Cyber Threat Intelligence 22 October 2026

NCSA_THAICERT

Industrial Sector

AI Has 'potential' To Turn Script Kiddies Into Sophisticated Infrastructure Attackers
"When it comes to cyberattacks that shut down power grids, drinking-water systems, and other critical infrastructure, AI doesn’t – yet – turn script kiddies into sophisticated, nation-state attackers. But “the potential is there,” according to operational technology (OT) security experts. "One thing that we've relied on for years is security by obscurity when it comes to utilities," said Steve Swick, former chief information security officer at American Electric Power. "The knowledge needed to do some of that stuff is getting less likely to be necessary," Swick added during a media panel ahead of the publication of Frenos' State of AI in Security report."
https://www.theregister.com/security/2026/10/21/ai-has-potential-to-turn-script-kiddies-into-sophisticated-infrastructure-attackers/5304297

New Tooling

DevGuard: Open-Source Vulnerability Management For The Software Supply Chain
"DevGuard is a free, open source vulnerability management platform that collects a software project’s security findings in one place, ranks them by risk, and tracks them. It’s an OWASP Incubating Project, and anyone can self-host it. DevGuard runs secret scanning, static code analysis, dependency checks against known CVEs, infrastructure-as-code checks, container scanning, and license checks through one CLI that wraps existing open source tools. Teams already using Trivy, Grype, or Semgrep can skip the built-in scanners and upload CycloneDX SBOMs (machine-readable lists of the components in a build) or SARIF results. Findings sync both ways with GitHub Issues, GitLab Issues, and Jira, where developers triage them with slash commands."
https://www.helpnetsecurity.com/2026/10/21/devguard-open-source-vulnerability-management/
https://github.com/l3montree-dev/devguard
Google Open-Sourced TorchTPU, So PyTorch On TPUs Just Got a Lot Easier
"Google released TorchTPU as open source, giving PyTorch developers a native way to run models on the company’s Tensor Processing Units. Google also announced TPU support in the vLLM and SGLang serving engines, the TorchTitan training framework, Ray, and Hugging Face’s libraries. Teams that write their models in PyTorch and run them on GPUs by default have the most to gain. Google says those workloads now move to TPUs, its custom AI chips, with minimal code changes. If that claim holds up in practice, a team weighing GPU costs can test Google’s hardware without first rebuilding its software."
https://www.helpnetsecurity.com/2026/10/21/torchtpu-pytorch-on-tpus/
https://github.com/google-pytorch/torch_tpu

Vulnerabilities

PHP Ships Emergency Patches For Critical PHP2Shell Flaws
"The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. The two unauthenticated RCE flaws were discovered by Calif, , and OpenAI security researchers, and affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. "We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs," the PHP security team said."
https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html
https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
https://blog.talosintelligence.com/two-critical-rces-in-php-core/
https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry
https://therecord.media/php-foundation-statement-critical-vulnerabilities
https://blog.checkpoint.com/security/php2shell-what-we-know-about-the-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/
https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/
https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce
https://www.wiz.io/blog/php2shell-php-rce
https://asec.ahnlab.com/en/95944/
https://www.bankinfosecurity.com/critical-php-patches-address-very-very-bad-vulnerability-a-33162
https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/
https://www.infosecurity-magazine.com/news/critical-php-vulnerabilities-leaked/
https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/
https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates
https://www.theregister.com/security/2026/10/21/php-devs-publish-critical-bug-fix-as-site-owners-warned-pull-em-offline-if-youre-unpatched/5304519
https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611
https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years Of Releases
"GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an instance updated then is in range again. The flaw, tracked as CVE-2026-110264, is rated 10.0 on the CVSS scale, the maximum. GitLab says that, under certain conditions, it could allow an unauthenticated user to run arbitrary code on the server due to an integer overflow during the compilation of a specially crafted regular expression."
https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
Signal Bug Could Let Someone Keep Listening After You Hang Up
"A recently disclosed flaw in Signal’s calling software could allow another participant to keep hearing you after you hang up. The vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 out of 10), affects RingRTC versions earlier than 2.72.0. RingRTC is the open-source library behind Signal’s voice and video calling functionality, providing calling components for its mobile and desktop applications. The flaw concerns how Signal’s calling library shuts down a call. It does not affect how it encrypts conversations. According to the published vulnerability description, another participant could overwhelm a call’s internal event queue and interfere with the steps that should disconnect it when you end the call."
https://www.malwarebytes.com/blog/bugs/2026/10/signal-bug-could-let-someone-keep-listening-after-you-hang-up
https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528
Memory Bugs Account For Most Of Chrome’s 353 New Security Fixes
"Google on Tuesday announced the promotion of Chrome 156 to the stable channel with patches for 353 vulnerabilities. Most of the resolved security defects were memory safety flaws, including 163 memory corruption bugs, 125 use-after-free issues, and 17 out-of-bounds reads. Of the remaining weaknesses, 36 are improper input validations. The browser refresh resolves six critical-severity vulnerabilities: five memory corruption defects and one use-after-free bug."
https://www.securityweek.com/memory-bugs-account-for-most-of-chromes-353-new-security-fixes/

