สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 20 รายการ เมื่อวันที่ 22 ตุลาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSMA-26-295-01 - InterSystems Corporation InterSystems IRIS for Health
• ICSA-26-295-01 - Kiloview E3 NDI Encoder
• ICSA-26-295-02 - Siemens Industrial Edge App Publisher
• ICSA-26-295-03 - Siemens Software Center
• ICSA-26-295-04 - Siemens Capital Embedded AR Classic
• ICSA-26-295-05 - Siemens SENTRON 3NA COM Fuse
• ICSA-26-295-06 - Siemens PSS(R)SINCAL
• ICSA-26-295-07 - Siemens SIMATIC IPCs
• ICSA-26-295-08 - Siemens APOGEE, TALON and Desigo PXC/PXM Products
• ICSA-26-295-09 - Siemens Industrial Edge Device Kit
• ICSA-26-295-10 - Siemens SIMATIC S7 Webserver API
• ICSA-26-295-11 - Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
• ICSA-26-295-12 - Siemens RUGGEDCOM CROSSBOW
• ICSA-26-295-13 - Siemens WinCC
• ICSA-26-295-14 - Siemens SIMATIC S7 PLCs Web Server
• ICSA-26-295-15 - Siemens RUGGEDCOM CROSSBOW Station Access Controller
• ICSA-26-295-16 - Siemens SIMATIC S7-1500 TM MFP
• ICSA-26-295-17 - Siemens Industrial Edge Devices
• ICSA-26-295-18 - Siemens RUGGEDCOM APE1808 Devices
• ICSA-26-274-06 - Meari IoT Cloud Platform OpenAPI Service (Update A)

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 6 รายการ เมื่อวันที่ 20 ตุลาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-26-293-01 - HMS Networks PEAK-System PCAN Windows drivers
• ICSA-26-293-02 - WAGO OS Linux
• ICSA-26-293-03 - Moxa AIG-302 ThingsPro Edge
• ICSA-26-293-04 - Hitachi Energy MicroSCADA X SYS600 Product
• ICSA-26-293-05 - Hitachi Energy RTU500 Product
• ICSA-26-062-03 - Hitachi Energy RTU500 Product (Update A)

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 6 รายการ เมื่อวันที่ 15 ตุลาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-26-280-01 CISA Malcolm
• ICSA-26-288-01 Eclipse Foundation Eclipse Milo
• ICSA-26-288-02 Guangzhou Juan IoT Technology EseeCloud
• ICSMA-26-288-01 Thermo Fisher Torrent Suite
• ICSMA-26-288-02 J4Care dcm4che
• ICSA-26-281-01 Red Lion Controls N-Tron 700 Series (Update A)

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 2 รายการ เมื่อวันที่ 13 ตุลาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-26-286-01 Inductive Automation Ignition Software
• ICSA-26-286-02 Swann Communications SWIFI-SE2KIC

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Healthcare Sector

• 4 Flaws Found In Widely Used Health Data Exchange Software
  "Four vulnerabilities in a widely used open-source healthcare interoperability software could enable attackers to improperly access sensitive patient records, cross security boundaries separating healthcare organizations' data and potentially disrupt services, according to new security research. The findings, which were the subject of four Cybersecurity Infrastructure and Security Agency CVE advisories issued Thursday, affect HAPI FHIR, an open-source implementation of the Fast Healthcare Interoperability Resources."
  https://www.bankinfosecurity.com/4-flaws-found-in-widely-used-health-data-exchange-software-a-33192

