Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Executive Summary
A ransomware and data-extortion group has pulled off what security researchers describe as one of the largest attacks on the maritime sector in years: the n0n group pivoted from the network of a maritime IT services provider — likely South Korea's CyberLogitec — into more than 40 port authorities, shipping lines and logistics companies across 18 countries, and is demanding ransoms totalling roughly US$1.2 billion. Closer to the endpoint, Kaspersky revealed that APT41-revived BlackX, a successor to the BlackLotus UEFI bootkit, bypasses Secure Boot on fully patched Windows machines because Microsoft's Baton Drop fix only works once administrators manually activate the certificate revocation — an operational gap, not a patch gap. The week's other big software story deepened too: the memory-corruption flaw in Google's Brotli decoder behind the Node.js RCE (CVE-2026-111497) also ships in Bun, Python and Envoy, and Imperva demonstrated real code execution on an official Node.js build. CISA, meanwhile, added both the Collabora Online CODE server and Arista VeloCloud Orchestrator flaws to its Known Exploited Vulnerabilities catalogue with federal patch deadlines on 26 October.
No Australian operator has been named among n0n's victims to date, but the supply-chain route the extortionists used — a platform vendor's network sitting beneath dozens of port and shipping customers — is exactly the supplier-trust gap the ACSC has been pressing: Australian port operators, stevedores and shipping lines running partner booking, terminal or cargo platforms should validate access now rather than wait for their own name on a leak site, and treat the campaign as a live reminder that maritime systems qualify as critical infrastructure under the SOCI Act. The ACSC's three listings held no new publications overnight (the newest remain the 23 October Fortinet alert and the 21 October PHP alert, both already covered). On BlackX, the Essential Eight's patching discipline has a blind spot worth closing this week: the Secure Boot revocation that defeats Baton Drop (CVE-2022-21894) is not applied automatically by the March 2023 Windows update — organisations must enable it manually, and the Kaspersky findings show targeted, fully patched networks where that step was skipped. The Siemens/PAN-OS PHP2Shell advisories of 23 October are also directly relevant to Australian industrial estates, where RUGGEDCOM APE1808-class OT gateways now carry a named 9.8 CVSS exposure, and APRA-regulated entities reviewing CPS 234 obligations should fold both into their patch inventories. Finally, the coordinated push by major North American banks to block AI agents such as Meta's Muse from touching customer accounts is a policy question Australian banks — and APRA, which regulates financial-data handling — will be watching closely.
Across the seven days to 24 October (18–24 October) the corpus logged 95 stories, led by breach and data-leak coverage (27), zero-day and vulnerability reporting (21), malware (18) and ransomware (12), with US-centred stories at 50, multi-region at 29 and Australian relevance scored in 11. Four trends mark the week. First, ransomware groups are compressing their time-to-data: n0n launched in mid-September, amassed more than 140 leak-site victims and by this week's counting would rank third among active groups behind Qilin and The Gentlemen — the same extortion-first, supply-chain-pivot playbook the FBI and CISA warned about in their 20 October SafePay advisory (600-plus victims). Second, the KEV catalogue is forcing a Monday-morning patch wave: eight additions inside the week — Plex's four, the SiteGuard command-injection flaw, Siemens Software Center, VeloCloud and Collabora — with federal deadlines through 26 October. Third, PHP2Shell was the week's through-line: disclosed 21 October, exploited four days pre-disclosure, chased by ASD, ACSC, UK NCSC and CISA alerts, probed by Mirai-derived botnets, and now propagating into Siemens and Palo Alto OT appliances — a textbook example of a web-runtime flaw settling into industrial estates. Fourth, the AI-agent economy collided with account-layer security: Microsoft tied the ConnectWise supply-chain campaign to China-state Storm-0940 operating through AI agents, Meta's Muse crossed ten million downloads in a month and drew coordinated bank blocks, and V12 showed x402 payment SDKs could let a malicious API drain an agent's token balance. Watch next week for the 26 October KEV deadlines, PHP's fix for the unpatched CVE-2026-115560 in its next routine release, n0n's expansion beyond maritime into healthcare and IT verticals, and whether the US regulator-backed bank stance on agentic account access hardens into policy.
Incident Map
Transport 1 story
Ransomware group n0n's supply-chain pivot hits more than 40 maritime firms across 18 countries, with ransoms totalling US$1.2bn
The extortion group n0n, active only since mid-September, has listed more than 40 port authorities, container and industrial port operators, shipping lines, ship managers and maritime logistics companies on its dark web leak site — victims spanning 18 countries, listed on 12 October with a payment deadline of 19 October that most refused, after which their data was published. Security firm CyDome assesses that half the batch are known customers of CyberLogitec, a South Korean provider of maritime IT platforms whose website has been down for weeks — pointing to a supply-chain breach that one vendor's network seeded the whole sweep. The group is reportedly demanding ransoms totalling about US$1.2 billion and its leak site already lists more than 140 victims, a pace that would have made it the third-most-active ransomware group of Q3 behind Qilin and The Gentlemen. CyberLogitec has confirmed to Korea's Daily Log that the named Korean companies are its customers and says their systems are operating normally; no victim organisation has yet published a disclosure. This week's leak-site rows have also branched beyond shipping into IT and healthcare organisations, signalling the campaign is widening rather than winding down.
Defence 2 stories
BlackX UEFI bootkit revives the Baton Drop exploit to bypass Secure Boot on fully patched Windows machines
Kaspersky's Global Research and Analysis Team has documented a UEFI bootkit it calls BlackX — assessed with moderate confidence as the work of China-linked APT41 — used in early 2026 against diplomatic organisations in Tajikistan, Uzbekistan and Turkmenistan. BlackX is a modernised successor to BlackLotus, the commercially sold bootkit from late 2022, and bypasses Secure Boot by abusing Baton Drop (CVE-2022-21894). The crucial finding is operational rather than technical: the targeted machines were fully patched, yet remained vulnerable because Microsoft's fix only takes effect once administrators manually activate the revocation of the vulnerable Windows boot-manager certificates — a step Kaspersky says few organisations perform. The bootkit injects a malicious kernel driver, signed with a since-revoked certificate, that disables endpoint-security callbacks; follow-on spyware exfiltrates data through Google Drive, OneDrive and Yandex Disk. Kaspersky says its own products blocked the tampering attempt. Organisations should verify the Secure Boot revocation database update (dbx) is actually applied, not merely assume a patched build is protected.
ESET uncovers MythicRatatoskr — a Go backdoor hiding its command-and-control inside the Yggdrasil mesh network
ESET researchers have documented a previously unknown backdoor, MythicRatatoskr, deployed in an intrusion that ended in a destructive data-wiping attack against a Ukrainian grain firm. Initial access was gained on 16 July 2025 via a spear-phishing email that ran the MATCHBOIL downloader and the MATCHWOK backdoor — a chain ESET attributes with high confidence to UAC-0099 (Earth Sirrush) — with MythicRatatoskr deployed a day later. The backdoor stands out for how it hides: its command-and-control server lives inside the Yggdrasil peer-to-peer mesh network, a public anonymity overlay that complicates traffic analysis and takedown. On 17 September 2025, more than two months after the foothold, access was handed to the Russian state-sponsored Sandworm group, which conducted the wiping attack against the logistics firm's systems. ESET notes the backdoor was developed specifically for this operation, with indications the malware family is still evolving. The collaboration is notable for the division of labour — UAC-0099 providing silent initial access at scale while Sandworm delivered the destructive payload — and for the mesh-network C2 channel that defenders will now need to hunt.
Government 1 story
CISA adds Collabora Online and Arista VeloCloud flaws to the KEV catalogue, citing active exploitation, with federal deadlines on 26 October
CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalogue on 23 October, each carrying a federal civilian patch deadline of 26 October. The first is CVE-2026-110447 (CVSS 9.2), an operating-system command-injection flaw in the Collabora Online Built-in CODE Server packaged with Nextcloud (richdocumentscode), which allows remote code execution through proxy.php when the local CODE server is not running; it was fixed in September 2026 in version 26.4.303. The second is CVE-2026-114625 (CVSS 9.9), a SQL injection in on-premises Arista VeloCloud Orchestrator that lets a remote attacker reach privileged internal functionality; fixed in October in versions 5.2.3.18, 6.1.3.10 and 6.4.2.12. The VeloCloud flaw was already covered in Friday's edition as an exploited zero-day; the KEV additions formalise the binding federal remediation clock and extend the exploitable list to the Nextcloud ecosystem, whose CODE servers are common in self-hosted deployments. Organisations running either product are now inside the enforceable deadline window for US federal systems, and should treat the two-day turnaround as the effective patch priority for Australian equivalents under ASD's passive cyber-hygiene expectations.
Energy & Utilities 1 story
Critical heap overflow in the open62541 OPC UA stack (CVE-2026-116014, CVSS 9.2) fixed in version 1.5.7
A critical vulnerability in open62541 — the most widely deployed open-source implementation of the OPC UA industrial communication standard — allows a malicious OPC UA server to crash clients or achieve code execution on them. Tracked as CVE-2026-116014 and published to the GitHub Advisory Database as GHSA-78c3-xxg6-2pf3, the flaw is an integer overflow in the decodeBinaryStructure routine triggered by specially crafted DataType definitions, leading to a heap buffer overflow. It affects open62541 versions 1.5.0 through 1.5.6 and carries a CVSS 3.1 score of 9.2 with a network vector, no authentication and no user interaction — attack complexity is high, and no in-the-wild exploitation is known at publication. open62541 underpins OPC UA servers and clients across energy, manufacturing and building-automation estates, and the library's wide use means the patched 1.5.7 release needs to propagate through downstream vendors and embedded builds, not just direct users. Given the audit focused the industrial sector this week on PHP2Shell's arrival in OT appliances, the fixed version should be folded into the same patch pass, and OPC UA endpoints should in any case be network-segmented from general IT.
Financial Services 1 story
Major North American banks move to block Meta's Muse agent and third-party AI assistants from customer accounts
The launch of Meta's consumer-facing AI agent Muse — more than ten million downloads within its first month — has prompted a coordinated response from the largest US and Canadian banks, all moving to stop outside AI agents from logging into or transacting on customer accounts. JPMorgan Chase chief executive Jamie Dimon said last week the bank will not allow outside agents direct account access on behalf of retail customers; Citi confirmed it does not permit third-party AI agents to log into accounts or transact within its digital platforms, allowing only read-only access via Citi-approved open banking providers; Bank of America's Brian Moynihan argued "there should be a human in the loop to authorise money moving out of your account", and Charles Schwab has followed with restrictions of its own. In Canada, RBC's Dave McKay told Bloomberg the bank is considering blocking Muse from client account information, and BMO's Darryl White warned the Toronto Global Forum that banking usernames, passwords, credit cards, social insurance numbers and PINs are "not protected" when handed to agents. CNBC reports banks have been in touch with Federal Reserve regulators, who privately back blocking moves. It is the first systemic bank-sector response to agentic AI's consumer rollout, and the access-governance baseline it sets will shape how regulators and banks treat agents everywhere.
Education 1 story
ETS faces proposed class action over the breach of records of 7 million current and former California students
Educational Testing Service, California's statewide assessment contractor, is facing a proposed class-action lawsuit over a data breach that exposed records of around seven million current and former public school students. The suit, filed 20 October, alleges ETS failed to protect student information and that the breach could have been prevented with stronger security measures, seeking monetary damages and court-ordered improvements to the company's data security practices. The California Department of Education confirmed it is reviewing ETS's compliance with contractual and data-security requirements after receiving breach notification on 26 September, and has been coordinating with the California Cybersecurity Integration Center, the California Department of Technology and the Governor's Office of Emergency Services. The action follows California's statewide student-data warning — covered in Monday's edition — and extends the pattern of education-sector breaches flowing through assessment and record-keeping contractors, whose consolidated student datasets make them high-value targets: a single contractor compromise now reaches seven million individuals including minors, whose records are among the most sensitive categories a school system holds.
Retail & Entertainment & Sport 1 story
Researchers push more than two million remote updates to disable an abandoned Popcorn Time updater that could have powered a botnet
Dutch security firm Eye Security has disclosed that between November 2025 and March 2026 it pushed more than two million updates to computers it did not own, remotely disabling a vulnerable updater in Time4Popcorn, an abandoned fork of the Popcorn Time pirate-streaming app. During a routine threat hunt the firm found Updater.exe on a client's laptop repeatedly contacting a web address that was no longer registered; after registering the domain itself, it observed around 50 connection requests per second. The updater ran with elevated privileges on Windows and macOS machines and could have allowed attackers to execute malicious code on millions of computers — or quietly enrol them into a botnet — had the domain fallen into hostile hands. Eye Security's mass update switched the mechanism off on Windows and macOS, but Android users remain exposed because neutering the updater there needs user interaction the researchers could not perform. The case is a reminder that abandonware persists on endpoints long after its developers move on, and that unregistered update channels are a standing code-execution risk for anyone who kept the software installed.
Global (Macro) 3 stories
Brotli decoder flaw behind the Node.js RCE also affects Bun, Python and Envoy, as Imperva demonstrates code execution
The memory-corruption flaw in Google's Brotli decoder that forced Node.js emergency patches on 21 October has proved far broader than one runtime: tracked as CVE-2026-111497, the out-of-bounds write lets crafted compressed data corrupt memory and potentially execute attacker-controlled code, and it ships in Bun, the Python brotli and brotlicffi packages, and Envoy proxies configured to decompress Brotli — because every program carries its own copy of the decoder, each must be updated individually. Imperva researchers then went further than the first proof of concept: their Node2Shell demonstration achieved code execution on an official, unmodified Node.js 24.22.0 Linux arm64 build by feeding crafted Brotli data to the bundled decoder, succeeding only after repeated attempts and not retested on other architectures or the 22.x/26.x lines; the fixed 24.22.1 build rejected the same payload outright. Node.js and Google shipped fixes on 21 October and more products have followed since, but no real-world exploitation has been reported. Organisations decoding untrusted Brotli data — a common path in CDNs, proxies and upload pipelines — should enumerate every embedded decoder, not only Node.js, a breadth matching the ecosystem-wide nature of the flaw.
Fresh malicious npm and PyPI packages include an x402 security-scanner impostor and pino logging typosquats
The OpenSourceMalware archive flagged a fresh batch of human-verified malicious packages across npm and PyPI on 23–24 October, led by x402-prompt-injection-scan (npm, 0.1.3) — a package naming itself after security scanners for the x402 payments SDK, arriving the same days that V12's research on x402's payment-drain flaws (three critical issues, all fixed in the 18 August releases) was circulating. The naming choice is either a typosquat on a scanner or an attempt to ride attention on the x402 topic to install a payload in developer environments; the archive records it as critical, with OSV advisory MAL-2026-18197 published. The same window brought pino-std and @k.vict1999/pino-std-serializers (npm, both 7.2.0 on 22 October) — typosquats of pino's widely downloaded pino-std-serializers package, for which no OSV advisory has yet been published — alongside PyPI rows sitecard (0.1.14), bravos (0.6.0), getpubip and others at critical severity. Installations of these names inside CI pipelines or vulnerable publish chains repeat the LiteLLM pattern, where a spoofed package inside a build reached a production release. Teams should treat the appearance of closely-misspelled versions of trusted packages as an immediate dependency-integrity investigation.
LiteLLM pins October's release-pipeline compromise on an unrevoked master key left in a public GitHub repository
LiteLLM has disclosed the root cause of the 10 October intrusion behind the malicious versions of its PyPI package and Docker images surfaced in Friday's edition: an Agent Platform master key was accidentally committed to the public LiteLLM-Labs/lite-harness repository in a configuration file on 27 May 2026 and, although the error was quickly spotted and the file force-pushed over, the key flagged for revocation was never actually revoked. The unknown attacker, operating from the IP 69.48.229[.]143, used the still-live master key on 10 October to access the Agent Platform, extract a GitHub CLI OAuth token the service held for self-hosted cloud access, and push the malicious package and images — an info-stealing payload that would harvest credentials and session data from installed environments. LiteLLM has rotated the affected keys, revoked the credentials the attacker accessed, taken the malicious distributions down and notified affected users, and believes the platform compromise fits a larger wave of attacks against AI providers that also touched Railway this month. The disclosure is the completion of the incident's causal chain: a single unrevoked secret in a public repo, not a flaw in the package tooling itself, was sufficient to hijack a release pipeline.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |
Key to this page
Two pill families appear in the text and they answer different questions. A CVE pill colours severity — a measured CVSS band from the National Vulnerability Database. A threat-actor pill colours attribution confidence — how well-corroborated the naming is, which is a claim rather than a measurement. Both are links: a CVE opens the ATT&CK matrix or its wiki page, an actor opens its wiki page.
CVE identifiers
- CVE-XXXX-NNNNCritical · CVSS 9.0+
- CVE-XXXX-NNNNHigh · CVSS 7.0–8.9
- CVE-XXXX-NNNNMedium · CVSS 4.0–6.9
- CVE-XXXX-NNNNLow · below 4.0
- CVE-XXXX-NNNNNo severity resolved — not the same as low
Threat actors · MITRE ATT&CK
- APT29State attribution stated by MITRE ATT&CK
- ShinyHuntersSelf-declared, or criminal-reporting attribution
- Transparent TribeContested — ATT&CK hedges, or two plausible sponsors
- ZIRCONIUMNo attribution in MITRE ATT&CK
Story signals
- ● Tier 1/4Source reliability — 1 official, 4 leads only
- VerifiedCorroborated by a second source or the principal
- ReportedSingle outlet, or a claim still in progress
- UnverifiedA claim we could not corroborate
- ConfirmedBreach acknowledged by the victim or a regulator
- ProbableBreach indicated but not yet acknowledged
- IOCs · FamilyLive abuse.ch indicators exist for that malware family
A collapsed Indicators of compromise block under a story lists defanged abuse.ch indicator values. The defanging is deliberate — never click, resolve or fetch them. An indicator corroborates a report; it never proves one.
Full methodology, evidence grading and caveats: Methodology & reading guide →