Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Executive Summary
Arista has patched a maximum-impact zero-day in its VeloCloud Orchestrator (CVE-2026-114625, CVSS 9.9) that attackers were already exploiting against SD-WAN management planes — the third VeloCloud flaw exploited since late July, and the first that needs only the lowest built-in customer role, Enterprise Read Only, to reach full operator control. In the same 24 hours, Microsoft attributed the ConnectWise Cloud Backup supply-chain campaign to a Chinese state-aligned actor, Storm-0940, which used an open-source agentic AI penetration-testing framework called ARTEX to run password sprays at up to 2,900 sign-in attempts per minute and reach privileged cloud access in under three hours at multiple victims. The PHP emergency patch cycle turned into a pre-disclosure story: Amazon's threat-intelligence team says it saw a PHP2Shell exploitation attempt on 17 October, four days before the flaws were published, and publicly available proofs of concept appeared about twelve hours before the scheduled release. Capcom, meanwhile, confirmed a breach of its CAPCOM ID membership service affecting 11.7 million accounts.
The ACSC's newest publication is an [alert of 21 October](https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php) on the critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), sitting above an alert of 14 October on operational technology and edge devices and an advisory of 9 October on Chinese government-linked actors combining automated and hands-on intrusion tooling. For Australian organisations running PHP-backed web estates — WordPress, Drupal, Joomla and Magento dominate local content platforms — the ACSC alert converts a global patch race into a domestic one, and reporting from Amazon Threat Intelligence that exploitation attempts predate disclosure removes the usual assumption of a grace period. The joint CISA/FBI advisory on SafePay, published 20 October with German and UK partners, explicitly names Australia among the regions the group has hit, and attributes at least 600 critical-infrastructure victims to it since August 2024. Domestically, a class action filed in the Federal Court by MinterEllison on behalf of eight plaintiffs alleges Meta harmed users while they were under 18 — the first Australian suit to blame social-media design rather than a data incident — and arrives alongside the under-16 social-media ban and proposed algorithm-toggle rules. As always, the OAIC publishes no per-incident breach register: its notifiable-data-breach material is an aggregate dashboard updated roughly twice yearly, so no individual notification can be asserted from it either way.
Across the seven days to 22 October (16–22 October) the corpus carried 83 stories, dominated by malware (21), breach and data-leak items (20), zero-day and vulnerability coverage (18) and ransomware (11), with nation-state and OT/ICS activity at four each. Geographically, 41 stories centred on the United States, 20 were multi-region, 17 had Australian relevance and three were European. The week's through-line is the industrialisation of attack automation: Storm-0940's use of ARTEX agents, Zscaler's finding that the same campaign reached dozens of industries beyond South Korea and Japan, and the targeting of AI infrastructure itself — Railway's environment-variable compromise, LiteLLM's hijacked release pipeline, and LLMjacking economics where victims pay for an attacker's GPU time. A second pattern is disclosure compression. PHP2Shell was exploited before it was patched, KSMBD's two CVSS 9.0 flaws reached public mailing lists before mainline kernel fixes, and a FortiSIEM proof of concept landed days after its patch — the interval between fix availability and weaponisation keeps shrinking, and leaks now sit in that interval. Third, trust anchors keep failing: eMudhra is withdrawing from the global TLS business after intermediate CA private keys were found to be trivially weak, one of them the number four, in a ceremony that passed two independent audits. Ransomware, finally, is re-consolidating rather than declining — Nord Security counted 2,894 attacks in July–September, up 50% year on year, with The Gentlemen (383) and Qilin (363) trading places at the top. Watch next week for whether the PHP2Shell leak is traced to a coordinated actor and for the first regulatory actions to land on AI-agent access design.
Incident Map
Financial Services 1 story
Central Bank of Ireland fines Coinbase Ireland €3.25m over customer fund safeguarding
The Central Bank of Ireland fined Coinbase Ireland Limited €3,252,618 on 22 October for contravening the Electronic Money Regulations 2011 between 1 November 2020 and 19 August 2025. The penalty was originally €4,646,597 before a standard 30% settlement discount; Coinbase Ireland admitted the contraventions and accepted a reprimand, with the sanctions taking effect once confirmed by the High Court. The regulator found the firm outsourced the critical safeguarding function to a US Coinbase Group company without sufficient Irish oversight or expertise, and that calculation errors in the systems used to size and rebalance safeguarding accounts left funds under-protected for at least 18 months — an average shortfall of 0.54% across 2023 and the first half of 2024, with maximum daily shortfalls of €3.4m in 2023 and €5.2m in 2024. It follows a €21.5m settlement with Coinbase Europe in November 2025 over anti-money-laundering monitoring failures.
Legal Services 2 stories
New Mexico court orders Meta to pay US$25bn over 43 million privacy violations
A New Mexico state district court ordered Meta on 21 October to pay US$25bn in penalties after finding more than 43 million violations of the state's unfair practices law, in litigation that grew out of the 2018 Cambridge Analytica revelations. Judge Francis J. Mathew wrote that Facebook promised users they controlled their data and that "this was false", holding the company's privacy statements misleading. The case was filed in 2021 after Cambridge Analytica obtained data on roughly 87 million profiles through a personality quiz app that also harvested participants' friends' data. Meta's chief legal officer C.J. Mahoney said the company will appeal. The penalty is by far the largest privacy sanction recorded against the company: it dwarfs the US$725m class-action settlement of 2022 and the US$5bn Federal Trade Commission penalty of 2019, and lands alongside an US$18bn multi-state child-safety settlement agreed in August.
First Australian class action alleging social-media design harm filed against Meta
A class action filed in the Federal Court by law firm MinterEllison on behalf of eight plaintiffs alleges that Meta's Facebook and Instagram exposed children to harmful content and kept them addicted through algorithmic feeds, in what is reported as the first Australian suit to blame social-media design for harming users rather than a data incident. The plaintiffs say they were harmed while under 18 and are seeking compensation; Meta said it will defend the claim vigorously. A suppression order issued on Monday bars publication of material that could identify the applicants or the statement of claim. The case arrives amid heightened Australian regulatory pressure on large platforms, including the world-first ban on social media for under-16s and proposed rules allowing users to switch off algorithm-driven feeds.
Defence 2 stories
Microsoft attributes ConnectWise supply-chain campaign to China-state Storm-0940 acting through AI agents
Microsoft Security Research attributed the ConnectWise Cloud Backup supply-chain attacks to a Chinese state-aligned actor it tracks as Storm-0940, which it says used an open-source agentic AI penetration-testing framework called ARTEX to automate intrusion work from as early as September 2026. In a four-day password-spraying campaign ending 14 October the group targeted 327 Microsoft 365 and Exchange Online accounts across eight organisations, generating more than 151,000 failed logons and peaking at 2,900 failures per minute; the same infrastructure was turned on ConnectWise the following day, reaching more than 2,250 tenants. Microsoft says the AI agents progressed beyond authentication into Microsoft Graph and directory operations, modifying application credentials for persistence, and that in several cases privileged cloud access was achieved in under three hours. ARTEX, published on GitHub this year by an account tracked as "Autumn-27", coordinates a team of agents to run an autonomous penetration test. Zscaler reported that the campaign reached dozens of industries across multiple countries.
Iran-linked 'Prince of Persia' found hosting command-and-control inside the United States
Semperis researchers disclosed on 22 October that Prince of Persia, an Iranian nation-state group active for roughly two decades, has been hosting command-and-control infrastructure on a US hosting provider — the first time in at least twelve years an Iranian threat group has been identified doing so. The group targets public- and private-sector organisations across the US, Europe and the Middle East, as well as dissidents opposed to the Iranian regime. Its current toolset includes the Foudre loader, the Tonnerre second-stage implant with screenshot and audio-capture surveillance capability, and Tornado, which uses both HTTPS and the Telegram API as covert channels so traffic blends with legitimate services. The researchers said Prince of Persia appeared to go dark in February, coinciding with US and Israeli strikes on Iran, and that information inside Tornado led them to the US-hosted infrastructure. Semperis recommends monitoring for unusual Telegram traffic alongside standard patch and control hygiene.
Healthcare 1 story
Ridgeway Pharmacy breach exposes health data of 258,920 customers through its website
Ridgeway Pharmacy, a Victor, Montana-based mail-order and community pharmacy, has notified almost 259,000 individuals that personal and protected health information was exposed through its third-party designed and developed website. The company became aware of the exposure on 21 August 2026 and engaged digital forensics specialists, who confirmed the incident was limited to the website and that no internal systems were involved. Exposed data included names, addresses, dates of birth, prescription information, health information and insurance information, with payment card data affected for a subset of individuals. Ridgeway has moved to a new website platform, restricted access and strengthened monitoring, and is offering complimentary credit monitoring and identity theft protection. The same notification round covered IMS Care Center in Arizona and Persona Dental in Minnesota, continuing a run of small-provider healthcare breaches.
Government 4 stories
Toronto Crime Stoppers halts tip intake after 1.5 million tips surface in a breach
Toronto Crime Stoppers froze its operations late on 21 October, hours after CBC reporting showed that more than 1.5 million tips submitted to Crime Stoppers chapters across Canada had been exposed in a data breach and provided to journalists by the transparency collective Distributed Denial of Secrets in March. CBC reached more than a dozen tipsters from the data; about half of the 1.5 million tips it reviewed, some of them 25 years old, contained personal information. Chapters had confirmed the breach in the days after the intrusion but gave no detail about what was exposed, blaming vendor Navigate360 and its subsidiary P3 Global Intel. Toronto's chapter broke ranks with the national association, published a timeline of what it knew and when, and told Navigate360 to stop taking tips and processing new information. Chair Sean Sportun said the promise of anonymity had been broken for some tipsters.
Cyberattack shuts down citizen service platforms in South Carolina's capital
The city of Columbia, South Carolina, said it is responding to a cyberattack that has disabled several government systems, including the MyColaSC platform residents use to pay utility bills, report non-emergency issues and access other city services. Geographic information systems and systems supporting animal services were also knocked offline, and officials asked residents to telephone reports of potholes, fallen trees and broken streetlights while the platform remains down. The city's IT department identified suspicious activity and referred the matter to the South Carolina Law Enforcement Division, which is leading the investigation and declined to comment. Columbia, a city of about 150,000 people, did not answer questions about whether ransomware was involved, and no group had claimed responsibility. Officials said police, fire, 911 communications and water systems remained operational. South Carolina has recently dealt with ransomware at Spartanburg county and an incident at the AnMed hospital system.
INTERPOL-coordinated Africa operation disrupts 10,909 cybercrime networks
A continent-wide law-enforcement operation coordinated by INTERPOL resulted in 1,462 arrests and the disruption of 10,909 cybercrime networks across Africa, with more than US$105m in illicit assets seized. The operation targeted the infrastructure and money flows behind online fraud, business email compromise and digital extortion rather than isolated offenders, and involved national police services across the continent working with INTERPOL's cybercrime directorate. The scale of the takedown — both the network count and the seized value — makes it one of the largest coordinated cybercrime actions reported this year, and it follows a run of regional operations in which investigators have paired arrests with the seizure of the payment and hosting infrastructure that supports the fraud economy.
PHP2Shell was exploited four days before disclosure, ACSC tells Australian operators to patch
The ACSC published an alert on 21 October covering the two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0 and together dubbed PHP2Shell, which allow unauthenticated remote code execution on sites running PHP versions released over the past decade. Amazon Threat Intelligence then confirmed it observed a PHP2Shell exploitation attempt on 17 October — four days before the scheduled disclosure — from an IP associated with a commercial anonymisation network, in its MadPot honeypot fleet. Multiple proof-of-concept exploits appeared around twelve hours before the planned release, with payload variation suggesting more than one actor; CISA said it had not itself observed exploitation. French public administrations, the Dutch national cyber security centre and the University of Vienna took sites offline ahead of patching. PHP underpins roughly 69.7% of websites whose server-side language is known.
Retail & Entertainment & Sport 2 stories
Capcom confirms breach of its membership service affecting 11.7 million accounts
Capcom has confirmed that intruders breached CAPCOM ID, the shared account system for its web services and some online games, exposing more than 11.7 million customer email addresses together with account creation dates, last-login timestamps, login counts and the IP address used at last login. A subset of 43 accounts also had dates of birth, gender, nicknames and countries exposed, and in 196 accounts the attackers changed login passwords in an attempt to lock owners out; Capcom reset those accounts. The company says no other passwords and no credit card data were exposed. Capcom detected suspicious activity and confirmed unauthorised access on 19 October, established the scope of the data loss the following day, and reported the incident to police and Japan's Personal Information Protection Commission on 21 October. Affected customers will be notified in stages. Capcom's 2021 breach, which exposed customer and employee data, was traced to an old VPN appliance.
European Commission opens Digital Services Act proceedings against Booking.com over scam risk
The European Commission opened formal proceedings against Booking.com on 21 October to establish whether the platform has breached the Digital Services Act's security and transparency provisions in ways that expose customers to fraudulent listings and phishing. Investigators will examine whether Booking.com diligently assessed and mitigated phishing risks, how reservation and guest data is shared with accommodation providers and what safeguards prevent misuse for payment fraud, how its messaging service can be abused, whether systemic risks from illegal content such as impersonation fraud were properly assessed, and whether its advertising practices meet DSA transparency obligations. Non-compliance could bring a fine of up to 6% of global annual turnover and corrective orders. Executive vice-president Henna Virkkunen said Europeans should be able to book holidays without fear of being scammed; the Commission stressed that opening proceedings does not prejudge the outcome.
Global (Macro) 5 stories
Arista patches a VeloCloud Orchestrator zero-day exploited in the wild (CVSS 9.9)
Arista warned on 22 October that attackers are exploiting a SQL injection zero-day in VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, tracked as CVE-2026-114625 and rated 9.9. Exploitation needs only network access to the orchestrator's web interface and a valid login at the lowest built-in customer role, Enterprise Read Only; success grants operator privileges, described as a local superuser with full access, and may allow the VCO host itself to be exposed, modified or disrupted. Orchestrators are exposed by default and no VCO setting prevents it. On-premises deployments need VCO 5.2.3.18, 6.1.3.10 or 6.4.2.12, while hosted and dedicated orchestrators have already been patched — and because the fixes sit above the releases that resolved the July and September VCO flaws, instances patched against those remain vulnerable. This is the third VCO flaw reported as exploited since late July and the first requiring authentication; the advisory does not say when attacks began or who was hit.
GitLab patches a maximum-severity unauthenticated RCE reaching back to 2014
GitLab released fixes on 21 October for CVE-2026-110264, a flaw rated 10.0 that can let an unauthenticated attacker run arbitrary code on a self-managed server through an integer overflow during compilation of a specially crafted regular expression. The vulnerability affects every release of the software going back to version 7.0 in 2014, and the fix matters even for administrators who patched nine days earlier: the 12 October update covered only versions 19.2 and later, and the new fixed releases sit one patch above it, placing an instance updated then back in range. GitLab shipped fixes across seven versions at once, including 19.5.1, 19.4.3 and 19.3.6, and says GitLab.com and current GitLab Dedicated tenants already run fixed code. The company reports no sign the flaw has been exploited, and it is not in the CISA known-exploited-vulnerabilities catalogue.
Railway discloses compromise of the systems holding customer environment variables
Platform-as-a-service provider Railway disclosed on 22 October that an unauthorised third party may have gained access to encrypted customer environment variables and, in some cases, obtained their decrypted contents, with impact limited to a subset of users it has not quantified. Environment variables typically hold API keys, database credentials and feature flags. Railway said the incident is likely part of a series of attacks against platform companies aimed ultimately at compromising AI inference providers, and that it has notified upstream providers so keys can be revoked. It has rotated bucket credentials, invalidated API tokens and restored builds for Pro and Enterprise workspaces, and is urging customers to rotate environment variables and private registry credentials and review logs. Security researcher Taylor Monahan reported that cryptocurrency wallets whose private keys were stored on Railway were drained, with the first known theft transaction occurring at 19:36, at least two hours before the incident was disclosed.
eMudhra withdraws from the global TLS certificate business after the weak-key affair
eMudhra, one of the few Indian root certificate authorities trusted by major browsers, said on 22 October that it is voluntarily withdrawing from the global SSL/TLS certificate business, days after eight of its intermediate private keys were found to be weak and Chrome, Firefox and Apple blocked the affected certificates. The withdrawal turns a certificate-removal exercise into the collapse of a browser-trusted CA brand: the company told users it is exiting the business rather than reissuing under the same root. eMudhra said the certificates were created during a ceremony in April 2025 and that the fault was a flaw in one step of the ceremony procedure — a defect that went undetected for 18 months and survived two independent audits before researcher Scott Helme reverse-engineered the weak key material. Because those certificates were trusted by browsers, operating systems and major service providers, anyone able to intercept a connection could have minted a certificate for a domain they do not control and impersonated it. The remediation burden now runs well beyond browsers, into Go, curl, Python and Electron trust stores.
LiteLLM pins its release-pipeline compromise on GitHub tokens lifted from an exposed deployment
LiteLLM has established how its release pipeline was poisoned on 21 October, when a malicious v1.107.0 build was published to PyPI and Docker. The company says the attacker operated through the GitHub accounts of three of its engineers using stolen GitHub CLI OAuth tokens: one account changed the release pipeline and triggered the release, a second approved it, and a third deleted the workflow records, limiting the logs available to investigators. The tokens were taken from the logs of an internal LiteLLM deployment that was exposed to the public internet. The vendor has also published exposure windows — the bad package sat on PyPI from 11:39 to 13:23 UTC and Docker tags v1.107.0, latest, main-latest and main-stable served it from 11:46 to 14:20 UTC — with v1.106.2 the last safe release. LiteLLM notes it has observed Claude Code embed a user's GitHub CLI OAuth token in a response body, so tokens can surface wherever gateway logs retain response bodies.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |
Key to this page
Two pill families appear in the text and they answer different questions. A CVE pill colours severity — a measured CVSS band from the National Vulnerability Database. A threat-actor pill colours attribution confidence — how well-corroborated the naming is, which is a claim rather than a measurement. Both are links: a CVE opens the ATT&CK matrix or its wiki page, an actor opens its wiki page.
CVE identifiers
- CVE-XXXX-NNNNCritical · CVSS 9.0+
- CVE-XXXX-NNNNHigh · CVSS 7.0–8.9
- CVE-XXXX-NNNNMedium · CVSS 4.0–6.9
- CVE-XXXX-NNNNLow · below 4.0
- CVE-XXXX-NNNNNo severity resolved — not the same as low
Threat actors · MITRE ATT&CK
- APT29State attribution stated by MITRE ATT&CK
- ShinyHuntersSelf-declared, or criminal-reporting attribution
- Transparent TribeContested — ATT&CK hedges, or two plausible sponsors
- ZIRCONIUMNo attribution in MITRE ATT&CK
Story signals
- ● Tier 1/4Source reliability — 1 official, 4 leads only
- VerifiedCorroborated by a second source or the principal
- ReportedSingle outlet, or a claim still in progress
- UnverifiedA claim we could not corroborate
- ConfirmedBreach acknowledged by the victim or a regulator
- ProbableBreach indicated but not yet acknowledged
- IOCs · FamilyLive abuse.ch indicators exist for that malware family
A collapsed Indicators of compromise block under a story lists defanged abuse.ch indicator values. The defanging is deliberate — never click, resolve or fetch them. An indicator corroborates a report; it never proves one.
Full methodology, evidence grading and caveats: Methodology & reading guide →