https://thesituationmonitor.org/Hacks, breaches, exploited vulnerabilities and supply-chain attacks, aggregated from public sources.Sat, 24 Oct 2026 08:20:21 GMThttps://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.htmlsituation-monitor-c3e002ca74d2Sat, 24 Oct 2026 06:25:57 GMTnewsThe Hacker News — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity…https://github.com/advisories/GHSA-5x8w-8jj5-q52hsituation-monitor-e8fbfd56b0a2Fri, 23 Oct 2026 21:55:21 GMTvulnGitHub Advisory DB (critical) — ### Credits **Researcher**: Alex Bouffard (mixbo@pebwalker.com) ### Summary A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with `Image.open()`. The file is recognized by content (the OLE2…https://www.theregister.com/security/2026/10/23/theres-a-third-php2shell-bug-but-it-wont-get-an-emergency-fix/5305208situation-monitor-80f9b59c4667Fri, 23 Oct 2026 20:04:40 GMTnewsThe Register — Bad things (and software bugs?) come in threeshttps://www.microsoft.com/en-us/security/blog/2026/10/23/inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks/situation-monitor-70834e56e693Fri, 23 Oct 2026 18:12:19 GMTadvisoryMicrosoft Security Blog — Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations.https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.htmlsituation-monitor-7ff30d4c6263Fri, 23 Oct 2026 17:54:08 GMTnewsThe Hacker News — Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it…https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/situation-monitor-ba280a6315d6Fri, 23 Oct 2026 16:40:07 GMTnewsBleepingComputer — American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system.https://techcrunch.com/2026/10/23/lab-testing-giant-quest-diagnostics-confirms-patients-personal-and-health-data-was-compromised-during-breach/situation-monitor-019687e1f391Fri, 23 Oct 2026 15:00:09 GMTnewsTechCrunch Security — Quest is the latest in a series of healthcare technology companies that have been hacked in recent months.https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.htmlsituation-monitor-4cfb00e1ff44Fri, 23 Oct 2026 13:50:56 GMTnewsThe Hacker News — Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous…https://www.helpnetsecurity.com/2026/10/23/microsoft-365-accounts-stolen-sessions/situation-monitor-806627667353Fri, 23 Oct 2026 11:45:12 GMTnewsHelp Net Security — An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress. The researchers tracked the campaign between July 14 and September 22, 2026, counting 497…https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.htmlsituation-monitor-a177a383ec80Fri, 23 Oct 2026 11:25:43 GMTnewsThe Hacker News — PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.The project is not issuing an…https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/situation-monitor-3bd8fb933f2cFri, 23 Oct 2026 09:58:34 GMTnewsSecurityWeek — The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.htmlsituation-monitor-992ca8ea9cb8Fri, 23 Oct 2026 09:36:00 GMTnewsThe Hacker News — Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs…https://www.helpnetsecurity.com/2026/10/23/capcom-id-data-breach-11-million-records-exposed/situation-monitor-e570996af6cbFri, 23 Oct 2026 09:07:31 GMTnewsHelp Net Security — Players who signed up for Capcom’s online account service may want to look twice at emails that seem to come from the company. The company has disclosed that a third party gained unauthorized access to customer information linked to CAPCOM ID, the account people use to sign in to the company’s web services and to play…https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.htmlsituation-monitor-3976fbb78444Fri, 23 Oct 2026 08:35:45 GMTnewsThe Hacker News — AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to…https://www.securityweek.com/11-million-impacted-by-capcom-data-breach/situation-monitor-addca3bbbe26Fri, 23 Oct 2026 08:34:14 GMTnewsSecurityWeek — The hackers stole 11 million email addresses from CAPCOM ID and changed the login passwords for 196 accounts.https://www.securityweek.com/quest-diagnostics-reports-cyber-breach-affecting-certain-patient-records/situation-monitor-b44bfcb0976fFri, 23 Oct 2026 08:25:06 GMTnewsSecurityWeek — In a regulatory filing, Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager, a platform where certain clients can place test orders.https://www.securityweek.com/litellm-compromised-in-fresh-supply-chain-attack/situation-monitor-7308efd2fcbfFri, 23 Oct 2026 08:10:46 GMTnewsSecurityWeek — Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker.https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.htmlsituation-monitor-7f2e7a0b4814Fri, 23 Oct 2026 07:40:45 GMTnewsThe Hacker News — Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and…https://therecord.media/php-php2shell-exploitation-attempts-pocssituation-monitor-79e3cc91452cFri, 23 Oct 2026 04:00:00 GMTnewsThe Record — The headline-grabbing bugs known colloquially as PHP2Shell are giving cyber analysts a lot to track — and a lot to debunk.https://nvd.nist.gov/vuln/detail/CVE-2026-114625situation-monitor-5c5173785d8eFri, 23 Oct 2026 00:00:00 GMTkevCISA KEV — Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the…https://nvd.nist.gov/vuln/detail/CVE-2026-110447situation-monitor-73ce6b0df02fFri, 23 Oct 2026 00:00:00 GMTkevCISA KEV — Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.https://www.bleepingcomputer.com/news/security/railway-warns-devs-to-rotate-secrets-after-potential-breach/situation-monitor-09fdac855b6eThu, 22 Oct 2026 21:25:31 GMTnewsBleepingComputer — Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week.https://www.vanityfair.com/story/jared-kushner-hacked-phone-secret-negotiationssituation-monitor-7c4de98d27e0Thu, 22 Oct 2026 21:24:41 GMTcommunityHacker News — 536 points · 223 comments on Hacker Newshttps://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attacksituation-monitor-f11cad1b49dcThu, 22 Oct 2026 20:42:17 GMTnewsDark Reading — The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/situation-monitor-1a27507934b5Thu, 22 Oct 2026 20:22:45 GMTnewsBleepingComputer — Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information.https://www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/situation-monitor-24be2507ef67Thu, 22 Oct 2026 19:12:51 GMTnewsBleepingComputer — Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables.https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.htmlsituation-monitor-546f85604caeThu, 22 Oct 2026 19:05:17 GMTnewsThe Hacker News — Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator…https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/situation-monitor-789ca6d5bc13Thu, 22 Oct 2026 17:18:22 GMTnewsBleepingComputer — Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments.https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.htmlsituation-monitor-71c7104b2dcaThu, 22 Oct 2026 17:01:53 GMTnewsThe Hacker News — Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other…https://github.com/advisories/GHSA-673q-mjm6-r5xrsituation-monitor-acb782055663Thu, 22 Oct 2026 16:42:31 GMTvulnGitHub Advisory DB (critical) — ## Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays. ## Workaround There is no known workaround for affected applications with such `use cache` functions. You should…https://github.com/advisories/GHSA-v9pv-5gc8-w2m6situation-monitor-982bce34a174Thu, 22 Oct 2026 16:00:15 GMTvulnGitHub Advisory DB (critical) — ### Summary Pillow multi-frame image loaders can retain native `ImagingCore` storage allocated for one frame while changing the Python-side image `mode` and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as `L`, and a later frame of the same dimensions switches to a wider mode…https://github.com/advisories/GHSA-2464-fhr4-w9xwsituation-monitor-1614f74f1025Thu, 22 Oct 2026 15:52:53 GMTvulnGitHub Advisory DB (critical) — ## Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. ## Workaround Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs…https://github.com/advisories/GHSA-9v8h-qqgm-4m35situation-monitor-c7bc6b5d8a43Thu, 22 Oct 2026 15:32:49 GMTvulnGitHub Advisory DB (critical) — A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code…https://techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack/situation-monitor-8bcf4e1acba7Thu, 22 Oct 2026 14:03:00 GMTnewsTechCrunch Security — The vibe-coding platform said all of its customers should revoke and rotate their private keys, after hackers were able to decrypt some customer secrets.https://www.helpnetsecurity.com/2026/10/22/litellm-compromised-supply-chain-attack-pypi-docker/situation-monitor-a019a286e1d8Thu, 22 Oct 2026 13:10:28 GMTnewsHelp Net Security — A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it. “LiteLLM got compromised… again,” security researcher Kevin Beaumont wrote on Mastodon. In August, Hudson Rock…https://nvd.nist.gov/vuln/detail/cve-2026-111943situation-monitor-848b94f8a6abThu, 22 Oct 2026 08:51:31 GMTcommunityHacker News — 336 points · 123 comments on Hacker Newshttps://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.htmlsituation-monitor-82f7c7177bd4Thu, 22 Oct 2026 08:28:48 GMTnewsThe Hacker News — LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the…https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.htmlsituation-monitor-a07ef732238eThu, 22 Oct 2026 04:21:26 GMTnewsThe Hacker News — Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its…https://dysruptionhub.com/columbia-south-carolina-security-outage/situation-monitor-03a57b369a4bThu, 22 Oct 2026 00:00:00 GMTbreachransomware.live disclosures — Un incident de sécurité réseau a perturbé les services en ligne de la ville de Columbia, en Caroline du Sud. Les services d'urgence, l'eau et les paiements en ligne sont restés opérationnels. Les perturbations ont affecté les demandes de services, les licences commerciales et les permis. Les autorités enquêtent, mais…https://dysruptionhub.com/petersburg-alaska-ransomware-utility-billing/situation-monitor-ed53a1006a56Thu, 22 Oct 2026 00:00:00 GMTbreachransomware.live disclosures — Le Borough de Petersburg, en Alaska, a révélé avoir été victime d'une cyberattaque par ransomware le 11 juillet 2026. L'incident a ciblé le logiciel de facturation des services publics, permettant l'accès aux noms des clients et aux numéros de compte. Les informations bancaires et les données de carte de crédit n'ont…https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611situation-monitor-650e25e16a36Wed, 21 Oct 2026 23:02:57 GMTnewsThe Register — 'Coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild,' Chainguard CEO tells The Reghttps://cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940/situation-monitor-a852f8016f40Wed, 21 Oct 2026 21:58:21 GMTnewsCyberScoop — Storm-0940 used the agentic AI penetration testing framework to automate attacks and “reach more than 2,250 tenants at 2,900 sign-in attempts per minute,” Microsoft researchers said.https://github.com/advisories/GHSA-332p-7hrc-92wfsituation-monitor-44eebe0d451dWed, 21 Oct 2026 21:28:09 GMTvulnGitHub Advisory DB (critical) — ``` ============================================================================ Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Location: src/libImaging/TiffDecode.c:94 in _tiffWriteProc() Commit: a707c6b21c313880d0771e54965d142dd42358b6…https://isc.sans.edu/diary/rss/33440situation-monitor-4bb94bf6a5e8Wed, 21 Oct 2026 21:02:43 GMTnewsSANS Internet Storm Center — PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits before the patch became available.https://github.com/advisories/GHSA-w889-685w-c8fhsituation-monitor-68f363fc5f8dWed, 21 Oct 2026 19:58:44 GMTvulnGitHub Advisory DB (critical) — ### Summary `PIL.EpsImagePlugin.Ghostscript()` builds the Ghostscript command line using the input file path (`fp.name`) **without sanitization**, placing it at `-f `. A filename beginning with `-` is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact)…https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industrysituation-monitor-008d1b0c2d20Wed, 21 Oct 2026 19:19:17 GMTnewsDark Reading — Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts.https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.htmlsituation-monitor-73ad62f8f5bdWed, 21 Oct 2026 18:57:34 GMTnewsThe Hacker News — GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions…https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/situation-monitor-57738110634dWed, 21 Oct 2026 18:23:55 GMTadvisoryMicrosoft Security Blog — Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548situation-monitor-222bda02fe9cWed, 21 Oct 2026 18:22:20 GMTnewsThe Register — Plus a RAT for good measure - get threat hunting nowhttps://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.htmlsituation-monitor-f857298eef6cWed, 21 Oct 2026 18:01:57 GMTnewsThe Hacker News — The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The…https://www.theregister.com/security/2026/10/21/php-devs-publish-critical-bug-fix-as-site-owners-warned-pull-em-offline-if-youre-unpatched/5304519situation-monitor-145cb1e1d82dWed, 21 Oct 2026 15:08:51 GMTnewsThe Register — Websites down as precaution as exploits have already been publishedhttps://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/situation-monitor-19be0293d558Wed, 21 Oct 2026 14:26:19 GMTnewsWIRED Security — The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.https://www.cybersecuritydive.com/news/fbi-cisa-warn-safepay-ransomware-threat-critical-infrastructure/833589/situation-monitor-def7ba44a2e4Wed, 21 Oct 2026 14:25:47 GMTnewsCybersecurity Dive — The group has been linked to a 2025 attack targeting technology firm Ingram Micro.https://www.cybersecuritydive.com/news/php-website-vulnerabilities/833580/situation-monitor-587d8f969fe6Wed, 21 Oct 2026 14:12:29 GMTnewsCybersecurity Dive — Government agencies urged organizations to take their sites offline until they could be fixed.https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor/situation-monitor-e66952802744Wed, 21 Oct 2026 14:00:26 GMTcommunityHacker News — 594 points · 196 comments on Hacker Newshttps://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.htmlsituation-monitor-b99e39613f03Wed, 21 Oct 2026 14:00:00 GMTnewsThe Hacker News — PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws, together called PHP2Shell, sit in the…https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/situation-monitor-153f0d90a2adWed, 21 Oct 2026 13:40:02 GMTnewsCyberScoop — The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw.https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.htmlsituation-monitor-925317ef03dfWed, 21 Oct 2026 10:36:53 GMTnewsThe Hacker News — You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says. PHP will release the fix at 14:00 UTC on October 21 for two flaws it rates 9.2 out of 10, and has given…https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.htmlsituation-monitor-c4db0d2f8932Wed, 21 Oct 2026 09:05:17 GMTnewsThe Hacker News — This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory. PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that…https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312situation-monitor-4d33eb7e5bd2Tue, 20 Oct 2026 22:57:44 GMTnewsThe Register — Massive clean-up job under way because this mess makes it possible to impersonate any website or servicehttps://github.com/advisories/GHSA-8g5g-8vmr-9782situation-monitor-63dc6d51f37eTue, 20 Oct 2026 20:40:07 GMTvulnGitHub Advisory DB (critical) — ## Summary `JpegImageFile.draft()` — which `Image.thumbnail()` calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks `self._size` and the tile extents to match, so `_setimage()` allocates a single-row decode buffer of `ceil(W/s)` samples. `ImagingJpegDecode()` sets…https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.htmlsituation-monitor-ef37e5960667Tue, 20 Oct 2026 17:09:53 GMTnewsThe Hacker News — The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a…https://cyberscoop.com/connectwise-cloud-backup-supply-chain-attack/situation-monitor-93654b344667Tue, 20 Oct 2026 16:17:52 GMTnewsCyberScoop — Hundreds of customers are confirmed impacted, as attackers use a sensitive credential to break into connected Microsoft 365 applications unimpeded.https://databreaches.net/2026/10/20/qilin-and-inc-ransomware-groups-exploit-palo-alto-networks-flaw-to-bypass-mfa/situation-monitor-b3f63a8df13bTue, 20 Oct 2026 16:08:24 GMTnewsDataBreaches.net — Ravie Lakshmanan reports: Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to…https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.htmlsituation-monitor-4f063b83795eTue, 20 Oct 2026 15:38:52 GMTnewsThe Hacker News — Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an…https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.htmlsituation-monitor-4f5a6ec257b3Tue, 20 Oct 2026 15:32:27 GMTnewsThe Hacker News — Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN…https://www.cybersecuritydive.com/news/ransomware-targeting-palo-alto-networks-vulnerability/833474/situation-monitor-76ba3b7b0038Tue, 20 Oct 2026 15:04:11 GMTnewsCybersecurity Dive — Multiple threat actors have exploited a high-severity flaw in the company’s GlobalProtect portal.https://www.theregister.com/cyber-crime/2026/10/20/password1-and-a-forgotten-test-account-land-welsh-outfits-in-hot-water/5304139situation-monitor-0706e9590b71Tue, 20 Oct 2026 13:35:00 GMTnewsThe Register — ICO reprimands Ogi Networks and Data Cymru after ransomware breach exposes info of 3,300 people, mostly childrenhttps://databreaches.net/2026/10/20/welsh-firms-password1-and-test-2-fails-led-to-hackers-stealing-childrens-data/situation-monitor-f4387c26b067Tue, 20 Oct 2026 13:28:52 GMTnewsDataBreaches.net — Alex Hickey reports: Two Welsh organisations have been censured by the Information Commissioner’s Office (ICO) after a ransomware attack led to the theft of personal data belonging to 3,300 individuals, the vast majority of whom were children. Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales…https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.htmlsituation-monitor-f669c84182baTue, 20 Oct 2026 11:06:25 GMTnewsThe Hacker News — The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO). The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker…https://thehackernews.com/2026/10/connectwise-resets-credentials-as-cloud.htmlsituation-monitor-fc6d27df43a4Tue, 20 Oct 2026 10:56:08 GMTnewsThe Hacker News — ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup…https://nvd.nist.gov/vuln/detail/CVE-2026-106931situation-monitor-0a66bd2c2b18Tue, 20 Oct 2026 00:00:00 GMTkevCISA KEV — EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.https://nvd.nist.gov/vuln/detail/CVE-2026-96656situation-monitor-4a04f66d10a5Tue, 20 Oct 2026 00:00:00 GMTkevCISA KEV — Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.https://nvd.nist.gov/vuln/detail/CVE-2026-96655situation-monitor-8bbcdeb741c7Tue, 20 Oct 2026 00:00:00 GMTkevCISA KEV — Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.https://nvd.nist.gov/vuln/detail/CVE-2026-96654situation-monitor-2e468db3eb1aTue, 20 Oct 2026 00:00:00 GMTkevCISA KEV — Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.https://nvd.nist.gov/vuln/detail/CVE-2026-96652situation-monitor-fc4ea6162ac1Tue, 20 Oct 2026 00:00:00 GMTkevCISA KEV — Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654…https://nvd.nist.gov/vuln/detail/CVE-2026-110936situation-monitor-27702b69663dTue, 20 Oct 2026 00:00:00 GMTkevCISA KEV — Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.https://www.bleepingcomputer.com/news/security/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack/situation-monitor-7de4c4c06319Tue, 20 Oct 2026 00:00:00 GMTbreachransomware.live disclosures — La société américaine de logiciels de recrutement Bullhorn a dû désactiver l'accès à sa plateforme suite à une cyberattaque ayant provoqué une panne généralisée. L'incident, dont les premiers signes ont été observés le vendredi 16 octobre 2026, a été contenu par l'entreprise qui a isolé la menace et lancé une enquête…https://mscnews.net/local-news/936628situation-monitor-87338bfcf670Tue, 20 Oct 2026 00:00:00 GMTbreachransomware.live disclosures — Le Community Medical Center (CMC) de Falls City a été attaqué par le Groupe Qilin, le week-end du 17-18 octobre 2026. L'attaque a permis d'accéder à certaines parties du réseau informatique et a causé des dommages aux fichiers commerciaux. Le système a été verrouillé, entraînant des perturbations majeures des services…https://dysruptionhub.com/colorado-county-texas-systems-disruption/situation-monitor-e9812adf03ccTue, 20 Oct 2026 00:00:00 GMTbreachransomware.live disclosures — Le comté de Colorado, au Texas, a signalé une perturbation de ses systèmes gouvernementaux et des risques pour les services essentiels, y compris la sécurité publique. Bien qu'une liste de rançongiciel NightSpire ait été enregistrée le 14 octobre, le lien avec la perturbation du comté n'est pas confirmé. Les autorités…