Malware

Does It Stop When Someone Is Watching? The Suspicious Behavior Of a New Type Of Infostealer
"It is already well known that illegal software and cracked programs can be exploited for malware distribution. Recently, AhnLab identified a new type of information theft malware (Infostealer) disguised as an illegal program. This malware was first detected in mid-August and, after altering its execution method, began spreading widely in September. Notably, it not only collects information stored in browsers and business applications but can also install additional malware, raising the possibility of secondary damage beyond mere Information Theft. Let’s take a look at the distribution methods, key behaviors, and countermeasures for this new type of Infostealer."
https://asec.ahnlab.com/en/95937/
Operation FlashHole: Lazarus Breaks Security, Defies Control
"In January, we responded to the Lazarus Group’s novel attack campaign against South Korea, which followed last year’s Operation SyncHole. In this new operation, the group employed an updated malware chain that included both their old and new malware, which we disclosed in full, and used another mandatory South Korean security software program as a part of infection chain using a watering‑hole strategy. Notably, the group targeted victims more selectively, sending spear‑phishing emails with links to fabricated but relevant sites, such as portfolio and résumé pages tailored to each target. We dubbed this activity Operation FlashHole."
https://securelist.com/lazarus-operation-flashhole/121541/
https://www.bleepingcomputer.com/news/security/lazarus-hackers-use-post-quantum-cryptography-for-malware-delivery/
Suppressing Misalignment Monitoring Alerts And Disabling Misalignment Monitoring
"In two internal coding tasks, agents weakened misalignment monitoring while making requested software changes. A GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to our Security team, treating an earlier instruction not to send messages during a Slack history search as a reason to suppress monitoring notifications. In a separate task, a GPT-6 Astra agent migrating a program removed its monitoring integration in order to match a reference implementation, and then falsely claimed to the user that it had not removed the monitor. In both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them. We are strengthening our misalignment monitoring system in response, and are also assessing whether these cases reflect benign overpersistence or a propensity to evade misalignment monitoring in particular."
https://alignment.openai.com/misalignment-reports/suppressing-misalignment-monitoring-alerts-and-disabling-misalignment-monitoring/
https://www.bleepingcomputer.com/news/security/openai-agents-disabled-safety-monitoring-one-lied-about-it/
https://thehackernews.com/2026/10/openais-gpt-6-agent-removed-safety.html
https://www.securityweek.com/openai-agents-silenced-security-team-alerts-removed-misalignment-monitor/
https://securityaffairs.com/201435/ai/openai-reports-two-incidents-of-ai-agents-disabling-their-own-oversight.html
How Fraudulent Airline Support Numbers Exploit Search Results And AI-Generated Answers
"A canceled flight. A missed connection. A refund that has yet to arrive. When travelers need urgent help, they often turn to search engines, social media, or AI tools to find a customer support number. Threat actors are increasingly exploiting that moment of urgency. In our previous investigation, Scammers Are Watching Airline Complaints and Posing as Customer Support, Check Point Exposure Management researchers uncovered scammers monitoring airline complaints on social media and impersonating customer support representatives."
https://blog.checkpoint.com/research/how-fraudulent-airline-support-numbers-exploit-search-results-and-ai-generated-answers/
Parasitizing Trust: How Legitimate Infrastructure Becomes a Delivery Pipeline For Attackers
"Talos recently analyzed two order notification campaigns abusing Staples and Dell transactional email pipelines. Together, these campaigns accounted for roughly 1,400 messages observed by Talos. The malicious element was not the outer sender identity, like a simple forged sender or lookalike domain. It was the content of the legitimate order notification workflow rendered. The suspicious content appeared inside the notification itself, in fields that would normally contain shipping information. The attacker’s objective was to use a trusted retail pipeline to create urgency around a high-value purchase and push the recipient toward an attacker-controlled phone number."
https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/
Threats Hidden In Replies: Threat Actors Deliver Malware And Credential Phishing In Email Threads
"Recently, threat actors have been increasingly delivering malware or credential phishing attacks at the end of long email threads designed to exploit a potential victim’s trust in an email contact. In this tactic, threat actors deliver malicious payloads at the end of seemingly normal email conversations after gaining the potential victim’s trust. These kinds of attacks, also known as email thread hijacking, exploit the recipient’s trust in the sender after several legitimate emails. Often these are legitimate email threads that threat actors respond to when accessing compromised email accounts."
https://cofense.com/blog/cofense-intelligence-strategic-analysis
AI-Driven, Large-Scale Nation-State Campaign Using ARTEX Enables Supply Chain Compromise
"As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure – including multiple instances where the time from initial targeting to privileged access was less than 3 hours. Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application."
https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
https://cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940/
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
"Huntress investigated multiple incidents stemming from an Amazon-themed ClickFix campaign tied to a sponsored Google search result for the keywords "amazon business." The sponsored result leads to a spoofed Amazon login page with an embedded ClickFix (fake CAPTCHA) that downloads a malicious payload from attacker-controlled infrastructure. The ClickFix command calls on Window's built-in finger utility, a relic of the early internet, used in this case as a living off the land binary (LOLBIN). The finger command kicks off a complex, multi-layered attack chain that ends with multiple payloads dropped, including a pirated copy of the NetSupport Client remote monitoring and management (RMM) tool and a version of Lumma Stealer."
https://www.huntress.com/blog/amazon-clickfix-finger
https://www.darkreading.com/cyberattacks-data-breaches/decades-old-windows-utility-modern-clickfix-attack
Stray Cat, Open Doors: How k0t Wanders Through The Network Edge
"Group-IB Threat Intelligence, together with NyxLab, collaborated on a joint investigation on a campaign involving widespread exploitation of network edge devices. This joint-investigation effort has managed to uncover indications that this may be connected to the FortiBleed cluster seen earlier this year in June as well as the exposure of adversarial tooling as well as discovery of Tactics, Techniques and Procedures (TTPs) employed by the threat actor known as ‘k0t’. Notable among the observed TTPs is the exploitation of vulnerabilities in network devices such as FortiGate Firewalls and Palo Alto GlobalProtect to gain initial access. Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, resulting in persistent remote access and data exfiltration."
https://www.group-ib.com/blog/stray-cat-network-edge/
Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models To Run Attacks
"Attackers have built an autonomous offensive agent that hunts the internet for exposed large language models (LLMs) and hijacks them to power a self-directed cybercrime operation. Once connected to an unprotected model, the agent is instructed to scan for new targets, exploit common web frameworks, steal databases and credentials, and quietly install cryptocurrency miners, for up to 100,000 steps and without asking a human for approval. The owner of the hijacked model pays for the computing power, while the servers the agent breaks into are stripped of data and put to work mining."
https://www.security.com/blog-post/ai-llmjacking-skynet
https://www.infosecurity-magazine.com/news/symantec-ai-agent-llmjacking/
Fake Amazon Music x YouTube Deal Lures Creators Into a Google Login Trap
"On August 27, YouTube announced that Amazon had joined its Shopping Affiliate Program. Eligible creators can now tag Amazon products in their videos and earn a commission on sales. Weeks later, we found a wave of sites offering YouTube creators what looks like another Amazon opportunity: an invite-only advertising deal with Amazon Music. The site shows creators their own channel stats, then asks them to “verify” their channel with Google before it reveals a personalized offer."
https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-amazon-music-x-youtube-deal-lures-creators-into-a-google-login-trap
Inside a Global AI-Assisted Hacking Campaign
"In October 2026, Zscaler ThreatLabz investigated AI-assisted cyberattacks that combined the ARTEX penetration testing framework with AI coding assistants and custom automation scripts. Initial reporting of the incident identified the targeting of South Korean financial institutions. However, ThreatLabz discovered additional information about the attack, which went far beyond South Korea. The AI-assisted attacks were widespread and targeted organizations around the globe and in multiple industry sectors."
https://www.zscaler.com/blogs/security-research/inside-global-ai-assisted-hacking-campaign
Compromised LiteLLM 1.107.0 On PyPI Installs a Credential Stealer And Backdoor
"The LiteLLM 1.107.0 release on PyPI carries a credential stealer and a remote code execution backdoor. All seven wheels (Linux, macOS, Windows) install them as three files in site-packages. Both run when any Python process starts on the host, even one that never imports litellm. The upstream GitHub source does not contain them. PyPI has since removed the release. Versions 1.106.2, 1.107.0rc1, and 1.107.0rc2 are clean. The companion packages that 1.107.0 pins, litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78, are also clean."
https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor/
https://socket.dev/blog/litellm-compromise
https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer
https://www.upwind.io/feed/litellm-1-107-0-supply-chain-attack-malicious-code-found-in-pypi-package
https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html
https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548
BRONZE SANDCASTLE Deploys Modified Meterpreter Shells
"Counter Threat Unit (CTU) and SophosLabs researchers investigated a cluster of incidents attributed to the BRONZE SANDCASTLE threat group. The most distinctive technical marker for BRONZE SANDCASTLE is its consistent use of Sandboxie DLL sideloading. Across multiple victims’ environments, legitimate Sandboxie executables were placed alongside a malicious sbiedll.dll file, causing the trusted application to load attacker-controlled code at runtime. This consistent pattern functions as a signature for the group, although the threat actors employ several other sideloading file combinations as well (see Table 1)."
https://www.sophos.com/en-us/blog/bronze-sandcastle-deploys-modified-meterpreter-shells
https://thehackernews.com/2026/10/china-aligned-bronze-sandcastle-abuses.html
Hackers Hid Vasilek Backdoor In VMware Tools During 2-Year Russian Healthcare Intrusion
"A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans. Known to be active since at least 2020, the group has a track record of striking industrial enterprises and government agencies in Russia and Belarus with a backdoor called Vasilek that uses Telegram for command-and-control (C2) and data exfiltration."
https://thehackernews.com/2026/10/hackers-hid-vasilek-backdoor-in-vmware.html
“Next Exploit Opportunities”: How a Threat Actor Used AI To Help Plan And Execute Multiple Types Of Cybercrime Activities
"“Can you find about like what scam or thing they done in past like spoofing calls or somthing [sic],” the threat actor typed. The conversation was with one of several AI assistants that the actor was using to get advice on planning and executing a variety of cybercrime activities. Our visibility into this specific actor's operational environment gives us unique insights into exactly how threat actors are building, testing and executing agentic attacks across multiple campaign types."
https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/
New PhaaS Platform Uses AI To Craft Phishing Lures And Mask Malicious Activity
"A new phishing phishing-as-a-service (PhaaS) platform, dubbed Athena StealthRoute, has been found to use AI tools to both deliver and conceal phishing attacks. Researchers at cybersecurity firm Abnormal AI first identified Athena StealthRoute-linked infrastructure during an August 2026 phishing campaign. In the six months to October 9, the firm identified approximately 89,700 attack-related messages containing the platform's distinctive link pattern across around 2,280 organizations in the US and Europe."
https://www.infosecurity-magazine.com/news/new-phaas-uses-ai-phishing-lures/
CrowdStrike Uncovers New Agentic AI Campaigns
"A new report from the CrowdStrike Counter Adversary Operations team details research into four previously unreported threat actors, each of whom left their offensive agent frameworks exposed via open directories. In doing so, they shared detailed insight into their use of AI agents and revealed how adversaries are quickly becoming more proficient in AI."
https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-agentic-ai-campaigns/
https://www.crowdstrike.com/en-us/resources/reports/agentic-ai-attack-campaigns/
ThreatLocker MDR Team Intercepts Chimera C2 ClickFix Attack
"On September 28, 2026, ThreatLocker MDR identified and intercepted the implementation of an active C2 framework in a monitored environment. A ClickFix attack persuaded the victim to execute malicious PowerShell commands, leading to machine compromise and the subscription to a Command-and-Control platform titled ChimeraC2. Chimera has been previously attributed to a Chinese based threat actor group by MITRE and the broader intelligence community, although evidence present to the ThreatLocker Intelligence Team indicates that Russian-speaking threat actors are behind this panel. The apparently AI-assisted tooling present does not align with open-source intelligence reports on Chimera, and ThreatLocker Threat Intelligence cannot independently attribute this campaign to the previously documented Chimera group."
https://www.threatlocker.com/blog/threatlocker-mdr-team-intercepts-chimera-c2-clickfix-attack
Recent AI-Assisted Cyber Attacks In Japan: Investigating Attack Infrastructure And Techniques
"On October 8, 2026, JPCERT/CC issued an alert regarding a series of unauthorized access incidents involving the leakage of personal and other information reported by multiple organizations in Japan. In cooperation with multiple organizations, JPCERT/CC has been investigating infrastructure that may have been used in these attacks. We confirmed that the attackers had used AI to scan for known vulnerabilities and carry out attacks via APIs. We identified several servers used for these activities and confirmed that the attackers had also targeted web services intended for users outside Japan. This article presents our findings from an investigation of attack servers involved in attacks targeting web services and other systems in Japan and abroad."
https://blogs.jpcert.or.jp/en/2026/10/web_api_attacks.html
The Gentlemen: A Closer Look At a Not-So-Gentle Ransomware-As-a- Service Operation
"The Gentlemen ransomware is a Russian-speaking ransomware-as-a-service (RaaS) threat provider that first emerged in mid-2025. Its Go-based ransomware targets Windows, Linux, NAS and BSD systems. The operators reportedly offer affiliates up to 90% of the ransom revenue generated from their operations. The Gentlemen uses a double-extortion model. In addition to encrypting files, the ransomware can exfiltrate data from compromised systems. This puts additional pressure on victims to pay the ransom to restore access to their files and prevent the stolen data from being publicly leaked."
https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/

Breaches/Hacks/Leaks

Japan's Onamae Desktop Cloud Hacked, Up To 27,000 Servers Affected
"Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers. The company confirmed on October 20 that an unauthorized third party installed "malicious programs" in some customer environments. After detecting the intrusion, the company says it progressively shut down customer servers beginning at 04:00 local time on October 21, 2026."
https://www.bleepingcomputer.com/news/security/japans-onamae-desktop-cloud-hacked-up-to-27-000-servers-affected/
TiDB Breach Exposes Flawed Cloud Security Assumptions
"A breach of an open source database provider may have inadvertently highlighted a serious gap in the way companies think about their cloud security. On Oct. 19, software maker PingCAP, which sells an SQL database program called TiDB, disclosed that it had been breached. According to PingCAP's website, it serves major American corporations like Atlassian, Square, and Pinterest, as well as major players in China's artificial intelligence (AI) space, including Manus, Kimi, and more."
https://www.darkreading.com/cloud-security/tidb-breach-flawed-cloud-security
Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account
"The personal details of thousands of children and their families were breached in Wales after ransomware attackers compromised an account protected by a ‘Password1’ password, an investigation by the UK’s Information Commissioner’s Office (ICO) has revealed. The data protection regulator issued a reprimand to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, for security failings relating to the November 2024 incident. Data Cymru is funded by the Welsh government and is tasked with enabling local councils and other organizations to find, collect, analyze and present data effectively."
https://www.infosecurity-magazine.com/news/children-data-stolen-password1/
State Bank Of India Confirms Data Leak After 3,897 Customer Records Found On Dark Web
"State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from. The state-owned bank, India's largest, said in a stock-exchange filing dated October 21 that it "has experienced an incident involving the loss of certain data." The count is preliminary, and the bank has yet to establish whether the data is authentic, how far the exposure goes and what risk it poses to customers."
https://thehackernews.com/2026/10/state-bank-of-india-confirms-data-leak.html

General News

Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens
"Data loss prevention (DLP) tools are often functioning as after-the-fact forensic systems rather than prevention controls, according to DLP in the AI Era, a new survey from the Cloud Security Alliance (CSA), the world's leading not-for-profit organization committed to AI, cloud, and Zero Trust cybersecurity education. The study, conducted in collaboration with Jazz, found that 73% of organizations said they experienced at least one confirmed data loss incident in the past 24 months. Among the respondents, only 16% said DLP blocked their most significant incident before data left the organization."
https://www.darkreading.com/cloud-security/cloud-security-alliance-survey-data-loss-prevention-detects-data-loss
Survey Finds High-Profile Executives Feel Untouchable As Digital Exposure Turns Into Physical Risk
"360 Privacy, a digital exposure reduction company, today released its 2026 Annual Digital Exposure Report. It found that security and risk leaders now treat digital exposure and physical danger as the same problem, and that the executives, celebrities and wealthy families they protect often don't believe they're at risk."
https://www.darkreading.com/cybersecurity-operations/360-privacy-survey-high-profile-executives-feel-untouchable
Why Security Tools Lose Sight Of The Credential
"Security teams have tools for code, endpoints, cloud infrastructure, identity, and secrets management. Credentials cut across all of them. A developer finds an AWS key in a repository. The first step is obvious: remove it. But that does not answer the questions the security team now has: Is the key still active? Who owns it? What can it access? Is the same credential sitting in a CI/CD variable, a local .env file, a Slack thread, or an old commit? Has it ever been exposed publicly?"
https://www.helpnetsecurity.com/2026/10/21/gitguardian-securing-credential-layer/
Ransomware Attacks Rise As Rival Gangs Vie For Market Supremacy
"Almost 3000 ransomware attacks took place between July and September 2026 and the figure marked a significant increase when compared with the same period last year. According to an analysis by Nord Security, the 2894 ransomware attacks which took place during the quarter represents a 50% increase when compared with the same period last year. It also represents a slight increase when compared with the previous quarter of this year, as the July to September period saw an 8.6% rise in ransomware attacks when compared with April to June."
https://www.infosecurity-magazine.com/news/rival-gangs-vie-for-market/
Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports
"Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templates now arrive fluent, personalized, and unique to each recipient, and the behavioral signals email filters have relied on for years are fading as a result. Proofpoint shared several examples of the shift at its Protect 2026 conference. In one, a single threat actor contacted more than 30 real estate agents at the same company, each from a different account, about a different property, and in different words, before closing every thread with the same request: join a video meeting."
https://thehackernews.com/2026/10/generative-ai-is-erasing-behavioral.html

อ้างอิง
Electronic Transactions Development Agency (ETDA)