สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• Hitachi Energy RTU500 Product
  "Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-05
• HMS Networks PEAK-System PCAN Windows Drivers
  "Successful exploitation of these vulnerabilities could crash the Windows kernel."
• **https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01
• Moxa AIG-302 ThingsPro Edge**
  "Successful exploitation of these vulnerabilities could allow an attacker to obtain and disclose sensitive information."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-03
• Hitachi Energy MicroSCADA X SYS600 Product
  "Hitachi Energy is aware of multiple vulnerabilities that affect MicroSCADA X SYS600 product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-04

Vulnerabilities

• Open And Shut: Remote Code Execution In Opencode Via MCP OAuth
  "What is opencode: opencode is a popular open-source AI coding agent with approximately 3 million weekly npm downloads and 211,000 GitHub stars. Like other coding agents, it can access local files, execute commands and interact with external systems, typically operating with the developer's privileges. What we found: Pillar Security discovered a critical remote code execution (RCE) flaw in opencode affecting Windows and Windows Subsystem for Linux (WSL). The flaw allows an attacker-controlled remote Model Context Protocol (MCP) server to execute arbitrary code on a developer's machine during a remote MCP OAuth authentication process, without additional user interaction or consent."
  https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth
  https://www.infosecurity-magazine.com/news/opencode-quietly-patched-critical/
• PHP Warns Admins Of Two Critical Flaws, Emergency Patches Coming Tomorrow
  "The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. PHP powers many websites and web applications, including content management systems, e-commerce platforms, and custom web services. In an advisory published Tuesday, the PHP development team announced that it plans to release security updates on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern), to address two vulnerabilities, each rated 9.2 under CVSS v4.0."
  https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/
• Critical FortiSIEM Flaw Gets Public Exploit PoC For Unauthenticated Remote Code Execution
  "Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets."
  https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html
• CISA Adds Six Known Exploited Vulnerabilities To Catalog
  "CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
  CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
  CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
  CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability
  CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
  CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog

Malware

• #StopRansomware: SafePay Ransomware
  "This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics."
  https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a
  https://therecord.media/fbi-says-safepay-ransomware-gang-among-most-active-600-victims
• OVHcloud CLI Releases Backdoored On GitHub To Steal Developer Secrets
  "French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. The attacker hijacked a developer’s GitHub account to gain access to the OVHcloud CLI repository and modify versions 0.11.0 through 0.15.0 of the tool. OVHcloud offers the CLI tool as an alternative for system administrators and developers to manage cloud and hosting services directly from a terminal, including for automating tasks."
  https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/
  https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html
• [AnyDesk TAG] AnyDesk And ScreenConnect In a Campaign Targeting Banking Customers
  "Last week at VulnCheck's ThreatCon1 conference we briefly touched on a campaign we have been tracking since early spring. It was one of several examples in a talk about looking outward for adversary infrastructure rather than waiting for an attack to arrive. This one is not an Adversary-in-the-Middle campaign. It is a phone-led fraud operation targeting banking customers, and it has been running since at least March 2026. The operator uses convincing copies of bank support pages, genuine remote-access software and custom signed payloads to gain remote access to victims' computers."
  https://www.aitmfeed.com/blog/blog-1/anydesk-tag-anydesk-and-screenconnect-in-a-campaign-targeting-banking-customers-22
  https://www.bankinfosecurity.com/fraudsters-clone-bank-support-pages-urge-victims-to-call-a-33149
• The Risk Of AI-Powered Antidetect Browsers In Online Fraud And Influence Operations
  "Online platforms rely on digital signals to identify suspicious accounts and activity. Antidetect browsers make those signals harder to trust by allowing operators to create and manage large numbers of browser profiles that appear to belong to different users, devices and locations. While these tools have legitimate uses, Check Point Research found documented evidence of their use in criminal ecosystems for activities including account takeover and payment fraud. AI and automation can further increase the scale of these operations."
  https://blog.checkpoint.com/security/antidetect-browsers-how-ai-is-scaling-online-fraud-and-account-takeovers/
• Doppelgänger Russian Influence Campaign In Israel
  "Doppelgänger (German for “double”) describes the campaign’s hallmark: fake copies of well-known news sites, with a design, logo and layout meant to make readers think they are reading an article from a legitimate media outlet. In recent weeks, ClearSky identified renewed activity by the Russian influence campaign in Israel. The campaign, known as “The Double” – Doppelgänger, spreads false and misleading messages built on parts of real publications, while impersonating well-known media outlets. The messages are spread on social networks, mainly on X, through a network of fake accounts."
  https://www.clearskysec.com/doppelganger-russian-influence-campaign-in-israel/
• Beyond Passwords: How Attackers Abuse Device Code Authentication
  "The Cofense Phishing Defense Center (PDC) has analyzed several emails that may look like ordinary spam to the untrained eye. Threat actors attempt to mimic routine corporate emails and blend into everyday inbox traffic. As aware of the common phishing tac tactics grows, threat actors are turning to techniques such as device code phishing. To understand how this technique works, it is important to understand what access codes are and how they differ from the common username-and-password method of authentication."
  https://cofense.com/blog/beyond-passwords-how-attackers-abuse-device-code-authentication
• Swallowtail: Russian Espionage Group Targets Defense Firms In Two NATO Countries
  "Russian espionage group Swallowtail (aka APT28, Fancy Bear, Forest Blizzard) targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. All three targets were likely to hold information of direct interest to a foreign intelligence service. During one attack, against the naval shipbuilder, operators returned to a compromised host repeatedly over the course of a week in what appeared to be hands-on-keyboard activity. They stole credential material using two separate techniques, opened a persistent SSH tunnel into the organization's internal network and deployed a previously undocumented reflective loader."
  https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets
  https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.html
  https://therecord.media/european-defense-contractors-fancy-bear-espionage
  https://cyberscoop.com/russian-hackers-apt28-target-nato-defense-firms/
• The Checker You Pay For
  "Fraud against spend-management platforms is usually pictured as theft from the platform itself: a stolen card is spent, a false reimbursement is paid, a chargeback is booked. This blog documents a quieter pattern, observed in a recent case within the environment of a Group-IB Fraud Protection client, in which the platform was not the target of the fraud, but was instead abused as a component of the fraud’s infrastructure. Two linked behaviours were observed. In the first, the platform’s trusted email and payment rails were used to lend credibility to phishing scams aimed at people who are not the platform’s customers. In the second, the platform’s bank-account linking flow–provided through an open-banking aggregator–was used to validate stolen card and bank credentials, a checking function that fraudsters abused at no cost to themselves."
  https://www.group-ib.com/blog/spend-management-abuse-fraud-classiscam/
• The Journey Of a Paper Unicorn: Adventures Inside a Modern Warehouse
  "Imagine you’ve ordered a small paper unicorn from an online marketplace. You clicked “Buy”, received a cheerful notification, and expect a courier to bring the box tomorrow. If the unicorn is delayed by a day, it will be annoying but not catastrophic: an apology, a discount promo code — and the incident is forgotten. Now let’s multiply one late unicorn by several hundred thousand orders. Packages start heading to the wrong cities. The website shows an item is in stock, even though the required bin is empty. Conveyors stop, boxes get stuck between floors, the cargo piles up with no freight manifest. Trucks line up at the gates, and every minute of downtime turns into blown schedules, support tickets, fines, and lost sales."
  https://securelist.com/paper-unicorn-warehouse-security/121537/
• Threat Brief: Active Exploitation Of PAN-OS CVE-2026-0257 (Updated October 20)
  "Unit 42 continues to observe attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc). We’re also aware of public reporting attributing exploitation to threat actors using Settra ransomware. Palo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect. This security flaw involves an authentication bypass in the portal and gateway components of vulnerable versions of PAN-OS software, which could allow unauthorized attackers to circumvent security controls and initiate virtual private network (VPN) connections. This CVE was added to the Known Exploited Vulnerability (KEV) catalog on May 13, 2026."
  https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/#
  https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html
  https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226
• WhatsApp Help Pages Leaked Hidden Instructions For a Meta Chatbot
  "Dozens of WhatsApp web pages designed to answer people’s questions about Meta’s encrypted messaging app inadvertently exposed the company’s own instructions to its chatbot. These included some sections titled “WHAT NOT TO SAY” to users asking questions and explicit instructions not to provide people with legal advice. A new analysis has found that around 80 help and FAQ pages across WhatsApp’s website exposed text instructions that were designed for a large language model, specifically one of Meta’s own. The instructions, according to findings from privacy company Redact, appeared in the webpages’ code and contained written details that were not explicitly on the WhatsApp help pages."
  https://www.wired.com/story/whatsapp-help-pages-leaked-hidden-instructions-for-a-meta-chatbot/
  https://thehackernews.com/2026/10/whatsapp-hid-instructions-in-help-pages.html
• How Ray Cracked The Phish No Scanner Could Find
  "A targeted credential phishing campaign delivered 22 emails to a single enterprise tenant within a two-hour window on August 27, 2026, engineered to pass every email gateway by hiding the payload behind legitimate Frame[.]io share notifications. Static gateway scanners see a clean Frame[.]io link and give the email a safe verdict. They cannot read the shared asset inside the SaaS platform. Just three minutes after the first email landed, a targeted employee reported it. But because the link led to genuine infrastructure, traditional security controls saw nothing malicious. Not until Ocean's agentic investigation engine, Ray, got inside the platform and pulled the true payload."
  https://ocean.security/resources/blog/frame-io-phishing-aitm-share-link
  https://hackread.com/scammers-frame-io-steal-microsoft-365-credentials/
• INC And The Gentlemen Ransomware: Exposed AI Infrastructure
  "SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen Ransomware groups. A single publicly accessible command-and-control server exposed the operators’ AI session databases, their central knowledge base and the source code of Phantom, a new “Autonomous Red Team Kill Chain Framework”. Configuration files, logs and credentials inside that server led STRU to six more exposed adversary-controlled servers."
  https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/
• How I Got Over 300 Tor Exit Nodes Removed
  "On Friday Oct 2, 09:35am, 333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible. To give you a sense of scale, all of Tor has around 3000 exit relays, so roughly 10% were under their control. The attackers had gained access to the servers two months earlier, in August, and quietly deployed their Ebury 1.8.3 payload (an OpenSSH backdoor and credential stealer for Linux)."
  https://kaba.cx/posts/20261020_Tor/

