NCSA_THAICERT

NCSA_THAICERT

ช่องโหว่ Microsoft Authenticator บน Android เสี่ยงถูกแอปอันตรา.png

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

NCSA_THAICERT

ตำรวจเกาหลีใต้จับกุมอดีต Pentester ใช้ ARTEX AI โจมตี.png

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

NCSA_THAICERT

พบ Worm บน npm ซ่อน Payload ขนาดใหญ่เพื่อหลบเลี่ยงการ.png

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

NCSA_THAICERT

Industrial Sector

EPICS Base
"Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01
https://www.theregister.com/security/2026/10/27/ai-hacker-finds-4-severe-bugs-in-popular-industrial-control-software-in-under-4-hours/5305811
Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 And BizViz
"Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in information disclosure, tampering with, destruction, or deletion of information, and a denial-of-service (DoS) condition of the system."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-02

Vulnerabilities

HPE Patches Dozens Of Critical Flaws In Networking Products
"HPE last week released patches for 72 vulnerabilities in the AOS-8 and AOS-10 wireless operating systems of its Aruba networking products, including 33 critical-severity flaws. The security updates address eight max-severity bugs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851. Successful exploitation of these security defects could allow unauthenticated attackers to achieve remote code execution (RCE), bypass authentication to gain administrative privileges, run arbitrary commands, and completely compromise the affected systems."
https://www.securityweek.com/hpe-patches-dozens-of-critical-flaws-in-networking-products/
Apple Backports CoreGraphics Zero-Day Patches To Older iPhones
"Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. Apple patched the same vulnerability in September for devices running iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. Meta Product Security discovered this out-of-bounds write weakness (tracked as CVE-2026-86950) in CoreGraphics, a framework used for two-dimensional vector graphics, text drawing, and image rendering across iOS, macOS, iPadOS, watchOS, and tvOS."
https://www.bleepingcomputer.com/news/apple/apple-backports-coregraphics-zero-day-patches-to-older-iphones/
https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html
https://www.securityweek.com/ios-macos-27-2-patch-286-bugs-fix-for-exploited-flaw-backported-to-ios-18/
AuthMask: We Made Microsoft Authenticator Hand Over Tokens To An App With Zero Permissions
"A single exported activity handed out tokens for the victim's work account. We found that an unprivileged Android app with zero permissions could impersonate any installed Microsoft first-party app and have the Microsoft Authenticator broker hand it that app's tokens. The setup is a device with Authenticator installed and one work account signed into it. The caller's identity was never used for any trust decision, so a single exported activity handed out tokens for the work account."
https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens
https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html
https://www.helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097/
CISA Adds Two Known Exploited Vulnerabilities To Catalog
"CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability"
https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
Microsoft Releases Windows OOB Updates To Distrust eMudhra Certificates
"Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. The KB5134133 update for Windows 11 versions 24H2, 25H2, and 26H2 and the KB5134125 update for Windows 10 versions 21H2 and 22H2 were released on October 26. The updates are for systems without Internet access, devices that cannot access Microsoft's certificate-update service, and those where automatic Certificate Trust List (CTL) updates have been disabled."
https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-oob-updates-to-distrust-emudhra-certificates/
https://www.theregister.com/security/2026/10/27/microsoft-releases-out-of-band-windows-fixes-with-certificate-updates/5305637
Stealing OpenAI Reasoning Traces Via Compaction Smuggling
"In August 2026, Xint researchers discovered a bug in the OpenAI API that leaks raw reasoning traces from frontier OpenAI models. Dubbed compaction smuggling, the attack bypasses the mitigations OpenAI deployed in response to the Stolen Thoughts paper published earlier this year. OpenAI confirmed the issue and deployed an undisclosed fix on October 23, 2026. The Xint team was rewarded with a $6,000 bounty."
https://xint.io/blog/compaction-smuggling-reasoning-traces
https://thehackernews.com/2026/10/openai-compaction-flaw-let-researchers.html
https://www.infosecurity-magazine.com/news/openai-compaction-flaw-ai/
Samsung TVs Without Mics May Listen Through Soundbars, Researcher Says
"A reverse engineer claims that their Samsung smart TV has been collecting audio without their consent. The researcher, who calls themselves “log4j,” said in an X thread that their 2025 Samsung TV was delivering ads that seemed suspiciously relevant to them. Investigating, they claim to have found a package called “always on voice,” which uses the TV’s built-in microphone to collect sounds from the room. The software logged events such as dogs barking and babies crying, log4j said, adding that these events are counted and reported back to Samsung."
https://www.malwarebytes.com/blog/privacy/2026/10/samsung-tvs-without-mics-may-listen-through-soundbars-researcher-says
An Insecure Neighbor: How a Vulnerability Chain Led To An Isolation Bypass In Cloud Infrastructure
"This article is published for educational purposes only, to raise awareness among information security professionals. The research was part of an official bug bounty program on a major platform. We notified the cloud provider about the vulnerabilities in line with our responsible disclosure policy, and all security issues we found were fixed in full. The infrastructure analyzed in this post has been anonymized, so the organization cannot be identified. We believe that regular pentests, bug bounty programs, and conversations between developers and independent researchers are the foundation of security for any IT product."
https://securelist.com/cloud-infrastructure-isolation-bypass/121609/
Choose Your Backend: Three TLS Bugs In GoAhead
"GoAhead is used in hundreds of millions of IoT, Firewall, OT, and Military devices including those from Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing, and more. Three independent bugs in GoAhead's TLS integrations can leave revoked client certificates accepted, encrypted sessions recoverable to an observer or a configured chain-depth limit unenforced."
https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead
https://thehackernews.com/2026/10/goahead-tls-flaws-allow-revoked-client.html

