178 casos · pág. 4/9
A Register "On Call" column recounts a reader's account (pseudonym Daniel) of joining a UK school in 2020, after the school's network had been taken offline for three months by ransomware. Recovery relied on external contractors and a months-old backup. His audit found a password policy of six letters with no complexity or expiry, and use…
The October 2026 Windows security update changes the default handling of NTLMv1-derived credentials for Single Sign-On. Before the update, Windows allowed them and logged warning events. Now they are blocked. Wi-Fi, Ethernet and VPN authentication may fail in environments that still depend on the legacy protocol. Microsoft states this is …
The Administrative Office of the US Courts reported a "cybersecurity incident" affecting the Bankruptcy Noticing Center (BNC), which is operated by BAE Systems, Inc. for the Federal Judiciary. The BNC systems and websites were taken offline, halting the production and distribution of electronic and paper bankruptcy notices for federal ban…
Ahold Delhaize, the Dutch grocery group behind Food Lion, Giant Food, Stop & Shop, Hannaford, Martin's and Albert Heijn, confirmed that a cyberattack caused by "malicious actions of others" forced it to proactively take IT systems offline, including websites and apps. The incident was first disclosed on October 12 and affected most of the…
MITRE released version 20 of its ATT&CK framework, expanding coverage of recent adversary tradecraft across the Enterprise, ICS and Mobile domains. Enterprise gains nine techniques and sub-techniques, including two prompt injection techniques (direct and indirect), abuse of an organization's own AI agents for data theft, poisoning of web …
Microsoft has confirmed that the October 2026 Windows Server security updates cause Outlook on the web (OWA) sign-in failures and mail delivery problems on some on-premises Exchange Server systems. Affected hosts run Windows Server 2019 and later. Messages sent from Outlook may stay in the Outbox, and Exchange may have trouble accessing m…
Microsoft has fixed a known issue in which games and Windows 11 apps using AC-3 (Dolby Digital) audio decoding crashed after the September 2026 optional preview update KB5124010. The fix is included in the October 2026 Patch Tuesday update KB5127648, which Microsoft advises installing on affected systems running Windows 11 24H2 and later.…
Bullhorn, a US cloud staffing and recruitment software vendor serving more than 10,000 customers, disabled access to its platform after detecting a cyber incident that caused a system-wide outage. Customers first saw job posting problems on Friday, and the company confirmed the cyberattack the following day. Bullhorn says it has isolated …
ESET reports that Russia-linked actors used the decentralized Yggdrasil mesh network to hide command-and-control traffic during an attack on a Ukrainian grain logistics company in July 2025. ESET says this is the first documented use of the technology by a state-linked group. The intrusion began with a phishing email sent in a campaign ag…
The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…
Microsoft assesses that the China-aligned actor Storm-0940 used the agentic AI penetration testing framework ARTEX to compromise the Microsoft 365 tenants of ConnectWise, then pivoted to its downstream customers. The campaign began in September 2026 and targeted hundreds of organizations worldwide across aerospace and defense, energy, fin…
Kaspersky GReAT identified an APT campaign in early 2026 targeting diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. The attackers used a UEFI bootkit dubbed BlackX, which closely resembles BlackLotus and bypasses Secure Boot by exploiting Baton Drop (CVE-2022-21894). Kaspersky attributes the activity to APT41 with medium co…
Indian certification authority eMudhra has publicly responded to the disclosure that private keys behind some of its root and issuing CAs were trivially weak. One key was reportedly the number "4" and others were short, easily guessed numbers. The company says a flaw in a Key Generation Ceremony (KGC) held on April 30, 2025 produced a sec…
Attackers gained unauthorized access to Onamae.com Desktop Cloud, operated by GMO Internet, and installed malicious programs in some customer server environments. GMO confirmed the installations on October 20, 2026. On October 21 it began rolling shutdowns of all Desktop Cloud plans and identified 26,739 potentially affected servers. Info…
Microsoft attributed the recent supply chain compromise of the ConnectWise Cloud Backup application to Storm-0940, a China state-aligned actor. The actor used ARTEX, a Go-based agentic AI penetration testing framework, to automate reconnaissance, password spraying and OAuth application abuse at "machine speed" against hundreds of organiza…
Two critical vulnerabilities affect PHP, in all versions since PHP 5 (2004). The NSA warned about them on Wednesday 21 October 2026, saying they let attackers reach the server file system or the database used by the web application (techcrunch.com). The PHP Foundation released four updates on 21 October 2026, including PHP 8.5.12. Each fl…
Hackers compromised the infrastructure of Onamae.com Desktop Cloud, a VPS service operated by GMO Internet in Japan, and installed malicious programs on up to 26,739 customer servers. The company confirmed the intrusion on October 20, 2026. It began progressively shutting down customer servers at 04:00 local time on October 21, and all De…
A cluster of unrelated but concurrent security events hit on 21 October 2026. Reuters reported government websites worldwide going offline after AI-discovered critical vulnerabilities in PHP, and the NSA advised organizations to update immediately or take PHP systems offline. The same day, Node.js patched four high-severity flaws, and Lit…
Kaspersky's analysis of Operation FlashHole describes a Lazarus Group campaign against South Korean organizations. It follows Operation SyncHole and is placed within the broader Cascade Hole activity. The earliest evidence dates to July 2025 (securelist.com, bleepingcomputer.com), and Kaspersky identified at least three victims in the sof…
F5 released NGINX 1.30.6 (stable) and 1.31.7 (mainline) on October 14, 2026 to fix five vulnerabilities. Three are memory-corruption bugs that F5 scores 9.2 (Critical) on CVSS v4.0, and they can crash a worker process or, in some conditions, allow code execution. The others are a TLS session-ticket flaw that can bypass client-certificate …