Vulnerabilities

• PHP Shares Mitigation For New RCE Vulnerability With No Patch
  "The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. PHP is an open-source web development language used by nearly 70% of all websites on the Internet. According to VirusTotal estimates, more than 5.1 million PHP hosts are exposed online, and roughly 3.8 million have at least one port open to attacks. According to a Friday advisory, this security flaw (tracked as CVE-2026-115560) can only be exploited when targeting systems "with an unusual combination of configuration and application code.""
  https://www.bleepingcomputer.com/news/security/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability/
  https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html
  https://www.theregister.com/security/2026/10/23/theres-a-third-php2shell-bug-but-it-wont-get-an-emergency-fix/5305208
  https://securityaffairs.com/201595/security/php-warns-of-new-code-execution-flaw-days-after-php2shell-patches.html
• HPE Patches Eight Max Severity RCE And Auth Bypass AOS Flaws
  "Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. Also known as AOS, ArubaOS powers Aruba Networking enterprise wireless infrastructure, including mobility conductors, access points, controllers, and gateway devices. The eight maximum-severity security flaws patched today affect multiple AOS-8 and AOS-10 software versions, and they can be exploited by remote threat actors without privileges through low-complexity attacks that don't require user interaction."
  https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/
  https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
• Critical Flaw In Python’s Popular Pillow Image Library Allows Code Execution Via a Crafted Image
  "Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first. Ghostscript can read a name chosen by an attacker as instructions rather than as a file, and point it to a second file that carries commands to run. Pillow's maintainers fixed it in version 13.0.0, released on October 16."
  https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html
  https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh
  https://www.ox.security/blog/three-critical-pillow-cves-rce-and-heap-overflows-in-pythons-imaging-library-cve-2026-112900-cve-2026-112393-cve-2026-112403/
• 25 Vulnerabilities In The x402 Protocol: Inside Three Critical Findings
  "x402 lets software pay for an API request as part of an ordinary HTTP exchange. A server responds with 402 Payment Required, the client signs a payment payload and retries the request with the payload attached, which then proceeds. This is useful for automated clients and AI agents that need to buy data or services without a person approving every request."
  https://v12.sh/blog/x402
  https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html
• Atlassian Patches 75 Flaws In Data Center And Server Products
  "Atlassian on Tuesday published its October 2026 security bulletin, which lists 162 high-severity and 14 critical-severity vulnerabilities. All of the entries are tied to third-party dependencies, and many CVEs appear under several products. By SecurityWeek’s count, the bulletin covers 75 unique CVEs, six of them rated critical. The affected products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management."
  https://www.securityweek.com/atlassian-patches-75-third-party-flaws-in-data-center-and-server-products/
• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0
  https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html
  https://securityaffairs.com/201652/security/u-s-cisa-adds-collabora-online-flaw-to-its-known-exploited-vulnerabilities-catalog.html
• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog
  https://securityaffairs.com/201609/hacking/u-s-cisa-adds-arista-velocloud-orchestrator-flaw-to-its-known-exploited-vulnerabilities-catalog.html
• Operation IXIM: Preventing a Botnet Of Millions Of Popcorn Time Users
  "Between November 2025 and March 2026, Eye Research actively disabled the vulnerable update mechanism used by the popular download client Popcorn Time (Time4Popcorn). This involved executing code on systems running the vulnerable software. This is the story of how we got here and why we took the unprecedented decision of taking matters into our own hands. The vulnerability was assigned CVE-2026-30612, about which we published an advisory in June 2026."
  https://labs.eye.security/operation-ixim-preventing-a-botnet-of-millions-of-popcorn-time-users/
  https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/
  https://thehackernews.com/2026/10/researchers-push-over-2-million-updates.html
• Ruby Fixes Three Regex Engine Bugs Responsible For Four Critical GitLab RCE Flaws
  "Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any application that builds a regular expression from text an attacker controls is affected, not just GitLab."
  https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html
  https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
• Node2Shell: From Brotli Data To Remote Code Execution
  "Node2Shell is Imperva Red Team’s name for our analysis of CVE-2026-111497, a High severity flaw in Node.js’s bundled Brotli decoder. Node.js says the out-of-bounds write can permit remote code execution and has released fixes for the 22.x, 24.x, and 26.x lines. Our standalone proof of concept ran code carried in a Brotli response or request body inside applications using the official Node.js 24.22.0 Linux arm64 image. It needed no debugger or instrumented binary. The same inputs were rejected by 24.22.1. We tested Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0, including the latest releases available at testing; execution took multiple attempts in our setup."
  https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/
  https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html
  https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html
• Tailworm
  "The design choices of the open source tailscale and headscale software have created an environment ripe for risk, while marketing security as its design and purpose. Choices have been made to move away from security-in-depth, removing layers of authentication, and replacing daemons such as OpenSSH which employ privilege-separation with a highly-privileged process. Other findings include broader-than-advertised network security boundaries, which seems to be legitimate bugs, but the missing security and isolation is precisely what users are advertised by these tools."
  https://tailworm.com/
  https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html
• Securing Our Frontier Model Training Environment
  "This post describes how we secure the environments that we use to train and evaluate frontier models. These research settings differ from those in which customers use our released models: models in development may not yet have completed safety and alignment training, and we deliberately test them under adversarial conditions to expose weaknesses. Before making models available for broader use, we conduct safety and alignment assessments and put production safeguards in place."
  https://openai.com/index/securing-our-frontier-model-training-environment/
  https://thehackernews.com/2026/10/openai-ai-agents-demonstrate-vm-escapes.html
  https://securityaffairs.com/201673/ai/openai-paused-frontier-ai-training-after-a-security-incident.html

