Security News
Massive Leak Exposes 41,000 Homeland Security Workers (Slashdot) — Data from DHS's Okta login system exposes approximately 41,000 employees and contractors including around 10,000 ICE personnel: phone numbers, email addresses, office locations, reporting structures, and permission groups.
CISA Warns of Node2Shell Exploitation (BleepingComputer) — CISA added the critical Brotli vulnerability (Node2Shell / HTTP2Shell / Broccoli2Shell) to the KEV catalogue; honeypots logging active exploit attempts.
Hackers Probe Oracle EBS CVE-2026-101767 (SecurityWeek) — Unauthenticated SQL injection enabling RCE; active scanning underway within days of patch release.
China-Linked Hackers Exploit PHP2Shell to Root Firewalls (SecurityWeek) — Chained PHP2Shell and Fragnesia exploits compromised two servers of a US government-affiliated organisation.
Volt Typhoon's Silent Train Zero-Day Framework (BleepingComputer) — Chinese state group using rotating chains of compromised edge devices to mask zero-day attacks, complicating attribution.
GitLab Security Incident: CVE-2026-97229 (Hacker News) — Attempted exploitation detected and contained; self-managed GitLab admins should patch immediately.
Police Seize Virtualine Bulletproof Hosting (BleepingComputer) — FBI-led operation seizes domain tied to ransomware, money laundering, and CSAM distribution.
Japan Airlines Data Breach — 2,000 Customers (The Record) — Passport numbers, frequent flyer IDs, and contact details exposed.
Sony Network Communications Breach — 2.5 Million Records (BleepingComputer) — Sony's ISP subsidiary confirms exposure of current and former customer personal information.
Nefilim & Hive Affiliate Gets 70 Months (The Register) — Ukrainian national Artem Stryzhak sentenced by New York federal court for attacking hospitals and government entities with ransomware.
CISA Known Exploited Vulnerabilities
Node2Shell (Brotli / HTTP2Shell / Broccoli2Shell) — Added 28 October 2026. Active exploitation confirmed. Patch immediately across all systems using Brotli-linked services. See: cisa.gov/known-exploited-vulnerabilities-catalog
UK & Regional Highlights
123 Reg "AI Cyberattack" — China Nexus Suspected (The Register) — UK domain registrar discloses breach of customer contact info, VAT numbers, and relationship data. Attribution points toward China.
UK Budget: Software Companies Could Face Cyber Liability (The Record) — UK government signals intention to consider placing legal liability for cyber breaches on software vendors — a potential landmark regulatory shift.
Ransomware Activity
12 victims · 8 groups
Barracuda
Femern Link Contractors 🇩🇰 ⚠️ Critical Infrastructure — Fehmarnbelt tunnel joint venture (Denmark–Germany). Access from 17 September 2026. 2.44TB / 1.5M files exfiltrated: construction plans, engineering designs, procurement, employee data. All vCenter VMs encrypted. $500,000 demand.
SilentRansomGroup
Morrison Foerster 🇺🇸 — Major international law firm. Privileged client data at risk. Plus 3 further redacted victims pending extortion timers.
Rhysida
Noelker and Hull Associates 🇺🇸 ⚠️ Healthcare-Adjacent — Pennsylvania architecture firm specialising in healthcare/senior living design. Clients: Penn State Health, WellSpan, UPMC, Select Medical, Tower Health. Claims: 60+ SSNs, AJera ERP payroll SQL, executive ID packages, 26GB email, active litigation.
Wallstreet
Fortrex 🇺🇸 — North American food safety/sanitation for USDA/FDA-regulated processing facilities.
Global Secret Group
The Anglican International School 🇮🇱 — 218GB / 257,960 files.
Panzer
PQE Group 🇮🇹 — Life sciences technology and compliance consulting. Florence-based.
Payload
Hauhinco 🇩🇪 — High-pressure water hydraulics for mining and industry.
Marbre Design 🇫🇷 — Natural stone processing.
N0n
Company #112 🇲🇾 — Redacted Malaysian telecommunications company; identity pending.