The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Japan's Onamae Desktop Cloud breached, up to 26,739 customer servers hit
GMO Internet's VPS service confirmed on Oct 20 that unauthorized programs were installed on customer servers. It began shutting servers down at 4:00 a.m. local time Oct 21, with no restart date. Payment data is stored separately and said to be unaffected. Customers are told to rotate any secrets…
-
LiteLLM 1.107.0 compromised on PyPI and Docker with a credential stealer and backdoor
Malicious wheels and Docker images ran a startup .pth file that stole cloud tokens, SSH keys, AI tool credentials and browser data, then installed a backdoor polling a GitHub dead drop. The attacker used stolen GitHub CLI OAuth tokens from three engineers, one triggering the release and another…
-
GitLab critical flaw, CVSS 10.0, unauthenticated RCE across 12 years of releases
CVE-2026-110264 is an integer overflow in the Onigmo regex compiler. It affects self-managed GitLab back to 7.0 (2014). Fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab.com is already fixed. GitLab reports no attacks so far and it is not in CISA KEV as of today.
-
Ransomware affiliates' exposed servers show AI used to plan intrusions (INC, The Gentlemen)
SOCRadar found open servers tied to INC and The Gentlemen affiliates holding 8,257 AI messages across 133 sessions, 46 victim-specific encryptor builds, and stolen credentials. Operators used OpenCode with hosted models to plan recon and organize stolen data, with humans approving each step. 62…
-
CISA, FBI and partners: SafePay ransomware has hit 600+ organizations and wipes backups
The advisory, co-signed by the FBI, Secret Service, and German and UK law enforcement, says SafePay has compromised at least 600 organizations across critical infrastructure sectors in North America, South America, Europe, and Australia since August 2024. Entry comes through exposed credentials…
-
Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it's unclear how the keys were compromised.
-
DHS orders federal civilian agencies to stop using DeepSeek
Published in the Federal Register Oct 20. Covers DeepSeek, affiliates, and third-party products built on its technology. Agencies must stop procurement and remove it immediately or file an exception within 60 days. CISA reviews exceptions. Does not restrict private or consumer use.
-
Conduent agrees to $80 million settlement over 2024 breach affecting about 62 million people
Settlement filed Oct 16 in a class action over the 2024 attack, allegedly by SafePay. Data exposed includes SSNs and medical details. Two subclasses (about 40 million and about 22 million). Cash up to $3,500 for documented fraud losses. Conduent denies wrongdoing and agreed to strengthen security…
-
Ahold Delhaize cyberattack still disrupting stores and apps in Europe and the US
Attack discovered the prior week. Albert Heijn, Etos, Gall & Gall, and Delhaize sites and apps went down, and Stop & Shop staff lost access to schedules and pay stubs. Stores stayed open. Albert Heijn deliveries resume Oct 23, US e-commerce "in the coming days." No evidence yet of stolen sensitive…
-
PHP warns of two critical RCE flaws; emergency patches due today 14:00 UTC (10:00 ET)
CVE-2026-109618 and CVE-2026-109619. PHP rates both CVSS v4 9.2; watchTowr says 10.0 and describes them as RCE affecting PHP 5 through 8. Affected versions are not yet official. No exploitation seen, and watchTowr reproduced one flaw but holds details until patches ship. PHP may release early if…
-
eMudhra certificate authority keys trivially recoverable; Mozilla, Google, Apple, Microsoft block them
Eight intermediate CA certificates (six TLS, two code signing) used P-384 private keys with values below 256, so anyone could derive them. A key-generation script error is blamed. Found Oct 17, browsers blocked the intermediates Oct 17 to 20, Mozilla asked for emergency distrust of the emSign ECC…
-
OVHcloud CLI releases hijacked on GitHub to steal developer secrets
Attackers used a hijacked developer GitHub account to alter existing CLI releases (v0.11.0 to v0.15.0). The bad release went up at 14:47 on Oct 19 and was blocked at 16:21 after a customer report. It pulled secrets from disk on macOS, Linux, and Windows. GitHub release immutability was off…
-
Stolen UpdraftCentral keys used to backdoor WordPress sites (TeamUpdraft breach)
TeamUpdraft, maker of UpdraftPlus, found unauthorized access to its website on Oct 17 and 18. The attacker likely took the customer database, including connection keys for UpdraftCentral. Patchstack says attacks began Oct 18, using stolen keys to add admin accounts and push at least 99 malicious…
-
Qilin and INC ransomware exploit Palo Alto PAN-OS flaw to bypass MFA and reach vCenter
CVE-2026-0257 (CVSS 7.8) is an authentication bypass in PAN-OS and Prisma Access that lets attackers open unauthorized VPN sessions. It was patched in May and added to CISA KEV on May 13, yet Unit 42 now ties it to Qilin and INC intrusions. In one case attackers moved from the gateway to vCenter…
Also covered by Help Net Security
-
CISA adds CVE-2026-96656 to KEV: Plex Media Server External Control of File Name or Path Vulnerability
Federal patch deadline 2026-10-23. Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
-
CISA adds CVE-2026-106931 to KEV: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
Federal patch deadline 2026-10-23. EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Also covered by BleepingComputer
-
ICSA-26-062-03: Hitachi Energy RTU500 Product (Update A)
Highest CVSS 7.5. Affects RTU500 series CMU Firmware. Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. Successful exploitation of these vulnerabilities can result in the exposure of low-value user management information and device outage…
-
ICSA-26-293-01: HMS Networks PEAK-System PCAN Windows drivers
Highest CVSS 7.1. Affects PEAK-System Device Driver Setup, PCAN Windows CAN device drivers. Successful exploitation of these vulnerabilities could crash the Windows kernel.
-
ICSA-26-293-03: Moxa AIG-302 ThingsPro Edge
Highest CVSS 8.1. Affects Moxa AIG-302 ThingsPro Edge firmware. Successful exploitation of these vulnerabilities could allow an attacker to obtain and disclose sensitive information.
-
ICSA-26-293-04: Hitachi Energy MicroSCADA X SYS600 Product
Highest CVSS 7.8. Affects MicroSCADA X SYS600. Hitachi Energy is aware of multiple vulnerabilities that affect MicroSCADA X SYS600 product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks on the product. Please refer to the Recommended Immediate…
-
ICSA-26-293-05: Hitachi Energy RTU500 Product
Highest CVSS 8.8. Affects RTU500 series CMU Firmware. Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to the…
-
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources…
-
Rank Math PRO WordPress plugin hit by supply chain attack
Paid Rank Math PRO copies distributed in a short window contained a backdoor that can recreate itself on affected sites. Details on the exact window and version are in the linked articles; confirm before quoting.
-
MITRE ATT&CK v20 adds AI abuse, MFA bypass, and water utility PLC attacks
Nine new Enterprise techniques include direct and indirect prompt injection, abuse of an organization's own AI agents for data theft, and theft of app-specific passwords that skip MFA. Coding-agent and IDE config files now count as compromised dependencies. ICS gets nine detection strategies, a…
-
Drupal warns critical core and contrib RCE flaws may be exploited fast
Five fixes: CVE-2026-108099 (Entity List 3.0.10) and CVE-2026-108097 (core Field UI, mitigate by uninstalling Field UI) are critical RCE and need other contributed modules to exploit, with at least one unauthenticated path each. Three XSS fixes. Core fixed in 11.4.10, 11.3.19, 10.6.19; older lines…