Security News
Code-execution flaw in UEFI firmware threatens most servers on planet Earth (Ars Technica) — CVSS 9.5 RCE in TianoCore EDK II boot firmware; no patch timeline confirmed yet.
CISA confirms PHP2Shell vulnerabilities now exploited in attacks (BleepingComputer) — CVE-2026-109618 and CVE-2026-109619 added to KEV; federal agencies must patch by Thursday 30 October.
UNM Health ransomware attack disrupts patient care, surgeries (BleepingComputer) — Day 2: medicine, nursing, and pharmacy classes cancelled; ambulance diversions and surgery suspensions on day 1.
Tailscale rushes patches after uncoordinated disclosure of 'Tailworm' flaws (SecurityWeek) — Nearly a dozen SSH vulnerabilities including root privilege escalation went public before patches were ready.
Japan's GMO urges customers to shut down PCs amid ransomware threat (BleepingComputer) — Live ransomware threat against Onamae Desktop Cloud customers; disconnect and shut down advised.
Hackers hijack Convertr analytics script to steal payment card data (BleepingComputer) — Supply chain skimmer injected into shared analytics script hitting e-commerce merchants at checkout.
External Teams chats anchor 15-minute malware delivery (Dark Reading) — Email bombing + external Microsoft Teams messages linked to Black Basta delivering malware within 15 minutes.
Energy giant ENGIE discloses data breach affecting customers (BleepingComputer) — Attackers breached a marketing platform used by business partners; customer data stolen.
HPE patches dozens of critical flaws in networking products (SecurityWeek) — Eight max-severity flaws allow RCE and authentication bypass across HPE networking equipment.
AI 'hacker' finds 4 severe bugs in EPICS ICS software in under 4 hours (The Register) — Autonomous AI agent discovered critical RCE and other severe flaws in widely used industrial/scientific control software.
'Aokigahara' stealer targets developer keyrings and AI assistants (Dark Reading) — New infostealer harvests keyring credentials, AI session tokens, and business data from developer endpoints.
Cybersecurity CEO indicted for allegedly scamming millions from ransomware victims (Slashdot/ProPublica) — Zohar Pinhasi of MonsterCloud charged with paying ransoms directly while billing victims for fake decryption services.
Hackers repeatedly breached suppliers holding UK police data, watchdog finds (The Record) — HMICFRS confirms multiple breaches of British police data through third-party IT suppliers this decade.
iOS, macOS 27.2 patch 286 bugs; CoreGraphics zero-day backported to iOS 18 (SecurityWeek) — Apple releases broad update; exploited CoreGraphics flaw extended to older iPhones.
Attack on AfD email hosting provider exposed 345,000 accounts (The Register) — Confidential emails, attachments, and 345,439 unique addresses from Germany's AfD confirmed by HIBP.
CISA Known Exploited Vulnerabilities
CVE-2026-109618 — PHP: Remote code execution vulnerability. Federal patch deadline: 30 October 2026.
CVE-2026-109619 — PHP: Remote code execution vulnerability. Federal patch deadline: 30 October 2026.
HaveIBeenPwned
AfD (Alternative für Deutschland) — Added 27 October 2026 — 345,439 accounts. Attack on the party's email hosting provider exposed addresses and confidential communications.
Ransomware Activity
22 victims across 7 groups in the past 48 hours.
Booba Project — 10 victims
⚠️ Horizon Eye Specialists & LASIK Center 🇺🇸 — Healthcare
⚠️ BASS Medical Group 🇺🇸 — Healthcare
⚠️ King Family Medical 🇺🇸 — Healthcare
⚠️ Aesthetic Specialty Centre 🇵🇰 — Healthcare
⚠️ Charter Township of Commerce 🇺🇸 — Government & Defense
⚠️ City of Big Spring 🇺🇸 — Government & Defense
Hudson River Museum 🇺🇸 — Education
Regent Christian Online Academy 🇨🇦 — Education
Kerckstede vzw 🇧🇪 — Other
Play — 7 victims
Tailormade Logistics 🇩🇰 — Transportation
⚠️ Hygiena 🇺🇸 — Healthcare
Money Concepts Capital 🇺🇸 — Financial Services
VPC Builders 🇺🇸 — Professional Services
Coast 2 Coast 🇺🇸 — Retail
MicroSearch — Technology
QLC 🇺🇸 — Technology
Wallstreet — 1 victim
⚠️ Bristol City Council 🇬🇧 — Government & Defense
Direwolf — 1 victim
⚠️ Grupo Petroil 🇲🇽 — Energy & Utilities
Rhysida — 1 victim
Machelen 🇧🇪 — Unknown
Whitearmor — 1 victim
wagyu.xyz — Retail/Gaming
Emperador — 1 victim
TWICE SRL — Unknown