CVE-2026-111497) that it says could allow remote code execution on 22.x, 24.x and 26.x. End-of-life versions get no patch. ThreatRoundup.com The Hacker News Threat Level: High Hunt Leads: 0 CVEs: 10 ThreatRoundup.com The Hacker News High 0 10 https://threatroundup.com/news/lazarus-operation-flashhole/ https://threatroundup.com/news/lazarus-operation-flashhole/ Thu, 22 Oct 2026 11:26:00 +0000 Kaspersky says Lazarus abused South Korea's mandatory INISAFE CrossWeb EX security plug-in to break into at least three firms, using fake résumé sites, GitHub-based C2 and a post-quantum key exchange. ThreatRoundup.com Kaspersky Securelist Threat Level: High Hunt Leads: 9 CVEs: 0 ThreatRoundup.com Kaspersky Securelist High 9 0 https://threatroundup.com/news/papercut-attacker-ai-toolkit-second-rce/ https://threatroundup.com/news/papercut-attacker-ai-toolkit-second-rce/ Thu, 22 Oct 2026 11:25:00 +0000 Hunt.io found the PaperCut mass-exploitation crew's AI agent prompts, exploit variants, credential stealers and victim access kits on an open server, plus a second RCE route through the XML-RPC API. ThreatRoundup.com Hunt.io Threat Level: High Hunt Leads: 0 CVEs: 2 ThreatRoundup.com Hunt.io High 0 2 https://threatroundup.com/news/slaiclind-clickfix-etherhiding/ https://threatroundup.com/news/slaiclind-clickfix-etherhiding/ Thu, 22 Oct 2026 11:24:00 +0000 Stormshield says hacked WordPress sites read C2 addresses from a Polygon smart contract, then show Windows visitors a fake Cloudflare check that leads to a stealer loaded through the Deno runtime. ThreatRoundup.com Stormshield Threat Level: Medium Hunt Leads: 7 CVEs: 0 ThreatRoundup.com Stormshield Medium 7 0 https://threatroundup.com/news/vasilek-backdoor-vmware-tools-russian-healthcare/ https://threatroundup.com/news/vasilek-backdoor-vmware-tools-russian-healthcare/ Thu, 22 Oct 2026 11:23:00 +0000 Solar 4RAYS says Partisan Zmiy spent about two years in a Russian healthcare network, hiding the Telegram-controlled Vasilek backdoor and a fake service in an unmonitored VMware Tools directory. ThreatRoundup.com The Hacker News Threat Level: Medium Hunt Leads: 0 CVEs: 0 ThreatRoundup.com The Hacker News Medium 0 0 https://threatroundup.com/news/russian-hackers-wipe-ukrainian-grain-firm/ https://threatroundup.com/news/russian-hackers-wipe-ukrainian-grain-firm/ Thu, 22 Oct 2026 11:22:00 +0000 ESET says UAC-0099 phished into a Ukrainian grain logistics company and handed access to Sandworm, which wiped data, while a new Go backdoor hid its C&C inside the Yggdrasil mesh network. ThreatRoundup.com The Record Threat Level: Medium Hunt Leads: 6 CVEs: 0 ThreatRoundup.com The Record Medium 6 0 https://threatroundup.com/news/africa-cybercrime-networks-disrupted/ https://threatroundup.com/news/africa-cybercrime-networks-disrupted/ Thu, 22 Oct 2026 11:21:00 +0000 An Interpol-led operation across 21 countries arrested 1,462 suspects, dismantled 10,909 malicious networks and recovered more than $105 million from BEC, scam and ransomware crews, BleepingComputer reports. ThreatRoundup.com BleepingComputer Threat Level: Medium Hunt Leads: 0 CVEs: 0 ThreatRoundup.com BleepingComputer Medium 0 0 https://threatroundup.com/news/chrome-gemini-scam-detection-clickfix/ https://threatroundup.com/news/chrome-gemini-scam-detection-clickfix/ Thu, 22 Oct 2026 11:20:00 +0000 Chrome's Enhanced Protection now checks copied commands for ClickFix scams, uses server-side Gemini to spot scam pages, and adds a softer suspicious-site warning. ThreatRoundup.com BleepingComputer Threat Level: Info Hunt Leads: 0 CVEs: 0 ThreatRoundup.com BleepingComputer Info 0 0 https://threatroundup.com/news/pan-os-cve-2026-0257-qilin-inc-mfa-bypass/ https://threatroundup.com/news/pan-os-cve-2026-0257-qilin-inc-mfa-bypass/ Wed, 21 Oct 2026 12:47:44 +0000 Unit 42 says the Qilin and INC ransomware groups are using CVE-2026-0257, a GlobalProtect authentication bypass patched in May, to open VPN sessions without MFA and then move on to vCenter, ESXi and Veeam. ThreatRoundup.com The Hacker News Threat Level: Critical Hunt Leads: 0 CVEs: 2 ThreatRoundup.com The Hacker News Critical 0 2 https://threatroundup.com/news/plex-media-server-exploited-cryptominer/ https://threatroundup.com/news/plex-media-server-exploited-cryptominer/ Wed, 21 Oct 2026 12:46:44 +0000 Attackers are chaining four Plex Media Server bugs, now on CISA's exploited list, to drop a cryptominer and a traffic-relay proxy on servers that never got September's fix. ThreatRoundup.com boredhackerblog Threat Level: Critical Hunt Leads: 0 CVEs: 4 ThreatRoundup.com boredhackerblog Critical 0 4 https://threatroundup.com/news/netscaler-cve-2026-88771-88779-chained-intrusions/ https://threatroundup.com/news/netscaler-cve-2026-88771-88779-chained-intrusions/ Wed, 21 Oct 2026 12:45:44 +0000 Rapid7 details intrusions where attackers chained CVE-2026-88771 and CVE-2026-88779 to get root on NetScaler ADC and Gateway, then planted HA-aware persistence and stole the appliance's credentials and keys. ThreatRoundup.com Rapid7 Threat Level: Critical Hunt Leads: 0 CVEs: 2 ThreatRoundup.com Rapid7 Critical 0 2 https://threatroundup.com/news/php-cve-2026-109618-109619-critical-rce/ https://threatroundup.com/news/php-cve-2026-109618-109619-critical-rce/ Wed, 21 Oct 2026 12:44:44 +0000 PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21 to fix two critical bugs nicknamed php2shell, after details leaked early. Updated Oct. 25: Amazon says both bugs are now broadly exploited. ThreatRoundup.com BleepingComputer Threat Level: Critical Hunt Leads: 0 CVEs: 2 ThreatRoundup.com BleepingComputer Critical 0 2 https://threatroundup.com/news/ovhcloud-cli-glassworm-backdoor/ https://threatroundup.com/news/ovhcloud-cli-glassworm-backdoor/ Wed, 21 Oct 2026 12:43:44 +0000 An attacker used a hijacked developer account to swap the binaries on five OVHcloud CLI releases for a build that steals cloud keys, SSH keys and AI-tool data. OVHcloud ties it to GlassWorm and says about 250 downloads happened in the 94-minute window. ThreatRoundup.com OpenSourceMalware Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com OpenSourceMalware High 0 0 https://threatroundup.com/news/rank-math-seo-plugin-backdoor/ https://threatroundup.com/news/rank-math-seo-plugin-backdoor/ Wed, 21 Oct 2026 12:42:44 +0000 Rank Math PRO 3.0.123, served from the vendor's own site for about 11 hours on Oct. 15-16, carried a backdoor that creates hidden admins and rebuilds itself. Updating alone doesn't clean it. ThreatRoundup.com BleepingComputer Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com BleepingComputer High 0 0 https://threatroundup.com/news/connectwise-cloud-backup-supply-chain-attack/ https://threatroundup.com/news/connectwise-cloud-backup-supply-chain-attack/ Wed, 21 Oct 2026 12:41:44 +0000 An attacker used ConnectWise Cloud Backup's own app credential to sign in to 173 partner and customer Microsoft 365 tenants, per Huntress. ConnectWise has taken the service offline and disabled seven app identities. ThreatRoundup.com Truesec Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com Truesec High 0 0 https://threatroundup.com/news/apt28-nato-naval-shipbuilder-reflective-loader/ https://threatroundup.com/news/apt28-nato-naval-shipbuilder-reflective-loader/ Wed, 21 Oct 2026 12:40:44 +0000 Symantec says Russia's APT28 breached a naval shipbuilder, a law enforcement agency and an aircraft-engine maker in two NATO countries, using the HOOKEDGE backdoor and a previously unseen reflective loader. ThreatRoundup.com The Hacker News Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com The Hacker News High 0 0 https://threatroundup.com/news/armory-castle-beyondtrust-exploitation/ https://threatroundup.com/news/armory-castle-beyondtrust-exploitation/ Wed, 21 Oct 2026 12:39:44 +0000 Google and Mandiant say suspected Chinese espionage group ARMORY CASTLE has exploited a BeyondTrust Remote Support zero-day since late August. Once inside, it took root, dumped stored credentials and used the support tool to reach internal machines. ThreatRoundup.com Google Threat Intelligence Group / Mandiant Threat Level: Critical Hunt Leads: 8 CVEs: 1 ThreatRoundup.com Google Threat Intelligence Group / Mandiant Critical 8 1 https://threatroundup.com/news/ahold-delhaize-cyberattack-us-europe/ https://threatroundup.com/news/ahold-delhaize-cyberattack-us-europe/ Wed, 21 Oct 2026 12:38:44 +0000 Ahold Delhaize, parent of Food Lion, Stop & Shop, Hannaford and Giant, is restoring websites and apps after a cyberattack disclosed Oct. 12. Stores are open and no data theft has been found so far. ThreatRoundup.com BleepingComputer Threat Level: High Hunt Leads: 0 CVEs: 0 ThreatRoundup.com BleepingComputer High 0 0 https://threatroundup.com/news/unit42-ai-espionage-government-linux/ https://threatroundup.com/news/unit42-ai-espionage-government-linux/ Wed, 21 Oct 2026 12:37:44 +0000 Unit 42 says a cluster it calls CL-UNK-1211 spent six months in government Linux servers using AI-generated scripts, a new Go RAT and fake red-team markers, going after databases, mailboxes and linked social media accounts. ThreatRoundup.com Palo Alto Networks Unit 42 Threat Level: High Hunt Leads: 12 CVEs: 2 ThreatRoundup.com Palo Alto Networks Unit 42 High 12 2