DanSec

Cybersecurity Brief

Tuesday 27 October 2026

In this brief PHP, Keystone, ENGIE, DreamHost, Magento, Microsoft, +14 more
Vendors
PHP, Keystone, ENGIE, DreamHost, Magento, Microsoft, Node.js, Apple, HPE, Popcorn Time, Kubernetes, GitHub, Dahua, LiteLLM, OpenAI, Siemens, Schneider, ABB
Threat actors
Lazarus Group
CVEs
CVE-2026-111497

Major Incidents or Breaches

  • Keystone will destroy 18,835 hardware wallets after attackers obtained the device verification key by compromising its website, raising concerns about the authenticity of affected devices and potential supply chain risks [2].
  • French energy provider ENGIE confirmed a data breach after attackers accessed a marketing platform used by business partners, resulting in customer data theft [14].
  • The University of Copenhagen disclosed a data breach exposing personal data of 525,000 individuals after hackers accessed a test environment [16][56][73].
  • DreamHost forced password resets for email and FTP/SFTP accounts following an incident that disrupted services, with ongoing customer access issues [19][25][75].
  • The University of New Mexico Health Sciences Center suffered a cyberattack that disrupted hospital operations and led to patient diversions and clinic closures. An extortion group has claimed responsibility [31][70].
  • Attackers infected 953 online stores, mostly Magento-based, with scanner-evading JavaScript as part of a campaign active since July 2025, enabling theft of customer data [9].
  • An attack on the email hosting provider for Germany’s AfD party exposed 345,000 accounts [47].
  • Japanese virtual desktop cloud service Onamae Desktop Cloud was compromised, with the company admitting security holes and asking for the service to be banned due to the severity of the breach [48][88].

Newly Discovered Vulnerabilities

  • Microsoft fixed a flaw in its Authenticator app for Android that allowed any permissionless app to impersonate trusted Microsoft apps and steal work account sign-in tokens [1].
  • Multiple critical vulnerabilities dubbed PHP2Shell in PHP were confirmed to be actively exploited in the wild, enabling remote code execution. CISA added these to the Known Exploited Vulnerabilities catalog and mandated rapid patching for US federal agencies. Major industrial vendors including Siemens, Schneider Electric, and ABB confirmed some of their products are affected [8][15][33][42][64].
  • A critical ‘HTTP2Shell’ vulnerability (CVE-2026-111497) in the Brotli compression library, used in Node.js and other platforms, allows attackers to corrupt memory and access sensitive data. Emergency patches have been issued for PHP, Node.js, and Microsoft .NET. No in-the-wild exploitation has been confirmed yet [10][20][21][52][77][94].
  • Apple backported CoreGraphics zero-day patches to older iPhones and iPads, addressing a flaw exploited in targeted attacks. Apple also released updates patching hundreds of vulnerabilities across iOS and macOS [13][26][85].
  • Six Linux flaws were disclosed, including one with a public root exploit and no merged fix, exposing systems before patches are available [61].
  • HPE patched dozens of critical flaws in networking products, including eight max-severity vulnerabilities that could lead to remote code execution and authentication bypass [24].
  • A forgotten updater for the Popcorn Time streaming app was found to execute code served from a remote domain at system boot with full privileges, leaving millions of devices exposed [29][92].
  • A vulnerability chain in Kubernetes, Konnectivity, and overlay networking enabled isolation bypass and remote code execution in cloud infrastructure [83].

Notable Threat Actor Activity

  • North Korea-linked Lazarus Group was attributed to Operation FlashHole, a cyber espionage campaign targeting South Korean organizations by abusing security software and deploying malware using post-quantum encryption [4].
  • A supply chain attack dubbed Gheist harvested credentials and secrets from thousands of developer repositories by abusing stolen GitHub tokens and planting malicious branches in over 850 compromised accounts [37][60][74].
  • Attackers hijacked Dahua IP cameras in Ukraine using P2P access and authentication weaknesses, gaining unauthorized remote access [7].
  • A former pentester and six others used the ARTEX AI pentesting framework to breach over 90 organizations in South Korea, stealing 8.2 million data records [17].
  • Cybercriminals used Microsoft Teams external chat creation for social engineering, deploying malware and ransomware through IT support scams, with breaches occurring in under 15 minutes [11][55].
  • A worm campaign armed 42 GitHub repositories with large payload blobs to evade code search and facilitate malware distribution [49].
  • A supply chain attack on LiteLLM began with an exposed master key, highlighting risks from inadequate key rotation [51].
  • Attackers infected developer systems by distributing malware via signed ChatGPT and Claude binaries, leveraging the popularity of AI tools [87].
  • An unknown threat actor infected nearly 1,000 Magento stores with scanner-evasive JavaScript to steal payment data [9].
  • A China-linked ransomware group disabled security tools at a critical infrastructure operator before deploying their encryptor [76].
  • Generative AI is being used to create highly convincing fake login pages, making phishing and account takeover attacks more effective and easier to scale [3].
  • AI agent prompt injection attacks now exploit trust in Markdown files, allowing coding assistants to be manipulated via local instruction files [36].
  • Researchers demonstrated that OpenAI’s compaction feature could be abused to exfiltrate a model’s hidden reasoning in plain text [6].
  • There is a continued surge in remote code execution vulnerabilities, especially in widely used open-source components, prompting rapid emergency patching and increased scanning for unpatched systems [12][63][90].
  • New security solutions are emerging to monitor and govern AI and autonomous agent activity, including Exeon.AgentGuard for shadow AI, ThreatAware Dimension for governed AI workspaces, and FireMon Agentic AI for policy investigation [68][69][72].
  • The use of AI in offensive security is growing, as seen in the ARTEX AI pentesting framework used in large-scale breaches [17].
  • AI security benchmarking remains fragmented, with no single benchmark providing a comprehensive view of model security [34].
  • The risk of secret leakage from private repositories persists, as evidenced by ongoing Gheist campaigns [74].
  • Microsoft Teams external chat exploitation is becoming a recurring and highly effective social engineering vector for malware and ransomware delivery [11][55].
  • Forgotten or abandoned software updaters, such as Popcorn Time’s, continue to pose significant supply chain risks [29][92].

Regulatory or Policy Developments Affecting the Security Industry

  • CISA released its CISA 2030 strategy, emphasizing rapid detection, response, and resilience for US critical infrastructure, and prioritizing proactive over passive defense [59][71][80].
  • CISA ordered federal agencies to patch PHP2Shell vulnerabilities within days and added them to the Known Exploited Vulnerabilities catalog [8][15][42].
  • The UK government has been criticized for using AI in immigration and asylum decisions under near-total secrecy, routinely invoking national security to avoid transparency [65].
  • The EU is making faster progress than the UK in patching critical PHP vulnerabilities, with the UK lagging behind in remediation efforts [64].
  • The UK police and fire services have been urged by a watchdog to strengthen cybersecurity in response to rising threats [58].
  • Texas filed a lawsuit against OpenAI, seeking reforms and fines for allegedly deceiving consumers about the safety of its products, and aiming to hold the CEO personally liable [44].
  • The NIST, CISA, and NSA released guidance treating incidents involving rogue AI agents as security incidents, stressing the need for clear identity and authority records for deployed agents [22].
  • ISC2 announced a pilot phase for its first AI security certification, expected for release in early 2027 [57].
  • The UK Chancellor announced further investments in AI ahead of the Autumn Budget 2026 [62].
  • A maritime coalition launched a free vulnerability database covering IT and OT flaws relevant to ships and ports [30].
  • The NCSC highlighted collaboration with the FCA to improve information sharing while protecting market integrity [97].

Sources

  1. Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key - thehackernews.com
  2. Energy giant ENGIE discloses data breach affecting customers - bleepingcomputer.com
  3. University of Copenhagen data breach exposes data of 525,000 people - bleepingcomputer.com
  4. Copenhagen University Breach Compromises Data on Half a Million People - infosecurity-magazine.com
  5. Cyberattack on University of Copenhagen exposes data of 525,000 people - helpnetsecurity.com
  6. DreamHost forces password resets in ongoing "incident" - bleepingcomputer.com
  7. Unexplained DreamHost Incident Prompts Email, FTP Password Resets - securityweek.com
  8. DreamHost incident triggers password resets, locks customers out of email and FTP accounts - helpnetsecurity.com
  9. Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics - securityweek.com
  10. Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack - helpnetsecurity.com
  11. Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento - thehackernews.com
  12. Attack on email hosting provider for German far right party AfD exposed 345k accounts - theregister.com
  13. Japanese virtual desktop cloud hacked so hard it asks to be banned - theregister.com
  14. 26th October – Threat Intelligence Report - research.checkpoint.com
  15. Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens - thehackernews.com
  16. CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution - thehackernews.com
  17. CISA confirms PHP2Shell vulnerabilities now exploited in attacks - bleepingcomputer.com
  18. Industrial Vendors Check Products for PHP2Shell Vulnerabilities - securityweek.com
  19. CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch - therecord.media
  20. EU makes progress towards PHP patching, UK lags behind - computerweekly.com
  21. PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw - thehackernews.com
  22. Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches - bleepingcomputer.com
  23. Microsoft releases emergency .NET patches for critical Brotli flaw - bleepingcomputer.com
  24. Microsoft releases emergency .NET security fixes for Google Brotli bug - theregister.com
  25. Experts temper emergency-level alarms over critical Brotli defect - cyberscoop.com
  26. CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder - rapid7.com
  27. Apple backports CoreGraphics zero-day patches to older iPhones - bleepingcomputer.com
  28. iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18 - securityweek.com
  29. Apple Patches for October 2026, (Mon, Oct 26th) - isc.sans.edu
  30. Linux Flaws Exposed Before Fixes as Root Exploit Goes Public - infosecurity-magazine.com
  31. HPE Patches Dozens of Critical Flaws in Networking Products - securityweek.com
  32. Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover - securityweek.com
  33. Popcorn Time’s forgotten updater left millions of devices exposed to hijacking - malwarebytes.com
  34. An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure - securelist.com
  35. Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption - thehackernews.com
  36. 'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets - darkreading.com
  37. Gheist Attackers Stumble in Attempt to Abuse GitHub Tokens - infosecurity-magazine.com
  38. Private repos still leak secrets to Gheist, a stolen GitHub token campaign - helpnetsecurity.com
  39. Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses - thehackernews.com
  40. Former pentester used ARTEX AI to steal 8.2 million data records - bleepingcomputer.com
  41. Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware - thehackernews.com
  42. Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes - infosecurity-magazine.com
  43. Worm armed 42 GitHub repos by hiding a payload too big to fail - theregister.com
  44. LiteLLM supply chain attack started with an exposed master key - theregister.com
  45. Tricks from the Past deployed via signed ChatGPT and Claude binaries - research.checkpoint.com
  46. What happens when security tools go dark before the ransomware - cyberscoop.com
  47. AI-Generated Fake Login Pages Are Making Account Takeovers Easier - thehackernews.com
  48. In-the-Wild Attack Abuses AI Agents' Trust in Markdown - darkreading.com
  49. OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections - thehackernews.com
  50. ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More - thehackernews.com
  51. AI World: AI vulnerability surge brings change for Oracle’s cyber practice - computerweekly.com
  52. The web’s having a rough week. Here’s how to browse safely - malwarebytes.com
  53. FireMon Agentic AI helps teams investigate access and prepare policy changes - helpnetsecurity.com
  54. Exeon expands threat detection to shadow AI and autonomous agents - helpnetsecurity.com
  55. ThreatAware brings governance to AI-built security applications - helpnetsecurity.com
  56. So Many AI Security Benchmarks, But None Tell the Whole Story - darkreading.com
  57. CISA 2030 Sets Out ‘Aggressive, Anticipatory’ Cyber Defense Strategy for Critical Infrastructure - infosecurity-magazine.com
  58. CISA lays out plan to push cyber adversaries out of US critical infrastructure - helpnetsecurity.com
  59. CISA publishes strategy with eye on the next four years - cyberscoop.com
  60. UK secrecy over AI in immigration and asylum decisions under fire - computerweekly.com
  61. Watchdog Urges Police and Fire Service to Improve Cybersecurity - infosecurity-magazine.com
  62. Texas sues OpenAI for deceiving consumers about safety, seeks sweeping reforms and fines - therecord.media
  63. When an AI Agent Is the Incident, the Identity Record Is the Evidence - bleepingcomputer.com
  64. First ISC2 AI Security Certification Expected for Early 2027 - infosecurity-magazine.com
  65. Autumn Budget 2026: Healey sets out AI funding - computerweekly.com
  66. Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems - securityweek.com
  67. From industry concern to practical action: the value of working with regulators - ncsc.gov.uk