Malware

Notorious Brazilian Magecart Group Hijacks Convertr Checkouts Via Plausible Analytics
"A notorious Brazilian Magecart group, active since 2024, planted a card skimmer in the analytics script of ecommerce platform Convertr. From 24 October, Convertr checkouts sent the card details and CPF numbers of shoppers to 1x0.is. Convertr runs the online stores and checkout of dozens of Brazilian fashion brands. Convertr says its merchants have sold more than R$2 billion (about €320 million) through the platform. All of them load a tracker from analytics.convertr.app.br, Convertr's own Plausible analytics server. The attacker appended a skimmer to that one file. Every Convertr checkout loaded it."
https://sansec.io/research/convertr-plausible-supply-chain-attack
https://www.bleepingcomputer.com/news/security/hackers-hijack-convertr-analytics-script-to-steal-payment-card-data/
Yoba Malware Abuses Signed ChatGPT And Claude Binaries To Target AI Users
"As interest in new AI tools accelerates, cybercriminals are finding ways to exploit the trust surrounding them. Check Point Research (CPR) has uncovered Yoba, a malware campaign using fake GitHub projects impersonating supposed ChatGPT and Claude desktop applications, while abusing legitimate, signed OpenAI and Anthropic executables to help load malware. The campaign shows how the rush to access new AI tools is creating opportunities for social engineering, even when the AI platforms themselves have not been compromised."
https://blog.checkpoint.com/research/yoba-malware-abuses-signed-chatgpt-and-claude-binaries-to-target-ai-users/
Locked And Loaded: Phishing Through Fake Bids And Protected Documents
"In the sales process, few emails carry as much weight as an invitation to bid. It opens the conversation that can eventually lead to revenue, and professionals are conditioned to treat it with urgency and care. Threat actors understand this, and they have learned to pair that urgency with a simple tactic: the password-protected document. Password protection lends the file an air of legitimacy, mimicking a practice companies use every day, while providing threat actors with a critical advantage - most email security tools cannot inspect the contents of an encrypted file. In this walkthrough, we break down how an important sales invitation and a "secured" document combine to set up a tricky and deceptive credential phishing campaign."
https://cofense.com/blog/locked-and-loaded-phishing-through-fake-bids-and-protected-documents
Not Only ARTEX: The Different Levels AI Is Used In Attacks Targeting Japan
"In autumn 2026, companies and other organizations in Japan reported a succession of data leaks from their web systems. The Japanese government’s National Cybersecurity Office issued an alert to businesses on October 9, and the chair of the ruling party’s cybersecurity headquarters described cyberspace as being in a “state of emergency.” These incidents prompted growing concern about the use of AI in attacks. Our own investigations have confirmed AI use in operations targeting Japanese organizations, but its role varies considerably."
https://www.trendaisecurity.com/en-us/resources-insights/deep-research/not-only-artex-the-different-levels-ai-is-used-in-attacks-targeting-japan
https://thehackernews.com/2026/10/cyberstrikeai-uses-44-ai-agents-to.html
Australia Gets Into Amadey Malware Backend, Cuts Off Access To 180,000 Infected Computers
"A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. "The next steps that we took were to disconnect that Amadey controller from all those victims," Tauri Gregory, ASD's acting deputy director-general of intelligence, told ABC News in an interview published on October 27."
https://thehackernews.com/2026/10/australia-gets-into-amadey-malware.html
Malicious Apps Prey On Russians’ Anxiety About Fuel Prices, Drone Strikes
"Cybercriminals are exploiting fuel shortages and fears of drone attacks in Russia to trick users into downloading malicious Android apps designed to steal personal and financial information, according to a new report. The latest campaign targets Russian drivers with an app that claims to show the locations of traffic police patrols, speed cameras and gas stations with fuel in stock. Instead, it delivers ZloyRAT, an Android trojan capable of collecting sensitive information and accessing functions on infected phones, according to researchers at Russian cybersecurity firm F6."
https://therecord.media/malicious-apps-russian-anxiety-gas-prices-drone-strikes
Oncerning Behavior From a Popular Open-Weight AI Model
"Inside a closed testing sandbox managed by Cohere, one of Alibaba's newest Qwen3.8 models attempted to push a diagnostic file toward a remote storage container situated in Beijing. Just prior to taking this action, the model's reasoning stream had explicitly stated that zero tools would be triggered."
