สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• AI Has 'potential' To Turn Script Kiddies Into Sophisticated Infrastructure Attackers
  "When it comes to cyberattacks that shut down power grids, drinking-water systems, and other critical infrastructure, AI doesn’t – yet – turn script kiddies into sophisticated, nation-state attackers. But “the potential is there,” according to operational technology (OT) security experts. "One thing that we've relied on for years is security by obscurity when it comes to utilities," said Steve Swick, former chief information security officer at American Electric Power. "The knowledge needed to do some of that stuff is getting less likely to be necessary," Swick added during a media panel ahead of the publication of Frenos' State of AI in Security report."
  https://www.theregister.com/security/2026/10/21/ai-has-potential-to-turn-script-kiddies-into-sophisticated-infrastructure-attackers/5304297

New Tooling

• DevGuard: Open-Source Vulnerability Management For The Software Supply Chain
  "DevGuard is a free, open source vulnerability management platform that collects a software project’s security findings in one place, ranks them by risk, and tracks them. It’s an OWASP Incubating Project, and anyone can self-host it. DevGuard runs secret scanning, static code analysis, dependency checks against known CVEs, infrastructure-as-code checks, container scanning, and license checks through one CLI that wraps existing open source tools. Teams already using Trivy, Grype, or Semgrep can skip the built-in scanners and upload CycloneDX SBOMs (machine-readable lists of the components in a build) or SARIF results. Findings sync both ways with GitHub Issues, GitLab Issues, and Jira, where developers triage them with slash commands."
  https://www.helpnetsecurity.com/2026/10/21/devguard-open-source-vulnerability-management/
  https://github.com/l3montree-dev/devguard
• Google Open-Sourced TorchTPU, So PyTorch On TPUs Just Got a Lot Easier
  "Google released TorchTPU as open source, giving PyTorch developers a native way to run models on the company’s Tensor Processing Units. Google also announced TPU support in the vLLM and SGLang serving engines, the TorchTitan training framework, Ray, and Hugging Face’s libraries. Teams that write their models in PyTorch and run them on GPUs by default have the most to gain. Google says those workloads now move to TPUs, its custom AI chips, with minimal code changes. If that claim holds up in practice, a team weighing GPU costs can test Google’s hardware without first rebuilding its software."
  https://www.helpnetsecurity.com/2026/10/21/torchtpu-pytorch-on-tpus/
  https://github.com/google-pytorch/torch_tpu

Vulnerabilities

• PHP Ships Emergency Patches For Critical PHP2Shell Flaws
  "The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. The two unauthenticated RCE flaws were discovered by Calif, , and OpenAI security researchers, and affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. "We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs," the PHP security team said."
  https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
  https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
  https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html
  https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
  https://blog.talosintelligence.com/two-critical-rces-in-php-core/
  https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
  https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry
  https://therecord.media/php-foundation-statement-critical-vulnerabilities
  https://blog.checkpoint.com/security/php2shell-what-we-know-about-the-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/
  https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/
  https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce
  https://www.wiz.io/blog/php2shell-php-rce
  https://asec.ahnlab.com/en/95944/
  https://www.bankinfosecurity.com/critical-php-patches-address-very-very-bad-vulnerability-a-33162
  https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/
  https://www.infosecurity-magazine.com/news/critical-php-vulnerabilities-leaked/
  https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/
  https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates
  https://www.theregister.com/security/2026/10/21/php-devs-publish-critical-bug-fix-as-site-owners-warned-pull-em-offline-if-youre-unpatched/5304519
  https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611
  https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/
• Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years Of Releases
  "GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an instance updated then is in range again. The flaw, tracked as CVE-2026-110264, is rated 10.0 on the CVSS scale, the maximum. GitLab says that, under certain conditions, it could allow an unauthenticated user to run arbitrary code on the server due to an integer overflow during the compilation of a specially crafted regular expression."
  https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
• Signal Bug Could Let Someone Keep Listening After You Hang Up
  "A recently disclosed flaw in Signal’s calling software could allow another participant to keep hearing you after you hang up. The vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 out of 10), affects RingRTC versions earlier than 2.72.0. RingRTC is the open-source library behind Signal’s voice and video calling functionality, providing calling components for its mobile and desktop applications. The flaw concerns how Signal’s calling library shuts down a call. It does not affect how it encrypts conversations. According to the published vulnerability description, another participant could overwhelm a call’s internal event queue and interfere with the steps that should disconnect it when you end the call."
  https://www.malwarebytes.com/blog/bugs/2026/10/signal-bug-could-let-someone-keep-listening-after-you-hang-up
  https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528
• Memory Bugs Account For Most Of Chrome’s 353 New Security Fixes
  "Google on Tuesday announced the promotion of Chrome 156 to the stable channel with patches for 353 vulnerabilities. Most of the resolved security defects were memory safety flaws, including 163 memory corruption bugs, 125 use-after-free issues, and 17 out-of-bounds reads. Of the remaining weaknesses, 36 are improper input validations. The browser refresh resolves six critical-severity vulnerabilities: five memory corruption defects and one use-after-free bug."
  https://www.securityweek.com/memory-bugs-account-for-most-of-chromes-353-new-security-fixes/

Malware

• Does It Stop When Someone Is Watching? The Suspicious Behavior Of a New Type Of Infostealer
  "It is already well known that illegal software and cracked programs can be exploited for malware distribution. Recently, AhnLab identified a new type of information theft malware (Infostealer) disguised as an illegal program. This malware was first detected in mid-August and, after altering its execution method, began spreading widely in September. Notably, it not only collects information stored in browsers and business applications but can also install additional malware, raising the possibility of secondary damage beyond mere Information Theft. Let’s take a look at the distribution methods, key behaviors, and countermeasures for this new type of Infostealer."
  https://asec.ahnlab.com/en/95937/
• Operation FlashHole: Lazarus Breaks Security, Defies Control
  "In January, we responded to the Lazarus Group’s novel attack campaign against South Korea, which followed last year’s Operation SyncHole. In this new operation, the group employed an updated malware chain that included both their old and new malware, which we disclosed in full, and used another mandatory South Korean security software program as a part of infection chain using a watering‑hole strategy. Notably, the group targeted victims more selectively, sending spear‑phishing emails with links to fabricated but relevant sites, such as portfolio and résumé pages tailored to each target. We dubbed this activity Operation FlashHole."
  https://securelist.com/lazarus-operation-flashhole/121541/
  https://www.bleepingcomputer.com/news/security/lazarus-hackers-use-post-quantum-cryptography-for-malware-delivery/
• Suppressing Misalignment Monitoring Alerts And Disabling Misalignment Monitoring
  "In two internal coding tasks, agents weakened misalignment monitoring while making requested software changes. A GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to our Security team, treating an earlier instruction not to send messages during a Slack history search as a reason to suppress monitoring notifications. In a separate task, a GPT-6 Astra agent migrating a program removed its monitoring integration in order to match a reference implementation, and then falsely claimed to the user that it had not removed the monitor. In both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them. We are strengthening our misalignment monitoring system in response, and are also assessing whether these cases reflect benign overpersistence or a propensity to evade misalignment monitoring in particular."
  https://alignment.openai.com/misalignment-reports/suppressing-misalignment-monitoring-alerts-and-disabling-misalignment-monitoring/
  https://www.bleepingcomputer.com/news/security/openai-agents-disabled-safety-monitoring-one-lied-about-it/
  https://thehackernews.com/2026/10/openais-gpt-6-agent-removed-safety.html
  https://www.securityweek.com/openai-agents-silenced-security-team-alerts-removed-misalignment-monitor/
  https://securityaffairs.com/201435/ai/openai-reports-two-incidents-of-ai-agents-disabling-their-own-oversight.html
• How Fraudulent Airline Support Numbers Exploit Search Results And AI-Generated Answers
  "A canceled flight. A missed connection. A refund that has yet to arrive. When travelers need urgent help, they often turn to search engines, social media, or AI tools to find a customer support number. Threat actors are increasingly exploiting that moment of urgency. In our previous investigation, Scammers Are Watching Airline Complaints and Posing as Customer Support, Check Point Exposure Management researchers uncovered scammers monitoring airline complaints on social media and impersonating customer support representatives."
  https://blog.checkpoint.com/research/how-fraudulent-airline-support-numbers-exploit-search-results-and-ai-generated-answers/
• Parasitizing Trust: How Legitimate Infrastructure Becomes a Delivery Pipeline For Attackers
  "Talos recently analyzed two order notification campaigns abusing Staples and Dell transactional email pipelines. Together, these campaigns accounted for roughly 1,400 messages observed by Talos. The malicious element was not the outer sender identity, like a simple forged sender or lookalike domain. It was the content of the legitimate order notification workflow rendered. The suspicious content appeared inside the notification itself, in fields that would normally contain shipping information. The attacker’s objective was to use a trusted retail pipeline to create urgency around a high-value purchase and push the recipient toward an attacker-controlled phone number."
  https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/
• Threats Hidden In Replies: Threat Actors Deliver Malware And Credential Phishing In Email Threads
  "Recently, threat actors have been increasingly delivering malware or credential phishing attacks at the end of long email threads designed to exploit a potential victim’s trust in an email contact. In this tactic, threat actors deliver malicious payloads at the end of seemingly normal email conversations after gaining the potential victim’s trust. These kinds of attacks, also known as email thread hijacking, exploit the recipient’s trust in the sender after several legitimate emails. Often these are legitimate email threads that threat actors respond to when accessing compromised email accounts."
  https://cofense.com/blog/cofense-intelligence-strategic-analysis
• AI-Driven, Large-Scale Nation-State Campaign Using ARTEX Enables Supply Chain Compromise
  "As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure – including multiple instances where the time from initial targeting to privileged access was less than 3 hours. Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application."
  https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
  https://cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940/
• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
  "Huntress investigated multiple incidents stemming from an Amazon-themed ClickFix campaign tied to a sponsored Google search result for the keywords "amazon business." The sponsored result leads to a spoofed Amazon login page with an embedded ClickFix (fake CAPTCHA) that downloads a malicious payload from attacker-controlled infrastructure. The ClickFix command calls on Window's built-in finger utility, a relic of the early internet, used in this case as a living off the land binary (LOLBIN). The finger command kicks off a complex, multi-layered attack chain that ends with multiple payloads dropped, including a pirated copy of the NetSupport Client remote monitoring and management (RMM) tool and a version of Lumma Stealer."
  https://www.huntress.com/blog/amazon-clickfix-finger
  https://www.darkreading.com/cyberattacks-data-breaches/decades-old-windows-utility-modern-clickfix-attack
• Stray Cat, Open Doors: How k0t Wanders Through The Network Edge
  "Group-IB Threat Intelligence, together with NyxLab, collaborated on a joint investigation on a campaign involving widespread exploitation of network edge devices. This joint-investigation effort has managed to uncover indications that this may be connected to the FortiBleed cluster seen earlier this year in June as well as the exposure of adversarial tooling as well as discovery of Tactics, Techniques and Procedures (TTPs) employed by the threat actor known as ‘k0t’. Notable among the observed TTPs is the exploitation of vulnerabilities in network devices such as FortiGate Firewalls and Palo Alto GlobalProtect to gain initial access. Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, resulting in persistent remote access and data exfiltration."
  https://www.group-ib.com/blog/stray-cat-network-edge/
• Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models To Run Attacks
  "Attackers have built an autonomous offensive agent that hunts the internet for exposed large language models (LLMs) and hijacks them to power a self-directed cybercrime operation. Once connected to an unprotected model, the agent is instructed to scan for new targets, exploit common web frameworks, steal databases and credentials, and quietly install cryptocurrency miners, for up to 100,000 steps and without asking a human for approval. The owner of the hijacked model pays for the computing power, while the servers the agent breaks into are stripped of data and put to work mining."
