Every ThreatRoundup story: what happened, what it means for you, and what defenders should do. https://threatroundup.com/news/ https://threatroundup.com/news/m365-revoke-sessions-graph-ews-90-minutes/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Eye Security Medium 4 0

Eye Security found that revoking sessions or resetting a password leaves Graph, EWS and ActiveSync mail access open for up to 90 minutes; only disabling the account cuts it off immediately.

https://threatroundup.com/news/edk2-pxe-uefi-flaw-cve-2026-97631/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com The Hacker News Critical 0 1

CVE-2026-97631, a 9.5-rated overflow in EDK II's PXE driver dating to 2010, can let someone on the local network run code before Secure Boot on network-booting machines. Firmware updates are still pending.

https://threatroundup.com/news/sony-so-net-isp-breach-2-5-million/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com BleepingComputer High 0 0

Sony Network Communications says an Oct. 19 intrusion exposed 2.59 million So-net and Docomo Hikari customer records, plus 54,401 email addresses with passwords. No card data was taken.

https://threatroundup.com/news/cyberdakait-android-banking-trojans-india/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Group-IB High 5 0

Group-IB tracked seven Android trojan families behind fake bank 'protection plan' calls in India: nearly 18,000 phones infected and 7.6 million texts, including OTPs, intercepted.

https://threatroundup.com/news/skyw4lker-device-code-phishing-m365/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com ANY.RUN High 5 0

ANY.RUN tracked the SkyW4lker kit across 173 domains: password-protected lures send Microsoft 365 users to the real device login page, where one typed code hands the attacker a token.

https://threatroundup.com/news/qilin-ransomware-acronis-esxi-deep-dive/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Acronis TRU High 6 0

Acronis TRU dissects Qilin's Rust encryptor, its password gate and the PowerShell routine that resets ESXi root passwords and encrypts every host, as the gang passes 900 claimed victims in 2026.

https://threatroundup.com/news/yoba-fake-chatgpt-claude-installers-sideloading/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Check Point Research High 6 0

Check Point's Yoba campaign pairs genuine signed OpenAI and Anthropic installers with a sideloaded DLL on fake GitHub AI-app pages, installing a hidden XMRig miner via a Telegram-seeded DGA.

https://threatroundup.com/news/vmware-esx-logging-zero-day-warp-panda-kev/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com The Hacker News High 0 1

CrowdStrike says China-nexus Warp Panda used CVE-2026-41709, a VMware ESX insufficient-logging flaw, as a zero-day against US law firms. CISA added it to KEV with a Nov. 11 deadline.

https://threatroundup.com/news/volt-typhoon-silent-train-zero-days-lumen/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Lumen Black Lotus Labs Critical 6 1

Lumen ties Volt Typhoon's Silent Train covert network to zero-days in N-able, Cisco SD-WAN, VeloCloud and likely Quest KACE, while Cisco Talos details KeyDrift malware stealing SD-WAN keys.

https://threatroundup.com/news/cisco-asa-ftd-vpn-dos-cve-2026-76418/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com The Hacker News Critical 0 1

Cisco says attackers are exploiting CVE-2026-76418, an unauthenticated bug in the ASA and FTD SSL VPN that forces the firewall to reboot when secondary authentication is configured.

https://threatroundup.com/news/magento-cms-block-loader-953-stores/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Sansec High 0 2

Sansec found a JavaScript loader in Magento CMS blocks on 953 stores since July 2025; the newest version fingerprints visitors so scanners see nothing, and PolyShell is the main way in.

https://threatroundup.com/news/aokigahara-infostealer-ai-coding-tools/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Check Point Research Medium 6 0

Check Point says the new Aokigahara infostealer has a dedicated module for AI assistant and coding-tool sessions, plus cloud configs, SSH keys, browsers and crypto wallets.

https://threatroundup.com/news/engie-france-customer-data-partner-marketing-tool/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com BleepingComputer Medium 0 0

ENGIE says attackers stole French customers' contact details and contract and meter numbers from a partner marketing platform; no banking data, and its own systems weren't hit.

https://threatroundup.com/news/dreamhost-forced-password-resets-incident/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com BleepingComputer High 0 0

DreamHost is forcing email, FTP and SFTP password resets in an ongoing incident and telling owners to remove unknown forwarding rules, but hasn't said what happened.

https://threatroundup.com/news/teams-fake-it-support-quick-assist-ransomware/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Arctic Wolf High 0 0

Arctic Wolf has seen more than 400 incidents where attackers mail-bomb a user, pose as IT on Microsoft Teams and get remote access via Quick Assist, a path to Black Basta, Cactus and Chaos ransomware.

https://threatroundup.com/news/dahua-cameras-hijacked-ukraine-p2p-cert-ua/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com The Hacker News High 0 2

CERT-UA warns attackers are hijacking Dahua cameras and recorders in Ukraine through Easy4IP P2P access, guessable serials, weak passwords and old auth-bypass bugs.

https://threatroundup.com/news/asd-amadey-botnet-180000-disconnected/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com The Hacker News Medium 0 0

Australia's ASD broke into an Amadey malware control panel and disconnected it from about 180,000 infected computers. Data already stolen is still out there.

https://threatroundup.com/news/unm-health-cyberattack-ambulance-diversion/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com SecurityWeek (AP) High 0 0

A cybersecurity incident forced UNM Health to divert ambulances from New Mexico's only Level 1 trauma center and cancel appointments at more than 30 clinics. The FBI is assisting.

https://threatroundup.com/news/gmo-onamae-desktop-cloud-trading-accounts-extortion/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com GMO Internet Group High 0 0

GMO Internet says an attacker who breached Onamae.com Desktop Cloud used stolen logins to trade in customers' brokerage accounts and is now demanding money. GMO won't pay.

https://threatroundup.com/news/apple-ios-18-7-11-coregraphics-zero-day-backport/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com BleepingComputer Critical 0 1

iOS and iPadOS 18.7.11 backport Apple's fix for CVE-2026-86950, a CoreGraphics zero-day Apple says may have been exploited against targeted individuals, to the iPhone XS, XR and older iPads.

https://threatroundup.com/news/fbi-midterm-campaign-donation-scams/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com MoneyWise Info 0 0

The FBI warns of midterm scams promising guaranteed returns on campaign donations, fake PACs that keep the money, merchandise that never ships and fake voter-registration pages.

https://threatroundup.com/news/tailworm-tailscale-ssh-root-flaws/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Cyberdione Labs (Tailworm) High 0 0

Cyberdione Labs' Tailworm report says flaws in Tailscale SSH's root-run forwarding let a permitted SSH user reach root-only sockets. Tailscale calls the issues serious and targets a patched client by Oct. 27.

https://threatroundup.com/news/gheist-github-tokens-actions-logs-secrets/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Wiz High 6 0

Wiz says the Gheist campaign used stolen GitHub tokens to plant 13,500+ branches across 850+ accounts, each running a workflow that dumps repository secrets into Actions logs and deletes the run.

https://threatroundup.com/news/m365-token-replay-97-accounts-huntress/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Huntress High 6 0

Huntress tracked a campaign that replayed stolen Microsoft 365 sign-in tokens to take over 97 accounts at 79 organizations, then planted rogue Entra devices, swapped MFA methods and hid payroll mail.

https://threatroundup.com/news/fortinet-ai-found-flaws-patch-before-cves/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Cyber Daily High 0 0

Fortinet patched critical flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator found by AI-assisted review, but won't publish CVEs until Nov. 10. Australia's ACSC says patch urgently.

https://threatroundup.com/news/nefilim-hive-affiliate-stryzhak-70-months/ 2026-10-28T22:28:00+00:00 ThreatRoundup.com BleepingComputer Info 0 0

Artem Stryzhak, a Ukrainian affiliate who rented Nefilim and Hive ransomware to hit companies, law firms, a dental office and a healthcare provider, was sentenced to 70 months in US prison.

https://threatroundup.com/news/trust-graft-wordpress-admin-plugin-backdoor/ 2026-10-28T22:28:00+00:00 ThreatRoundup.com Securonix Medium 5 0

Securonix found JavaScript on hijacked sites that uses a logged-in WordPress admin's session to install a backdoored plugin that persists in mu-plugins and hides from the plugin list.

https://threatroundup.com/news/silent-ransom-group-leak-law-firms/ 2026-10-28T22:28:00+00:00 ThreatRoundup.com Ransom-ISAC High 4 0

Ransom-ISAC's analysis of leaked Silent Ransom Group files shows callback-phishing extortion of mostly US law firms via AnyDesk, with at least $43.95 million confirmed received.

https://threatroundup.com/news/convertr-plausible-magecart-checkout-skimmer/ 2026-10-28T22:28:00+00:00 ThreatRoundup.com Sansec High 4 1

Sansec says a Brazilian Magecart group planted a card skimmer in the Plausible analytics script every Convertr store loads, exposing checkouts at dozens of fashion brands Oct. 24 to 27.

https://threatroundup.com/news/microsoft-authenticator-android-authmask-token-theft/ 2026-10-28T22:28:00+00:00 ThreatRoundup.com Enclave High 0 1

Enclave's AuthMask bug let any Android app get work-account Microsoft Graph tokens from Authenticator by posing as Teams; Microsoft fixed it in 6.2606.4246 and says it wasn't exploited.

https://threatroundup.com/news/cisa-kev-polyshell-node2shell-exploit-traffic/ 2026-10-28T22:28:00+00:00 ThreatRoundup.com The Hacker News Critical 0 2

CISA added Adobe Commerce's PolyShell and the Brotli Node2Shell bug to its exploited-vulnerabilities list, due Nov. 10, as ELLIO logged the first Node2Shell exploit traffic.

https://threatroundup.com/news/php2shell-hunt-io-open-directory-iocs/ 2026-10-27T15:08:00+00:00 ThreatRoundup.com Hunt.io Critical 0 2

Hunt.io combed about ten attacker open directories full of PHP2Shell tooling and a Mirai-style botnet, and published attempt signatures and indicators defenders can search for today.

https://threatroundup.com/news/cyfirma-dprk-php2shell-staging/ 2026-10-27T15:07:00+00:00 ThreatRoundup.com CYFIRMA Critical 0 2

CYFIRMA says Korean-speaking operators are quietly scanning 216 unpatched PHP hosts at governments, banks and logistics firms, with a moderate-confidence Lazarus link.

https://threatroundup.com/news/oracle-java-emergency-update-emudhra-cve-2026-91403/ 2026-10-27T15:06:00+00:00 ThreatRoundup.com Cyber Security News Critical 0 2

Oracle's out-of-band CVE-2026-91403 fix (CVSS 9.1) stops Java trusting eight eMudhra intermediate certificates with weak keys; a second update, CVE-2026-114820, removes the related roots.

https://threatroundup.com/news/k0t-network-edge-intrusions-group-ib/ 2026-10-27T15:05:00+00:00 ThreatRoundup.com Group-IB High 0 5

Group-IB and NyxLab say actor k0t exploited exposed FortiWeb, FortiGate and GlobalProtect devices through 2026, reached domain admin, and stole more than 70,000 credentials, likely as an initial access broker.

https://threatroundup.com/news/node2shell-nodejs-brotli-rce-demo/ 2026-10-27T15:04:00+00:00 ThreatRoundup.com The Hacker News High 0 1

Imperva ran attacker code on an official Node.js 24.22.0 image by feeding it crafted Brotli data, through fetch() responses or Express 5 body parsers. Patch Node.js and rebuild images.

https://threatroundup.com/news/blackx-uefi-bootkit-baton-drop/ 2026-10-27T15:03:00+00:00 ThreatRoundup.com Kaspersky Securelist High 0 1

Kaspersky found BlackX, a UEFI bootkit used against Central Asian diplomats that bypasses Secure Boot via Baton Drop because Microsoft's revocation step was never applied. Medium-confidence link to APT41.

https://threatroundup.com/news/quest-diagnostics-patient-records-breach/ 2026-10-27T15:02:00+00:00 ThreatRoundup.com SecurityWeek (Associated Press) High 0 0

Quest Diagnostics says an intruder reached patient records through its Quanum Lab Services Manager platform. It hasn't said how many people are affected.

https://threatroundup.com/news/wiz-artex-storm-0940-expands-targeting/ 2026-10-27T15:01:00+00:00 ThreatRoundup.com Wiz Research High 6 0

Wiz says ARTEX AI agents tied to Storm-0940 spent October probing IT and software vendors' Okta, Entra ID and Cognito sign-ins. Most attempts failed.

https://threatroundup.com/news/popcorn-time-updater-rce-disabled/ 2026-10-27T15:00:00+00:00 ThreatRoundup.com BleepingComputer High 0 1

Eye Security found Time4Popcorn's abandoned updater would run any file as SYSTEM or root, registered its domain and used it to switch the updater off. Android users remain exposed.

https://threatroundup.com/news/loblaw-breach-2-million-credit-monitoring/ 2026-10-27T14:59:00+00:00 ThreatRoundup.com CBC News High 0 0

Loblaw's CEO has apologized to about two million customers whose names, addresses, birthdates and purchase details were taken in a February breach, and is offering two years of TransUnion monitoring.

https://threatroundup.com/news/asus-router-firmware-cve-2026-93489/ 2026-10-27T14:58:00+00:00 ThreatRoundup.com Notebookcheck High 0 3

Asus fixed three High-rated router flaws, including CVE-2026-93489 (CVSS 8.7), that let someone on your network act as admin without a password. No attacks reported yet.

https://threatroundup.com/news/litellm-leaked-master-key-release-hijack/ 2026-10-27T14:57:00+00:00 ThreatRoundup.com The Hacker News High 0 0

LiteLLM says a master key leaked on GitHub in May and never revoked let an attacker steal maintainer tokens and ship a backdoored 1.107.0 to PyPI, Docker Hub and GHCR.

https://threatroundup.com/news/amazon-clickfix-finger-malware/ 2026-10-27T14:56:00+00:00 ThreatRoundup.com Huntress Medium 0 0

Huntress says a sponsored Google result led to a fake Amazon login and a ClickFix CAPTCHA that used finger.exe to install the Lumma infostealer and NetSupport remote access.

https://threatroundup.com/news/keystealth-device-code-phishing-kit/ 2026-10-27T14:55:00+00:00 ThreatRoundup.com ADAMnetworks Medium 0 0

ADAMnetworks details how a device code phishing kit let an operator register rogue Entra devices, sit in a company's Microsoft 365 account for seven weeks and attempt payment fraud.

https://threatroundup.com/news/prince-of-persia-iran-apt-us-c2/ 2026-10-27T14:54:00+00:00 ThreatRoundup.com Semperis Medium 0 0

Semperis says Iran-linked Prince of Persia (Infy) rebuilt its infrastructure after a February exposure and is now running a Tornado C2 server in the US for the first time in a decade.

https://threatroundup.com/news/etherrat-teams-fake-it-support-ethereum-c2/ 2026-10-27T14:53:00+00:00 ThreatRoundup.com bluecyber.hashnode.dev Medium 6 0

A Teams caller posing as IT talks victims into installing remote-access tools, then drops EtherRAT, a Node.js backdoor that looks up its command server in an Ethereum smart contract.

https://threatroundup.com/news/vbscript-malware-brazil-portugal-trusted-tools/ 2026-10-27T14:52:00+00:00 ThreatRoundup.com WatchGuard Medium 5 0

WatchGuard details three Brazil-linked campaigns, Overlord RAT, Lampion and a newdev.dll RAT, that start with VBScript and lean on built-in Windows tools and signed programs to stay hidden.

https://threatroundup.com/news/johns-hopkins-bayview-patient-data-ai-tool/ 2026-10-27T14:51:00+00:00 ThreatRoundup.com Hoodline Medium 0 0

Johns Hopkins Bayview is notifying 3,182 patients after an employee uploaded a spreadsheet of their records, including medications and record numbers, to an unapproved public AI tool.

https://threatroundup.com/news/php2shell-exploited-before-disclosure-madpot/ 2026-10-22T11:31:00+00:00 ThreatRoundup.com Amazon Threat Intelligence (AWS Security Blog) Critical 7 2

Amazon says a PHP2Shell exploit hit its MadPot honeypots on Oct. 17, four days before PHP disclosed CVE-2026-109618 and CVE-2026-109619. It now calls exploitation broad.

https://threatroundup.com/news/storm-0940-artex-connectwise-supply-chain/ 2026-10-22T11:30:00+00:00 ThreatRoundup.com Microsoft Threat Intelligence Critical 7 0

Microsoft ties the ConnectWise Cloud Backup supply-chain attack to China-aligned Storm-0940, which used ARTEX AI agents to try sign-ins to more than 2,250 Microsoft 365 tenants at up to 2,900 a minute.

https://threatroundup.com/news/gitlab-cvss-10-unauthenticated-rce/ 2026-10-22T11:29:00+00:00 ThreatRoundup.com The Hacker News Critical 0 4

GitLab fixed CVE-2026-110264, a CVSS 10.0 flaw in its bundled Ruby regex engine that could let unauthenticated attackers run code on self-managed servers as old as version 7.0. No exploitation seen yet, and no workaround.

https://threatroundup.com/news/cisa-safepay-ransomware-advisory-aa26-293a/ 2026-10-22T11:28:00+00:00 ThreatRoundup.com CISA High 9 5

A joint FBI, CISA and USSS advisory says SafePay ransomware has hit at least 600 victims since August 2024, getting in through stolen or guessed VPN logins and old Cisco ASA, SonicWall and Veeam flaws, then wiping backups before it encrypts.

https://threatroundup.com/news/nodejs-brotli-decoder-rce/ 2026-10-22T11:27:00+00:00 ThreatRoundup.com The Hacker News High 0 10

Node.js fixed an out-of-bounds write in its bundled Brotli decoder (CVE-2026-111497) that it says could allow remote code execution on 22.x, 24.x and 26.x. End-of-life versions get no patch.

https://threatroundup.com/news/lazarus-operation-flashhole/ 2026-10-22T11:26:00+00:00 ThreatRoundup.com Kaspersky Securelist High 9 0

Kaspersky says Lazarus abused South Korea's mandatory INISAFE CrossWeb EX security plug-in to break into at least three firms, using fake résumé sites, GitHub-based C2 and a post-quantum key exchange.

https://threatroundup.com/news/papercut-attacker-ai-toolkit-second-rce/ 2026-10-22T11:25:00+00:00 ThreatRoundup.com Hunt.io High 0 2

Hunt.io found the PaperCut mass-exploitation crew's AI agent prompts, exploit variants, credential stealers and victim access kits on an open server, plus a second RCE route through the XML-RPC API.

https://threatroundup.com/news/slaiclind-clickfix-etherhiding/ 2026-10-22T11:24:00+00:00 ThreatRoundup.com Stormshield Medium 7 0

Stormshield says hacked WordPress sites read C2 addresses from a Polygon smart contract, then show Windows visitors a fake Cloudflare check that leads to a stealer loaded through the Deno runtime.

https://threatroundup.com/news/vasilek-backdoor-vmware-tools-russian-healthcare/ 2026-10-22T11:23:00+00:00 ThreatRoundup.com The Hacker News Medium 0 0

Solar 4RAYS says Partisan Zmiy spent about two years in a Russian healthcare network, hiding the Telegram-controlled Vasilek backdoor and a fake service in an unmonitored VMware Tools directory.

https://threatroundup.com/news/russian-hackers-wipe-ukrainian-grain-firm/ 2026-10-22T11:22:00+00:00 ThreatRoundup.com The Record Medium 6 0

ESET says UAC-0099 phished into a Ukrainian grain logistics company and handed access to Sandworm, which wiped data, while a new Go backdoor hid its C&C inside the Yggdrasil mesh network.

https://threatroundup.com/news/africa-cybercrime-networks-disrupted/ 2026-10-22T11:21:00+00:00 ThreatRoundup.com BleepingComputer Medium 0 0

An Interpol-led operation across 21 countries arrested 1,462 suspects, dismantled 10,909 malicious networks and recovered more than $105 million from BEC, scam and ransomware crews, BleepingComputer reports.

https://threatroundup.com/news/chrome-gemini-scam-detection-clickfix/ 2026-10-22T11:20:00+00:00 ThreatRoundup.com BleepingComputer Info 0 0

Chrome's Enhanced Protection now checks copied commands for ClickFix scams, uses server-side Gemini to spot scam pages, and adds a softer suspicious-site warning.

https://threatroundup.com/news/pan-os-cve-2026-0257-qilin-inc-mfa-bypass/ 2026-10-21T12:47:44+00:00 ThreatRoundup.com The Hacker News Critical 0 2

Unit 42 says the Qilin and INC ransomware groups are using CVE-2026-0257, a GlobalProtect authentication bypass patched in May, to open VPN sessions without MFA and then move on to vCenter, ESXi and Veeam.

https://threatroundup.com/news/plex-media-server-exploited-cryptominer/ 2026-10-21T12:46:44+00:00 ThreatRoundup.com boredhackerblog Critical 0 4

Attackers are chaining four Plex Media Server bugs, now on CISA's exploited list, to drop a cryptominer and a traffic-relay proxy on servers that never got September's fix.

https://threatroundup.com/news/netscaler-cve-2026-88771-88779-chained-intrusions/ 2026-10-21T12:45:44+00:00 ThreatRoundup.com Rapid7 Critical 0 2

Rapid7 details intrusions where attackers chained CVE-2026-88771 and CVE-2026-88779 to get root on NetScaler ADC and Gateway, then planted HA-aware persistence and stole the appliance's credentials and keys.

https://threatroundup.com/news/php-cve-2026-109618-109619-critical-rce/ 2026-10-21T12:44:44+00:00 ThreatRoundup.com BleepingComputer Critical 0 2

PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21 to fix two critical bugs nicknamed php2shell, after details leaked early. Updated Oct. 25: Amazon says both bugs are now broadly exploited.

https://threatroundup.com/news/ovhcloud-cli-glassworm-backdoor/ 2026-10-21T12:43:44+00:00 ThreatRoundup.com OpenSourceMalware High 0 0

An attacker used a hijacked developer account to swap the binaries on five OVHcloud CLI releases for a build that steals cloud keys, SSH keys and AI-tool data. OVHcloud ties it to GlassWorm and says about 250 downloads happened in the 94-minute window.

https://threatroundup.com/news/rank-math-seo-plugin-backdoor/ 2026-10-21T12:42:44+00:00 ThreatRoundup.com BleepingComputer High 0 0

Rank Math PRO 3.0.123, served from the vendor's own site for about 11 hours on Oct. 15-16, carried a backdoor that creates hidden admins and rebuilds itself. Updating alone doesn't clean it.

https://threatroundup.com/news/connectwise-cloud-backup-supply-chain-attack/ 2026-10-21T12:41:44+00:00 ThreatRoundup.com Truesec High 0 0

An attacker used ConnectWise Cloud Backup's own app credential to sign in to 173 partner and customer Microsoft 365 tenants, per Huntress. ConnectWise has taken the service offline and disabled seven app identities.

https://threatroundup.com/news/apt28-nato-naval-shipbuilder-reflective-loader/ 2026-10-21T12:40:44+00:00 ThreatRoundup.com The Hacker News High 0 0

Symantec says Russia's APT28 breached a naval shipbuilder, a law enforcement agency and an aircraft-engine maker in two NATO countries, using the HOOKEDGE backdoor and a previously unseen reflective loader.

https://threatroundup.com/news/armory-castle-beyondtrust-exploitation/ 2026-10-21T12:39:44+00:00 ThreatRoundup.com Google Threat Intelligence Group / Mandiant Critical 8 1

Google and Mandiant say suspected Chinese espionage group ARMORY CASTLE has exploited a BeyondTrust Remote Support zero-day since late August. Once inside, it took root, dumped stored credentials and used the support tool to reach internal machines.

https://threatroundup.com/news/ahold-delhaize-cyberattack-us-europe/ 2026-10-21T12:38:44+00:00 ThreatRoundup.com BleepingComputer High 0 0

Ahold Delhaize, parent of Food Lion, Stop & Shop, Hannaford and Giant, is restoring websites and apps after a cyberattack disclosed Oct. 12. Stores are open and no data theft has been found so far.

https://threatroundup.com/news/unit42-ai-espionage-government-linux/ 2026-10-21T12:37:44+00:00 ThreatRoundup.com Palo Alto Networks Unit 42 High 12 2

Unit 42 says a cluster it calls CL-UNK-1211 spent six months in government Linux servers using AI-generated scripts, a new Go RAT and fake red-team markers, going after databases, mailboxes and linked social media accounts.