https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model
https://securityaffairs.com/201810/ai/cohere-finds-qwen-ai-model-contacting-a-server-in-china.html
RATatouille: Today’s Special: Impersonating Companies In Korea, Payments In Cryptocurrency
"While tracking infrastructure related to ValleyRAT, numerous suspicious websites were identified that impersonated companies and brands from Korea such as Doosan Robotics and Cheonjeong. The identified sites used the actual companies’ logos, promotional videos, and descriptions to disguise themselves as official websites. The websites offered features such as invitation-code-based registration, login, fee history inquiries, VIP membership benefits, and cryptocurrency deposit and withdrawal functions."
https://asec.ahnlab.com/en/96151/
Invoice Fraud Campaign Adds Prompt Injection Aimed At Email AI Agents
"As more workers use AI agents to read incoming email and take actions from it, attackers are trying out new variations of familiar fraud campaigns that target both the human and the AI assistant reading the email. If either the AI agent or the human are tricked into following instructions from the attacker, that can increase the odds that the fraud attempt will succeed. Sublime Security has found a new version of this in the wild, where anattacker is including a new prompt injection technique in their long-standing invoice fraud campaign."
https://sublime.security/blog/invoice-fraud-campaign-adds-prompt-injection-aimed-at-email-ai-agents/
Analysis Of Multi-Stage Attack Infrastructure Targeting Defense, Security, And Government Organizations In The United States And Asia
"Oasis Security analyzed files collected from an attacker server used in multiple attacks, including reconnaissance, vulnerability exploitation, SSRF, session exfiltration, and credential brute-forcing, against infrastructure associated with [Victim A], a U.S. government-funded research institute. A total of 1,665 documents related to applicants to [Victim B], an Indo-Pacific security research institute, were also identified on the server. The files also showed attacks against Malaysian government institutions and public services."
https://oasis-security.io/blog/Analysis-of-Multi-Stage-Attacks-on-Defense-Security-and-Government-Organizations-in-the-US-and-Asia
AI, Scripts, Operator - Inside The ConnectWise Attack
"On October 16, Huntress first reported the abuse of a ConnectWise Cloud Backup credential to access Microsoft 365 tenants, and since then we have been continuing to investigate threat actor behavior related to this incident. Now, we're pulling on a different thread: who, or what, was doing the typing during the unauthorized activity we observed. Microsoft has published its own findings, attributing the activity to a threat actor it tracks as Storm-0940, which it says used ARTEX, an open-source multi-agent AI framework, to abuse the compromised ConnectWise application credentials and sign in to downstream Microsoft 365 tenants at machine speed. Our telemetry aligns with Microsoft's findings, but does not independently confirm them."
https://www.huntress.com/blog/connectwise-attack-ai
Unveiling Sirius Backdoor: A Multistage Fileless Campaign Disguised As FedEx Invoices
"During a recent priority customer escalation, our “Trellix” Threat Response Team investigated a suspicious alert involving the unexpected execution of a PDF document. What initially appeared to be a routine phishing attempt quickly unfolded into a sophisticated, multistage campaign delivering a previously undocumented variant of the Sirius Backdoor. While the initial delivery via an email containing a ZIP archive with a PDF appeared routine, the execution flow stood out due to its heavy use of living-off-the-land (LotL) techniques."
https://www.trellix.com/blogs/research/sirius-backdoor-fileless-campaign-fedex-invoices/
The Pwn Request Reckoning: What Still Works Against GitHub Actions
"For years, pull_request_target has been the canonical Pwn request vector: a workflow trigger that runs with repository secrets, yet can be triggered by anyone who opens a pull request from a fork. In 2026, GitHub responded with platform changes that make the default-case exploit significantly harder. These changes represent real progress. Checkout protections, read-only cache tokens, and event policies close the paths that made exploitation trivial. But they don't eliminate the vulnerability class. They shift it. Attackers who previously exploited any pull_request_target workflow now need to find explicit opt-ins, outdated checkout versions, unprotected triggers, or script injection."
https://www.wiz.io/blog/github-actions-security-pwn-request-reckoning

Breaches/Hacks/Leaks

Japan's GMO Urges Customers To Shut Down PCs Amid Ransomware Threat
"The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company’s Onamae Desktop Cloud threatened to launch a ransomware attack today. The company later confirmed that data belonging to both the company and its customers had been published online. The alert concerns a cyberattack on Onamae Desktop Cloud, a popular VPS provider in Japan operated by GMO Internet, a member of GMO Internet Group and one of Japan's largest domain registrars."
https://www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/
https://www.theregister.com/security/2026/10/27/japanese-virtual-desktop-cloud-hacked-so-hard-it-asks-to-be-banned/5305610
UNM Health Ransomware Attack Disrupts Patient Care, Surgeries
"The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. On Monday, UNM Health, the university’s healthcare provider, began temporarily limiting new patient admissions, diverting ambulances to nearby hospitals, and suspending outpatient surgeries and appointments. In an update on the incident, UNM said UNM Hospital and Sandoval Regional Medical Center remain open, and all clinics will resume scheduled appointments and procedures starting today, Tuesday, October 27."
https://www.bleepingcomputer.com/news/security/unm-health-ransomware-attack-disrupts-patient-care-surgeries/
https://therecord.media/university-of-new-mexico-hospital-diverts-cyber-incident
https://www.bankinfosecurity.com/cyberattack-disrupts-new-mexicos-only-trauma-center-a-33220
https://www.infosecurity-magazine.com/news/cyber-unmhealth-surgeries/
https://www.securityweek.com/cybersecurity-issue-forces-a-major-new-mexico-hospital-to-divert-patients-and-close-clinics/
https://www.theregister.com/cyber-crime/2026/10/27/day-2-of-canceled-classes-at-university-of-new-mexico-after-health-sciences-center-cyberattack/5305690
https://www.helpnetsecurity.com/2026/10/27/university-of-new-mexico-hospitals-cyberattack/
Warp Discloses Breach Exposing AI Agent Logs, User Telemetry Data
"Agent decision logs and telemetry data belonging to Warp agentic development environment users were exposed in an attack on a third-party vendor in the project’s infrastructure. The company’s founder and CEO, Zach Lloyd, estimates that "roughly 1% of Warp users may have been impacted," but external experts are helping with the ongoing investigation. Warp is a popular developer tool that started as a modern terminal and evolved into an agentic development environment (ADE) that allows developers to direct AI agents to write and test code and deploy software."
https://www.bleepingcomputer.com/news/security/warp-discloses-breach-exposing-ai-agent-logs-user-telemetry-data/
Energy Giant ENGIE Discloses Data Breach Affecting Customers
"French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners. ENGIE operates in renewable energy, infrastructure, and customer energy supply in 30 countries, employs over 90,000 people, and reported €71.9 billion in revenue last year. An ENGIE spokesperson told BleepingComputer that it cut off the attackers' access to the compromised platform and that they didn't breach the company's internal systems."
https://www.bleepingcomputer.com/news/security/energy-giant-engie-discloses-data-breach-affecting-customers/
Vendor Key Leak Puts Data Of 238,000 Denver Health Plan Members At Risk
"Denver Health Medical Plan (DHMP) is notifying 238,000 people that their personal and health information may have been compromised in a data breach. Based in Denver, Colorado, DHMP is a non-profit managed care organization within the Denver Health and Hospital Authority system. Through its Denver Health Medicaid Choice plan, it administers Health First Colorado (Medicaid) benefits for members in Denver and three surrounding counties. The data breach, DHMP says, involved third-party vendor SquareML, which provides a no-code platform for healthcare analytics."
https://www.securityweek.com/vendor-key-leak-puts-data-of-238000-denver-health-plan-members-at-risk/
Italy ’s Parliament Under Cyber Pressure: Why The Attack On The Chamber Matters
"The cyberattack targeting email accounts at Italy’s Chamber of Deputies, including a parliamentary account assigned to Prime Minister Giorgia Meloni, raises questions that go well beyond the security of individual inboxes. At a time when European institutions face growing cyber pressure, the incident highlights how access to political communications can become part of a broader hybrid warfare strategy."
https://securityaffairs.com/201867/hacking/italys-parliament-under-cyber-pressure-why-the-attack-on-the-chamber-matters.html

General News

The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest
"Cyber headlines often focus on the flashy attacks, but the ones that actually cause OH $#!T moments are the tactics that abuse the tools and workflows you already trust. If you run a small or mid-sized organization, whether you handle IT yourself or outsource it, it’s a constant race to keep up with attackers and their evolving tactics. The bottom line is that you need to know which attacks are landing in environments like yours, and how to prioritize your defenses against them."
https://www.bleepingcomputer.com/news/security/the-huntress-tragic-quadrant-ranking-threats-hitting-businesses-hardest/
Ukrainian National Sentenced For Role In Hacking Hospitals, Businesses, And Governments As Part Of Ransomware Conspiracies Causing Over $100 Million In Losses
"Artem Stryzhak, 36, a Ukrainian national, was sentenced today to 70 months in prison for conspiracy to commit computer fraud in connection with a series of ransomware attacks that targeted hospitals, government entities, law firms, and other businesses around the world. “This sentence concludes a years-long, multi-continent investigation into a defendant who participated in cyber-attacks against Americans’ businesses and health care,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “Cybercriminals who terrorize American businesses cannot evade justice by operating from abroad or hiding behind sophisticated technology. Artem Stryzhak’s sentence underscores the Justice Department’s resolve to dismantle ransomware groups, hold them accountable, and protect American businesses and people from cyber extortion.”"
https://www.justice.gov/opa/pr/ukrainian-national-sentenced-role-hacking-hospitals-businesses-and-governments-part
https://therecord.media/nefilim-hive-ransomware-operator-70-months-prison
https://cyberscoop.com/nefilim-hive-ransomware-affiliate-artem-stryzhak-sentenced/
3 Frameworks To Protect CISOs & Orgs Against AI Liability
"Many chief information security officers (CISOs) currently find themselves in the deep weeds of AI governance. But the question they might not be asking is how do you defend decisions around AI deployments when litigators, regulators, and customers come looking for someone to assume liability for a compromise? Cyber legal expert Daniel B. Garrie, CEO of Law and Forensics, is striving to answer that question with distinct frameworks that both help CISOs determine whether a specific AI feature is sufficiently safe to run, as well as generate an evidentiary trail of paperwork that can be used to defend their actions, should something go horribly awry down the road."
https://www.darkreading.com/cyber-risk/3-frameworks-cisos-ai-liability
Beware The Slasher: AI Could Kill Off Cybersecurity Pros' Skills
"The use of AI as a tool to enhance cybersecurity operations is emerging as a double-edged knife for security professionals. While it can make them more capable, it could also spell the demise of the very skills they need to use it effectively. That's the concern of Nathan Hamiel, senior director of research at Kudelski Security, who has made a case for how evolving technology can erode technical skills since well before the generative AI boom. Now, that concern is getting much louder."
https://www.darkreading.com/cybersecurity-operations/ai-kill-off-cybersecurity-pros-skills
Several AI Security Market Categories Are Headed For Bigger Platforms
"In this interview with Help Net Security, Jonathan Care, Lead Analyst and Practice Lead AI at KuppingerCole Analysts, compares AI security startups to the early fraud market he helped define at Gartner. He explains which categories will survive as products and which will become features inside bigger platforms. Care talks about Q3 funding going to fewer, larger rounds, Israel’s share of cyber venture investment, and the five controls an organization needs before an agent touches production. He names three categories he would bet on for 2028 and three he would bet against."
https://www.helpnetsecurity.com/2026/10/27/jonathan-care-kuppingercole-analysts-ai-security-market/
Top 7 Email Security Threats Facing Businesses In 2026
"Email security threats are attacks that use email to steal credentials, compromise accounts, deliver malware, or expose sensitive data. Roughly 80% of data breaches begin right in an employee’s inbox because email is cheap, fast, and can bypass firewalls by targeting human psychology instead of system vulnerabilities. Email security issues have evolved far beyond simple spam. We’re now fighting AI-generated phishing, targeted credential theft, and ransomware delivery systems that traditional filters can’t catch. And the problem is only growing: The FBI’s 2025 Internet Crime Report ranked phishing and spoofing among the most commonly reported cybercrimes, with more than 1 million complaints and nearly $21 billion in reported losses overall."
https://blog.barracuda.com/2026/10/26/email-security-threats
US Indicts Malaysian National After Madagascar Scam Operation Uncovered
"The Justice Department said it disrupted a Madagascar-based scam operation that allegedly stole hundreds of thousands from Americans through fictitious NFT investment schemes. On Tuesday, prosecutors announced indictments of Malaysian national Chui Kok Wa and five others for their role in stealing more than $516,695 from 74 cryptocurrency wallets associated with victims in Maryland, Oregon, Nevada, Minnesota and other states. The indictment said Wa worked with accomplices in China in coordinating and funding the scheme, which allegedly moved to Madagascar last year after law enforcement takedowns in Cambodia."
https://therecord.media/malaysian-national-indicted-after-scam-centers-raid-madagascar
Annual Cyber Threat Report 2025-26
"I am pleased to present the Annual Cyber Threat Report for 2025-26. The world continues to face the most complex and challenging strategic circumstances since the Second World War. The rules-based international order, which has underpinned Australia’s security and prosperity for decades, is in transition. Nations are increasingly contesting for influence, technological advantage and economic security. Cyber operations have become a central feature of this competition, offering adversaries a means to advance their objectives below the threshold of conventional conflict."
https://www.cyber.gov.au/publication/annual-cyber-threat-report-2025-26
https://www.abc.net.au/news/2026-10-27/australian-signals-directorate-ai-cybersecurity-hacking-threats/107309858
https://therecord.media/australia-spies-share-intel-and-want-victims-to-share-back
https://securityaffairs.com/201859/ai/australias-cyber-spy-chief-expect-more-disruption-as-ai-accelerates-hacking.html
This Is Fine: What NetScaler Zero-Days Tell Us About The New Normal
"If you’ve been paying attention to enterprise edge security lately, the September 2026 Citrix NetScaler zero-day advisories probably gave you a familiar case of heartburn. But before everyone panics, let’s step back and look at the bigger picture: what we are seeing right now isn’t a collapse of edge defense. It is, in fact, exactly how modern active defense is supposed to work when high-value, internet-facing infrastructure comes under heavy fire. First, a quick refresher on why Citrix NetScaler ADC (Application Delivery Controller) and Gateway sit directly in the crosshairs of global threat actors. NetScaler is an everything-at-the-edge solution. It acts as a reverse proxy, load balancer, Web Application Firewall (WAF), traditional firewall, and SSL VPN all rolled into one appliance."
https://www.securityweek.com/this-is-fine-what-netscaler-zero-days-tell-us-about-the-new-normal/
What Happens When Security Tools Go Dark Before The Ransomware
"On Oct. 1, threat researchers reported that the China-linked group behind Warlock ransomware, which Microsoft tracks as Storm-2603, had attacked at least four organizations in the prior two months. A water utility and a telecommunications provider were among them, along with a regional government body and a university. This all occurred in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America. The likely way in was on-premises Microsoft SharePoint. The researchers believe the group still carries the ToolShell flaws it exploited in July 2025, the same month Microsoft shipped the fixes, alongside newer SharePoint flaws. An exploit for a bug patched more than a year ago is still worth packing. Somewhere, a server is still waiting for its fix."
https://cyberscoop.com/warlock-ransomware-storm-2603-sharepoint-attacks-op-ed/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

NCSA_THAICERT

เมื่อวันที่ 27 ตุลาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 2 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability