DanSec

Cybersecurity Brief

Wednesday 28 October 2026

In this brief Sony, So-net, Oracle, University of New Mexico, GMO Group, Moldova, +27 more
Vendors
Sony, So-net, Oracle, University of New Mexico, GMO Group, Moldova, Bithumb, Warp, 123 Reg, Convertr, Tailscale, Adobe, Google, GoAhead, EPICS, PHP, Node2Shell, CISA, Virtualine, Black Basta, Cisco, Microsoft, Mozilla, Magento, eMudhra
Threat actors
ShinyHunters, ARTEX group, CyberStrikeAI, Nefilim, Aokigahara, Black Basta, Hive
CVEs
CVE-2026-101767

Major Incidents or Breaches

  • Sony-owned So-net, a Japanese internet provider, suffered a data breach exposing personal information of over 2.58 million current and former customers, including email passwords for more than 54,000 users [58].
  • The University of New Mexico Health Sciences Center experienced a ransomware attack causing system outages, disruption to patient care, and the diversion of ambulances. Outpatient surgeries and academic activities were suspended [20][46][50].
  • Japanese internet giant GMO Group instructed customers to disconnect and shut down PCs following a breach of its Onamae Desktop Cloud service and a subsequent ransomware threat. The company is offering up to $1 million for information leading to the identification of the attackers [8][18][69].
  • Moldova was forced to take down over 80 public services following a cyberattack [67].
  • Bithumb, a South Korean cryptocurrency exchange, disclosed a data leak after a breach of its internal mobile system [68].
  • Warp, a development environment provider, disclosed a breach that exposed AI agent decision logs and user telemetry data due to a third-party vendor compromise [23].
  • 123 Reg, a UK-based hosting provider, reported an “AI cyberattack” on customer data and suspects a China-linked threat actor, possibly related to the ARTEX group [48].
  • British police data has been breached multiple times through third-party IT suppliers, according to a report from His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services [45].
  • Attackers hijacked a Convertr analytics script, leading to the theft of payment card data from e-commerce shoppers [21].

Newly Discovered Vulnerabilities

  • A critical unauthenticated SQL injection vulnerability (CVE-2026-101767) in Oracle E-Business Suite is being actively scanned and probed by attackers for remote code execution [1][15][31].
  • The critical Oracle PeopleSoft zero-day exploited by ShinyHunters consists of three chained vulnerabilities, all now patched [10].
  • Tailscale patched multiple SSH server vulnerabilities that could allow lateral movement and root access on other servers within tailnets. The flaws were disclosed publicly before fixes were available [9][33][55].
  • Adobe released patches for eight critical vulnerabilities in Campaign Classic, which could enable arbitrary code execution, security bypass, and privilege escalation [4].
  • Google Chrome and Mozilla Firefox released updates addressing over 200 vulnerabilities combined, including serious security flaws [25][82].
  • A 16-year-old flaw in EDK II, used in UEFI firmware, allows code execution before secure boot on network-booting servers [2].
  • TLS flaws in the GoAhead web server, used in hundreds of millions of devices, could allow revoked certificates or eavesdropping on encrypted sessions [26].
  • Four long-hidden vulnerabilities in EPICS Base, a control software used in research facilities, were patched after discovery by an autonomous system. The flaws could let attackers crash processes at particle accelerators and fusion labs [28][49].
  • Two critical PHP vulnerabilities, collectively known as “PHP2Shell,” are being actively exploited to compromise web management interfaces of firewalls, VPNs, and application delivery controllers [13][14][27][51].
  • Node2Shell, a critical Brotli vulnerability affecting Adobe Commerce, Magento, and Google’s Brotli decoder, is under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities catalog [11][16][32].

Notable Threat Actor Activity

  • China-linked hackers have exploited PHP2Shell and Fragnesia vulnerabilities to gain root access to firewalls, including attacks on US government-affiliated organizations [27].
  • ShinyHunters exploited chained Oracle PeopleSoft vulnerabilities for attacks since May [10].
  • A credit card skimming group compromised Convertr analytics scripts to steal payment card data [21].
  • CyberStrikeAI used 44 AI agents in three cyberattacks targeting organizations in Japan, with AI playing a central role in attack execution or support [12].
  • A Ukrainian national, Artem Stryzhak, was sentenced to 70 months in prison for his involvement in Nefilim and Hive ransomware attacks targeting hospitals, government entities, law firms, and businesses worldwide, causing over $100 million in losses. The US is offering an $11 million reward for information on a co-conspirator [17][43][56][65][73].
  • The FBI seized the domain of bulletproof hosting provider Virtualine, which was used for criminal hosting, money laundering, and facilitating the distribution of child sexual abuse material [7][42][57].
  • 123 Reg suspects a China-based group in its AI-enabled cyberattack, possibly linked to the ARTEX group known for targeting South Korean financial institutions [48].
  • Threat actors are increasingly chaining multiple vulnerabilities for exploitation, as seen in the Oracle PeopleSoft and PHP2Shell cases [10][27].
  • Attackers are abusing legitimate cloud services, authentication mechanisms, and trusted business infrastructure in phishing campaigns, moving beyond traditional credential theft [5][78].
  • A significant increase in phishing campaigns leveraging legitimate platforms has been observed, with over 25 services abused in the past year [78].
  • AI-driven attacks are on the rise, with examples including CyberStrikeAI’s multi-agent operations in Japan and the use of unreleased AI models to chain vulnerabilities across Chrome, Safari, Windows, and Linux into working exploits [6][12].
  • Malware such as “Aokigahara” stealer is targeting developer keyrings and AI assistants, expanding the focus of infostealers to sensitive business and AI data [39].
  • Mail bombing and social engineering via external Teams chats are being used for malware delivery, possibly linked to the Black Basta ransomware gang [36].
  • Attackers are leveraging mobile device management (MDM) platforms to deploy rogue remote monitoring and management (RMM) tools for persistent remote access [85].
  • Cisco open-sourced Project Quarry, a tool for detecting AI agents engaged in hacking operations [47].
  • CISA released updated versions of ScubaGear and ScubaGoggles, open-source tools for auditing Microsoft 365 and Google Workspace security settings [59].
  • AbuseBox, a new open-source tool, enables monitoring of IP and domain reputation, DNS, SSL, and email records [61].

Regulatory or Policy Developments Affecting the Security Industry

  • The US National Institute of Standards and Technology (NIST) released a roadmap for migration to post-quantum cryptography, with accelerated deadlines for sensitive federal systems [62].
  • Microsoft released out-of-band Windows updates to distrust certificates tied to compromised eMudhra certificate authority keys [22].
  • CISA added the Node2Shell and PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog, mandating patching for federal agencies [11][16][32][51].
  • The UK’s His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services highlighted repeated breaches of British police data via third-party suppliers, raising concerns about supply chain security [45].
  • Austria is preparing to replace email and phone communications among doctors with an end-to-end encrypted instant messaging service for hospitals and clinics [52].

Sources

  1. Data breach at Sony-owned internet provider compromises 2.6 million customer records - helpnetsecurity.com
  2. UNM Health ransomware attack disrupts patient care, surgeries - bleepingcomputer.com
  3. University of New Mexico hospital diverts ambulances after cyberattack - therecord.media
  4. Day 2 of canceled classes at University of New Mexico after Health Sciences Center cyberattack - theregister.com
  5. Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach - thehackernews.com
  6. Japan's GMO urges customers to shut down PCs amid ransomware threat - bleepingcomputer.com
  7. Japanese internet giant GMO tells customers to shut down and disconnect PCs from the internet following data breach and ransomware threat - databreaches.net
  8. Risky Bulletin: Moldova takes down 80+ public services after cyberattack - news.risky.biz
  9. KR: Bithumb discloses data leak after internal system breach; One of three financial firm breaches reported that day - databreaches.net
  10. Warp discloses breach exposing AI agent logs, user telemetry data - bleepingcomputer.com
  11. 123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus - theregister.com
  12. Hackers repeatedly breached suppliers holding UK police data, watchdog finds - therecord.media
  13. Hackers hijack Convertr analytics script to steal payment card data - bleepingcomputer.com
  14. Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch - thehackernews.com
  15. Hackers now scanning systems for recently-patched Oracle flaw - bleepingcomputer.com
  16. Hackers Start Probing Fresh Oracle EBS Vulnerability - securityweek.com
  17. ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws - thehackernews.com
  18. Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers - thehackernews.com
  19. Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws - securityweek.com
  20. Tailscale fixes SSH flaws allowing lateral movement within tailnets - helpnetsecurity.com
  21. Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass - thehackernews.com
  22. Chrome and Firefox Updates Patch Over 200 Vulnerabilities - securityweek.com
  23. Chrome and Firefox updates fix serious security flaws. Install them now - malwarebytes.com
  24. Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers - thehackernews.com
  25. TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices - securityweek.com
  26. Long-Hidden Flaws Patched in EPICS Research Facility Control Software - securityweek.com
  27. AI 'hacker' finds 4 severe bugs in popular industrial control software in under 4 hours - theregister.com
  28. InfraTrust report warns of exploited flaws in critical network infrastructure - bleepingcomputer.com
  29. Even after PHP2Shell, blast radius matters more than a CVSS score - bleepingcomputer.com
  30. China-Linked Hackers Exploit PHP2Shell to Root Firewalls - securityweek.com
  31. CISA confirms PHP2Shell under attack as researchers clock successful exploits - theregister.com
  32. Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges - thehackernews.com
  33. CISA warns of hackers now exploiting critical Node2Shell flaw - bleepingcomputer.com
  34. CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts - securityweek.com
  35. CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets - thehackernews.com
  36. Nefilim and Hive ransomware affiliate gets 70 months in prison - bleepingcomputer.com
  37. Nefilim, Hive ransomware operator given five-year-plus sentence after guilty plea - therecord.media
  38. Ukrainian ransomware hacker sentenced, $11 million reward offered for co-conspirator - helpnetsecurity.com
  39. Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison - cyberscoop.com
  40. Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million in Losses - databreaches.net
  41. FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering - thehackernews.com
  42. FBI seizes ‘bulletproof’ hosting site accused of facilitating child abuse, money laundering - therecord.media
  43. FBI seizes Virtualine, bulletproof hosting provider that promised to shield criminals from police - helpnetsecurity.com
  44. American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed - thehackernews.com
  45. Attackers Abuse Legitimate Infrastructure to Distribute Phishing Emails - blog.knowbe4.com
  46. Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits - thehackernews.com
  47. 'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants - darkreading.com
  48. External Teams Chats Anchor 15-Minute Malware Delivery - darkreading.com
  49. Managed for Malice: How Attackers Turn MDM into Remote Access - huntress.com
  50. Cisco open sources tool for detecting AI agents on hacking sprees - theregister.com
  51. CISA updates ScubaGear and ScubaGoggles, and says Microsoft 365 checks get faster - helpnetsecurity.com
  52. AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records - helpnetsecurity.com
  53. NIST starts the countdown to retire quantum-vulnerable encryption - helpnetsecurity.com
  54. Microsoft releases Windows OOB updates to distrust eMudhra certificates - bleepingcomputer.com
  55. Austrian doctors to swap emails and phone calls for encrypted messages - computerweekly.com