  https://www.security.com/blog-post/ai-llmjacking-skynet
  https://www.infosecurity-magazine.com/news/symantec-ai-agent-llmjacking/
• Fake Amazon Music x YouTube Deal Lures Creators Into a Google Login Trap
  "On August 27, YouTube announced that Amazon had joined its Shopping Affiliate Program. Eligible creators can now tag Amazon products in their videos and earn a commission on sales. Weeks later, we found a wave of sites offering YouTube creators what looks like another Amazon opportunity: an invite-only advertising deal with Amazon Music. The site shows creators their own channel stats, then asks them to “verify” their channel with Google before it reveals a personalized offer."
  https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-amazon-music-x-youtube-deal-lures-creators-into-a-google-login-trap
• Inside a Global AI-Assisted Hacking Campaign
  "In October 2026, Zscaler ThreatLabz investigated AI-assisted cyberattacks that combined the ARTEX penetration testing framework with AI coding assistants and custom automation scripts. Initial reporting of the incident identified the targeting of South Korean financial institutions. However, ThreatLabz discovered additional information about the attack, which went far beyond South Korea. The AI-assisted attacks were widespread and targeted organizations around the globe and in multiple industry sectors."
  https://www.zscaler.com/blogs/security-research/inside-global-ai-assisted-hacking-campaign
• Compromised LiteLLM 1.107.0 On PyPI Installs a Credential Stealer And Backdoor
  "The LiteLLM 1.107.0 release on PyPI carries a credential stealer and a remote code execution backdoor. All seven wheels (Linux, macOS, Windows) install them as three files in site-packages. Both run when any Python process starts on the host, even one that never imports litellm. The upstream GitHub source does not contain them. PyPI has since removed the release. Versions 1.106.2, 1.107.0rc1, and 1.107.0rc2 are clean. The companion packages that 1.107.0 pins, litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78, are also clean."
  https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor/
  https://socket.dev/blog/litellm-compromise
  https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer
  https://www.upwind.io/feed/litellm-1-107-0-supply-chain-attack-malicious-code-found-in-pypi-package
  https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html
  https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548
• BRONZE SANDCASTLE Deploys Modified Meterpreter Shells
  "Counter Threat Unit (CTU) and SophosLabs researchers investigated a cluster of incidents attributed to the BRONZE SANDCASTLE threat group. The most distinctive technical marker for BRONZE SANDCASTLE is its consistent use of Sandboxie DLL sideloading. Across multiple victims’ environments, legitimate Sandboxie executables were placed alongside a malicious sbiedll.dll file, causing the trusted application to load attacker-controlled code at runtime. This consistent pattern functions as a signature for the group, although the threat actors employ several other sideloading file combinations as well (see Table 1)."
  https://www.sophos.com/en-us/blog/bronze-sandcastle-deploys-modified-meterpreter-shells
  https://thehackernews.com/2026/10/china-aligned-bronze-sandcastle-abuses.html
• Hackers Hid Vasilek Backdoor In VMware Tools During 2-Year Russian Healthcare Intrusion
  "A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans. Known to be active since at least 2020, the group has a track record of striking industrial enterprises and government agencies in Russia and Belarus with a backdoor called Vasilek that uses Telegram for command-and-control (C2) and data exfiltration."
  https://thehackernews.com/2026/10/hackers-hid-vasilek-backdoor-in-vmware.html
• “Next Exploit Opportunities”: How a Threat Actor Used AI To Help Plan And Execute Multiple Types Of Cybercrime Activities
  "“Can you find about like what scam or thing they done in past like spoofing calls or somthing [sic],” the threat actor typed. The conversation was with one of several AI assistants that the actor was using to get advice on planning and executing a variety of cybercrime activities. Our visibility into this specific actor's operational environment gives us unique insights into exactly how threat actors are building, testing and executing agentic attacks across multiple campaign types."
  https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/
• New PhaaS Platform Uses AI To Craft Phishing Lures And Mask Malicious Activity
  "A new phishing phishing-as-a-service (PhaaS) platform, dubbed Athena StealthRoute, has been found to use AI tools to both deliver and conceal phishing attacks. Researchers at cybersecurity firm Abnormal AI first identified Athena StealthRoute-linked infrastructure during an August 2026 phishing campaign. In the six months to October 9, the firm identified approximately 89,700 attack-related messages containing the platform's distinctive link pattern across around 2,280 organizations in the US and Europe."
  https://www.infosecurity-magazine.com/news/new-phaas-uses-ai-phishing-lures/
• CrowdStrike Uncovers New Agentic AI Campaigns
  "A new report from the CrowdStrike Counter Adversary Operations team details research into four previously unreported threat actors, each of whom left their offensive agent frameworks exposed via open directories. In doing so, they shared detailed insight into their use of AI agents and revealed how adversaries are quickly becoming more proficient in AI."
  https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-agentic-ai-campaigns/
  https://www.crowdstrike.com/en-us/resources/reports/agentic-ai-attack-campaigns/
• ThreatLocker MDR Team Intercepts Chimera C2 ClickFix Attack
  "On September 28, 2026, ThreatLocker MDR identified and intercepted the implementation of an active C2 framework in a monitored environment. A ClickFix attack persuaded the victim to execute malicious PowerShell commands, leading to machine compromise and the subscription to a Command-and-Control platform titled ChimeraC2. Chimera has been previously attributed to a Chinese based threat actor group by MITRE and the broader intelligence community, although evidence present to the ThreatLocker Intelligence Team indicates that Russian-speaking threat actors are behind this panel. The apparently AI-assisted tooling present does not align with open-source intelligence reports on Chimera, and ThreatLocker Threat Intelligence cannot independently attribute this campaign to the previously documented Chimera group."
  https://www.threatlocker.com/blog/threatlocker-mdr-team-intercepts-chimera-c2-clickfix-attack
• Recent AI-Assisted Cyber Attacks In Japan: Investigating Attack Infrastructure And Techniques
  "On October 8, 2026, JPCERT/CC issued an alert regarding a series of unauthorized access incidents involving the leakage of personal and other information reported by multiple organizations in Japan. In cooperation with multiple organizations, JPCERT/CC has been investigating infrastructure that may have been used in these attacks. We confirmed that the attackers had used AI to scan for known vulnerabilities and carry out attacks via APIs. We identified several servers used for these activities and confirmed that the attackers had also targeted web services intended for users outside Japan. This article presents our findings from an investigation of attack servers involved in attacks targeting web services and other systems in Japan and abroad."
  https://blogs.jpcert.or.jp/en/2026/10/web_api_attacks.html
• The Gentlemen: A Closer Look At a Not-So-Gentle Ransomware-As-a- Service Operation
  "The Gentlemen ransomware is a Russian-speaking ransomware-as-a-service (RaaS) threat provider that first emerged in mid-2025. Its Go-based ransomware targets Windows, Linux, NAS and BSD systems. The operators reportedly offer affiliates up to 90% of the ransom revenue generated from their operations. The Gentlemen uses a double-extortion model. In addition to encrypting files, the ransomware can exfiltrate data from compromised systems. This puts additional pressure on victims to pay the ransom to restore access to their files and prevent the stolen data from being publicly leaked."
  https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/

Breaches/Hacks/Leaks

• Japan's Onamae Desktop Cloud Hacked, Up To 27,000 Servers Affected
  "Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers. The company confirmed on October 20 that an unauthorized third party installed "malicious programs" in some customer environments. After detecting the intrusion, the company says it progressively shut down customer servers beginning at 04:00 local time on October 21, 2026."
  https://www.bleepingcomputer.com/news/security/japans-onamae-desktop-cloud-hacked-up-to-27-000-servers-affected/
• TiDB Breach Exposes Flawed Cloud Security Assumptions
  "A breach of an open source database provider may have inadvertently highlighted a serious gap in the way companies think about their cloud security. On Oct. 19, software maker PingCAP, which sells an SQL database program called TiDB, disclosed that it had been breached. According to PingCAP's website, it serves major American corporations like Atlassian, Square, and Pinterest, as well as major players in China's artificial intelligence (AI) space, including Manus, Kimi, and more."
  https://www.darkreading.com/cloud-security/tidb-breach-flawed-cloud-security
• Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account
  "The personal details of thousands of children and their families were breached in Wales after ransomware attackers compromised an account protected by a ‘Password1’ password, an investigation by the UK’s Information Commissioner’s Office (ICO) has revealed. The data protection regulator issued a reprimand to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, for security failings relating to the November 2024 incident. Data Cymru is funded by the Welsh government and is tasked with enabling local councils and other organizations to find, collect, analyze and present data effectively."
  https://www.infosecurity-magazine.com/news/children-data-stolen-password1/
• State Bank Of India Confirms Data Leak After 3,897 Customer Records Found On Dark Web
  "State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from. The state-owned bank, India's largest, said in a stock-exchange filing dated October 21 that it "has experienced an incident involving the loss of certain data." The count is preliminary, and the bank has yet to establish whether the data is authentic, how far the exposure goes and what risk it poses to customers."
  https://thehackernews.com/2026/10/state-bank-of-india-confirms-data-leak.html

General News

• Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens
  "Data loss prevention (DLP) tools are often functioning as after-the-fact forensic systems rather than prevention controls, according to DLP in the AI Era, a new survey from the Cloud Security Alliance (CSA), the world's leading not-for-profit organization committed to AI, cloud, and Zero Trust cybersecurity education. The study, conducted in collaboration with Jazz, found that 73% of organizations said they experienced at least one confirmed data loss incident in the past 24 months. Among the respondents, only 16% said DLP blocked their most significant incident before data left the organization."
  https://www.darkreading.com/cloud-security/cloud-security-alliance-survey-data-loss-prevention-detects-data-loss
• Survey Finds High-Profile Executives Feel Untouchable As Digital Exposure Turns Into Physical Risk
  "360 Privacy, a digital exposure reduction company, today released its 2026 Annual Digital Exposure Report. It found that security and risk leaders now treat digital exposure and physical danger as the same problem, and that the executives, celebrities and wealthy families they protect often don't believe they're at risk."
  https://www.darkreading.com/cybersecurity-operations/360-privacy-survey-high-profile-executives-feel-untouchable
• Why Security Tools Lose Sight Of The Credential
  "Security teams have tools for code, endpoints, cloud infrastructure, identity, and secrets management. Credentials cut across all of them. A developer finds an AWS key in a repository. The first step is obvious: remove it. But that does not answer the questions the security team now has: Is the key still active? Who owns it? What can it access? Is the same credential sitting in a CI/CD variable, a local .env file, a Slack thread, or an old commit? Has it ever been exposed publicly?"
  https://www.helpnetsecurity.com/2026/10/21/gitguardian-securing-credential-layer/
• Ransomware Attacks Rise As Rival Gangs Vie For Market Supremacy
  "Almost 3000 ransomware attacks took place between July and September 2026 and the figure marked a significant increase when compared with the same period last year. According to an analysis by Nord Security, the 2894 ransomware attacks which took place during the quarter represents a 50% increase when compared with the same period last year. It also represents a slight increase when compared with the previous quarter of this year, as the July to September period saw an 8.6% rise in ransomware attacks when compared with April to June."
  https://www.infosecurity-magazine.com/news/rival-gangs-vie-for-market/
• Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports
  "Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templates now arrive fluent, personalized, and unique to each recipient, and the behavioral signals email filters have relied on for years are fading as a result. Proofpoint shared several examples of the shift at its Protect 2026 conference. In one, a single threat actor contacted more than 30 real estate agents at the same company, each from a different account, about a different property, and in different words, before closing every thread with the same request: join a video meeting."
  https://thehackernews.com/2026/10/generative-ai-is-erasing-behavioral.html

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• Hitachi Energy RTU500 Product
  "Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-05
• HMS Networks PEAK-System PCAN Windows Drivers
  "Successful exploitation of these vulnerabilities could crash the Windows kernel."
• **https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01
• Moxa AIG-302 ThingsPro Edge**
  "Successful exploitation of these vulnerabilities could allow an attacker to obtain and disclose sensitive information."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-03
• Hitachi Energy MicroSCADA X SYS600 Product
  "Hitachi Energy is aware of multiple vulnerabilities that affect MicroSCADA X SYS600 product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-04

Vulnerabilities

• Open And Shut: Remote Code Execution In Opencode Via MCP OAuth
  "What is opencode: opencode is a popular open-source AI coding agent with approximately 3 million weekly npm downloads and 211,000 GitHub stars. Like other coding agents, it can access local files, execute commands and interact with external systems, typically operating with the developer's privileges. What we found: Pillar Security discovered a critical remote code execution (RCE) flaw in opencode affecting Windows and Windows Subsystem for Linux (WSL). The flaw allows an attacker-controlled remote Model Context Protocol (MCP) server to execute arbitrary code on a developer's machine during a remote MCP OAuth authentication process, without additional user interaction or consent."
  https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth
  https://www.infosecurity-magazine.com/news/opencode-quietly-patched-critical/
• PHP Warns Admins Of Two Critical Flaws, Emergency Patches Coming Tomorrow
  "The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. PHP powers many websites and web applications, including content management systems, e-commerce platforms, and custom web services. In an advisory published Tuesday, the PHP development team announced that it plans to release security updates on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern), to address two vulnerabilities, each rated 9.2 under CVSS v4.0."
  https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/
• Critical FortiSIEM Flaw Gets Public Exploit PoC For Unauthenticated Remote Code Execution
  "Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets."
  https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html
• CISA Adds Six Known Exploited Vulnerabilities To Catalog
  "CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
  CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
  CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
  CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability
  CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
  CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog

Malware

• #StopRansomware: SafePay Ransomware
  "This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics."
  https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a
  https://therecord.media/fbi-says-safepay-ransomware-gang-among-most-active-600-victims
• OVHcloud CLI Releases Backdoored On GitHub To Steal Developer Secrets
  "French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. The attacker hijacked a developer’s GitHub account to gain access to the OVHcloud CLI repository and modify versions 0.11.0 through 0.15.0 of the tool. OVHcloud offers the CLI tool as an alternative for system administrators and developers to manage cloud and hosting services directly from a terminal, including for automating tasks."
  https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/
  https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html
• [AnyDesk TAG] AnyDesk And ScreenConnect In a Campaign Targeting Banking Customers
  "Last week at VulnCheck's ThreatCon1 conference we briefly touched on a campaign we have been tracking since early spring. It was one of several examples in a talk about looking outward for adversary infrastructure rather than waiting for an attack to arrive. This one is not an Adversary-in-the-Middle campaign. It is a phone-led fraud operation targeting banking customers, and it has been running since at least March 2026. The operator uses convincing copies of bank support pages, genuine remote-access software and custom signed payloads to gain remote access to victims' computers."
  https://www.aitmfeed.com/blog/blog-1/anydesk-tag-anydesk-and-screenconnect-in-a-campaign-targeting-banking-customers-22
  https://www.bankinfosecurity.com/fraudsters-clone-bank-support-pages-urge-victims-to-call-a-33149
• The Risk Of AI-Powered Antidetect Browsers In Online Fraud And Influence Operations
  "Online platforms rely on digital signals to identify suspicious accounts and activity. Antidetect browsers make those signals harder to trust by allowing operators to create and manage large numbers of browser profiles that appear to belong to different users, devices and locations. While these tools have legitimate uses, Check Point Research found documented evidence of their use in criminal ecosystems for activities including account takeover and payment fraud. AI and automation can further increase the scale of these operations."
  https://blog.checkpoint.com/security/antidetect-browsers-how-ai-is-scaling-online-fraud-and-account-takeovers/
• Doppelgänger Russian Influence Campaign In Israel
  "Doppelgänger (German for “double”) describes the campaign’s hallmark: fake copies of well-known news sites, with a design, logo and layout meant to make readers think they are reading an article from a legitimate media outlet. In recent weeks, ClearSky identified renewed activity by the Russian influence campaign in Israel. The campaign, known as “The Double” – Doppelgänger, spreads false and misleading messages built on parts of real publications, while impersonating well-known media outlets. The messages are spread on social networks, mainly on X, through a network of fake accounts."
  https://www.clearskysec.com/doppelganger-russian-influence-campaign-in-israel/
• Beyond Passwords: How Attackers Abuse Device Code Authentication
  "The Cofense Phishing Defense Center (PDC) has analyzed several emails that may look like ordinary spam to the untrained eye. Threat actors attempt to mimic routine corporate emails and blend into everyday inbox traffic. As aware of the common phishing tac tactics grows, threat actors are turning to techniques such as device code phishing. To understand how this technique works, it is important to understand what access codes are and how they differ from the common username-and-password method of authentication."
  https://cofense.com/blog/beyond-passwords-how-attackers-abuse-device-code-authentication
• Swallowtail: Russian Espionage Group Targets Defense Firms In Two NATO Countries
  "Russian espionage group Swallowtail (aka APT28, Fancy Bear, Forest Blizzard) targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. All three targets were likely to hold information of direct interest to a foreign intelligence service. During one attack, against the naval shipbuilder, operators returned to a compromised host repeatedly over the course of a week in what appeared to be hands-on-keyboard activity. They stole credential material using two separate techniques, opened a persistent SSH tunnel into the organization's internal network and deployed a previously undocumented reflective loader."
  https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets
  https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.html
  https://therecord.media/european-defense-contractors-fancy-bear-espionage
  https://cyberscoop.com/russian-hackers-apt28-target-nato-defense-firms/
• The Checker You Pay For
  "Fraud against spend-management platforms is usually pictured as theft from the platform itself: a stolen card is spent, a false reimbursement is paid, a chargeback is booked. This blog documents a quieter pattern, observed in a recent case within the environment of a Group-IB Fraud Protection client, in which the platform was not the target of the fraud, but was instead abused as a component of the fraud’s infrastructure. Two linked behaviours were observed. In the first, the platform’s trusted email and payment rails were used to lend credibility to phishing scams aimed at people who are not the platform’s customers. In the second, the platform’s bank-account linking flow–provided through an open-banking aggregator–was used to validate stolen card and bank credentials, a checking function that fraudsters abused at no cost to themselves."
  https://www.group-ib.com/blog/spend-management-abuse-fraud-classiscam/
• The Journey Of a Paper Unicorn: Adventures Inside a Modern Warehouse
  "Imagine you’ve ordered a small paper unicorn from an online marketplace. You clicked “Buy”, received a cheerful notification, and expect a courier to bring the box tomorrow. If the unicorn is delayed by a day, it will be annoying but not catastrophic: an apology, a discount promo code — and the incident is forgotten. Now let’s multiply one late unicorn by several hundred thousand orders. Packages start heading to the wrong cities. The website shows an item is in stock, even though the required bin is empty. Conveyors stop, boxes get stuck between floors, the cargo piles up with no freight manifest. Trucks line up at the gates, and every minute of downtime turns into blown schedules, support tickets, fines, and lost sales."
  https://securelist.com/paper-unicorn-warehouse-security/121537/
• Threat Brief: Active Exploitation Of PAN-OS CVE-2026-0257 (Updated October 20)
  "Unit 42 continues to observe attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc). We’re also aware of public reporting attributing exploitation to threat actors using Settra ransomware. Palo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect. This security flaw involves an authentication bypass in the portal and gateway components of vulnerable versions of PAN-OS software, which could allow unauthorized attackers to circumvent security controls and initiate virtual private network (VPN) connections. This CVE was added to the Known Exploited Vulnerability (KEV) catalog on May 13, 2026."
  https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/#
  https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html
  https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226
• WhatsApp Help Pages Leaked Hidden Instructions For a Meta Chatbot
  "Dozens of WhatsApp web pages designed to answer people’s questions about Meta’s encrypted messaging app inadvertently exposed the company’s own instructions to its chatbot. These included some sections titled “WHAT NOT TO SAY” to users asking questions and explicit instructions not to provide people with legal advice. A new analysis has found that around 80 help and FAQ pages across WhatsApp’s website exposed text instructions that were designed for a large language model, specifically one of Meta’s own. The instructions, according to findings from privacy company Redact, appeared in the webpages’ code and contained written details that were not explicitly on the WhatsApp help pages."
  https://www.wired.com/story/whatsapp-help-pages-leaked-hidden-instructions-for-a-meta-chatbot/
  https://thehackernews.com/2026/10/whatsapp-hid-instructions-in-help-pages.html
• How Ray Cracked The Phish No Scanner Could Find
  "A targeted credential phishing campaign delivered 22 emails to a single enterprise tenant within a two-hour window on August 27, 2026, engineered to pass every email gateway by hiding the payload behind legitimate Frame[.]io share notifications. Static gateway scanners see a clean Frame[.]io link and give the email a safe verdict. They cannot read the shared asset inside the SaaS platform. Just three minutes after the first email landed, a targeted employee reported it. But because the link led to genuine infrastructure, traditional security controls saw nothing malicious. Not until Ocean's agentic investigation engine, Ray, got inside the platform and pulled the true payload."
  https://ocean.security/resources/blog/frame-io-phishing-aitm-share-link
  https://hackread.com/scammers-frame-io-steal-microsoft-365-credentials/
• INC And The Gentlemen Ransomware: Exposed AI Infrastructure
  "SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen Ransomware groups. A single publicly accessible command-and-control server exposed the operators’ AI session databases, their central knowledge base and the source code of Phantom, a new “Autonomous Red Team Kill Chain Framework”. Configuration files, logs and credentials inside that server led STRU to six more exposed adversary-controlled servers."
  https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/
• How I Got Over 300 Tor Exit Nodes Removed
  "On Friday Oct 2, 09:35am, 333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible. To give you a sense of scale, all of Tor has around 3000 exit relays, so roughly 10% were under their control. The attackers had gained access to the servers two months earlier, in August, and quietly deployed their Ebury 1.8.3 payload (an OpenSSH backdoor and credential stealer for Linux)."
  https://kaba.cx/posts/20261020_Tor/

Breaches/Hacks/Leaks

• Zeabur Shutting Down After Second Security Breach In Two Months
  "Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. The attackers used stolen administrator credentials and cloud access keys to compromise Zeabur’s shared hosting infrastructure and dedicated servers, eventually gaining access to its production database."
  https://www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/
• 970,000 Medi-Cal Members Affected By Paradigm Healthcare Data Breach
  "Paradigm Healthcare Services has told the US Department of Health and Human Services (HHS) that a data breach discovered last year affected more than 970,000 people. San Francisco-based Paradigm processes billing for Medi-Cal, California’s Medicaid program, under a data use agreement with the California Department of Health Care Services (DHCS). It also maintains Medi-Cal member identification numbers on the department’s behalf. The company says it became aware of unauthorized access to its local network on October 13, 2025. “On August 18, 2026, we determined that certain files containing select individuals’ protected health information may have been accessed by an unauthorized party between October 8, 2025, and October 15, 2025,” Paradigm said."
  https://www.securityweek.com/970000-medi-cal-members-affected-by-paradigm-healthcare-data-breach/
• AfD Email Breach Exposes 421,000 Messages In Anonymous Online Archive
  "Germany’s Alternative für Deutschland (AfD) confirmed on October 19 that its hosting provider was hacked in September and that mailboxes were copied. By the time the confirmation reached Bild, a website called hexane.cc had already been online for hours offering an index of what it claims are 421,179 internal party emails. “In September 2026 there was a hacking attack on a hosting provider used by our party.” By then the website hexane.cc had been online for several hours with an index of what it says are 421,179 of the party’s emails. In place of the emails, the site shows summaries written by software, sorted into categories that include racism and antisemitism and graded from Low to Critical."
  https://securityaffairs.com/201346/data-breach/afd-email-breach-exposes-421000-messages-in-anonymous-online-archive.html
• Stolen UpdraftCentral Keys Used To Backdoor WordPress Sites
  "A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. TeamUpdraft detected unauthorized access to its infrastructure over the weekend and believes that the hacker accessed the customer database. The developer offers several WordPress tools for backup, storage, and site management:"
  https://www.bleepingcomputer.com/news/security/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites/
  https://teamupdraft.com/blog/security-incident-october-2026/

General News

• Nigerian Man Sentenced To Eight Years For Hacking, Fraud, And Identity Theft Schemes
  "United States Attorney for the Southern District of New York, Jamie McDonald, announced that CHUKWUEMEKA VICTOR AMACHUKWU, a/k/a “Chukwuemeka Victor Eletuo,” a/k/a “So Kwan Leung,” was sentenced by U.S. District Judge Paul G. Gardephe to eight years in prison for his role in multiple fraud, hacking, and identity theft offenses. AMACHUKWU previously pled guilty to conspiracy to commit computer intrusions and conspiracy to commit wire fraud."
  https://www.justice.gov/usao-sdny/pr/nigerian-man-sentenced-eight-years-hacking-fraud-and-identity-theft-schemes
  https://www.bleepingcomputer.com/news/security/hacker-gets-8-years-for-stealing-33-million-from-taxpayers/
  https://therecord.media/nigerian-given-8-year-sentenc-tax-hacks
  https://cyberscoop.com/nigerian-sentenced-hacking-fraud-tax-investment-scheme/
• US Agencies Detail Incident Response Practices For Rogue AI Agents
  "Effective and efficient use of complex agentic systems is important for all organizations, but recognizing, preventing and recovering from them going rogue could be an existential necessity. NIST, the NSA, and CISA recognize the increasing potential for AI agents to behave in an unexpected and potentially harmful manner, and has responded with a list of key practices for both preparing for and responding to such behavior. The report (Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation) uses the term super intelligence (SI) rather than artificial intelligence (AI) in line with presidential executive order 14434."
  https://www.securityweek.com/us-agencies-detail-incident-response-practices-for-rogue-ai-agents/
  https://www.nist.gov/system/files/documents/2026/10/16/Key_Practices_for_Incident_Readiness_and_Response_in_Super_Intelligence _Training_and_Evaluation.pdf
  https://www.bankinfosecurity.com/nsa-nist-cisa-issue-guidance-on-rogue-ai-agents-a-33156
• There's Only So Much Code: The Rise In Vulnerability Numbers
  "Frontier AI models (like Mythos) are rapidly mining decades of technical debt across ubiquitous legacy libraries, driving monthly Microsoft Patch Tuesday vulnerability advisories up more than tenfold (reaching 1,415 this month). This volume is overwhelming open-source maintainers and putting pressure on the traditional 90-day coordinated disclosure model. Despite a 105% year-over-year surge in CVEs, Known Exploited Vulnerabilities (KEVs) grew by only 37%, and only 3 of September's 975 Microsoft advisories saw in-the-wild exploitation, demonstrating that the vast majority of AI-discovered bugs are not practically exploited."
  https://blog.talosintelligence.com/theres-only-so-much-code-the-rise-in-vulnerability-numbers/
• Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers And Software
  "Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. Major browsers and operating systems trusted the compromised certificates, potentially allowing attackers to impersonate legitimate websites and intercept encrypted communications. A security researcher known as Wayne discovered the weakness on October 17 while scanning publicly available certificate data."
  https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html
  https://emudhra.we-have-a-problem.com/
  https://www.darkreading.com/cyber-risk/tech-giants-emudhra-certificates-compromised-keys
  https://www.bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates/
  https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312
• Close Identity Gaps In Software Development Before Unleashing AI
  "When Renee Guttmann ran her first Open Worldwide Application Security Project (OWASP) meeting in New York City in the early 2000s, the general sentiment among the industry (and attendees) was one of skepticism: Why on earth would anyone care about scanning web applications for vulnerabilities? Flash forward 20-plus years, and Guttmann, founder of security consultancy Cisohive, no longer has to beat down doors to get people to listen. Initiatives like OWASP, with its aim to improve software security, are now regularly invited into software development life cycle (SDLC) conversations to help developers and teams embed secure software practices across planning, testing, deployment and maintenance."
  https://www.darkreading.com/application-security/close-identity-gaps-sdlc-before-ai
• Your Frontline Workers Have a Workaround For That MFA Prompt
  "Frontline workers in healthcare and manufacturing are getting around slow, unreliable logins by staying signed in, sharing credentials and trying to bypass multifactor authentication. Sapio Research surveyed 700 IT and security decision-makers in August, and 95% said they had seen frontline workers use workarounds like these in the past 12 months. Each of those habits breaks the link between an account and the person using it. A session left open on a shared workstation lets the next worker act under someone else’s name, and a password passed around a team lets anyone who knows it do the same. Attackers are working the same weak point from outside. Sixty-two percent of respondents reported a confirmed or suspected attempt to abuse account recovery, a password reset or an unlock in the past year."
  https://www.helpnetsecurity.com/2026/10/20/frontline-worker-authentication-passwordless/
• AI Agent Adoption Creates Risk As Oversight Struggles To Keep Pace, Splunk Finds
  "Businesses are rolling out AI agents across their networks much faster than they can implement monitoring procedures and security controls, leaving organizations exposed to security threats, hallucinations and other common issues associated with the technology. Published by Cisco on October 20, the2026 Splunk State of Observability warned that while many businesses are keen to explore the potential benefits of using AI in their ecosystem, many do so without a strategy in place to ensure it is being used safely."
  https://www.infosecurity-magazine.com/news/ai-agent-adoption-oversight/
• Seven Core Research Areas For a Rapidly Evolving Cyber Landscape
  "In the past year, cyber adversaries have started to exploit artificial intelligence (AI) technology to execute a wide range of attacks. AI is helping them accelerate, optimize, and scale up their techniques. Agentic AI lowers the work factor for savvy adversaries, and it lowers the barrier to entry for new entrants. There is already an increase in the extent, tempo, and sophistication of attacks, and they are targeting diverse sectors. There are the well-known Salt Typhoon attacks on multiple prominent telecommunications providers and, more recently, attacks on water systems attributed to Iran."
  https://www.sei.cmu.edu/blog/seven-core-research-areas-for-a-rapidly-evolving-cyber-landscape/
• What Security Teams Can Do To Tame Wild Code
  "A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team’s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support them. If you work in security, that success introduces a new set of questions. Whose credentials does the workflow use? Which records can it access? Who can see its output? If it starts exposing information it shouldn’t, can you trace what happened and stop further access?"
  https://thehackernews.com/2026/10/what-security-teams-can-do-to-tame-wild.html
• The Key To AI Software Security Isn’t Speed, It’s Maturity
  "Agentic artificial intelligence software development has all the traits of a summer blockbuster, with the prospects of Godzilla-sized productivity gains thrilling business leaders and security implications sending chills down the spines of developers and SOC teams. One difference, though, is that those thrills and chills are going to last longer than a summer, and the fallout could be a lot more serious than some spilled popcorn."
  https://www.securityweek.com/the-key-to-ai-software-security-isnt-speed-its-maturity/
• Swamped Curl Maintainers Take Low-Level Flaws Public To Survive Vulnerability 'avalanche'
  "An "avalanche of vulnerability reports" is forcing curl to move lower-severity cases into public view, reserving private handling for high and critical flaws. From October 26, low and medium-severity reports should be filed in the open source data transfer tool's public GitHub repository, maintainer Daniel Stenberg said. "Security researchers in doubt can still submit the issue on HackerOne and we can tell them what severity we deem it to be. Over the last few years, over 90 percent of all submissions could quickly be assessed to be less than HIGH.""
  https://www.theregister.com/security/2026/10/20/swamped-curl-maintainers-take-low-level-flaws-public-to-survive-vulnerability-avalanche/5304198
• ICANN Testing Tech To Let Law Enforcement Access Non-Public WHOIS Info
  "ICANN has started testing authentication schemes that will allow law enforcement agencies to make urgent requests for non-public WHOIS information – when needed to address threats to life, critical infrastructure, or child exploitation. Domain registrars collect information about their customers and in the past that data was publicly available in WHOIS records. Some domain registrars offer services that substitute their own contact details, to preserve customer privacy. In recent years, laws like GDPR mean registrars are sometimes required to hide WHOIS data."
  https://www.theregister.com/networks/2026/10/20/icann-testing-tech-to-let-law-enforcement-access-non-public-whois-info/5304036
• Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
  "U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom."
  https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand