Cyber Threat Intelligence 21 October 2026

NCSA_THAICERT

Industrial Sector

Hitachi Energy RTU500 Product
"Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-05
HMS Networks PEAK-System PCAN Windows Drivers
"Successful exploitation of these vulnerabilities could crash the Windows kernel."
**https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01
Moxa AIG-302 ThingsPro Edge**
"Successful exploitation of these vulnerabilities could allow an attacker to obtain and disclose sensitive information."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-03
Hitachi Energy MicroSCADA X SYS600 Product
"Hitachi Energy is aware of multiple vulnerabilities that affect MicroSCADA X SYS600 product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-04

Vulnerabilities

Open And Shut: Remote Code Execution In Opencode Via MCP OAuth
"What is opencode: opencode is a popular open-source AI coding agent with approximately 3 million weekly npm downloads and 211,000 GitHub stars. Like other coding agents, it can access local files, execute commands and interact with external systems, typically operating with the developer's privileges. What we found: Pillar Security discovered a critical remote code execution (RCE) flaw in opencode affecting Windows and Windows Subsystem for Linux (WSL). The flaw allows an attacker-controlled remote Model Context Protocol (MCP) server to execute arbitrary code on a developer's machine during a remote MCP OAuth authentication process, without additional user interaction or consent."
https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth
https://www.infosecurity-magazine.com/news/opencode-quietly-patched-critical/
PHP Warns Admins Of Two Critical Flaws, Emergency Patches Coming Tomorrow
"The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. PHP powers many websites and web applications, including content management systems, e-commerce platforms, and custom web services. In an advisory published Tuesday, the PHP development team announced that it plans to release security updates on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern), to address two vulnerabilities, each rated 9.2 under CVSS v4.0."
https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/
Critical FortiSIEM Flaw Gets Public Exploit PoC For Unauthenticated Remote Code Execution
"Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets."
https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html
CISA Adds Six Known Exploited Vulnerabilities To Catalog
"CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability
CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability"
https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog

Malware

#StopRansomware: SafePay Ransomware
"This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics."
https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a
https://therecord.media/fbi-says-safepay-ransomware-gang-among-most-active-600-victims
OVHcloud CLI Releases Backdoored On GitHub To Steal Developer Secrets
"French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. The attacker hijacked a developer’s GitHub account to gain access to the OVHcloud CLI repository and modify versions 0.11.0 through 0.15.0 of the tool. OVHcloud offers the CLI tool as an alternative for system administrators and developers to manage cloud and hosting services directly from a terminal, including for automating tasks."
https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/
https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html
[AnyDesk TAG] AnyDesk And ScreenConnect In a Campaign Targeting Banking Customers
"Last week at VulnCheck's ThreatCon1 conference we briefly touched on a campaign we have been tracking since early spring. It was one of several examples in a talk about looking outward for adversary infrastructure rather than waiting for an attack to arrive. This one is not an Adversary-in-the-Middle campaign. It is a phone-led fraud operation targeting banking customers, and it has been running since at least March 2026. The operator uses convincing copies of bank support pages, genuine remote-access software and custom signed payloads to gain remote access to victims' computers."
https://www.aitmfeed.com/blog/blog-1/anydesk-tag-anydesk-and-screenconnect-in-a-campaign-targeting-banking-customers-22
https://www.bankinfosecurity.com/fraudsters-clone-bank-support-pages-urge-victims-to-call-a-33149
The Risk Of AI-Powered Antidetect Browsers In Online Fraud And Influence Operations
"Online platforms rely on digital signals to identify suspicious accounts and activity. Antidetect browsers make those signals harder to trust by allowing operators to create and manage large numbers of browser profiles that appear to belong to different users, devices and locations. While these tools have legitimate uses, Check Point Research found documented evidence of their use in criminal ecosystems for activities including account takeover and payment fraud. AI and automation can further increase the scale of these operations."
https://blog.checkpoint.com/security/antidetect-browsers-how-ai-is-scaling-online-fraud-and-account-takeovers/
Doppelgänger Russian Influence Campaign In Israel
"Doppelgänger (German for “double”) describes the campaign’s hallmark: fake copies of well-known news sites, with a design, logo and layout meant to make readers think they are reading an article from a legitimate media outlet. In recent weeks, ClearSky identified renewed activity by the Russian influence campaign in Israel. The campaign, known as “The Double” – Doppelgänger, spreads false and misleading messages built on parts of real publications, while impersonating well-known media outlets. The messages are spread on social networks, mainly on X, through a network of fake accounts."
https://www.clearskysec.com/doppelganger-russian-influence-campaign-in-israel/
Beyond Passwords: How Attackers Abuse Device Code Authentication
"The Cofense Phishing Defense Center (PDC) has analyzed several emails that may look like ordinary spam to the untrained eye. Threat actors attempt to mimic routine corporate emails and blend into everyday inbox traffic. As aware of the common phishing tac tactics grows, threat actors are turning to techniques such as device code phishing. To understand how this technique works, it is important to understand what access codes are and how they differ from the common username-and-password method of authentication."
https://cofense.com/blog/beyond-passwords-how-attackers-abuse-device-code-authentication
Swallowtail: Russian Espionage Group Targets Defense Firms In Two NATO Countries
"Russian espionage group Swallowtail (aka APT28, Fancy Bear, Forest Blizzard) targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. All three targets were likely to hold information of direct interest to a foreign intelligence service. During one attack, against the naval shipbuilder, operators returned to a compromised host repeatedly over the course of a week in what appeared to be hands-on-keyboard activity. They stole credential material using two separate techniques, opened a persistent SSH tunnel into the organization's internal network and deployed a previously undocumented reflective loader."
https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets
https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.html
https://therecord.media/european-defense-contractors-fancy-bear-espionage
https://cyberscoop.com/russian-hackers-apt28-target-nato-defense-firms/
The Checker You Pay For
