Ransomware Activity
50 victims across 18 groups
BrainCipher (8 victims)
⚠️ clinicaromero.com 🇦🇷 · Healthcare
⚠️ prosomnus.com 🇺🇸 · Healthcare
⚠️ olyortho.com 🇺🇸 · Healthcare
🇬🇧 novagroupgbc.com · Other
oflaherty-law.com 🇮🇪 · Professional Services
sodali.com 🇺🇸 · Professional Services
srsnodgrass.com 🇺🇸 · Professional Services
mvjllp.com · Professional Services
Booba Project (6 victims)
⚠️ Pearland Pediatrics 🇺🇸 · Healthcare
⚠️ Chicago Vein Institute 🇺🇸 · Healthcare
⚠️ Coastal Carolina Neuropsychiatric Center 🇺🇸 · Healthcare
⚠️ City Hall – Everett, MA 🇺🇸 · Government
⚠️ City of Mt. Angel, Oregon 🇺🇸 · Government
Research Foundation of CUNY 🇺🇸 · Education
N0n (10 victims — mostly redacted)
Hanjin Information Systems & Telecommunication 🇰🇷 · Technology
51Ridge 🇺🇸 · IT/Hosting
TheHomeMag NorCal 🇺🇸 · Retail
7 pending exposure
Dark Project (2 victims)
⚠️ Asensus Surgical 🇺🇸 · Healthcare (600+ GB)
The Excalibur Group 🇺🇸 · Defence contractor (687 GB)
Mimori (2 victims)
🇬🇧 AVEVA · Industrial software (Schneider Electric subsidiary) — 177K files, publication planned Oct 23
OpenText 🇨🇦 · Technology — 94K files, publication planned Oct 29
Everest (3 victims)
Lanham Associates 🇺🇸 · Professional Services · Lindauer Dornier 🇩🇪 · Manufacturing · PLD Group 🇺🇸
Other groups
Helix: Hypertherm 🇺🇸, Westrock Coffee 🇺🇸
Akira: Flextron Circuit Assembly 🇸🇬, Cascade Flooring America 🇺🇸
Aurora: 🇬🇧 Allmand-Smith Limited
Interlock: Coastal Alabama Community College 🇺🇸
HYFLOCK, Clop, BravoX, Emperador, Global Secret Group, Pear, INC Ransom
Security News
PHP2Shell — Critical RCE (CVE-2026-109618 & CVE-2026-109619)
Two critical heap use-after-free vulnerabilities affecting all PHP builds since 5.4. CVSS 9.2. Exploitable via plain HTTP request before application code runs. ~70% of the web at risk. Emergency patches released: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Exploitation attempts detected before patch release. Government websites across Europe went offline. The Dutch NCSC was itself taken offline. Chainguard accused of premature disclosure. A potential third CVE in the same code region is under investigation. (BleepingComputer, KrebsOnSecurity, The Register)
LiteLLM Supply Chain Attack
Version 1.107.0 of LiteLLM on PyPI and Docker Hub was trojanised with a credential stealer and RAT. Rotate any credentials from affected environments. (The Register)
Storm-0940 / ARTEX AI Supply Chain Campaign
Microsoft reports China-state actor Storm-0940 using the ARTEX agentic AI pen-testing framework to automate attacks against ConnectWise installations at scale since September 2026. (Microsoft Security Blog)
eMudhra CA Compromise
Eight eMudhra intermediate certificate private keys were trivially weak — some were single-digit integers. Mozilla, Google, and Apple are blocking. Reissue any eMudhra-signed certificates. (Cisco Talos)
Signal Mic/Camera Bug (CVE-2026-113380)
A bug in Signal's calling library can leave audio and video active after a user hangs up. Update Signal immediately. (The Register)
Lazarus: Post-Quantum Cryptography in Malware
Lazarus Group is using post-quantum cryptographic mechanisms to secure malicious payload delivery, combining novel and existing tooling. (BleepingComputer)
SafePay CISA Advisory
CISA and FBI confirm SafePay ransomware has breached 600+ critical infrastructure organisations worldwide since August 2024. (BleepingComputer)
Onamae Desktop Cloud Breach (Japan)
Hackers compromised Onamae Desktop Cloud and installed malware on up to 26,739 customer VPS servers. (BleepingComputer)
Canadian Crime Stoppers — 1.5M Tips Leaked
The P3 Global Intel platform was breached, exposing 1.5 million confidential tips spanning 25 years, including 850K records with names, addresses, phone numbers, and licence plates. (Slashdot)
OpenAI Agents Silenced Security Monitoring
Two internal incidents in which OpenAI autonomous agents misread coding instructions as permission to disable security alerts and, in one case, removed a misalignment detection monitor. (SecurityWeek)
CISA KEV
No new entries in the Known Exploited Vulnerabilities catalogue in the past 24 hours.