Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Executive Summary
The US Cybersecurity and Infrastructure Security Agency has added the PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) to its Known Exploited Vulnerabilities catalogue, confirming in-the-wild remote code execution a week after the emergency patches shipped — the first verified RCE was captured against an Apache mod_php server, and federal agencies must remediate by 29 October. In the United States, a New Mexico university hospital network diverted ambulances for two hours and suspended surgeries after an attack claimed by the newly emerged BYOD ransomware gang, which alleges 36,000 compromised machines and stolen patient, student and employee data. Australia's Signals Directorate revealed it cut a criminal Amadey botnet controller off from 180,000 infected computers worldwide, including machines in Australia. The week's dominant theme continued to cut both ways across AI: a breach at developer platform Warp exposed AI agent decision logs and telemetry, while Trend Micro documented a 44-agent AI attack platform that validated at least 19 organisations, most of them in Japan.
Today's Australian headline is ASD's disclosure of an offensive cyber operation against an Amadey botnet — operators gained access to the criminal's backend and disconnected the controller from around 180,000 infected computers, including Australian machines. It lands a day after ASD released its seventh Annual Cyber Threat Report 2025-26, which logged more than 82,000 cybercrime reports (one every six minutes), responses to over 1,500 incidents, and more than 4,400 notifications to Australian entities about malicious activity — an almost 80% rise on the prior year. The pair shows the ACSC moving from reporting the threat to actively dismantling it. Both developments sharpen two standing patch obligations for Australian organisations: the ACSC's 21 October alert on the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) — now KEV-listed, so unpatched PHP should be treated as actively hunted — and the 23 October coordinated Fortinet updates across FortiOS, FortiManager and FortiAnalyzer. Enforcement also touches Australia directly: the Nefilim affiliate sentenced in New York on Tuesday targeted US, Canadian and Australian companies with more than $100 million in annual revenue. Regionally, the AI-assisted campaigns against Japanese organisations documented by Trend Micro underscore how close to home agentic attack tooling has moved for the Indo-Pacific.
The week to 27 October (21–27 October) produced 88 stories in the database: zero-day/vulnerability (25) and breach/data-leak (25) tied as the dominant threat types, ahead of malware (14), ransomware (5), AI security (5) and phishing/BEC (4); geography was US-heavy (40), followed by global (30), Australia (12), Europe (4) and APAC (2). Three threads define it. Exploitation velocity: the public FortiSIEM path-traversal exploit rated 9.4 (21 Oct), ACSC's Fortinet advisory (24 Oct), the Siemens ICS-CERT wave, and PHP2Shell moving from failed pre-disclosure attempts to confirmed RCE with an official KEV listing — CISA is now directing federal remediation within roughly 72 hours of listing, and the one-week patch-to-exploit cycle keeps compressing. AI as both threat and target: OpenAI's escaped red-team agents (26 Oct), the Huntress M365 token-replay campaign, today's Warp agent-log breach, and the 44-agent CyberStrikeAI operation in Japan put the agent-breach class on a weekly cadence; separately, Lazarus's Operation FlashHole shows a nation-state embedding post-quantum ML-KEM-1024 key exchange in C2 — state-level cryptographic hedging observed since September 2024. Enforcement and statecraft: the Iran-linked "Prince of Persia" C2 inside the US (23 Oct), the Central Bank of Ireland's €3.25 million Coinbase fine (23 Oct) and today's 70-month sentence for a Hive/Nefilim affiliate. Watch next week whether the new BYOD gang escalates hospital targeting, and whether the KEV additions of Google Brotli (CVE-2026-111497) and Adobe Commerce (CVE-2026-48356) follow PHP2Shell into exploited-in-the-wild reporting. Nearly a third of the week's stories (27 of 88) sat in Global (Macro) — a cross-sector-heavy week by any measure.
Incident Map
Government 3 stories
CISA adds PHP2Shell flaws to KEV as successful in-the-wild exploitation is confirmed
CISA has added the two critical PHP vulnerabilities tracked collectively as PHP2Shell (CVE-2026-109618, CVE-2026-109619) to its Known Exploited Vulnerabilities (KEV) catalogue, formally confirming in-the-wild exploitation of flaws first reported as unsuccessfully attacked. Both permit unauthenticated remote code execution and were patched by PHP on 21 October after PoC details leaked pre-disclosure; Amazon Threat Intelligence says targeting began four days before the patches shipped, from anonymised VPN infrastructure. The first verified success came on 24 October, when Perplexity detection-and-response lead Adel Karimi's honeypots recorded RCE against an Apache mod_php installation running PHP 8.4.26 — an 800 KiB decoded cookie dump plus a function address matching the public exploit's offsets — corroborated by Expel's Marcus Hutchins as the highest-quality confirmation seen. Federal Civilian Executive Branch agencies must remediate by 29 October under Binding Operational Directive 26-04; CISA urges all organisations to treat KEV-listed flaws as actively hunted. CISA separately added Google Brotli (CVE-2026-111497) and Adobe Commerce (CVE-2026-48356) to KEV on 27 October. ACSC's 21 October alert covers the same two PHP flaws for Australian organisations.
ASD cuts Amadey botnet controller off from 180,000 infected computers
The Australian Signals Directorate says its offensive cyber operators gained access to the backend of a criminal Amadey botnet operation and disconnected the controller from around 180,000 infected computers worldwide, including machines in Australia. Acting deputy director-general for intelligence Tauri Gregory told ABC News on 27 October that ASD "disconnected that Amadey controller from all those victims". Amadey has been sold to criminals as a service since 2018 — ESET tracks 53 separate botnets, each buyer running its own control panel — with infected machines typically used to drop the StealC infostealer and steal credentials; common delivery vectors are fake software updates, cracked installers and loader malware. ASD's offensive operations require explicit Australian government approval and can disrupt criminal infrastructure overseas, though the agency notes the takedown does not undo earlier theft — session cookies stolen by infostealers can bypass multi-factor authentication months later. The operation follows Operation Endgame's June disruption of Amadey, StealC and SocGholish infrastructure.
Indicators of compromise · Stealc +1 — 8 shown
ayelife57[.]resthxxp://144[.]31[.]151[.]8/hxxp://31[.]56[.]19[.]29/hxxp://62[.]60[.]226[.]232/ray-id-v3[.]comhxxp://109[.]238[.]87[.]75/g84kfs5n/index[.]phphxxp://193[.]178[.]158[.]71/b894jfjw/index[.]phphxxp://193[.]178[.]158[.]107/bjsw3dlg1/index[.]php
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
UK watchdog finds police data repeatedly breached through third-party suppliers
His Majesty's Inspectorate of Constabulary and Fire & Rescue Services has found that hackers repeatedly compromised third-party suppliers holding British police data since 2021, in attacks the Police Digital Service and the National Police Chiefs' Council described as affecting "third-party ICT supply chains which held police information". The report, published 27 October, deliberately withholds operational detail — how many incidents, which suppliers or forces, and whether data was stolen. The Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first three months of 2026, plus 796 "near misses" including malware, unauthorised access attempts and accidental disclosures by staff. Most police supplier contracts contained no ongoing cybersecurity assurance; some forces could not say whether suppliers were obliged to report incidents promptly. The inspectorate separately criticised policing and fire services being omitted from the National Risk Register 2025 and the Government Cyber Action Plan, and warned leaders judged further attacks "highly likely".
Healthcare 2 stories
New BYOD ransomware gang claims attack on University of New Mexico hospital network
The University of New Mexico Health System diverted ambulances to hospitals in Albuquerque and Santa Fe for about two hours on Monday 26 October and suspended outpatient surgeries and appointments for the day after a cyberattack hit its network. The organisation, which operates New Mexico's only burn unit, children's hospital and Level 1 trauma centre, contained the incident and notified federal law enforcement; staff were told to unplug desktops and disconnect mobile devices from hospital Wi-Fi. Services largely resumed late Monday, but classes across the School of Medicine, College of Nursing, College of Pharmacy and College of Population Health were cancelled Tuesday. A ransomware gang calling itself BYOD — which emerged last month with only a handful of known victims — claimed responsibility, alleging it compromised 36,000 machines across the main campus and hospital and stole data on students, patients and employees. The Health System, citing an active law-enforcement investigation, has not confirmed data theft or whether ransomware was deployed. It is the second major attack on a large US state hospital this year after University of Mississippi Medical Center's weeks-long disruption in March.
HHS delegates Medicare/Medicaid permissive-exclusion authority to CMS
The US Department of Health and Human Services has formally shared responsibility for excluding individuals and entities from federal healthcare programmes with the Centers for Medicare and Medicaid Services, a power previously held solely by the HHS Office of Inspector General. A Federal Register notice published 14 October took effect immediately. HHS-OIG retains sole authority over mandatory exclusions — its existing powers are unchanged — but CMS can now independently pursue permissive exclusions, bringing its direct administration of Medicare and Medicaid to bear on investigating suspected healthcare fraud and developing the evidentiary basis for exclusion determinations. HHS Secretary Robert F. Kennedy Jr said CMS is "uniquely positioned" to do so as the agency directly responsible for administering the programmes. For covered entities the practical effect is a second enforcement pathway able to bar providers, suppliers and individuals from programme participation without OIG action.
Education 1 story
University of Copenhagen confirms breach of test environment exposing 525,000 records
Denmark's University of Copenhagen has confirmed hackers gained access to one of its test environments, exposing personal data belonging to 525,000 people — full names, national identity (CPR) numbers, phone numbers and email addresses. The university detected the intrusion on 20 October and disclosed it on 23 October, then updated on 25 October that the PIN codes of a further 20,000 staff and students had also been exposed, prompting it to restrict physical access to some critical campus locations as a precaution. The institution, Denmark's oldest, founded in 1479, has approximately 36,800 students and 10,700 employees across six faculties; it is still investigating the incident's full scope. The exposed records raise the risk of targeted phishing and social-engineering campaigns against students and staff, the university warned. The disclosure is first-party and one of the largest education-sector breaches reported in Europe in the past year, on a scale comparable to the 2023 MOVEit-linked attacks on UK universities.
Energy & Utilities 1 story
ENGIE discloses data breach after attackers compromise partner marketing platform
French energy group ENGIE — one of the world's largest power and natural-gas providers, with more than 90,000 employees, operations in 30 countries and €71.9 billion in revenue last year — has confirmed that attackers stole customer data after breaching a marketing platform used by its business partners. A spokesperson told BleepingComputer that ENGIE's internal IT systems were not compromised: the company identified unusual data-access activity within a partner tool used for customer prospecting and marketing energy offers, cut off the attackers' access, notified the relevant authorities and contacted affected customers. The incident is limited to customers in France, and the data is confined to contact details and certain information relating to their energy contracts — no banking data is affected. ENGIE has not disclosed how many customers are impacted. For a critical-infrastructure operator that also supplies energy to businesses, the breach illustrates the exposure that flows down the partner channel even when core industrial systems remain untouched.
Financial Services 1 story
Keystone to destroy 18,835 hardware wallets after attacker steals device-authentication key
Crypto hardware-wallet maker Keystone has disclosed that an attacker who breached its website obtained the key its devices use to prove authenticity, and will destroy 18,835 unsold wallets that carry it. Keystone said on 26 October that it detected the unauthorised access on 20 October and blocked the attacker the same day; the intruder exploited a vulnerability in a third-party data-monitoring tool used by the website to escalate privileges, gaining customer data and the authentication key that backs the QR-code "Device Check" used to verify a wallet is genuine. Anyone holding the key could build counterfeit devices that pass the check — and a buyer who trusted a counterfeit could have their crypto stolen — though no counterfeit devices or corresponding thefts have been reported, and recovery phrases and private keys were not involved. All new devices will ship with a replacement key; owners of devices delivered after 20 October with the old key are asked to contact support before trusting the check.
Legal Services 1 story
Hive and Nefilim ransomware affiliate sentenced to 70 months in prison
A 36-year-old Ukrainian national has been sentenced to 70 months in prison in the United States for participating in a ransomware campaign spanning mid-2018 to late 2021. Artem Aleksandrovych Stryzhak pleaded guilty in late 2025 to multiple cybercrime counts; he was arrested in Spain in June 2024 and extradited to the US in April 2025. Prosecutors in the Eastern District of New York said Stryzhak operated with the Nefilim and Hive collectives, which attacked around 1,500 victims worldwide — including hospitals, government entities, law firms, a dentist's office and an oil-and-gas transport company — customising ransomware executables, decryption keys and ransom notes for each victim. The groups primarily targeted companies in the US, Canada and Australia with more than $100 million in annual revenue, extorting victims by threatening to publish stolen data after researching their net worth and size. US authorities are still seeking alleged co-conspirator Volodymyr Tymoshchuk, with US$11 million in reward money offered for information leading to his arrest.
Defence 1 story
Lazarus Operation FlashHole weaponises South Korea's mandatory banking plug-in and adopts post-quantum C2
Kaspersky GReAT has attributed a cyber-espionage campaign dubbed Operation FlashHole to North Korea's Lazarus Group, identifying at least three affected South Korean organisations across construction, software and wire-communication equipment manufacturing, with the earliest evidence dating to July 2025. Victims were sent spear-phishing emails linking to fabricated, individually tailored résumé and portfolio sites — hosted on GitHub Pages and featuring AI-generated profile photos. Visiting the site triggered an infection chain abusing INISAFE CrossWeb EX, the mandatory financial-security plug-in required for South Korean online banking and government portals, which launched the legitimate Windows binary fsquirt.exe with injected shellcode. In-memory components TechHub, TouchHub and TouchShift establish persistence via DLL sideloading before ClientHub (with HTTP or Dropbox C2) delivers the LPEClient profiling agent, which now conducts an ML-KEM-1024 post-quantum key exchange — new for the group, traced back to September 2024 — prior to loading the Cubridge framework that steals Chromium credentials and queries Active Directory. No CVE has been published and the exact abuse method remains under analysis; the campaign follows Operation SyncHole, disclosed in April 2025.
Global (Macro) 4 stories
Warp discloses breach of vendor infrastructure exposing AI agent logs and telemetry
Warp, the agentic development environment used by at least 800,000 developers, has disclosed that agent decision logs and telemetry data were exposed in a compromise of a third-party vendor inside its infrastructure. Founder and CEO Zach Lloyd said Warp became aware on Friday of "active and narrow-banded exploitation of a vendor in Warp's infrastructure", detected and remediated within hours, and estimates "roughly 1% of Warp users may have been impacted" — around 8,000 people. The company has not confirmed whether the exposed data included source code, prompts or credentials, and analysis of the incident reportedly indicates an "agent swarm" relying on a sophisticated penetration and escalation technique. CrowdStrike has been engaged and law enforcement notified. The incident follows last week's breach at AI coding platform OpenCode, where about 1.4% of users had stored API keys exposed and some suffered unauthorised charges of up to US$1,700 — the second supply-chain hit to AI development tooling in as many weeks, and a signal that agent orchestration layers are now squarely in attackers' sights.
Apple backports CoreGraphics flaw exploited against targeted individuals to older iPhones and iPads
Apple has expanded fixes for an exploited high-severity flaw to older devices, shipping iOS 18.7.11 and iPadOS 18.7.11 on Monday. Tracked as CVE-2026-86950 (CVSS 8.8), the out-of-bounds write in CoreGraphics could allow arbitrary code execution when processing a maliciously crafted file, and Apple says it "may have been exploited in an extremely sophisticated attack against specific targeted individuals" on versions of iOS before iOS 27 — the same flaw first patched last month in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. The backport covers iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation and later, iPad Air 4th generation and later, and iPad mini 6th generation and later. The release also addresses an Audio logic issue (CVE-2026-65339) that could leak sensitive user information and a CoreMedia flaw (CVE-2026-86990) allowing camera access without permission. Apple simultaneously shipped iOS 27.2, macOS Golden Gate 27.2 and related releases fixing several hundred vulnerabilities, including an Apple Intelligence authorisation issue (CVE-2026-86987) exploitable by a remote attacker.
Trend Micro exposes a 44-agent AI attack platform used against 19 organisations, most of them in Japan
Trend Micro's TrendAI research unit has disclosed three attack operations against Japanese organisations in which AI either drove or assisted the hacking, after analysing exposed attacker server environments holding reconnaissance tools, target lists and command histories. The first campaign abused CyberStrikeAI, an open-source penetration-testing tool previously linked to attacks on Fortinet FortiGate appliances, running a fully automated workflow across 44 AI agents — reconnaissance, exploitation, command-and-control, persistence, data exfiltration and automated reporting, including generating fake Japanese-language login pages. In a short period in October 2026, at least 19 identifiable organisations, 16 of them in Japan, were subjected to validation activity, each receiving a report in the same format with an index of evidence. A second case saw a human-led operation assisted by an LLM targeting AI workflow platforms and inference services, while a third confined AI to tool development for campaigns against Cisco, Citrix, F5 and Yamaha edge devices and included a GIS server with default credentials that yielded cadastral records, Windows credentials and email data. Researchers found no evidence the three share an operator, and noted the same actors have targeted Taiwan and Hong Kong.
Microsoft ships out-of-band updates to distrust eMudhra certificates after weak CA keys recovered
Microsoft has released out-of-band updates — KB5134133 for Windows 11 versions 24H2, 25H2 and 26H2, and KB5134125 for Windows 10 versions 21H2 and 22H2, both dated 26 October — that remove trust in certificates tied to eight compromised eMudhra certificate-authority keys, covering systems that do not receive automatic Certificate Trust List updates. The eight eMudhra intermediate CA private keys, generated in April 2025, were so weak — values smaller than 256 — that anyone could recover them almost instantly by testing just 256 possible numbers. An attacker holding the keys could forge certificates for legitimate websites and intercept encrypted communications. eMudhra has revoked the eight intermediate certificates, and Mozilla, Google, Apple and other vendors are revoking trust; Microsoft's out-of-band updates extend the block to offline, air-gapped and non-updating machines — a meaningful gap given weak CA keys undermine the entire trust model for organisations relying on them for signing and TLS.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |
Key to this page
Two pill families appear in the text and they answer different questions. A CVE pill colours severity — a measured CVSS band from the National Vulnerability Database. A threat-actor pill colours attribution confidence — how well-corroborated the naming is, which is a claim rather than a measurement. Both are links: a CVE opens the ATT&CK matrix or its wiki page, an actor opens its wiki page.
CVE identifiers
- CVE-XXXX-NNNNCritical · CVSS 9.0+
- CVE-XXXX-NNNNHigh · CVSS 7.0–8.9
- CVE-XXXX-NNNNMedium · CVSS 4.0–6.9
- CVE-XXXX-NNNNLow · below 4.0
- CVE-XXXX-NNNNNo severity resolved — not the same as low
Threat actors · MITRE ATT&CK
- APT29State attribution stated by MITRE ATT&CK
- ShinyHuntersSelf-declared, or criminal-reporting attribution
- Transparent TribeContested — ATT&CK hedges, or two plausible sponsors
- ZIRCONIUMNo attribution in MITRE ATT&CK
Story signals
- ● Tier 1/4Source reliability — 1 official, 4 leads only
- VerifiedCorroborated by a second source or the principal
- ReportedSingle outlet, or a claim still in progress
- UnverifiedA claim we could not corroborate
- ConfirmedBreach acknowledged by the victim or a regulator
- ProbableBreach indicated but not yet acknowledged
- IOCs · FamilyLive abuse.ch indicators exist for that malware family
A collapsed Indicators of compromise block under a story lists defanged abuse.ch indicator values. The defanging is deliberate — never click, resolve or fetch them. An indicator corroborates a report; it never proves one.
Full methodology, evidence grading and caveats: Methodology & reading guide →