"Fraud against spend-management platforms is usually pictured as theft from the platform itself: a stolen card is spent, a false reimbursement is paid, a chargeback is booked. This blog documents a quieter pattern, observed in a recent case within the environment of a Group-IB Fraud Protection client, in which the platform was not the target of the fraud, but was instead abused as a component of the fraud’s infrastructure. Two linked behaviours were observed. In the first, the platform’s trusted email and payment rails were used to lend credibility to phishing scams aimed at people who are not the platform’s customers. In the second, the platform’s bank-account linking flow–provided through an open-banking aggregator–was used to validate stolen card and bank credentials, a checking function that fraudsters abused at no cost to themselves."
https://www.group-ib.com/blog/spend-management-abuse-fraud-classiscam/
The Journey Of a Paper Unicorn: Adventures Inside a Modern Warehouse
"Imagine you’ve ordered a small paper unicorn from an online marketplace. You clicked “Buy”, received a cheerful notification, and expect a courier to bring the box tomorrow. If the unicorn is delayed by a day, it will be annoying but not catastrophic: an apology, a discount promo code — and the incident is forgotten. Now let’s multiply one late unicorn by several hundred thousand orders. Packages start heading to the wrong cities. The website shows an item is in stock, even though the required bin is empty. Conveyors stop, boxes get stuck between floors, the cargo piles up with no freight manifest. Trucks line up at the gates, and every minute of downtime turns into blown schedules, support tickets, fines, and lost sales."
https://securelist.com/paper-unicorn-warehouse-security/121537/
Threat Brief: Active Exploitation Of PAN-OS CVE-2026-0257 (Updated October 20)
"Unit 42 continues to observe attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc). We’re also aware of public reporting attributing exploitation to threat actors using Settra ransomware. Palo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect. This security flaw involves an authentication bypass in the portal and gateway components of vulnerable versions of PAN-OS software, which could allow unauthorized attackers to circumvent security controls and initiate virtual private network (VPN) connections. This CVE was added to the Known Exploited Vulnerability (KEV) catalog on May 13, 2026."
https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/#
https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html
https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226
WhatsApp Help Pages Leaked Hidden Instructions For a Meta Chatbot
"Dozens of WhatsApp web pages designed to answer people’s questions about Meta’s encrypted messaging app inadvertently exposed the company’s own instructions to its chatbot. These included some sections titled “WHAT NOT TO SAY” to users asking questions and explicit instructions not to provide people with legal advice. A new analysis has found that around 80 help and FAQ pages across WhatsApp’s website exposed text instructions that were designed for a large language model, specifically one of Meta’s own. The instructions, according to findings from privacy company Redact, appeared in the webpages’ code and contained written details that were not explicitly on the WhatsApp help pages."
https://www.wired.com/story/whatsapp-help-pages-leaked-hidden-instructions-for-a-meta-chatbot/
https://thehackernews.com/2026/10/whatsapp-hid-instructions-in-help-pages.html
How Ray Cracked The Phish No Scanner Could Find
"A targeted credential phishing campaign delivered 22 emails to a single enterprise tenant within a two-hour window on August 27, 2026, engineered to pass every email gateway by hiding the payload behind legitimate Frame[.]io share notifications. Static gateway scanners see a clean Frame[.]io link and give the email a safe verdict. They cannot read the shared asset inside the SaaS platform. Just three minutes after the first email landed, a targeted employee reported it. But because the link led to genuine infrastructure, traditional security controls saw nothing malicious. Not until Ocean's agentic investigation engine, Ray, got inside the platform and pulled the true payload."
https://ocean.security/resources/blog/frame-io-phishing-aitm-share-link
https://hackread.com/scammers-frame-io-steal-microsoft-365-credentials/
INC And The Gentlemen Ransomware: Exposed AI Infrastructure
"SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen Ransomware groups. A single publicly accessible command-and-control server exposed the operators’ AI session databases, their central knowledge base and the source code of Phantom, a new “Autonomous Red Team Kill Chain Framework”. Configuration files, logs and credentials inside that server led STRU to six more exposed adversary-controlled servers."
https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/
How I Got Over 300 Tor Exit Nodes Removed
"On Friday Oct 2, 09:35am, 333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible. To give you a sense of scale, all of Tor has around 3000 exit relays, so roughly 10% were under their control. The attackers had gained access to the servers two months earlier, in August, and quietly deployed their Ebury 1.8.3 payload (an OpenSSH backdoor and credential stealer for Linux)."
https://kaba.cx/posts/20261020_Tor/

Breaches/Hacks/Leaks

Zeabur Shutting Down After Second Security Breach In Two Months
"Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. The attackers used stolen administrator credentials and cloud access keys to compromise Zeabur’s shared hosting infrastructure and dedicated servers, eventually gaining access to its production database."
https://www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/
970,000 Medi-Cal Members Affected By Paradigm Healthcare Data Breach
"Paradigm Healthcare Services has told the US Department of Health and Human Services (HHS) that a data breach discovered last year affected more than 970,000 people. San Francisco-based Paradigm processes billing for Medi-Cal, California’s Medicaid program, under a data use agreement with the California Department of Health Care Services (DHCS). It also maintains Medi-Cal member identification numbers on the department’s behalf. The company says it became aware of unauthorized access to its local network on October 13, 2025. “On August 18, 2026, we determined that certain files containing select individuals’ protected health information may have been accessed by an unauthorized party between October 8, 2025, and October 15, 2025,” Paradigm said."
https://www.securityweek.com/970000-medi-cal-members-affected-by-paradigm-healthcare-data-breach/
AfD Email Breach Exposes 421,000 Messages In Anonymous Online Archive
"Germany’s Alternative für Deutschland (AfD) confirmed on October 19 that its hosting provider was hacked in September and that mailboxes were copied. By the time the confirmation reached Bild, a website called hexane.cc had already been online for hours offering an index of what it claims are 421,179 internal party emails. “In September 2026 there was a hacking attack on a hosting provider used by our party.” By then the website hexane.cc had been online for several hours with an index of what it says are 421,179 of the party’s emails. In place of the emails, the site shows summaries written by software, sorted into categories that include racism and antisemitism and graded from Low to Critical."
https://securityaffairs.com/201346/data-breach/afd-email-breach-exposes-421000-messages-in-anonymous-online-archive.html
Stolen UpdraftCentral Keys Used To Backdoor WordPress Sites
"A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. TeamUpdraft detected unauthorized access to its infrastructure over the weekend and believes that the hacker accessed the customer database. The developer offers several WordPress tools for backup, storage, and site management:"
https://www.bleepingcomputer.com/news/security/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites/
https://teamupdraft.com/blog/security-incident-october-2026/

General News

Nigerian Man Sentenced To Eight Years For Hacking, Fraud, And Identity Theft Schemes
"United States Attorney for the Southern District of New York, Jamie McDonald, announced that CHUKWUEMEKA VICTOR AMACHUKWU, a/k/a “Chukwuemeka Victor Eletuo,” a/k/a “So Kwan Leung,” was sentenced by U.S. District Judge Paul G. Gardephe to eight years in prison for his role in multiple fraud, hacking, and identity theft offenses. AMACHUKWU previously pled guilty to conspiracy to commit computer intrusions and conspiracy to commit wire fraud."
https://www.justice.gov/usao-sdny/pr/nigerian-man-sentenced-eight-years-hacking-fraud-and-identity-theft-schemes
https://www.bleepingcomputer.com/news/security/hacker-gets-8-years-for-stealing-33-million-from-taxpayers/
https://therecord.media/nigerian-given-8-year-sentenc-tax-hacks
https://cyberscoop.com/nigerian-sentenced-hacking-fraud-tax-investment-scheme/
US Agencies Detail Incident Response Practices For Rogue AI Agents
"Effective and efficient use of complex agentic systems is important for all organizations, but recognizing, preventing and recovering from them going rogue could be an existential necessity. NIST, the NSA, and CISA recognize the increasing potential for AI agents to behave in an unexpected and potentially harmful manner, and has responded with a list of key practices for both preparing for and responding to such behavior. The report (Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation) uses the term super intelligence (SI) rather than artificial intelligence (AI) in line with presidential executive order 14434."
https://www.securityweek.com/us-agencies-detail-incident-response-practices-for-rogue-ai-agents/
https://www.nist.gov/system/files/documents/2026/10/16/Key_Practices_for_Incident_Readiness_and_Response_in_Super_Intelligence _Training_and_Evaluation.pdf
https://www.bankinfosecurity.com/nsa-nist-cisa-issue-guidance-on-rogue-ai-agents-a-33156
There's Only So Much Code: The Rise In Vulnerability Numbers
"Frontier AI models (like Mythos) are rapidly mining decades of technical debt across ubiquitous legacy libraries, driving monthly Microsoft Patch Tuesday vulnerability advisories up more than tenfold (reaching 1,415 this month). This volume is overwhelming open-source maintainers and putting pressure on the traditional 90-day coordinated disclosure model. Despite a 105% year-over-year surge in CVEs, Known Exploited Vulnerabilities (KEVs) grew by only 37%, and only 3 of September's 975 Microsoft advisories saw in-the-wild exploitation, demonstrating that the vast majority of AI-discovered bugs are not practically exploited."
https://blog.talosintelligence.com/theres-only-so-much-code-the-rise-in-vulnerability-numbers/
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers And Software
"Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. Major browsers and operating systems trusted the compromised certificates, potentially allowing attackers to impersonate legitimate websites and intercept encrypted communications. A security researcher known as Wayne discovered the weakness on October 17 while scanning publicly available certificate data."
https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html
https://emudhra.we-have-a-problem.com/
https://www.darkreading.com/cyber-risk/tech-giants-emudhra-certificates-compromised-keys
https://www.bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates/
https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312
Close Identity Gaps In Software Development Before Unleashing AI
"When Renee Guttmann ran her first Open Worldwide Application Security Project (OWASP) meeting in New York City in the early 2000s, the general sentiment among the industry (and attendees) was one of skepticism: Why on earth would anyone care about scanning web applications for vulnerabilities? Flash forward 20-plus years, and Guttmann, founder of security consultancy Cisohive, no longer has to beat down doors to get people to listen. Initiatives like OWASP, with its aim to improve software security, are now regularly invited into software development life cycle (SDLC) conversations to help developers and teams embed secure software practices across planning, testing, deployment and maintenance."
https://www.darkreading.com/application-security/close-identity-gaps-sdlc-before-ai
Your Frontline Workers Have a Workaround For That MFA Prompt
"Frontline workers in healthcare and manufacturing are getting around slow, unreliable logins by staying signed in, sharing credentials and trying to bypass multifactor authentication. Sapio Research surveyed 700 IT and security decision-makers in August, and 95% said they had seen frontline workers use workarounds like these in the past 12 months. Each of those habits breaks the link between an account and the person using it. A session left open on a shared workstation lets the next worker act under someone else’s name, and a password passed around a team lets anyone who knows it do the same. Attackers are working the same weak point from outside. Sixty-two percent of respondents reported a confirmed or suspected attempt to abuse account recovery, a password reset or an unlock in the past year."
https://www.helpnetsecurity.com/2026/10/20/frontline-worker-authentication-passwordless/
AI Agent Adoption Creates Risk As Oversight Struggles To Keep Pace, Splunk Finds
"Businesses are rolling out AI agents across their networks much faster than they can implement monitoring procedures and security controls, leaving organizations exposed to security threats, hallucinations and other common issues associated with the technology. Published by Cisco on October 20, the2026 Splunk State of Observability warned that while many businesses are keen to explore the potential benefits of using AI in their ecosystem, many do so without a strategy in place to ensure it is being used safely."
https://www.infosecurity-magazine.com/news/ai-agent-adoption-oversight/
Seven Core Research Areas For a Rapidly Evolving Cyber Landscape
"In the past year, cyber adversaries have started to exploit artificial intelligence (AI) technology to execute a wide range of attacks. AI is helping them accelerate, optimize, and scale up their techniques. Agentic AI lowers the work factor for savvy adversaries, and it lowers the barrier to entry for new entrants. There is already an increase in the extent, tempo, and sophistication of attacks, and they are targeting diverse sectors. There are the well-known Salt Typhoon attacks on multiple prominent telecommunications providers and, more recently, attacks on water systems attributed to Iran."
https://www.sei.cmu.edu/blog/seven-core-research-areas-for-a-rapidly-evolving-cyber-landscape/
What Security Teams Can Do To Tame Wild Code
"A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team’s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support them. If you work in security, that success introduces a new set of questions. Whose credentials does the workflow use? Which records can it access? Who can see its output? If it starts exposing information it shouldn’t, can you trace what happened and stop further access?"
https://thehackernews.com/2026/10/what-security-teams-can-do-to-tame-wild.html
The Key To AI Software Security Isn’t Speed, It’s Maturity
"Agentic artificial intelligence software development has all the traits of a summer blockbuster, with the prospects of Godzilla-sized productivity gains thrilling business leaders and security implications sending chills down the spines of developers and SOC teams. One difference, though, is that those thrills and chills are going to last longer than a summer, and the fallout could be a lot more serious than some spilled popcorn."
https://www.securityweek.com/the-key-to-ai-software-security-isnt-speed-its-maturity/
Swamped Curl Maintainers Take Low-Level Flaws Public To Survive Vulnerability 'avalanche'
"An "avalanche of vulnerability reports" is forcing curl to move lower-severity cases into public view, reserving private handling for high and critical flaws. From October 26, low and medium-severity reports should be filed in the open source data transfer tool's public GitHub repository, maintainer Daniel Stenberg said. "Security researchers in doubt can still submit the issue on HackerOne and we can tell them what severity we deem it to be. Over the last few years, over 90 percent of all submissions could quickly be assessed to be less than HIGH.""
https://www.theregister.com/security/2026/10/20/swamped-curl-maintainers-take-low-level-flaws-public-to-survive-vulnerability-avalanche/5304198
ICANN Testing Tech To Let Law Enforcement Access Non-Public WHOIS Info
"ICANN has started testing authentication schemes that will allow law enforcement agencies to make urgent requests for non-public WHOIS information – when needed to address threats to life, critical infrastructure, or child exploitation. Domain registrars collect information about their customers and in the past that data was publicly available in WHOIS records. Some domain registrars offer services that substitute their own contact details, to preserve customer privacy. In recent years, laws like GDPR mean registrars are sometimes required to hide WHOIS data."
https://www.theregister.com/networks/2026/10/20/icann-testing-tech-to-let-law-enforcement-access-non-public-whois-info/5304036
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
"U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom."
https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/

อ้างอิง
Electronic Transactions Development Agency (ETDA)