Breaches/Hacks/Leaks

• Zeabur Shutting Down After Second Security Breach In Two Months
  "Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. The attackers used stolen administrator credentials and cloud access keys to compromise Zeabur’s shared hosting infrastructure and dedicated servers, eventually gaining access to its production database."
  https://www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/
• 970,000 Medi-Cal Members Affected By Paradigm Healthcare Data Breach
  "Paradigm Healthcare Services has told the US Department of Health and Human Services (HHS) that a data breach discovered last year affected more than 970,000 people. San Francisco-based Paradigm processes billing for Medi-Cal, California’s Medicaid program, under a data use agreement with the California Department of Health Care Services (DHCS). It also maintains Medi-Cal member identification numbers on the department’s behalf. The company says it became aware of unauthorized access to its local network on October 13, 2025. “On August 18, 2026, we determined that certain files containing select individuals’ protected health information may have been accessed by an unauthorized party between October 8, 2025, and October 15, 2025,” Paradigm said."
  https://www.securityweek.com/970000-medi-cal-members-affected-by-paradigm-healthcare-data-breach/
• AfD Email Breach Exposes 421,000 Messages In Anonymous Online Archive
  "Germany’s Alternative für Deutschland (AfD) confirmed on October 19 that its hosting provider was hacked in September and that mailboxes were copied. By the time the confirmation reached Bild, a website called hexane.cc had already been online for hours offering an index of what it claims are 421,179 internal party emails. “In September 2026 there was a hacking attack on a hosting provider used by our party.” By then the website hexane.cc had been online for several hours with an index of what it says are 421,179 of the party’s emails. In place of the emails, the site shows summaries written by software, sorted into categories that include racism and antisemitism and graded from Low to Critical."
  https://securityaffairs.com/201346/data-breach/afd-email-breach-exposes-421000-messages-in-anonymous-online-archive.html
• Stolen UpdraftCentral Keys Used To Backdoor WordPress Sites
  "A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. TeamUpdraft detected unauthorized access to its infrastructure over the weekend and believes that the hacker accessed the customer database. The developer offers several WordPress tools for backup, storage, and site management:"
  https://www.bleepingcomputer.com/news/security/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites/
  https://teamupdraft.com/blog/security-incident-october-2026/

General News

• Nigerian Man Sentenced To Eight Years For Hacking, Fraud, And Identity Theft Schemes
  "United States Attorney for the Southern District of New York, Jamie McDonald, announced that CHUKWUEMEKA VICTOR AMACHUKWU, a/k/a “Chukwuemeka Victor Eletuo,” a/k/a “So Kwan Leung,” was sentenced by U.S. District Judge Paul G. Gardephe to eight years in prison for his role in multiple fraud, hacking, and identity theft offenses. AMACHUKWU previously pled guilty to conspiracy to commit computer intrusions and conspiracy to commit wire fraud."
  https://www.justice.gov/usao-sdny/pr/nigerian-man-sentenced-eight-years-hacking-fraud-and-identity-theft-schemes
  https://www.bleepingcomputer.com/news/security/hacker-gets-8-years-for-stealing-33-million-from-taxpayers/
  https://therecord.media/nigerian-given-8-year-sentenc-tax-hacks
  https://cyberscoop.com/nigerian-sentenced-hacking-fraud-tax-investment-scheme/
• US Agencies Detail Incident Response Practices For Rogue AI Agents
  "Effective and efficient use of complex agentic systems is important for all organizations, but recognizing, preventing and recovering from them going rogue could be an existential necessity. NIST, the NSA, and CISA recognize the increasing potential for AI agents to behave in an unexpected and potentially harmful manner, and has responded with a list of key practices for both preparing for and responding to such behavior. The report (Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation) uses the term super intelligence (SI) rather than artificial intelligence (AI) in line with presidential executive order 14434."
  https://www.securityweek.com/us-agencies-detail-incident-response-practices-for-rogue-ai-agents/
  https://www.nist.gov/system/files/documents/2026/10/16/Key_Practices_for_Incident_Readiness_and_Response_in_Super_Intelligence _Training_and_Evaluation.pdf
  https://www.bankinfosecurity.com/nsa-nist-cisa-issue-guidance-on-rogue-ai-agents-a-33156
• There's Only So Much Code: The Rise In Vulnerability Numbers
  "Frontier AI models (like Mythos) are rapidly mining decades of technical debt across ubiquitous legacy libraries, driving monthly Microsoft Patch Tuesday vulnerability advisories up more than tenfold (reaching 1,415 this month). This volume is overwhelming open-source maintainers and putting pressure on the traditional 90-day coordinated disclosure model. Despite a 105% year-over-year surge in CVEs, Known Exploited Vulnerabilities (KEVs) grew by only 37%, and only 3 of September's 975 Microsoft advisories saw in-the-wild exploitation, demonstrating that the vast majority of AI-discovered bugs are not practically exploited."
  https://blog.talosintelligence.com/theres-only-so-much-code-the-rise-in-vulnerability-numbers/
• Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers And Software
  "Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. Major browsers and operating systems trusted the compromised certificates, potentially allowing attackers to impersonate legitimate websites and intercept encrypted communications. A security researcher known as Wayne discovered the weakness on October 17 while scanning publicly available certificate data."
  https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html
  https://emudhra.we-have-a-problem.com/
  https://www.darkreading.com/cyber-risk/tech-giants-emudhra-certificates-compromised-keys
  https://www.bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates/
  https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312
• Close Identity Gaps In Software Development Before Unleashing AI
  "When Renee Guttmann ran her first Open Worldwide Application Security Project (OWASP) meeting in New York City in the early 2000s, the general sentiment among the industry (and attendees) was one of skepticism: Why on earth would anyone care about scanning web applications for vulnerabilities? Flash forward 20-plus years, and Guttmann, founder of security consultancy Cisohive, no longer has to beat down doors to get people to listen. Initiatives like OWASP, with its aim to improve software security, are now regularly invited into software development life cycle (SDLC) conversations to help developers and teams embed secure software practices across planning, testing, deployment and maintenance."
  https://www.darkreading.com/application-security/close-identity-gaps-sdlc-before-ai
• Your Frontline Workers Have a Workaround For That MFA Prompt
  "Frontline workers in healthcare and manufacturing are getting around slow, unreliable logins by staying signed in, sharing credentials and trying to bypass multifactor authentication. Sapio Research surveyed 700 IT and security decision-makers in August, and 95% said they had seen frontline workers use workarounds like these in the past 12 months. Each of those habits breaks the link between an account and the person using it. A session left open on a shared workstation lets the next worker act under someone else’s name, and a password passed around a team lets anyone who knows it do the same. Attackers are working the same weak point from outside. Sixty-two percent of respondents reported a confirmed or suspected attempt to abuse account recovery, a password reset or an unlock in the past year."
  https://www.helpnetsecurity.com/2026/10/20/frontline-worker-authentication-passwordless/
• AI Agent Adoption Creates Risk As Oversight Struggles To Keep Pace, Splunk Finds
  "Businesses are rolling out AI agents across their networks much faster than they can implement monitoring procedures and security controls, leaving organizations exposed to security threats, hallucinations and other common issues associated with the technology. Published by Cisco on October 20, the2026 Splunk State of Observability warned that while many businesses are keen to explore the potential benefits of using AI in their ecosystem, many do so without a strategy in place to ensure it is being used safely."
  https://www.infosecurity-magazine.com/news/ai-agent-adoption-oversight/
• Seven Core Research Areas For a Rapidly Evolving Cyber Landscape
  "In the past year, cyber adversaries have started to exploit artificial intelligence (AI) technology to execute a wide range of attacks. AI is helping them accelerate, optimize, and scale up their techniques. Agentic AI lowers the work factor for savvy adversaries, and it lowers the barrier to entry for new entrants. There is already an increase in the extent, tempo, and sophistication of attacks, and they are targeting diverse sectors. There are the well-known Salt Typhoon attacks on multiple prominent telecommunications providers and, more recently, attacks on water systems attributed to Iran."
  https://www.sei.cmu.edu/blog/seven-core-research-areas-for-a-rapidly-evolving-cyber-landscape/
• What Security Teams Can Do To Tame Wild Code
  "A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team’s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support them. If you work in security, that success introduces a new set of questions. Whose credentials does the workflow use? Which records can it access? Who can see its output? If it starts exposing information it shouldn’t, can you trace what happened and stop further access?"
  https://thehackernews.com/2026/10/what-security-teams-can-do-to-tame-wild.html
• The Key To AI Software Security Isn’t Speed, It’s Maturity
  "Agentic artificial intelligence software development has all the traits of a summer blockbuster, with the prospects of Godzilla-sized productivity gains thrilling business leaders and security implications sending chills down the spines of developers and SOC teams. One difference, though, is that those thrills and chills are going to last longer than a summer, and the fallout could be a lot more serious than some spilled popcorn."
  https://www.securityweek.com/the-key-to-ai-software-security-isnt-speed-its-maturity/
• Swamped Curl Maintainers Take Low-Level Flaws Public To Survive Vulnerability 'avalanche'
  "An "avalanche of vulnerability reports" is forcing curl to move lower-severity cases into public view, reserving private handling for high and critical flaws. From October 26, low and medium-severity reports should be filed in the open source data transfer tool's public GitHub repository, maintainer Daniel Stenberg said. "Security researchers in doubt can still submit the issue on HackerOne and we can tell them what severity we deem it to be. Over the last few years, over 90 percent of all submissions could quickly be assessed to be less than HIGH.""
  https://www.theregister.com/security/2026/10/20/swamped-curl-maintainers-take-low-level-flaws-public-to-survive-vulnerability-avalanche/5304198
• ICANN Testing Tech To Let Law Enforcement Access Non-Public WHOIS Info
  "ICANN has started testing authentication schemes that will allow law enforcement agencies to make urgent requests for non-public WHOIS information – when needed to address threats to life, critical infrastructure, or child exploitation. Domain registrars collect information about their customers and in the past that data was publicly available in WHOIS records. Some domain registrars offer services that substitute their own contact details, to preserve customer privacy. In recent years, laws like GDPR mean registrars are sometimes required to hide WHOIS data."
  https://www.theregister.com/networks/2026/10/20/icann-testing-tech-to-let-law-enforcement-access-non-public-whois-info/5304036
• Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
  "U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom."
  https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

New Tooling

• Bearer CLI: Free, Source-Available Code Security Scanning Tool (SAST)
  "Bearer CLI is a free static application security testing (SAST) tool that scans source code for vulnerabilities and prioritizes them by the sensitive data they touch. SAST means the tool reads code without running it. Organizations can use it freely, with a license restriction covered below. Bearer’s complaint is that SAST tools can hand developers hundreds of findings with no sense of which to fix first. Its fix is to follow sensitive data through the code and put the flaws on those paths first, so whoever is triaging can start with the findings that can expose that data."
  https://www.helpnetsecurity.com/2026/10/19/bearer-cli-free-code-security-scanning-tool-sast/
  https://github.com/Bearer/bearer

Vulnerabilities

• Active Exploitation Of CVE-2026-110936 In Siemens Software Center
  "Siemens has validated that there is an active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center. Siemens fixed the weakness in version 4.0.9.8 and published advisory SSA-580366 on 15 October. Existing installations update automatically the next time they start. No Siemens system, product or update channel was breached to our knowledge. EDR vendors and authorities have been engaged for intelligence sharing, enabling broader detection coverage and coordinated defensive actions."
  https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/
  https://productcert.siemens.com/productcert/html/ssa-580366.html
  https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/

Malware

• PSA: Malware Found In Some Rank Math SEO PRO 3.0.123 Downloads
  "Rank Math has disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware. According to Rank Math, the affected version was downloaded or installed through an update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. If an affected copy of Rank Math SEO PRO 3.0.123 was active on your website, you should treat the website as compromised. Simply updating the plugin is not enough because the malware may have placed additional files, administrator accounts, or scheduled tasks elsewhere on the server."
  https://www.wordfence.com/blog/2026/10/rank-math-seo-pro-3-0-123-malware/
  https://rankmath.com/kb/pro-3-0-123-security-incident/
  https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html
  https://www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-math-compromised-to-backdoor-websites/
  https://www.securityweek.com/rank-math-pro-wordpress-plugin-compromised-in-supply-chain-attack/
• Targeting Democracy: Pegasus And Mercenary Spyware Attacks On Serbian Pro-Democracy Figures
  "In collaboration with the SHARE Foundation, we found with high confidence that Professor Vladan Đokić, Rector of the University of Belgrade, and prominent supporter of the Serbian student movement, was hacked with NSO Group’s Pegasus spyware in 2026. Additionally, we note that Rade Bajić, who, as a prosecutor, investigated official corruption in a failed project in Belgrade, received an Apple Threat Notification. These notifications are high-confidence indicators of targeting with mercenary spyware such as Pegasus. Our investigations into these cases are ongoing."
  https://citizenlab.ca/research/pegasus-spyware-serbian-pro-democracy/
  https://therecord.media/serbia-spyware-pegasus-elections
  https://cyberscoop.com/pegasus-spyware-serbia-critics-elections/
• Plex Vulnerabilities Being Exploited In The Wild To Drop a Cryptominer
  "If you see weird fonts and spacing, blame Blogger. Skip to "In the wild exploitation" if you just care about that part. It's just a cryptominer. On one hand that's not a big deal for victims on the other hand, I don't get interesting c o n t e n t to write about. I wouldn't be surprised if threat actors deploy more sophisticated things. Plex may be hosted on residential IP and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails. (edit: see update at the bottom. i do see proxy being deployed now)"
  https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
  https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html
  https://www.securityweek.com/plex2shell-exploit-chain-weaponized-against-plex-servers-hours-after-disclosure/
  https://securityaffairs.com/201324/hacking/plex2shell-exploit-used-to-turn-vulnerable-plex-servers-into-crypto-miners.html
• GhostAction Attack Escalates By Targeting GitHub Users
  "OpenSourceMalware has identified a new stage in the ongoing "GhostAction" malicious campaign that GitGuardian originally identified in 2025. This latest evolution appears to be an escalation and used two new domains targeting GitHub and GitLab. The GhostAction campaign is a continuing supply-chain campaign in which attackers compromise GitHub accounts and inject malicious Actions workflows across every repository those accounts can modify. Triggered by pushes or manual execution, the workflows steal CI/CD secrets—including package-publishing, cloud, GitHub, and AI-service credentials—and exfiltrate them to attacker-controlled infrastructure. Later variants expanded collection by scanning repository contents and complete git history, recovering credentials that developers believed had been deleted. GitGuardian (https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack- returns/)"
  https://opensourcemalware.com/blog/ghostaction-attack-escalates
  https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html
• Auditing The Auditor: Unmasking Apex Accelerator
  "Elastic Security Labs identified a malicious npm package, @apexacc/cli, which led us to an operation posing as a Web3 accelerator. That operation had spent months building a public presence, targeting cryptocurrency start-ups and founders with offers of free AI credits and coding tools, along with security audits. The group also advertised an in-person event through a dedicated invitation page, adding to its efforts to appear legitimate. The tools delivered information-stealing malware and backdoors for macOS and Windows machines. The operation also repackaged a legitimate coding agent to send model requests through attacker-controlled services, while its audit tools generated fabricated security findings."
  https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages
  https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html
• Inside Cairn: Open Windows Into Massive AI-Driven Cyber Operations
  "An investigation by NorForge into publicly exposed AI-driven penetration-testing control panels has uncovered how they are extensively used in malicious cyber operations. One of these is Cairn. In this setting, Cairn is an AI-powered hacking system. Give it a target and an objective, and it can coordinate AI agents to investigate the target, search for security weaknesses, and attempt to break in. More than 20 exposed Cairn panels were identified as likely associated with malicious activity, providing an unusually detailed view of how threat actors select targets, direct autonomous agents, exploit vulnerabilities, and establish persistent access to compromised systems. In addition, a considerable number of apparently legitimate red team operations were also exposed this way, potentially placing clients at risk."
  https://norforge.com/blog/inside_cairn

Breaches/Hacks/Leaks

• Nikkei Discloses Third Data Breach In a Month, 1.8M Records Exposed
  "Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. The Japanese giant says subsets of the data contained personally identifiable information and other sensitive details, but most records contained no identifying info. The company said that 150,000 records contained at least one of the following data types: full names, email addresses, physical addresses, telephone numbers, and dates of birth. Email addresses appeared in 120,000 records."
  https://www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/
• Bullhorn Takes Staffing Platform Offline To Contain Cyberattack
  "Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. The company says it has isolated the issue and eradicated the immediate threat. Currently, its team is working to restore services following thorough security reviews conducted with help from CrowdStrike specialists. Bullhorn is an American software company specializing in cloud-based staffing and recruitment solutions. Its platform helps staffing firms manage the recruitment lifecycle, including candidate tracking, onboarding, and payroll."
  https://www.bleepingcomputer.com/news/security/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack/
• OpenCode Hack Exposes API Keys Amid AI Distillation Attacks
  "The open-source AI coding project OpenCode has notified some users that stored API keys they used with external providers were exposed in a security breach. Multiple users reported that the incident led to unauthorized API charges and suspended projects in Google Cloud. According to the project maintainer, the breach affected 1.4% of OpenCode Console users, with some reporting more than $1,700 in unauthorized charges overnight."
  https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/
  https://thehackernews.com/2026/10/opencode-console-breach-may-have.html
  https://www.infosecurity-magazine.com/news/opencode-breach-openai-anthropic/
• Millions Of California Students’ Sensitive Data Stolen In Breach
  "Personal information belonging to millions of current and former California public school students has been stolen from a system operated by Educational Testing Service (ETS). ETS is a nonprofit organization that helps run the state’s standardized tests under contract with the California Department of Education (CDE). It has begun notifying students and families after an unauthorized party accessed and copied student information from an ETS-operated secure file transfer protocol (SFTP) site. CDE is distributing the ETS breach notice to help affected individuals receive information about the incident and available resources."
  https://www.malwarebytes.com/blog/data-breaches/2026/10/millions-of-california-students-sensitive-data-stolen-in-breach
  https://www.securityweek.com/one-compromised-login-exposed-millions-of-california-students-records/
• Ahold Delhaize Confirms 'malicious Actions' Behind Cyber Outages Affecting Grocery Brands
  "Ahold Delhaize, the Dutch multinational grocery chain, said Monday that a cyberattack forced it to take systems offline across most of its U.S. and European brands, impacting shoppers on both sides of the Atlantic. The company confirmed that the suspicious activity it announced detecting in its IT systems last week was caused by malicious actors, adding that it filed a police report in the Netherlands on Monday. The incident disrupted online services in the U.S., Netherlands and Belgium, although stores remained open. Although the company said it had no evidence that sensitive customer, employee or partner data was stolen, it cautioned that the investigation into the hack remains ongoing."
  https://therecord.media/ahold-delhaize-cyberattack-grocery
  https://www.theregister.com/security/2026/10/19/grocery-giant-ahold-delhaize-confirms-cyberattack-forced-us-and-european-systems-offline/5303970
• Hackers Steal Customer Data From Major Russian Hosting Provider FirstVDS
  "Hackers have stolen passwords, access credentials and other sensitive data belonging to customers of Russian hosting provider FirstVDS after exploiting a vulnerability in software used to manage its servers, the company said over the weekend. The attack, discovered on Saturday, affected part of FirstVDS's infrastructure, allowing the hackers to access data stored on customers' virtual servers without disrupting their operations."
  https://therecord.media/russia-cyberattack-firstvds-cloud

General News

• OnlyFans Copyright Takedowns Expose Compromised Websites
  "A university website gets hacked and, suddenly, its search results are promoting adult content. It sounds like an embarrassing but isolated incident. But according to research from UpGuard, these cases may be part of a much larger and growing problem — one that reveals how attackers exploit vulnerable websites and the digital footprints of legitimate organizations, exposing them to a variety of potential risks, including reputational damage. In an interview with Dark Reading associate editor Kristina Beek, Greg Pollock, UpGuard's director of research and insights, explains how an investigation into search engine spam led him to an unexpected source of threat intelligence: copyright takedown requests filed by OnlyFans and other adult content creators."
  https://www.darkreading.com/vulnerabilities-threats/onlyfans-copyright-takedowns-expose-compromised-websites
• The Evolving Cybersecurity Lexicon: Vulnerability Discovery To Resilience
  "Every year, the lexicographers at Merriam-Webster officially add new words or word usage to the dictionary. It's a fascinating process, outlined here. In 2009, a new usage of the word "tweet" was added to describe a social media post from the microblogging site then known as Twitter. "App" was added in 2010 to describe application software. And, in 2025, the word "slop" was amended to include AI slop, mass quantities of content created using generative AI. Watching our language and usage evolve gives us a glimpse into the zeitgeist."
  https://www.darkreading.com/vulnerabilities-threats/cybersecurity-lexicon-vulnerability-discovery-resilience
• Managing Open-Weight Model Risk In Enterprise Deployments
  "The growing AI landscape is giving enterprises more choice in how they build, customize, and deploy increasingly capable models. Open-weight models are an important part of that landscape. They give enterprises access to model weights and greater flexibility to inspect, evaluate, modify, and run models within their own environments. While that flexibility can be valuable, it also affects how enterprises evaluate models, where they implement safeguards, and who is responsible for maintaining those safeguards over time."
  https://www.microsoft.com/en-us/security/blog/2026/10/16/managing-open-weight-model-risk-in-enterprise-deployments/
  https://www.helpnetsecurity.com/2026/10/19/open-weight-ai-model-risks-microsoft-nvidia/
• Half The AI Bot Traffic Hammering Your Website Comes From Meta
  "AI agent traffic across DataDome’s network grew 41.5% quarter over quarter to nearly 25 billion requests in Q3 2026, according to the company’s AI Traffic Report Q3 2026. Meta’s Muse generated 29.1 million requests between September 22 and October 3, its first 12 days of full availability. In a sample of Muse traffic, 99.3% of requests came from cloud and CDN infrastructure. Nearly half of the AI agent traffic recorded in 2026 through September occurred in Q3. The growth had left capacity plans and bot-management policies based on the previous quarter’s averages out of date."
  https://www.helpnetsecurity.com/2026/10/19/datadome-ai-agent-traffic-report/
• Exploited Vulnerabilities Typically Take Three Months To Patch, Moody’s Finds
  "A new Moody’s report found that known exploited vulnerabilities take a median time of 87 days to be patched. This leaves half of these flaws unremediated after three months of their disclosures. This gap is even larger for vulnerabilities with no known exploitation evidence, for which median time to patch is at 107 days, the report showed."
  https://www.infosecurity-magazine.com/news/exploited-vulnerabilities-three/
• ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use And Abuse Of AI, & Iranian Cyber Espionage
  "ATT&CK v20 brings more critical infrastructure and cross-domain activity into the framework, with Campaigns for attacks on U.S. water utilities and an AI-assisted breach of Mexican government infrastructure that reached both IT and OT, along with new and updated Groups and Software tied to Iranian cyber espionage, Chinese and North Korean operations, and ransomware. Enterprise gains AI-focused and AI-enabled Techniques, ICS added Techniques for command and script execution and command and control over protocols industrial networks already use, and Mobile un-deprecated a Technique for delivering malicious apps outside official stores. On the defensive side, ICS Detection Strategies (DETs) now carry platform and Asset context, tying behaviors to the operational role of each system, and Mobile DETs reflect the visibility limits of Android and iOS."
  https://medium.com/mitre-attack/attack-v20-9701dd75ffb4
  https://www.securityweek.com/mitre-attck-v20-catalogs-ai-abuse-mfa-bypass-water-utility-attacks/
• PatchSlop: How Security Patches Became Maps For Attackers
  "Software security fixes are both bug closers and maps: they show where a given bug used to live and how the developer chose to close it. Narrowing down the fix so that it only blocks the reported case can point the next attacker toward undefended gaps around the repair. Terra Security noticed this in our own work this past year: a fix would ship, a bypass would be found, and another fix would go out. Worried this was sample bias, we looked at every published CVE record and every GitHub-reviewed advisory for one pattern: a fix ships, and a later advisory says it was incomplete or could be bypassed."
  https://www.terra.security/blog/how-security-patches-became-maps-for-attackers
  https://www.theregister.com/patches/2026/10/19/security-patches-need-patches-now-that-attackers-have-ai/5303927

อ้างอิง
Electronic Transactions Development Agency (ETDA)

Vulnerabilities

• BlockStrap: Magento And Adobe Commerce RCE (CVE-2026-103849)
  "BlockStrap (CVE-2026-103849) is a CVSS 10.0 Magento and Adobe Commerce flaw that gives unauthenticated attackers remote code execution. Adobe fixed it on October 13 in APSB26-153 but requires a manual patch, while new installs remain vulnerable. BlockStrap is the second critical break in Magento's email template engine in six weeks. It has the same CVSS 10.0 score as StyleSmuggler and the same impact: an unauthenticated attacker runs arbitrary PHP on the store server."
  https://sansec.io/research/blockstrap-magento-rce
  https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/
• ARMORY CASTLE Exploits BeyondTrust
  "On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances. BeyondTrust Remote Support is an enterprise secure remote access solution that enables IT teams to securely access and troubleshoot remote endpoints. The successful exploitation of this vulnerability results in the arbitrary upload of files. During an incident response engagement, Mandiant identified evidence that ARMORY CASTLE, a suspected PRC-nexus espionage threat actor (formerly tracked as UNC5221), exploited this vulnerability as a zero-day, in late August 2026. This blog describes how ARMORY CASTLE escalated privileges and established persistent access to compromised BeyondTrust Remote Support appliances following exploitation of CVE-2026-102764, and provides actionable guidance for defenders."
  https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust
  https://www.beyondtrust.com/blog/entry/bt26-05
  https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august/
  https://thehackernews.com/2026/10/china-linked-hackers-exploited.html
  https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs
  https://therecord.media/beyond-trust-cyberattack-china
  https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support
  https://www.bankinfosecurity.com/zero-day-in-beyondtrust-remote-support-appliances-exploited-a-33129
  https://cyberscoop.com/china-espionage-attacks-beyondtrust-zero-day-armory-castle/
  https://www.infosecurity-magazine.com/news/china-actor-beyondtrust-flaw-google/
  https://www.securityweek.com/chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day/
• F5, Juniper Networks Patch Critical Vulnerabilities
  "F5 and Juniper Networks have rolled out patches for dozens of vulnerabilities across their products, including critical-severity remote code execution (RCE) flaws. Security and application delivery firm F5 announced fixes for 11 security defects in NGINX. Among them, CVE-2026-15176 and CVE-2026-93479 are critical-severity bugs that could be exploited without authentication via crafted HTTP requests. Under certain conditions beyond their control, an unauthenticated attacker could exploit the security holes to trigger a buffer overflow leading to a restart. If ASLR is disabled or can be bypassed, the attacker could achieve RCE."
  https://www.securityweek.com/f5-juniper-networks-patch-critical-vulnerabilities/
  https://securityaffairs.com/201106/security/f5-addressed-critical-rce-flaws-in-nginx.html
• Microsoft Patches Two Dozen RCE Flaws In Office
  "Hot on the heels of its record Patch Tuesday rollout, Microsoft on Thursday announced patches for over 30 new vulnerabilities. Most of the new fixes address security defects in the Office suite. Two dozen of them patch high-severity remote code execution (RCE) flaws, including half a dozen bugs that could be targeted via the Preview Pane. In most cases, exploitation requires an attacker to send a specially crafted file, such as a malicious document, and convince the recipient to open it. Buffer overflow issues are blamed for most of the RCEs, with several defects being off-by-one, use-after-free, path traversal, and numeric truncation errors."
  https://www.securityweek.com/microsoft-patches-two-dozen-rce-flaws-in-office/
• Hackers Exploit SiteGuard WAF Flaw To Run Commands As Admins
  "Hackers are exploiting an OS command-injection vulnerability in the SiteGuard Server Edition web application firewall (WAF), allowing them to execute commands with root or SYSTEM privileges on affected machines. The security issue is tracked as CVE-2026-106931 and affects the statistics feature in host-based WAF instances, which is enabled by default. SiteGuard is a leading Japanese WAF vendor that claims to protect more than 1.5 million websites. Based on WordPress.org statistics, the product is active on 500,000 sites."
  https://www.bleepingcomputer.com/news/security/hackers-exploit-siteguard-waf-flaw-to-run-commands-as-system-root/
  https://jvn.jp/en/jp/JVN88474777/index.html
• CISA Adds Two Known Exploited Vulnerabilities To Catalog
  "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability
  CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog
  https://securityaffairs.com/201178/security/u-s-cisa-adds-fortinet-multiple-products-and-beyondtrust-remote-support-flaws-to-its-known-exploited-vulnerabilities-catalog.html
• CVE-2026-88771: Inside The Exploitation Of a Critical NetScaler RCE Vulnerability
  "On September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution (RCE) vulnerability affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. The vulnerability carries a CVSS v3.1 score of 9.8 according to NVD and a CVSS v4.0 score of 9.5 according to the Citrix security bulletin CTX697096. The vulnerability allows unauthenticated attackers to execute arbitrary commands on affected appliances. Exploitation requires no optional features to be enabled."
  https://www.zscaler.com/blogs/security-research/cve-2026-88771-inside-exploitation-critical-netscaler-rce-vulnerability
• Big Fish: Exploiting a 37-Year-Old Kernel Bug In OpenBSD
  "Calif frequently publishes our offensive research and work, but we otherwise don't draw much attention to the defensive work we do — assisting open source projects with remediation, patch generation, cryptographic improvements, and internal engineering projects we carry out for our clients. Earlier this year, we reported some vulnerabilities, often along with suggested patches to OpenBSD. One traced back roughly 37 years to the original BSD sources, where a shared memory attachment counter was defined as a signed 16-bit short. Repeatedly forking a process with shared memory attachment records could push that counter past its maximum value of 32,767, causing it to wrap to a negative value. This integer overflow could lead to a use-after-free via a race condition; combined with a separate out-of-bounds write in the kernel, it allowed local privilege escalation to root. The issues were addressed in errata 026 and 018, respectively."
  https://calif.io/research/big-fish
  https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html
• One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos And Linux
  "A vulnerability affecting Broadcom’s proprietary implementation of 802.11 has been present in their SDK since at least 2010. An incomplete patch was silently released in 2018, followed by Broadcom’s recommendation to move to hostapd instead, making it a definitive forever day on eCos-based platforms (BCM3380, BCM3383, BCM33834) and a potential forever day on Linux platforms (BCM3390, BCM65xx, BCM68xx) unless affected Original Equipment Manufacturers (OEMs) are willing to migrate. The vulnerability can be triggered remotely over WiFi without knowledge of the network key or completion of a normal WPS enrollment. Exploitation provides controlled information disclosure and arbitrary code execution."
  https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/
  https://securityaffairs.com/201268/iot/16-year-old-broadcom-wi-fi-bug-lets-attackers-take-over-routers-without-a-password.html

Malware

• Investigating Ephemeral Supply Chain Tampering
  "Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign targeting the update infrastructure belonging to AOMEI Technology between April 2026 and July 2026. The threat actor conducted repeated, short-burst configuration tampering against AOMEI origin servers. Each tampering window remained active for only five to ten minutes before reverting to authentic versions. This is the first time that we have encountered a software supply chain compromise that was implemented with these very short windows, effectively evading traditional point-in-time triage and automated file scanning."
  https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering
  https://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.html
  https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html
• CERT-In Warns AI Agents Accessed Sensitive Data At Indian Organizations During Testing
  "AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an advisory on October 15. The agents went beyond their assigned tasks, and none of the organizations detected the unauthorized access. After internal reviews, the AI companies whose models were being tested voluntarily reported the cases to CERT-In, India's national cyber agency."
  https://thehackernews.com/2026/10/cert-in-warns-ai-agents-accessed.html
  https://securityaffairs.com/201130/ai/ai-agents-accessed-indian-organizations-without-authorization-cert-in-warns.html
• OpenAI Models Hacked Data Portals, Raided a Crypto Wallet To Finish Tasks
  "OpenAI has disclosed two incidents in which internal AI models, asked only to look up public figures, instead broke into the live systems hosting that data. The reports, published on October 15, are the latest in a run of misalignment disclosures OpenAI started after its models compromised Hugging Face in July. OpenAI has since disclosed several other incidents, including models probing government websites for vulnerabilities, attempting to exploit SQL injection flaws, and searching GitHub for leaked API keys during training."
  https://www.securityweek.com/openai-models-hacked-data-portals-raided-a-crypto-wallet-to-finish-tasks/
• How RL Mapped a Midnight Blizzard-Linked Campaign From Two Hashes
  "ReversingLabs (RL) researchers recently identified and classified the malware that Anthropic disclosed in its September 2026 report on how the Russian-based threat group Midnight Blizzard was leveraging Anthropic’s Claude AI to rebuild- and redeploy flagged software implants, making them harder for victims to detect. As noted in that report, RL had detected and tracked the malware samples for weeks before the Anthropic report was published — showing why behavioral intelligence and historical telemetry matter in the AI age. Since then we’ve been asked to explain more about the process we used to link Anthropic’s research to a much larger malicious campaign."
  https://www.reversinglabs.com/blog/how-rl-mapped-a-midnight-blizzard-linked-campaign-from-two-hashes
• 25+ Versions In Six Months: How The SC WordPress Malware Adapts To Survive Cleanup
  "SC is a WordPress malware campaign best known for putting casino spam on other people’s websites, though the kit can do more: it adds hidden admin accounts, captures logins, and installs whatever its operator sends. Keeping it on those sites is where most of the attacker’s effort goes. Since March, its operator has shipped more than 25 versions and tested builds against Imunify on a server they rent. By September, they had a version that keeps a record of which of its hiding places were cleaned and decides, one at a time, whether to come back."
  https://blog.imunify360.com/how-sc-wordpress-malware-adapts-to-cleanups/
• ConnectWise (SkyKick) Vendor Credentials Abused In M365 Attacks
  "A Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup (formerly SkyKick) has been compromised, and Huntress has confirmed it is being used to gain unauthorized access to customers' M365 environments. Huntress has high confidence that the threat actor abused ConnectWise Cloud Management applications for Exchange Online, Microsoft Teams, and SharePoint Online, Cloud Backup, MS Graph, and Partner Center. In one Huntress partner tenant, a second ConnectWise application, ConnectWise Cloud Management - MS Teams (Application ID 24205314-2b89-4e07-a2a4-579e898a5640), gave itself Global Administrator and then added new credentials to two other applications in that tenant, one of them being a single-tenant Huntress application unique to this partner."
  https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access
  https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html
  https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html
  https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/
• MALFEX Moves Its Npm Loader Into a Native Windows DLL
  "The npm package imgdecode hides a malicious loader in a compiled Node.js addon. Its nine-line JavaScript file loads a Windows dynamic-link library (DLL). When a Node.js program calls require('imgdecode') from a Windows console, the DLL attempts to download encrypted shellcode from GitHub. It decrypts the response and injects the result into a new dllhost.exe process. This code does not need an install script. On 2026-10-13, the package was still available on npm."
  https://safedep.io/malfex-imgdecode-npm-native-addon-loader/
  https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html

Breaches/Hacks/Leaks

• Burger King Japan Data Breach Exposes 11 Million Customer Records
  "Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. Founded in 1953 in Florida, Burger King is now a multinational fast-food chain with nearly 20,000 locations worldwide, including 350 in Japan. In a Thursday press release, Burger King Japan said it concluded a follow-up investigation on October 13 and apologized to customers whose data was stolen in early October and leaked online."
  https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes-11-million-customer-records/
  https://securityaffairs.com/201119/security/burger-king-japan-data-breach-impacted-11-million-customers.html
• Baltimore Suburb Confirms August Data Breach After Ransomware Claims
  "Officials in Anne Arundel County, Maryland, confirmed that hackers stole files from government systems during an incident in August. A county spokesperson told Recorded Future News that they discovered “irregular activity” on August 28 and began an investigation on a “limited subset of systems within the county computer network.” “Through the course of the county’s response and investigation, it was determined that an unauthorized actor gained access to a limited number of systems and copied certain files from those systems,” the spokesperson said."
  https://therecord.media/anne-arundel-county-maryland-confirms-data-breach
• n0n Group Puts Dozens Of Global Ports And Shipping On Its Leak Site
  "A month after its first leak site postings, the n0n extortion group has turned its attention to global shipping. On October 12, 2026, the group added 38 organizations to its Dark Web leak site in one batch: container terminals in Brazil, Spain, Morocco, India and Vietnam, shipping lines in Singapore, China and Taiwan, port IT providers in Kuwait, Indonesia and Germany, and a dense cluster of South Korean operators. The batch more than doubles the group’s public victim count and shifts it from an opportunistic, cross-sector actor to one with a clear sector focus. The way the stolen data is described also raises a question that matters more to the maritime industry than any single listing: whether these are 38 separate intrusions, or exposure flowing out of one shared system."
  https://socradar.io/blog/n0n-group-global-ports-shipping-leak/

General News

• September 2026 Threat Trend Report On APT Groups
  "APT cases disclosed in September 2026 demonstrate that attacks have evolved to exploit the developer ecosystem, cloud services, and network management infrastructure as trust layers. Legitimate software installers, GitHub repositories, Microsoft 365, OneDrive, Telegram, Nostr, routers, and authentication servers were all included in the attack chain."
  https://asec.ahnlab.com/en/95883/
• Enterprise AI Enters Risk Management Phase As Security Concerns Rise
  "As artificial intelligence (AI) expands into core business operations, attention is shifting from adoption to execution risk, according to research and analysis from CompTIA. Governance, cybersecurity and workforce readiness are emerging as critical factors in determining whether AI initiatives deliver long-term business value, CompTIA’s new research brief “Practical Implications of AI Safety” finds."
  https://www.darkreading.com/cyber-risk/enterprise-ai-risk-management-phase-security-concerns-rise
• When Your Ransomware Negotiator Works For The Other Side
  "Edward Dubrovsky walked into the Philadelphia Cyber Risk Summit on Oct. 8 with his name on the sponsorship banner. His former company, Cypfer, was the event's largest sponsor. He'd co-authored a book on ransomware negotiation. He was, by every visible measure, exactly the kind of person you call at 2 a.m. when your network is down and someone is demanding eight figures to give it back. The FBI arrested him before the conference ended."
  https://www.darkreading.com/cyber-risk/when-your-ransomware-negotiator-works-other-side
• When AI Agents Commit Breaches, Humans May Not Be Held Liable
  "As AI agents continue to break containment and breach other organizations, it's clear that organizations are responsible for the actions of their models. But what that responsibility means is far less clear. Since July, when OpenAI said two of its frontier models autonomously hacked AI model store Hugging Face as part of a security benchmark exercise, several of the most prominent large language model (LLM) firms have disclosed cases where their powerful models escape guardrails and breach other organizations. The Hugging Face incident, for example, saw OpenAI's models guess that the popular AI model store held the solutions for the Exploit Gym tests the models were being measured against."
  https://www.darkreading.com/insider-threats/ai-agents-breaches-humans-liable
• The Rise In RFQ And Project Invitation Scams
  "The Fortra Intelligence and Research Experts (FIRE) team is tracking a 12-fold increase in emails using requests for quotation, project invitations, and procurement inquiries as a phishing pretext from October 2025 – September 2026. These messages impersonate prospective buyers seeking pricing, availability, or project participation. Their purpose is not to obtain a legitimate quote, but to persuade a recipient to access an attacker-controlled file-sharing, document-viewing, or procurement portal."
  https://www.fortra.com/blog/rise-rfq-and-project-invitation-scams
  https://www.helpnetsecurity.com/2026/10/16/rfq-phishing-emails-sales-procurement-staff/
• Why Active Directory Weaknesses Stay Open For Years In Teams With One Or Two Admins
  "David Fuhr, CTO at intcube, talks about a security cohort for public administration, where 27 municipalities hardened Windows Server and Active Directory together over 12 weeks. This Help Net Security interview covers how a cohort works, with weekly sessions, homework and measurements at the start and end. He explains how the group handled settings that can break systems, such as SMB signing, LDAP signing and Kerberos hardening, how changes were tested in a lab, and how rollback planning worked. He also covers who owns the settings afterward and why the group was split in two."
  https://www.helpnetsecurity.com/2026/10/16/david-fuhr-intcube-active-directory-security/
• Stolen AI API Keys Are Paying For Hackers’ Autonomous Scans
  "A seller on a restricted criminal forum is marketing an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google API keys, so the key’s owner pays for the scans. Bitsight’s threat intelligence team tracked the shift across thousands of posts on 16 underground forums from February through August 2026. Over that window, mentions of AI agents, indirect prompt injection and the Model Context Protocol (MCP) rose 67 percent. Two groups are exposed. A company that leaks an AI provider key pays for attacks on other people’s systems. An engineering team that pulls agent plugins from public registries can install malware dressed up as a useful tool."
  https://www.helpnetsecurity.com/2026/10/16/stolen-ai-api-keys-autonomous-scans/
• AI Decision Models And Their Impact On AI SOC Platforms
  "In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally. Others, like Laya, are already showing up in open source tooling. These models skip text generation entirely. You hand them some state and a set of typed questions. They hand back a choice, a score, or a yes/no with a probability attached."
  https://thehackernews.com/2026/10/ai-decision-models-and-their-impact-on.html
• Moscow Police Detain Suspected DataSuckers Hackers Linked To Breaches In Ukraine And Russia
  "Russian authorities have reportedly detained three suspected members of the DataSuckers hacking group following a cyberattack on a popular restaurant chain that exposed vast amounts of customer information. A Moscow court on Wednesday placed 19-year-old Denis Fridman under house arrest until December 8 in connection with the Dodo Pizza breach, which reportedly involved the theft of records related to hundreds of millions of orders placed over 15 years. He faces charges connected to the illegal handling of computer information containing personal data."
  https://therecord.media/russia-datasuckers-hackers-arrested
• Top 5 Initial Access Threat Vectors Observed By Unit 42 In September 2026
  "This report provides an overview of the top five initial access threat vectors observed by Unit 42 Threat Intelligence for September 2026. Adversary activity during this period demonstrates a pronounced reliance on external edge exploitation and identity compromise, with the targeting of public-facing infrastructure and legitimate credential abuse serving as the primary footholds for intrusion campaigns. Concurrently, social engineering continues to drive targeted operations against public sector and critical infrastructure targets, while high-impact supply chain intrusions and zero-interaction drive-by compromises pose acute systemic risks across interconnected technology ecosystems."
  https://unit42.paloaltonetworks.com/top-5-initial-access-vectors-september-2026/
• DDoS Attacks Can Knock Services Offline Before Links Reach Capacity
  "More than 9.1 million DDoS attacks were recorded globally between January and June 2026, an increase of nearly a quarter year over year, according to Netscout’s DDoS Threat Intelligence Report. Attacks exceeding 1 Tbps or 1 Gpps increased 1,286% year over year. Much of that growth came from botnet operators associated with Aisuru, Kimwolf, Jackskid, and their successors. That means attackers need fewer devices to launch large attacks."
  https://www.helpnetsecurity.com/2026/10/16/netscout-ddos-attack-growth-report/
• Inside The Q3 2026 Brand Phishing Report: Microsoft Now Accounts For One In Three Brand Impersonation
  "In Q3 2026, Microsoft was the most impersonated brand in phishing attacks, accounting for 33% of all brand impersonation attempts tracked by Check Point Research, up from 23% in Q2. Attackers favor Microsoft because stolen Microsoft credentials can unlock an entire corporate environment, including email, files and collaboration tools, while many of the other top brands mainly lead to personal accounts. Apple, Google, LinkedIn and Amazon completed the top five, and together these brands made up more than half of all attempts, showing how heavily attackers lean on a small group of trusted names."
  https://blog.checkpoint.com/security/inside-the-q3-2026-brand-phishing-report-microsoft-now-accounts-for-one-in-three-brand-impersonation/
• Inbox Flooded With Sign-Up Messages? Email Bombing Explained
  "In September, reports emerged that a Virginia woman had been submerged by a flood of emails. Hundreds of automated messages poured in over a 24-hour period, including newsletters and promotions she’d never signed up to. But this was no ordinary spam campaign. The real reason behind the inbox blitz was to bury a legitimate email from the victim’s bank warning her about a fraudulent laptop purchase. This is email bombing. And if it’s happened to you, it could be a warning sign that your identity or online accounts have been hijacked by fraudsters."
  https://www.welivesecurity.com/en/cybersecurity/inbox-flooded-signup-messages-email-bombing/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand