News · SANS NewsBites
-
SANS NewsBites
Apple Updates Include Security Fix for iOS & iPadOS 18
On Monday, October 26, Apple published updates for all its operating systems and for the Safari browser, addressing a total of 304 security vulnerabilities. This release includes a backported fix for a high-severity flaw affecting older versions of iOS and iPadOS, which was already addressed in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 on September 28, and was known to b…
-
SANS NewsBites
CISA 2030 Strategy Focuses on Leadership, Protection, and Resilience
The US Cybersecurity and Infrastructure Security Agency (CISA) has published an agency strategy document titled, "CISA 2030: Defend, Harden, Prevail." The guidance is structured around these three pillars, and is motivated by a need to "transform [CISA's] operational model to advance collective cyber defense, harden infrastructure most essential to [US] national and economic security, and mobiliz…
-
SANS NewsBites
University of New Mexico Health System Disrupted by Cyber Incident
Operations at the University of New Mexico Health System in Albuquerque — which includes the UNM Health Sciences Center (HSC) and more than 30 UNM Health clinics — have been disrupted by a cyber incident that took place on Monday, October 26. Between 12:30pm and 2:30pm MDT, UNM Health was forced to cancel all appointments, divert ambulances, stop accepting new patients, and suspend outpatient sur…
-
SANS NewsBites
Quest Diagnostics Patient Records Breached
Quest Diagnostics has published a notice and an FAQ informing providers and patients of a cyber incident in which the company's Quanum Lab Services Manager (LSM) system was accessed without authorization. Quanum LSM is a platform used by healthcare providers to centralize tasks and information related to labs, supplies, specimens, test results, pricing, billing, and other functions. The company's…
-
SANS NewsBites
Brotli Emergency Patches Arriving For Multiple Products
A critical vulnerability in the Brotli compression library has been addressed in patches from Google, Brotli's developer and maintainer, that are being incorporated into downstream emergency patches by developers whose products use Brotli. Aikido Security explains that "the root cause was fixed in the Brotli source code in February [2026], but it wasn't recognized as a security issue at the time…
-
SANS NewsBites
Update Now: Eight Maximum-Severity Flaws in HPE AOS 8 & 10
Hewlett Packard Enterprise (HPE) has published a security advisory addressing 72 vulnerabilities — eight of which carry a CVSS score of 10.0 — that affect HPE Networking Wireless Operating Systems for Mobility Conductors, Controllers, Gateways, and Access Points, specifically ArubaOS (AOS) 8 and 10. HPE notes that "any hardware, Mobility solutions (such as conductors, controllers, and gateways),…
-
SANS NewsBites
UK Proposes Modern Laws to Protect Undersea Cables
The UK Government's Department for Digital, Culture, Media and Sport is calling for an overhaul of the legislation protecting critical undersea infrastructure (CUI), proposing modernizations for existing laws that "[have] not been updated to reflect technological advances, the growing importance of undersea infrastructure, or the evolving threat environment." The proposal's section on criminal pe…
-
SANS NewsBites
Nearly 11.75 Million Capcom Accounts Breached
Japanese video game company Capcom has published a notice disclosing a recent breach of its CAPCOM ID membership service. On October 19, the company detected and blocked unauthorized access, implemented emergency measures, and launched an investigation into the cause, scope, and method of attack involved. On October 20, the company reported the incident to the Information Technology Security Over…
-
SANS NewsBites
Top Note
The articles in this issue of NewsBites reflect a historic and bruising week in cybersecurity. Trends in AI-accelerated vulnerability discovery came to a head with Wednesday’s PHP emergency, while serious flaws and supply-chain attacks kept coming, and agentic cyberattacks are already underway. We’re all feeling it. Defenders are working around the clock. Rumors are flying, and mainstream journal…
-
SANS NewsBites
State Bank of India Customers’ PII Leaked on Dark Web
The State Bank of India (SBI) has filed a legally mandatory disclosure with India's National Stock Exchange and BSE Limited, describing a recent "incident involving data loss." On October 16, SBI was notified by CERT-In and by the Defense Cyber Agency, SBI's threat intelligence service provider, that SBI customer information may have been exposed on the dark web. Analysis confirmed that "of appro…
-
SANS NewsBites
INTERPOL Disrupts Cybercrime Operations in 20 African Countries
INTERPOL has published an announcement describing the accomplishments of its recent cybercrime crackdown effort throughout Africa known as "Operation Serengeti III," which involved law enforcement from 21 countries and took place between June 29 and August 31, 2026. The operation targeted "cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion," and r…
-
SANS NewsBites
LiteLLM Supply Chain Compromised
A malicious version of LiteLLM (1.107.0) containing an infostealer and remote access trojan (RAT) was distributed in PyPI wheels and Docker images on Wednesday, October 21, after the software's release pipeline was compromised. The malicious version was live in PyPI from 11:39 UTC to 13:23 UTC and in Docker from 11:46 UTC to 14:20 UTC; PyPI has now quarantined the package, and Docker has removed…
-
SANS NewsBites
eMudhra Issues Certificates With Weak Private Keys; Update Python Packages to Fetch Safe Certificates
India's largest licensed digital certifying authority, eMudhra, has announced that it will voluntarily exit the global SSL/TLS certificate business following the discovery that the company had issued eight intermediate certificate authority (CA) certificates whose P384 private key numbers were found to be one byte or less in size. On October 17, a researcher reported to eMudhra and major root pro…
-
SANS NewsBites
Update GitLab CE/EE to Fix Maximum-Severity Flaw
On October 21, GitLab issued an emergency patch release addressing 12 flaws in GitLab Community Edition (CE) and Enterprise Edition (EE), including one maximum-severity vulnerability; this is separate from the maximum-severity flaw addressed in the October 12 release (described in NewsBites 28.76). CVE-2026-110264, CVSS score 10.0, allows an unauthenticated attacker to execute arbitrary code on a…
CVE-2026-110264 -
SANS NewsBites
Update PHP Immediately to Fix Critical Flaws
At 14:00 UTC on Wednesday, October 21, the PHP Foundation publicly released fixes for two vulnerabilities that allow unauthenticated remote code execution (RCE) in all versions of PHP, together dubbed "PHP2Shell." Both flaws carry CVSS score 9.2 and are known to be under attempted exploitation in the wild. CVE-2026-109618 allows RCE through out-of-memory corruption: An attacker can time a request…
CVE-2026-109618 -
SANS NewsBites
Data Cymru Breached in 2024 with Account “Test2” and “Password1”
The UK Information Commissioner's Office (ICO) has issued reprimands to Local Government Data Unit - Wales (Data Cymru) and to Data Cymru's IT provider, Ogi Networks Limited (ONL), for security failures under the General Data Protection Regulation (GDPR) that led to a 2024 ransomware attack in which a threat actor stole information belonging to 3,300 people, the majority of whom are children. The…
-
SANS NewsBites
Five Existing OVHcloud CLI Releases Compromised
In a social media post, Octave Klaba, the CEO of French cloud provider OVHcloud, urged users to quickly update to the latest version of OVHcloud CLI or else remove it entirely, because existing versions 0.11.0 through 0.15.0 had been compromised and contained secret-stealing malware. The attacker used a GitHub account belonging to a developer and was able to directly modify existing releases with…
-
SANS NewsBites
North American Utilities Offered Free Cybersecurity Support
500 eligible utilities in North America will have the opportunity to seek free cybersecurity support in the first phase of the Community Cyber Resilience Foundation, a program launched on October 20, 2026 by Dragos, Accenture, and the SANS Institute. Citing the prevalence of recent cyberattacks on critical infrastructure, the foundation aims to offer five main types of free assistance to build re…
-
SANS NewsBites
23andMe Settles with CA DOJ — Californians Can Still Request Deletion
Chrome Holding Company, a name assumed by 23andMe in the wake of the company’s bankruptcy in March 2025, will pay $6 million to settle a lawsuit brought by the California Department of Justice, which contended "that 23andMe violated California law because its unreasonable data security practices led to the 2023 data breach and that the company made certain misrepresentations that misled its custo…
-
SANS NewsBites
AOMEI Backupper Updates Compromised in Ten-Minute Bursts
From April to July, 2026, attackers tampered with the supply chain for AOMEI Backupper software in short bursts of five to ten minutes at a time, adjusting configuration files to deliver backdoor malware. AOMEI is a provider of disk management software, and Backupper is the company's backup software for Windows systems. Google Threat Intelligence Group (GTIG) explains that "the threat actor modif…
-
SANS NewsBites
ConnectWise Temporarily Suspends Cloud Backup After M365 Credential Used to Access M365 Environments
Late last week, ConnectWise published an advisory noting that it "identified unauthorized access to application identities within the ConnectWise Cloud Backup [formerly known as SkyKick] environment." In response, ConnectWise decided to temporarily suspend service to several ConnectWise application identities: ConnectWise Cloud Backup; ConnectWise Cloud Management; ConnectWise Cloud Management -…
-
SANS NewsBites
Follow-up: Ahold Delhaize Cybersecurity Incident
Netherlands-based multinational grocery store company Ahold Delhaize has published an update regarding a previously disclosed cybersecurity incident that has disrupted systems at multiple stores in the EU and the US. Ahold Delhaize disclosed the incident on Monday, October 12. After discovering the incident, the company engaged third-party cybersecurity experts. A subsequent investigation has det…
-
SANS NewsBites
Florida DMV Begins Notifying Individuals Affected by September Breach
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has begun notifying people whose data were compromised in a breach last month. FLHSMV became aware of the breach on September 4, at which time the department took steps to mitigate the incident, brought in third-party cybersecurity experts, and launched a coordinated investigation with the Florida Digital Service and Florida Dep…
-
SANS NewsBites
F5 Patches Critical Flaws in NGINX
On Wednesday, October 14, F5 published a security advisory that addresses 11 vulnerabilities in NGINX. CVE-2026-15176 and CVE-2026-93479, both with CVSS scores of 9.2, are heap-based buffer overflow issues in NGINX Plus and NGINX Open Source. SCWorld writes that "these flaws can be exploited by unauthenticated attackers through crafted HTTP requests, potentially leading to denial-of-service condi…
CVE-2026-15176, CVE-2026-93479 -
SANS NewsBites
Update Plex Media Server to Patch Against Exploited Vulnerability Chain
One high-severity and three medium-severity fixed flaws in Plex Media server were under exploitation in the wild within a day of a researcher publishing proof-of-concept (PoC) details for the exploit chain. When Plex first published the September 1 advisory recommending users update to Plex Media Server 1.43.3 and Plex Desktop 1.115.0 (described in NewsBites 28.67), these four flaws were still aw…
-
SANS NewsBites
ICS Patch Tuesday: Siemens, Schneider Electric, Rockwell Automation, and more
Last week, multiple vendors released updates for industrial control systems (ICS) products. Siemens published 17 advisories, which include fixes for some of the vulnerabilities, and suggested mitigations for others, which users are urges to apply until patches are available. On Monday, October 19, Siemens confirmed “that there is an active exploitation of CVE-2026-110936, a DLL side-loading vulne…
CVE-2026-110936 -
SANS NewsBites
Anne Arundel County Discloses August 2026 Ransomware Attack
Officials in Anne Arundel County, Maryland, have disclosed that data from government systems were stolen during an August 2026 cybersecurity incident. A spokesperson for the county said that they detected anomalous activity on August 28, and that subsequent investigation "determined that an unauthorized actor gained access to a limited number of systems and copied certain files from those systems…
-
SANS NewsBites
US Bankruptcy Courts Offline After Cyber Incident at IT Contractor
BAE Systems Inc. — a US defense contractor and independent subsidiary of British defense contractor BAE Systems plc (standing for British Aerospace) — has been impacted by a cybersecurity incident causing outages for IT managed by the company, including infrastructure for the US Bankruptcy Noticing Center (BNC). The US Federal Courts website published a notice on October 15 explaining that "all a…
-
SANS NewsBites
BeyondTrust Remote Support Vulnerability Exploited
Threat intelligence reports and security advisories from BeyondTrust, Google Threat Intelligence Group (GTIG), and Mandiant describe exploitation of a critical flaw affecting BeyondTrust Remote Support up to and including version 26.2.3. This exploitation was allegedly conducted by a threat actor associated with the Chinese government, months before the vulnerability was patched. CVE-2026-102764,…
CVE-2026-102764 -
SANS NewsBites
UK Legal Aid Agency Breach Update
A breach of the UK's Legal Aid Agency (LAA) was identified in April 2025. Several weeks after the incident was detected, LAA discovered "that the attack was more extensive than originally understood and that the criminal group behind it had accessed and exfiltrated a significant amount of personal data." The breach disrupted LAA's online services, which were not restored until December 2025. LAA'…
-
SANS NewsBites
Targeted Ads Serve Mercenary Spyware Without User Interaction
Researchers from the Citizen Lab at the University of Toronto have published a report investigating spyware campaigns that use targeted ads to deliver mercenary spyware without user interaction required. Citizen Lab calls this "the first public technical confirmation" of this attack technique, dubbed "AdFection," which uses the real-time bidding (RTB) process to push a malicious ad to a browser o…
-
SANS NewsBites
Follow-up: Supermarket Refrigeration Controller Cyberattack Targeted Devices from Multiple Vendors
The recent attack against internet-connected controllers for freezer, refrigeration, and cold storage room units in French supermarkets targeted not only AK-SC and AK-SM series devices from Danfoss, but also XWEB devices from Dixell and its parent company Copeland. The attackers manipulated the appliances' defrost mechanisms, causing them to reach temperatures of up to 50° Celsius (122° Fahrenhei…
-
SANS NewsBites
Microsoft and Health-ISAC Disrupt Chinese Criminal Marketplace Platforms
Microsoft, Health-ISAC, and Japan’s National Police Agency (NPA) have worked together to dismantle three components of "a sprawling Chinese-language cybercrime marketplace where criminals could buy accounts, hosting services and tools used to create fake websites and online identities." Those components — CoGUI, Iron Man, and YAM Store — are responsible for sending more than one billion malicious…
-
SANS NewsBites
Agents Deployed to Waste Scammers’ Time and Collect Information
A startup based in Sydney, Australia is using AI agents to engage with scams via phone, email, web browser, and social media to gather fraud intelligence while taking up the scammers' time and resources. This implementation stems from university research into the use of machine learning to collect specific content from scam calls, such as "bank accounts, crypto wallets, phone numbers, malicious w…
-
SANS NewsBites
Ivanti Patches Actively Exploited Vulnerability in Connect Secure
Researchers at Volexity have "identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices." On Tuesday, October 13, Ivanti released updates to address two of the three flaws in the exploit chain: a high-severity authentication bypass and a remote code execution vulnerability in Ivanti Connect Secure (CVE-2…
-
SANS NewsBites
Cisco Vulnerability Exploited (CVE-2026-76519)
On Wednesday, October 14, Cisco published a security advisory addressing a critical path traversal vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway (CVE-2026-76519, CVSS score 9.8). The vulnerability "could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system, ... [and] is due to improper handling of emai…
CVE-2026-76519 -
SANS NewsBites
Microsoft Releases 1,400+ Patches and “Risk Cohorts” System
Microsoft's Patch Tuesday release for October 2026 addresses at least 1,413 vulnerabilities in its products — surpassing September's record count of 974 — including a fix for one flaw disclosed prior to its patch and one flaw known to be under active exploitation at the time of disclosure. CVE-2026-96951, CVSS score 8.8, allows an unauthorized attacker to bypass the Mark of the Web (MoTW) securit…
CVE-2026-96951 -
SANS NewsBites
Operation Lonestar Roundup: NK Laptop Farm Disrupted, 14 People Charged
In Texas, FBI agents searched more than 40 residences and seized 187 laptops and KVM devices associated with a laptop farm for Democratic People’s Republic of Korea (DPRK) citizens pretending to be US citizens working remotely at IT jobs at US firms. According to a US Justice Department press release, "DPRK IT workers applied for and obtained remote positions by using stolen or fabricated identit…
-
SANS NewsBites
FBI Arrests Cyber Exec on Suspicion of ShinyHunters Conspiracy
Following a threat actor's defacement of FBIjobs[.]gov, the claimed theft of FBI agents' sensitive personal information, and the bureau's termination of a third-party contractor whose unpatched system may have allowed the breach, FBI Director Kash Patel announced on social media on October 9 that "another suspected co-conspirator" had been arrested. While the announcement does not give additional…
-
SANS NewsBites
iRhythm Breach Affects at Least 360,000 Individuals
iRhythm, a manufacturer of cardiac monitoring devices, says that a June cybersecurity incident compromised personal information, including Protected Health Information (PHI) belonging to at least 360,000 individuals. The company has filed breach notices in several US states, including California, South Carolina, and Texas; the notices say the incident occurred in June 2026, and that the data comp…
-
SANS NewsBites
Let's Encrypt Certificate Life Cycle Change Schedule
Open Certificate Authority (CA) Let’s Encrypt will be shortening the lifecycle of its certificates starting early next year. Currently, Let's Encrypt certificates have a 90-day lifespan. As of February 10, 2027, all certificates issued by Let’s Encrypt will expire after 64 days by default, and subscribers will have the option of choosing shorter lifespans for their certificates. Let's Encrypt wri…
-
SANS NewsBites
Patch Now: GitLab CE/EE Max-Severity Flaw
GitLab's Critical Patch Release on October 12, 2026, released GitLab Community Edition (CE) and Enterprise Edition (EE) 19.4.2, 19.3.4, and 19.2.8, including a fix for one maximum-severity and five high-severity flaws. CVE-2026-97229, CVSS score 10.0, allows an unauthenticated attacker to execute arbitrary code on the GitLab server by using a specially crafted regular expression to exploit insuff…
CVE-2026-97229 -
SANS NewsBites
Cyberattacks on Food Retailers: Ahold Delhaize Takes Some Systems Offline; Danfoss Freezers in French Supermarkets Sabotaged
In a Monday, October 12 press release, Netherlands-based food retailer Ahold Delhaize confirmed that it took some of its IT systems offline following a cybersecurity incident. While the company said its "stores are open and serving customers," reports from its US Stop & Shop supermarkets indicate that employees are experiencing difficulties accessing schedules and paystubs, and customers have rep…
-
SANS NewsBites
Judge Imposes 32-Month Sentence on Former Employee for Extortion and Damaging Protected Computer
A US District Judge in New Jersey has sentenced Daniel Rhyne to 32 months in prison for intentionally damaging his former employer's IT networks and attempting to extort his co-workers by threatening to shut down servers. Rhyne was employed "as a core infrastructure engineer at a U.S.-based industrial company headquartered in New Jersey." Court documents indicate that between November 8 and Novem…
-
SANS NewsBites
Qilin Suspect Extradited to Germany from Japan
A 28-year-old Russian man arrested in Japan on suspicion of involvement with an attack by the Qilin ransomware gang against a German company has now been extradited to Germany. In May 2026, the cyber special investigation department of the Japanese National Police Agency (NPA) collaborated in an investigation with police departments in Tokyo, Osaka, and Kyoto to initially determine the suspect's…
-
SANS NewsBites
FBI Seizes Malicious Chinese Web Domains Related to Flax Typhoon
The US Federal Bureau of Investigation (FBI) has seized seven domains that support hacking tools used and operated by Chinese security firm Integrity Technology Group (Integrity Tech), which has ties to the government of the People's Republic of China (PRC). The tools have been used to scan and, in some cases, break into critical infrastructure and other networks around the world. Court documents…
-
SANS NewsBites
CrowdStrike Investigation of Cyberattacks on South Korean Banks May Have Turned Up Information That Identified Hacker
While investigating a series of AI-assisted cyberattacks targeting South Korean financial institutions, researchers at CrowdStrike "identified infrastructure associated with a targeted campaign ... that resulted in exfiltrated data." The campaign ran from late September through early October 2026. CrowdStrike writes that "the threat actor leveraged ARTEX, a recently released open-source agentic p…