Malware

• PHP2Shell Exploit Attempts Hit Millions As Attackers Try To Deploy Mirai Malware
  "Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote code execution (RCE) via specially crafted HTTP requests. The vulnerabilities have been patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. "However, analysis of the sample revealed that it is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026," Sophos said. "The sample displays downloader and network disruption functionality.""
  https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html
  https://therecord.media/php-php2shell-exploitation-attempts-pocs
  https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/
  https://securityaffairs.com/201538/hacking/php2shell-millions-of-attacks-no-confirmed-successful-exploits-yet.html
• Infostealers Are Targeting AI: What Aokigahara Infostealer Reveals About The New Developer Attack Surface
  "AI assistants have quickly become part of everyday work, particularly for developers. Tools such as ChatGPT, Claude, Cursor and GitHub Copilot increasingly sit alongside source code, cloud environments and other sensitive business resources, making the credentials and sessions connected to these tools increasingly important to protect. New research from Check Point Research (CPR) into the Aokigahara infostealer shows how attackers are adapting to this shift. The malware specifically collects authentication files, session data and configuration files associated with popular AI applications and development tools."
  https://blog.checkpoint.com/ai-security/infostealers-are-targeting-ai-what-aokigahara-infostealer-reveals-about-the-new-developer-attack-surface/
  https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/
• M365 Token Spray And Replay Campaign Compromises Business Email Accounts
  "Over a ten-week stretch, Huntress tracked a Microsoft 365 campaign that captured sign-in sessions through adversary-in-the-middle (AiTM) relays and replayed the stolen tokens from an IP address block owned by German hosting provider 1337 Services GmbH. We responded to related incidents at 79 organizations, observing at least 497 successful sign-in events against more than 200,000 failed login attempts across our customer environments. Access to a Microsoft 365 account sets the stage for business email compromise (BEC). Across the affected environments, we observed the attacker registering at least 48 rogue Entra devices, wiping and replacing victims' MFA methods, and creating inbox rules to hide malicious communications. In one incident, the attacker used the compromised account to send a payroll-related email to an outside contact."
  https://www.huntress.com/blog/token-replay-spray
  https://www.infosecurity-magazine.com/news/tokenspraying-attacks-target/
  https://www.helpnetsecurity.com/2026/10/23/microsoft-365-accounts-stolen-sessions/
• When An Email Talks To Your AI: The Rise Of Indirect Prompt Injection
  "Imagine an employee receives what appears to be an ordinary business email. There is no suspicious attachment, urgent request, or link asking them to reset a password. To the employee, the message may seem completely harmless. But the employee may not be the only one reading it. Organizations are increasingly giving AI assistants access to inboxes so they can summarize conversations, retrieve information, recommend next steps, and, in some cases, take action. That creates a second audience for every email and an entirely new opportunity for attackers."
  https://blog.barracuda.com/2026/10/23/indirect-prompt-injection-email-ai-assistants
• DeadTag: How Forgotten Website Tags Became a Delivery Network For iPhone Spyware
  "Combined research between Report URI and iVerify has uncovered an extensive ecosystem being used to deliver two of the most capable iOS exploit kits ever seen, Coruna and DarkSword. Over the last month, our respective security teams have been tracking this proliferation, Report URI from the web delivery side and iVerify from the client-side. Attackers are buying up the expired domains behind old analytics and advertising tags that thousands of websites still load, and they're selling the visitors those tags bring in. Most of that traffic goes to scams, but the tags also quietly pick out iPhone visitors and load these advanced exploit kits, which steal keychain passwords and target crypto wallets."
  https://blog.report-uri.com/deadtag-how-forgotten-website-tags-became-a-delivery-network-for-iphone-spyware/
• Unboxing Phishing Kits: Advanced Cred Theft For Entry-Level Hackers
  "Teach a noob to phish and they'll be scamming for a lifetime. It has never been easier to steal credentials, thanks to a growing number of phishing kits that give aspiring attackers everything they need in one convenient interface. Huntress Staff Threat Intelligence Analyst Andrea Hatcher and Staff Product Manager Rich Mozeleski stopped by our monthly Tradecraft Tuesday series in October to unpack some recently staged phishing kits and walk through what the resulting malicious activity looks like from the defenders' point of view."
  https://www.huntress.com/blog/unboxing-phishing-kits
• Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens And Hijack Release Pipeline
  "LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of the LiteLLM Agent Platform, an open source tool we use for orchestrating agents," LiteLLM's Oliver Jensen and Mateo Wang said."
  https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html
  https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain
  https://www.securityweek.com/litellm-compromised-in-fresh-supply-chain-attack/
• Markdown Is The New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From The Web
  "This did not start in a lab. Forever caught live malware on a real customer’s machine, attempting a new kind of attack the industry had not documented - and stopped it cold, before any code ran. Forever Security found a malicious AGENTS.md file in the ~/Downloads folder of a real customer machine - plain text, disguised as ordinary engineering notes. This is not ordinary malware. An AGENTS.md is a file a coding agent is built to trust and obey, and ~/Downloads is the one folder a website can drop a file into with no click and no permission. Together, that lets the web plant orders your own agent carries out. Markdown is the new executable."
  https://forever.security/blog/hijacking-ai-agents-via-downloads-folder
  https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/
• PHP2Shell Exploitation Hits Government Entity Amid Global Scanning And Signs Of AI-Assisted Hacking
  "Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. "In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor authentication secrets," Palo Alto Networks Unit 42 said. "They also established an NT LAN Manager (NTLM)-relay tunnel into Active Directory and attempted Domain Admin privilege escalation.""
  https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html

Breaches/Hacks/Leaks

• Quest Diagnostics Confirms Data Breach Exposed Patient Records
  "American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. The company learned about the breach on October 21 and deployed its incident response protocol "to contain the activity, assess and investigate the nature and scope of the incident and implement appropriate remedial measures." “On October 21, 2026, Quest Diagnostics Incorporated learned of unauthorized access to its Quanum LSM system, which certain clients use to place test orders, receive and look up results,” the company says in a filing with the U.S. Securities and Exchange Commission (SEC)."
  https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/
  https://therecord.media/quest-diagnostics-network-intrusion
  https://www.securityweek.com/quest-diagnostics-reports-cyber-breach-affecting-certain-patient-records/

General News

• Trust Is Not What It Seems — And Fraudsters Are Counting On It
  "After a disruptive cyberattack hits, customer trust can take a while to rebuild. But now, threat actors are impersonating trusted brand names and existing customer accounts to abuse customer relations. "Trust has become easier to exploit and harder to establish," warned a new TransUnion report. Threat actors use social engineering, deepfake technology, text spoofing, compromised credentials, and artificial intelligence (AI) to become whoever they need to be, whether that's a new or existing customer, or the organization itself."
  https://www.darkreading.com/cyber-risk/trust-is-not-what-it-seems-and-fraudsters-are-counting-on-it
• AI Tools Are Generating Massive Attacks For Little Cost
  "Over five days in September, a Chinese-speaking attacker used three different AI harnesses and both open-weight and public AI models to target 105 different e-commerce sites. Often within a day, and at most within hours, the autonomous hacking system compromised at least 27 different companies. Malicious agents stole at least 600,000 payment card records from two, installed credit-card skimmers on the websites of five, and gained some degree of illicit access to the rest, which includes at least one Fortune 500 company, according to Gambit Security, which discovered the campaign."
  https://www.darkreading.com/cybersecurity-operations/ai-tools-massive-attacks-little-cost
• Why Caribbean Threats Cascade Into Global Cyber-Risk
  "On July 24, 2025, Curaçao's Tax and Customs Administration found ransomware on its network. Counter services, the call center, and internal processes went dark for more than a week, and the island's recovery depended on specialists flown in from the Netherlands. A day earlier, the Joint Court of Justice had gone down as well. Because that court serves Curaçao, Aruba, Sint Maarten, Bonaire, Saba, and Sint Eustatius, a single intrusion degraded the judicial system of six jurisdictions at once."
  https://www.darkreading.com/cyber-risk/why-caribbean-threats-cascade-global-cyber-risk
• Cyber Insurance's New Reality: Underwriting Isn't Enough
  "The relentless evolution of the threat landscape has pushed cyber insurance companies to follow suit with a continuous expansion of cybersecurity posture requirements as well as taking an active hand in the defense process. While cyber insurance has existed for years, the ransomware boom of the late 2010s and early 2020s transformed it from a niche risk transfer product into a central component of many organizations' security strategies. Today, policies cover everything from incident response and business interruption to legal costs and, in some cases, ransomware payments. Some of the names you'll see pop up around this space include Coalition, Chubb, AXA XL, Cowbell, and Resilience."
  https://www.darkreading.com/cyber-risk/cyber-insurances-underwriting-isnt-enough
• Drone Program Compliance: What a CTO Says Most Agencies Get Wrong
  "In this interview with Help Net Security, Nick Donarski, CTO at RotorLab, explains what councils, records clerks, insurers, and auditors expect from a public safety drone program, and where most programs fall short. He covers chain of custody for flight logs and video, how to publish drone activity without exposing sensitive operations, and common mistakes in open records handling. Drawing on his cybersecurity background, he points to risks in ground control software and spreadsheet logs. Donarski also offers practical advice for small agencies starting with little budget and looks at an FAA penalty case."
  https://www.helpnetsecurity.com/2026/10/23/nick-donarski-rotorlab-drone-program-compliance/
• 7 Out Of 10 Individuals Hit By Data Breaches Via Third Party, Kroll Finds
  "Kroll, the leading independent provider of financial and risk advisory solutions, today revealed that two-thirds of organizations surveyed (69%) suffered a data breach in the past year. More than a third (34%) were breached more than once, according to its 2026 annual Data Breach Outlook. Further analysis showed that financial services accounted for the largest share of organizations breached in Kroll's cases, at 20%, but a single breach at a technology provider can expose data belonging to customers of hundreds of businesses that use its services."
  https://www.prnewswire.com/news-releases/7-out-of-10-individuals-hit-by-data-breaches-via-third-party-kroll-finds-302916295.html
  https://www.infosecurity-magazine.com/news/tech-third-party-breach-victims/
• Red-Teaming OpenAI's Internal Agent Monitoring Systems
  "For three weeks, from July 21st to August 11th, a METR employee and a Redwood Research employee conducted a pilot high-access exercise to stress-test OpenAI’s internal misalignment monitoring system.1 The output of this exercise was a 61-page internal report that was shared with OpenAI researchers and security staff,2 primarily focused on estimating the fraction of agentic inference that is monitored, and whether agents could in principle disable or subvert the monitoring system. The exercise focused on the internal misalignment monitoring system as it existed on and before July 21st, and did not evaluate changes that were in progress at the time of the exercise."
  https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/
  https://www.theregister.com/ai-and-ml/2026/10/23/red-team-report-found-openai-utterly-failed-to-monitor-its-agents-during-hugging-face-attack/5305200

อ้างอิง
Electronic Transactions Development Agency (ETDA)

Healthcare Sector

• InterSystems Corporation InterSystems IRIS For Health
  "Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device."
  https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01

Industrial Sector

• Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
  "Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11
• Siemens SIMATIC S7-1500 TM MFP
  "Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16
• Siemens RUGGEDCOM CROSSBOW Station Access Controller
  "RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-15
• Siemens SIMATIC S7 PLCs Web Server
  "SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-14
• Kiloview E3 NDI Encoder
  "Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
• Siemens Industrial Edge Devices
  "Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17
• Siemens WinCC
  "Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-13
• Siemens RUGGEDCOM CROSSBOW
  "RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations or causing a denial of service. Siemens has released a new version for RUGGEDCOM CROSSBOW and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-12
• Siemens Industrial Edge Device Kit
  "Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09
• Siemens RUGGEDCOM APE1808 Devices
  "Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-18
• Siemens SIMATIC S7 Webserver API
  ".NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .NET Client Library for SIMATIC S7 Webserver API and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10
• Siemens APOGEE, TALON And Desigo PXC/PXM Products
  "The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08
• Siemens SIMATIC IPCs
  "The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled. Siemens has released new versions for the affected products and recommends to update to the latest versions."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-07
• Siemens PSS(R)SINCAL
  "PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type. Siemens is actively preparing updates and recommends applicable mitigations for products where patches are currently unavailable."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06
• Siemens SENTRON 3NA COM Fuse
  "SENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a denial-of-service (DoS) condition. Successful exploitation may require the affected network to be re-established to restore normal operation."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-05
• Siemens Capital Embedded AR Classic
  "The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-04
• Siemens Software Center
  "The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Siemens has released a new version for Siemens Software Center and recommends to update to the latest version. Please refer to our blog post for additional information about current known active exploitation and how to detect it."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03
• Siemens Industrial Edge App Publisher
  "The Industrial Edge App Publisher contains a vulnerability chain involving improper certificate validation and the rendering of unescaped data from backend responses. These issues can be combined to allow an attacker on the network to impersonate the management server and execute arbitrary code (RCE) on the local machine through Node.js integration. Siemens has released an update for the Industrial Edge App Publisher and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02

New Tooling

• New PHP2Shell Scanner Checks Your Hosts For CVE-2026-109618 And CVE-2026-109619
  "Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on October 21. PHP2Shell lets an attacker reach pre-auth RCE against PHP applications running on Apache mod_php or PHP-FPM under default configurations, with confirmed exploitation on widely deployed software including WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud, and Magento. If you run PHP behind a web server, you need to know which of your hosts are still vulnerable, and Searchlight’s researchers argue that most scanners already circulating cannot tell you reliably."
  https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/
  https://github.com/assetnote/php2shell-scanner

Vulnerabilities

• Arista Patches New VeloCloud Orchestrator Zero-Day Exploited In Attacks
  "Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. VCO is a web-based management portal that helps administrators configure, monitor, and manage VeloCloud SD-WANs (Software-Defined Wide Area Networks) and associated edge devices. Tracked as CVE-2026-114625, this critical-severity flaw can allow attackers with basic privileges, access to the VCO web interface, and a valid authenticated session to escalate privileges through low-complexity SQL injection attacks that don't require user interaction."
  https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/
  https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
  https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html
• Cisco Patches 34 Vulnerabilities Across Multiple Products
  "Cisco on Wednesday announced patches for 34 vulnerabilities across Expressway Series, IOS XR, Snort 3, and Unified Communications products. Expressway Series received fixes for 10 vulnerabilities, including a critical-severity remote code execution (RCE) bug tracked as CVE-2026-76466. According to Cisco, the use of persistent cookies and insufficient validation of client certificates in certain configurations could allow attackers to connect to the database service and invoke specific remote procedure call (RPC) commands to exploit the bug."
  https://www.securityweek.com/cisco-patches-34-vulnerabilities-across-multiple-products/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand