โพสต์ถูกสร้างโดย NCSA_THAICERT

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• Swann Communications SWIFI-SE2KIC
  "Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02

Vulnerabilities

• SAP Warns Of Maximum Severity OAuth2 SSRF Security Flaw
  "SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. The SAP Python SDK is the official programmatic toolkit for developing AI agents and Python applications on the company's SAP Business Technology Platform (BTP) services. Tracked as CVE-2026-89111, the maximum-severity vulnerability patched this month can be exploited by remote attackers without privileges to steal credentials."
  https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-oauth2-ssrf-security-flaw/
  https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html
• Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
  "Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0."
  https://thehackernews.com/2026/10/two-critical-marklogic-flaws-could-give.html
• Microsoft October 2026 Patch Tuesday Fixes 1,411 Flaws, 3 Zero-Days
  "Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. This Patch Tuesday addresses 70 "Critical" vulnerabilities, 57 of which are remote code execution, 11 are elevation of privileges, and 2 are spoofing."
  https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/
  https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/
  https://www.darkreading.com/vulnerabilities-threats/zero-days-microsoft-october-patch-tuesday
• A Series Of Unauthenticated Events: Chained Exploitation Of Ivanti Connect Secure Zero-Days
  "Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory providing upgrade instructions to customers. Systems exhibiting signs of compromise, such as attempts to move laterally originating from the ICS VPN device, should be forensically investigated to ensure no breach has occurred."
  https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
  https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
  https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/
  https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html
  https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
  https://www.bankinfosecurity.com/ivanti-vpn-zero-day-exploited-in-active-attacks-a-33094
  https://cyberscoop.com/ivanti-connect-secure-zero-day-actively-exploited/
  https://www.securityweek.com/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn/
• Docker Hub Security Advisory: Personal Access Tokens Transferred During Account-To-Organization Conversions
  "On September 30, 2026, security researchers reported a vulnerability in Docker Hub’s identity and access management through our Vulnerability Disclosure Program. We confirmed the report and deployed a fix to production the same afternoon, less than four hours after receiving it. We then reviewed every account conversion back to the date the flaw was introduced, and on October 2, notified every user and organization owner whose account could have been impacted by this vulnerability. This post explains what the vulnerability was, what it could and could not do, what we found, and what we have changed."
  https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/
  https://www.bleepingcomputer.com/news/security/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images/
  https://thehackernews.com/2026/10/docker-fixes-critical-two-year-old-hub.html
• Adobe Patches 140 Vulnerabilities Across 10 Products
  "Adobe has published 10 new security advisories to inform customers about roughly 140 vulnerabilities found and patched in its products. Adobe ColdFusion updates address 32 vulnerabilities, including critical bugs that can be exploited for code execution and privilege escalation. A significant number of flaws have been patched by Adobe in the Content Credentials SDK. The product received fixes for 30 vulnerabilities, many described as high-severity issues that can lead to a security feature bypass. Some security holes can be exploited to cause a DoS condition."
  https://www.securityweek.com/adobe-patches-140-vulnerabilities-across-10-products/
• Ghostscript Flaw Lets Hackers Hijack Servers Via PDF Uploads
  "A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. The flaw was discovered on August 23 by researchers at Defiant's platform Wordfence using their Argus AI-powered system. Ghostscript is a PostScript and PDF interpreter that can render PDFs as images, generate thumbnails for previews, and optimize PDF files by compressing embedded images and removing unnecessary font data."
  https://www.bleepingcomputer.com/news/security/ghostscript-flaw-lets-hackers-hijack-servers-via-pdf-uploads/
• CISA Adds Two Known Exploited Vulnerabilities To Catalog
  "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-96951 Microsoft Windows Command Injection Vulnerability
  CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
  https://securityaffairs.com/200887/security/u-s-cisa-adds-ivanti-connect-secure-flaw-to-its-known-exploited-vulnerabilities-catalog.html
• AI Models May Be Capable Of Self-Replicating Without Access To a Datacenter
  "Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes. A replicator like this would be challenging to shut down, since there’s no centralized point to shut off—though it may be slow (with a doubling time of days). Unlike non-AI malware, it could also figure out unfamiliar devices on its own. In our evaluations, a 9B model got inference running on 8 of the 9 hardware types we tested."
  https://www.anthropic.com/research/self-replicating-ai
  https://www.bleepingcomputer.com/news/security/anthropic-warns-self-replicating-ai-could-spread-to-your-smart-devices/
  https://www.darkreading.com/perimeter/anthropic-ingredients-future-ai-worms
  https://thehackernews.com/2026/10/anthropic-warns-small-ai-models-could.html
  https://www.theregister.com/ai-and-ml/2026/10/13/anthropic-conjures-another-threat-that-doesnt-exist-yet-to-stoke-fears-of-ai-apocalypse/5302866
  https://www.securityweek.com/small-ai-models-may-soon-be-able-to-self-replicate-on-iot-devices-anthropic-warns/
  https://securityaffairs.com/200880/ai/anthropic-shows-how-small-ai-models-could-replicate-across-iot-devices.html
• Check Point Research Discovers High Risk Vulnerabilities In LiteLLM, One Of The Most Widely Used LLM Gateways
  "Check Point Research has discovered two high risk vulnerabilities in LiteLLM, the open source LLM gateway that organizations use to connect their applications to AI providers such as OpenAI, Google and Anthropic. With 97 million downloads per month and over 59,000 GitHub stars, LiteLLM runs inside large enterprises, startups and many of the platforms used to build AI applications."
  https://blog.checkpoint.com/security/check-point-research-discovers-high-risk-vulnerabilities-in-litellm-one-of-the-most-widely-used-llm-gateways/
  https://research.checkpoint.com/2026/when-llm-gateways-go-wrong-findings-from-litellm/
• SlugFest: Millions Of AI Agents Install Npm Packages Exposed To Malicious Takeover Through GitHub
  "AI agents are quietly turning people who’ve never installed a code package into new cogs in the supply-chain risk machine. They’re also supercharging the developers who were already part of it, pulling in far more than they ever used to manually. We wanted to see exactly what that looks like in practice, so we studied how millions of AI agents behave across large enterprises. One number jumped out: the average agent installs 70 packages a month, with some developer endpoints hitting 350 a month. So we asked: what does the next shai-hulud look like? We found a way to take over thousands of packages downloaded by your agents daily - and the worst part - the gap was actively exploitable for 4 months after disclosure."
  https://bloom.security/blog/slugfest-millions-of-ai-agents-download-exposed-npm-packages
  https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html
  https://www.helpnetsecurity.com/2026/10/13/slugfest-npm-trusted-publishing-flaw/
• LG WebOS Sync-Demo Preauth RCE
  "This report covers a fullchain built from sync-demo LG-signed manifest replay client-key issuance bypass, cmp-client interactiveUrl PalmServiceBridge SSRF, and pmlogd collectAllLog targetDir command injection. First, the attacker replays the LG-signed manifest embedded in com.webos.app.sync-demo. SSG trusts the signature and follows the STB_INTERNAL_CONNECTION prompt-skip path, issuing a SECURE-tier client-key without a PIN prompt. Then cmp-client navigates to an attacker-controlled interactiveUrl. The loaded page keeps the app instance bridge and calls Luna services as cmp-client. Finally, collectAllLog inserts targetDir and targetFile into shell command strings. Shell metacharacters in targetDir execute in the root PmLogDaemon context."
  https://ssd-disclosure.com/lg-webos-sync-demo-preauth-rce/
  https://thehackernews.com/2026/10/lg-smart-tvs-vulnerable-to-pre-auth.html
• VerCellBreak: How We Escaped Vercel's Hardened Sandbox
  "In July, OpenAI's agents escaped their evaluation sandbox and breached Hugging Face. They didn't break through the sandbox walls. The sandbox let them reach a single internal service, a package manager, and the agents made it send internet requests on their behalf. A few weeks later, Vercel opened a bug bounty for its sandbox, covering both network and VM isolation. We went looking for the same pattern, and found it. Vercel built its sandbox to run untrusted code while containing what that code can touch: the host it runs on, and the servers it's allowed to reach."
  https://www.air.security/blog-posts/vercel-break
  https://therecord.media/sandbox-vulnerability-gives-rogue-ai-agents-path-out

Malware

• RSVP To Disaster: How One Click Installs a RAT
  "Imagine receiving a digital invite from a friend or relative. The message looks legitimate; the timing feels believable, and curiosity naturally takes over. This sense of curiosity and trust is exactly what cybercriminals are exploiting. The Cofense Phishing Defense Center (PDC) has recently intercepted a malicious email disguised by an online event invitation. Choosing to RSVP through the attached URLs leads users to a fake event page containing malware that grants threat actors remote access to systems."
  https://cofense.com/blog/rsvp-to-disaster-how-one-click-installs-a-rat
• “Don’t Get Played”: TOKEN2049 Security Event Faces Remote-Access Scam Allegations
  "A crypto security event that promised to teach attendees how to avoid scams is now the subject of scam allegations. The gathering, branded “Don’t Get Played,” was held as a side event during TOKEN2049 week in Singapore and co-hosted by groups operating under the names “Apex Accelerator” and “Stone Venture.” According to a police report filed by one attendee with the Singapore Police Force, the organizers allegedly pressured guests to install software that would have handed the organizers remote control of their computers. The allegation first gained traction on X, where several other users claimed they had also been approached by the same group."
  https://cyble.com/blog/dont-get-played-token2049-scam-allegations/
• Kimsuky’s Operation GitPower Targeting Ukraine Behind The Front Lines Of Russia’s War
  "This report analyzes a case in which attack tactics observed in Operation GitPower were used to target Ukrainian experts in diplomacy, security, and international politics. In particular, the threat actor has carried out persistent and relentless attacks against Ukrainian civil society figures working to repair war damage and rebuild the country following Russia’s invasion of Ukraine. This attack is particularly noteworthy as it indicates that Kimsuky has expanded its targeting scope beyond its traditional focus on South Korea to include key individuals in Ukraine. Although cyberattack attempts targeting specific individuals in Ukraine were identified, our investigation found that most of the observed attempts were unsuccessful."
  https://www.genians.co.kr/en/blog/threat_intelligence/operation-gitpower
  https://www.darkreading.com/cyberattacks-data-breaches/north-korea-phishes-ukrainians-war-intel
  https://therecord.media/north-korea-hackers-russia-ukraine
• Scammers Know Your Name, And They’re Counting On You To Reply
  "Scammers are finding different ways to use personal details exposed in data breaches to lure people into conversations. Last week, we showed how a Facebook Marketplace listing used the recipient’s name to make a text asking “Is this still available?” more convincing. The one we got this week was a lot simpler. No suspicious link. No overdue payment. No warning that your account is about to be closed. No fake images. Just your name, followed by a question mark."
  https://www.malwarebytes.com/blog/threat-intel/2026/10/your-whos-this-reply-is-exactly-what-text-scammers-want
• The Noise Inside The Network: How An Unsophisticated Attack Exposed a Third-Party Risk
  "When unusual activity was detected on a European bank’s central IT system, its internal security team quickly recognized that the incident warranted immediate response. They discovered unauthorized VPN-based access attempts that spanned several months. They then engaged Unit 42 to determine the full scope of the intrusion, identify any persistent footholds and secure the environment. While the activity appeared to be a stealthy cyberespionage campaign, the actual intrusion was made possible by gaps in foundational security controls. Rather than relying on novel techniques, the threat actor succeeded through persistence, exploiting weaknesses that stronger identity protections and basic security hygiene could have prevented. The case highlights an important lesson: Sometimes the most damaging intrusions begin with the simplest oversights."
  https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/
• XWorm Reborn: From Infostealer To Surveillance Platform
  "In September 2024, Netskope Threat Labs first reported on XWorm and its infection chain. The following year, in July 2025, we reported version 6.0 and its more advanced features. As we continued tracking the malware over the past year, we identified four distinct XWorm versions operating concurrently in the wild. Detection volume remains elevated, with Netskope Threat Labs recording 1,236 events across more than 100 customer organizations in Q3 2026, marking a 4x increase over Q3 2025. The public leak of the V6.4 builder in mid-2025 drove this initial surge, keeping activity consistently above pre-leak baselines ever since. The financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States."
  https://threatlabs.netskope.com/blog/2026/09/xworm-reborn
  https://www.securityweek.com/xworm-rat-evolves-into-surveillance-platform/

Breaches/Hacks/Leaks

• UK Housing Ombudsman Service Investigates 'security Incident'
  "The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday. Established under the Housing Act 1996, the Housing Ombudsman is an executive non-departmental public body sponsored by the Ministry of Housing, Communities, and Local Government. The watchdog settles disputes between social housing residents and social landlords in England, including housing associations, landlords, managers, and letting agents."
  https://www.bleepingcomputer.com/news/security/uk-housing-ombudsman-service-investigates-security-incident/
• TFG London Cyberattack Disrupts Systems At Hobbs And Whistles Retailers
  "TFG London detected a cybersecurity incident that impacted IT systems used by the Phase Eight, Hobbs, and Whistles premium fashion brands. The company disclosed earlier today that several IT systems remain unavailable, although physical stores remain open for customers. According to the press release, the incident has not affected the group’s other brands, Inside Story and White Stuff, or its operations in Australia and Africa."
  https://www.bleepingcomputer.com/news/security/tfg-london-cyberattack-disrupts-systems-at-hobbs-and-whistles-retailers/
  https://therecord.media/foschini-group-south-africa-cyber
  https://www.theregister.com/cyber-crime/2026/10/13/owner-of-fashion-brands-hobbs-and-whistles-joins-autumn-pwned-collection/5302752
• Russian Internet Provider SkyNet Reports Outages After Cyberattack Claimed By Ukrainian Hackers
  "A major internet provider in Russia's second-largest city, St. Petersburg, has reported days of service disruptions following a cyberattack claimed by a Ukrainian hacking group. SkyNet said in a statement on Friday that its network had been disrupted by a distributed denial-of-service (DDoS) attack since October 6, affecting services including online gaming, voice calls and video conferencing. The company said customers could experience slow connections, high latency and interruptions to audio and video services as it worked to mitigate the attack. It did not say when normal operations would resume."
  https://therecord.media/russian-internet-provider-skynet-reports-outages-ddos

General News

• Enterprises Struggle To Track AI Agent Actions
  "Nearly half of organizations say an artificial intelligence agent may have taken an action in the past year that the business did not intend, expect or authorize, new research shows. AI agents are moving into business operations faster than many companies can track their actions or stop them when something goes wrong, creating a growing challenge for technology leaders. The AI and API Security Trends 2026 (H2) report from cybersecurity vendor Salt Security found that nearly half of respondents confirmed or suspected an unintended agent action. Among that group, 54% reported an external API call or transaction, half reported a configuration or permission change and 42% reported that data was modified or deleted. Respondents could select more than one outcome."
  https://www.bankinfosecurity.com/enterprises-struggle-to-track-ai-agent-actions-a-33096
• The Department Of Justice Announces Results Of Law Enforcement And Private Industry Joint Disruption Week Targeting Online Scam Accounts And Transnational Criminal Networks Operating In West Africa
  "Transnational criminal scam networks operating from West Africa suffered major disruptions last week during a coordinated international “Joint Disruption Week,” an effort that produced arrests, seizures, and the largest-ever takedown of fraudulent social media accounts linked to scam centers in the region, announced the Department of Justice. “Criminals beware: Law enforcement from around the world are working together, and with private industry, to find you, stop your schemes, and bring you to justice,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “The Criminal Division’s Cyber-Enabled Scam Initiative (CSI) was built for this brand of collaboration. The millions of bogus social media accounts taken down and dozens of arrests that took place as part of Joint Disruption Week are just the beginning."
  https://www.justice.gov/opa/pr/department-justice-announces-results-law-enforcement-and-private-industry-joint-disruption
  https://therecord.media/ghana-nigeria-scam-centers-raided-uk-us
  https://cyberscoop.com/west-african-scammers-international-scam-crackdown-joint-disruption-week/
• Be a Good AI Ancestor: Cybersecurity Already Gave Us The Playbook
  "AI has brought us to a familiar inflection point in the story of privacy, cybersecurity, and online safety. We have an opportunity to apply decades of cybersecurity experience before the next generation of technology creates consequences we cannot easily reverse. I learned the importance of that responsibility through a three-year-old child I’ll call Adia. Her name is a protective pseudonym."
  https://www.helpnetsecurity.com/2026/10/13/cybersecurity-ai-safety-red-lines/
• Most High-Severity Cloud Security Findings Are Downgraded Once An AI Agent Checks The Environment
  "Cloud security platforms turn every failed rule into a finding, and those findings pile up in queues sorted by severity. Research from Sola Security tested what happens to that order when each finding gets checked against the environment where it lives. The researchers, Leon Goldberg and Gal Engelberg, built an AI agent that re-grades findings raised by third-party cloud security platforms. They ran it on 9,967 HIGH findings from two commercial platforms in eight production environments, and the agent changed the grade of 75.1% of them. Most moved down (58.5%), and 16.6% moved up."
  https://www.helpnetsecurity.com/2026/10/13/cloud-security-findings-severity-ai-agent/
  https://arxiv.org/pdf/2610.08895
• The Enterprise Threat Intelligence Report: 2026
  "Threat intelligence teams are heading into 2027 with more than ever to monitor, driven by an acceleration in the AI threat landscape. However, their expanded mandate typically doesn’t come with a proportional budget windfall. Instead, teams are under pressure to get greater value from the intelligence, systems, and analyst expertise already available to them. New independent research commissioned by Flashpoint shows where that pressure is being felt most. Alert noise and false positives are the most frequently cited challenges affecting threat intelligence program effectiveness, followed by analyst bandwidth, changes in the threat landscape, and integration across security tools. At the same time, AI-related threats have emerged as the leading area where practitioners want to expand intelligence coverage."
  https://flashpoint.io/blog/enterprise-threat-intelligence-report-2026/
  https://www.infosecurity-magazine.com/news/defenders-skeptical-agentic-ai/
• Fifth Of CISOs Take Time Off To Avoid Patch Tuesday
  "One-in-five cybersecurity leaders has either called in sick or deliberately booked holiday time off to avoid Patch Tuesday, according to new data from Socura. The MDR specialist polled 500 UK CSOs, CISOs and heads of IT security to better understand their attitudes to AI and the once-a-month date where Microsoft, Adobe and other vendors release their latest security updates. While a plurality (41%) revealed that they have worked overtime to manage the patching cycle and over a third (37%) claimed they’ve worked late to deploy patches, a significant 22% said they have tried to swerve the date altogether."
  https://www.infosecurity-magazine.com/news/fifth-cisos-take-time-off-avoid/
• A Five-Step Framework To Sufficient Realism In Cyber Simulations
  "In late August 2026, the Army’s chief of Network Command (NETCOM) announced that to take full advantage of artificial intelligence (AI), the Army needed a comprehensive simulation of its networks. While acknowledging the difficulty in building a digital twin, Maj. Gen. Jacqueline Denise McPhail stated in Breaking Defense that a simulation would create “an ultra-realistic training ground for network operators, cyber defenders, and AI algorithms on how the network works and how to keep it working, even when under attack.” Since 2017, the SEI has been developing and expanding the GHOSTS framework as a platform for simulating complex human, organizational, and machine behavior for cyber-training simulations. It began with simulated users operating real applications on hosts, producing the traffic, logs, files, browser history, and other artifacts defenders expect to encounter."
  https://www.sei.cmu.edu/blog/a-five-step-framework-to-sufficient-realism-in-cyber-simulations/
• Two Arrested As DOJ Takes Down Laptop Farms Responsible For $3 Million In North Korean Revenue
  "The Department of Justice disrupted multiple laptop farms across Texas allegedly being used by North Korean nationals to facilitate an IT worker scheme that allows the country to earn millions from U.S. companies. The laptop farm raids, which were conducted September 21-25, targeted more than 40 residences, the DOJ said. Law enforcement seized 187 laptops and other devices used by North Koreans. Such schemes have earned millions over the last eight years by tricking U.S. companies into hiring workers remotely into lucrative IT roles through stolen or purchased identities."
  https://therecord.media/north-korea-laptop-farms-worker-scams-doj-raids-texas
  https://cyberscoop.com/doj-north-korea-remote-work-laptop-farms/
• What To Do When a Data Breach Notice Doesn't Say Much
  "Publicly reported data breaches hit an all-time high in the US last year, with over 3,300 incidents recorded and nearly 280 million victim notices mailed out. But are all of these worth the paper they’re written on? Increasingly, they lack crucial details. As the volume of data breach incidents increases, there’s a growing chance that you’ll be caught up in one. According to the non-profit Identity Theft Resource Center (ITRC), over 471 million victim notices went out in the first half of 2026 alone. Yet just a quarter (24%) contained details about the attack vector. That’s the lowest ever rate recorded by the ITRC."
  https://www.welivesecurity.com/en/how-to/what-to-do-when-a-data-breach-notice-tells-you-almost-nothing/
• AI Turns Familiar Cyberattacks Into a Race Against Time
  "In the AI era, phishing remains the top attack vector in both use (17% of breaches) and breach costs (averaging at $5.29 per breach) according to the IBM Cost of a Data Breach Report 2026. AI creates more personalized content for phishing with higher success rates. At the same time, AI can identify vulnerabilities, use the phished entry point and elevate privileges for lateral movement at greater speed. None of this is new – cyberattacks haven’t changed with AI. “It just allows attackers to do the same familiar things much faster and at greater scale than ever before. The pressure comes from minimizing the time for defenders to respond,” says Steve Wallin, director of core integration and R&D labs leader at IBM UK."
  https://www.securityweek.com/ai-turns-familiar-cyberattacks-into-a-race-against-time/
• Statistical Report On Malware Targeting Linux SSH Servers In The Third Quarter Of 2026
  "The AhnLab SEcurity intelligence Center (ASEC) collected attack logs targeting poorly managed Linux SSH servers through honeypots. This report compiles statistics by categorizing the attack sources identified in the third quarter of 2026, the attacks carried out from those sources, and the malware used."
  https://asec.ahnlab.com/en/95808/
• Q3 2026 Statistical Report On Malware Targeting Windows Database Servers
  "The AhnLab SEcurity intelligence Center (ASEC) observed and classified attacks targeting MS-SQL servers and MySQL servers installed on Windows operating systems via the ASD infrastructure. This report summarizes the damage status, attack status, and the types of malware used in the attacks, based on logs identified in the third quarter of 2026."
  https://asec.ahnlab.com/en/95809/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

เมื่อวันที่ 13 ตุลาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 2 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-96951 Microsoft Windows Command Injection Vulnerability
• CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Financial Sector

• When Banks' AI Agents Meet Customers' AI Agents
  "Artificial intelligence agents are beginning to operate on both sides of banking transactions. Financial institutions are deploying agents internally to handle customer service, fraud, risk and operational tasks, while customers are gaining access to agents that can shop, negotiate and make payments on their behalf. As these two models converge, banks face a new challenge: determining how much authority to give AI agents and how to establish trust when machines increasingly transact with other machines."
  https://www.bankinfosecurity.com/blogs/when-banks-ai-agents-meet-customers-ai-agents-p-4216

New Tooling

• Strands Box: The Big Picture
  "I talk to AWS customers about agents nearly every day. I hear a lot of excitement about the results they’re already seeing from agents, including for software development, operations, business processes, and directly serving their customers. I also hear a deep desire for more control, stronger security, and a deeper understanding of how their agents are working. Guided by our customers, we are investing deeply in agent safety, isolation, and policy at AWS. Last summer we released AgentCore, our platform for building and optimizing agents. AgentCore Runtime is at the center of AgentCore: a secure sandbox for running agents, where each session with each agent gets its own dedicated MicroVM (based on Firecracker, and AWS’s two decades of investment in virtualization security). Later last year we released AgentCore Policy, allowing fine-grained control over how cloud-hosted agents use their tools, leveraging the Cedar policy language originally developed at AWS."
  https://strandsagents.com/blog/strands-box-the-big-picture/
  https://www.helpnetsecurity.com/2026/10/12/aws-strands-box-open-source-ai-agent-sandbox/
  https://github.com/strands-agents/box

Vulnerabilities

• GitLab Warns Of Max Severity Code Execution Vulnerability
  "GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. Tracked as CVE-2026-97229, this critical security flaw was discovered by a security researcher using the 'joaxcar' handle and reported via GitLab's HackerOne bug bounty program. CVE-2026-97229 stems from an integer overflow weakness in GitLab's CI/CD Regular Expression Compiler, which parses, compiles, and evaluates regular expressions in projects' pipeline configuration files."
  https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/
• Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited In Bricksforge Plugin
  "This blog post covers a Critical unauthenticated arbitrary file upload vulnerability in the Bricksforge (opens in new tab) plugin for WordPress. Patchstack has deployed a mitigation rule to protect against exploitation of this vulnerability. If you are a Bricksforge user, update to at least version 3.1.8.10. This vulnerability is currently being targeted in the wild. Tracked as CVE-2026-85097 (opens in new tab), the issue allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, leading to remote code execution (RCE). It affects Bricksforge versions up to and including 3.1.8.9. A fix is available in version 3.1.8.10, and organizations running affected versions should upgrade as soon as possible."
  https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/
  https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html
  https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/
• Months-Old Palo Alto VPN Vulnerability Remains a Target For Ransomware Groups
  "Ransomware groups continue to target a high-severity vulnerability in Palo Alto Networks products, despite a security patch being released five months ago, according to ReliaQuest. The cyber threat detection provider warned in a social media advisories posted on October 9 that multiple groups, including the Qilin and Settra ransomware operations, are actively targeting CVE-2026-0257 to establish unauthorized VPN sessions and gain initial access to internal networks. CVE-2026-0257 is an authentication bypass vulnerability in PAN-OS GlobalProtect and Prisma Access that affects several Palo Alto Networks products, including PAN-OS versions 10.2.0, 11.1.0, 11.2.0 and 12.1.0 and two versions of Prisma Access (10.2.0 and 11.2.0)."
  https://www.infosecurity-magazine.com/news/palo-alto-vpn-vulnerability-target/

Malware

• From Endpoint To Funhouse: Evolution Of Ransomware Families And Kimsuky-Linked Distribution Cases
  "AhnLab SEcurity intelligence Center (ASEC) recently identified a case in which the Kimsuky group ultimately distributed the Funhouse ransomware via a malicious Hangul document that was disguised as a resume. The Funhouse ransomware was identified as a variant of previously disclosed endpoint ransomware, and the tools used in this attack—such as Quasar RAT—as well as the overall attack chain shared numerous similarities with Kimsuky’s endpoint ransomware distribution cases observed since the first half of 2026. In this blog post, we analyze the recently identified Funhouse ransomware distribution campaign and summarize its connections to Kimsuky’s previous Endpoint ransomware distribution campaigns."
  https://asec.ahnlab.com/en/95775/
• Ledger Confirms Spy Chip Implant Behind Wallet Crypto Thefts
  "Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. The company has been investigating reports of users losing funds from wallets purchased through CryptoBilis, a major Malaysia-based hardware wallet retailer operating across Southeast Asia. Some researchers have shown the implant in Ledger X since September 16, saying tampered devices were available for nearly half the price of the original hardware."
  https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/
  https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html
  https://www.helpnetsecurity.com/2026/10/12/ledger-wallets-compromised-via-hardware-implant/
• Inside AvisLoader: A Windows Malware Loader Built To Resist Disruption
  "Varonis Threat Labs recently discovered AvisLoader, a new Windows loader named after the Latin word for bird. We found it on an exposed staging server alongside a ClickFix lure, supporting tools, and its Command Center. The attack starts with a familiar ClickFix lure. A page posing as a document-signing request asks visitors to copy and run an attacker-supplied command on their machine. The more interesting part is how AvisLoader stays connected. It communicates via Tox, an encrypted peer-to-peer (P2P) messaging network that carries commands and additional payloads from the operator."
  https://www.bleepingcomputer.com/news/security/inside-avisloader-a-windows-malware-loader-built-to-resist-disruption/
• CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure
  "SOCRadar’s Threat Research Unit (STRU) has documented CyberXero, a Russian-speaking, financially motivated Initial Access Broker that pairs commodity offensive tooling with an AI orchestration layer running on its own infrastructure. The operation runs two pipelines at once: a global, automated campaign against WordPress and e-commerce platforms, and a curated, manual campaign against Ukrainian energy and critical infrastructure. More than 628,000 Ukrainian individuals have confirmed data in the actor’s possession, including residents of Kharkiv, a city on an active war front. The entire operation surfaced from a single configuration error: an exposed open directory that served the actor’s live working directory, including AI session logs, scripts with plaintext tokens, and exfiltrated victim data. CyberXero remained active throughout the investigation and was still active at the time of publication."
  https://socradar.io/blog/cyberxero-ai-iab-ukraine-critical-infrastructure/
  https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html
  https://securityaffairs.com/200803/cyber-crime/cyberxero-used-51-ai-agents-to-steal-628000-ukrainian-records.html
• Canonical Websites Disrupted In Second DDoS Attack This Year
  "Canonical’s websites were disrupted last week by a distributed denial-of-service (DDoS) attack, months after a larger attack hit the Ubuntu maker’s infrastructure. The company confirmed the attack on October 8 in a post on the Ubuntu Discourse forum. “Canonical’s websites are under a sustained distributed denial of service attack,” the company said, adding that some services might not be reachable at times. The disruption was limited to Canonical’s primary web properties, OMG! Ubuntu reported. These included ubuntu.com, canonical.com, the Ubuntu blog and developer site, and Ubuntu’s security advisory pages and API."
  https://www.securityweek.com/canonical-websites-disrupted-in-second-ddos-attack-this-year/
  https://securityaffairs.com/200832/security/canonical-hit-by-second-ddos-attack-in-2026.html

Breaches/Hacks/Leaks

• Cyberattack Shuts Down Refrigerators At French Supermarkets
  "Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. Victims include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, with French outlets reporting that the attack affected 250 to 350 stores, causing significant financial losses and food waste. The threat actors hijacked refrigeration controllers running older versions of Danfoss control software on Sunday night and used them to raise supermarket refrigerator temperatures by triggering a built-in automatic defrosting system."
  https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/
  https://therecord.media/cyberattack-disrupts-refridgeration-in-france
  https://www.infosecurity-magazine.com/news/french-supermarket-chains/
  https://www.helpnetsecurity.com/2026/10/12/france-cyberattack-supermarket-freezers/
• Retail Giant Ahold Delhaize Takes Systems Offline After Cyberattack
  "Retail giant Ahold Delhaize, one of the world's largest food retail chains, confirmed today that it was forced to take some systems offline after a "cybersecurity incident." As a wholesale company and multinational retailer, Ahold Delhaize operates more than 9,400 local stores across Europe, the United States, and Indonesia, employs nearly 400,000 people, and serves around 60 million customers each week through physical retail locations and online. Ahold Delhaize reported yearly net sales of over $104 billion in 2024, and it owns a wide range of brands, including Delhaize, Maxi, Mega Image, Albert, bol, Alfa Beta, Etos, Gall & Gall, and Profi in Europe, and Food Lion, Stop & Shop, Giant Food, and Hannaford in the American market."
  https://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhaize-takes-systems-offline-after-cyberattack/
  https://www.bankinfosecurity.com/supermarket-chain-ahold-delhaize-caught-in-cyber-incident-a-33072

General News

• September 2026 Dark Web Breach Incident Trend Report
  "The September 2026 Dark Web Breach Incident Trend Report focuses on data breach cases and the sale of initial access credentials posted on the deep web and dark web forums. The report explicitly states that the accuracy of some of its content cannot be fully verified due to the nature of the sources."
  https://asec.ahnlab.com/en/95764/
• September 2026 Dark Web Issue Trend Report
  "The September 2026 Dark Web Issue Trend Report summarizes major issues that occurred on the deep web and dark web. However, the report notes that due to the nature of the sources, it may be difficult to fully verify the accuracy of some information."
  https://asec.ahnlab.com/en/95769/
• September 2026 Dark Web Threat Actor Trend Report
  "The September 2026 Dark Web Threat Actor Trend Report focuses on threat actors active on the deep web and dark web, as well as publicly reported cyberattack incidents. It is noted that the factual accuracy of some content cannot be independently verified."
  https://asec.ahnlab.com/en/95770/
• No Identity, No Recovery: Cyber Resilience Starts With IAM
  "Enterprises need cyber resilience to ensure that they can sustain operations in the face of ransomware and other cyber threats, and a frequently underappreciated piece of cyber resilience is identity resilience. Identity resilience is a prerequisite to cyber resilience. While you might have a resilience plan for your data and apps, that doesn't matter if teams can't access their apps because your identity infrastructure is inaccessible."
  https://www.darkreading.com/cybersecurity-operations/cyber-resilience-starts-with-iam
• Geopolitics And The Cyber Resilience Gap Belong In Your Threat Model
  "In this Help Net Security interview, Akshay Joshi, Head of the Centre for Cybersecurity at the World Economic Forum, talks about how AI, geopolitics and industrialized fraud are changing cyber risk. He discusses findings from the Global Cybersecurity Outlook 2026, including that CEOs now rank cyber-enabled fraud above ransomware as their top concern. Joshi explains the widening resilience gap between large and small organizations and between regions, the role of skills shortages, and what public-private cooperation needs to work at scale. He also offers advice for CEOs and boards."
  https://www.helpnetsecurity.com/2026/10/12/akshay-joshi-wef-cyber-resilience-gap/
• AI Vulnerability Patching Has a Grading Problem
  "Researchers at Northwestern University tested AI coding agents on 112 real security bugs. They found that a patch which stops a crash often fails the checks the project’s maintainers wrote for the fix. With Claude Opus 4.7, third of the patches that made the crash go away still failed those maintainer tests. If you’re thinking about letting an AI tool patch vulnerabilities for you, this is the number to look at. Many security patching benchmarks grade a fix on one question: does the proof-of-concept input, the sample that triggers the bug, still crash the program? A patch can pass by blocking the path to the crash and leaving the flaw where it was. The authors call that kind of fix “strictly worse than no fix at all,” since it tells you the problem is solved when it isn’t."
  https://www.helpnetsecurity.com/2026/10/12/ai-vulnerability-patching-grading-problem/
  https://arxiv.org/pdf/2610.10150
• How Much Does It Cost To Use Open Source Software?
  "Open source software is used pervasively, with some estimating that over 90% of codebases contain open source software. Many adopt open source software because it’s free and thus cheaper than writing a proprietary alternative. But as the community saying goes: “open source is free as in puppies, not free as in beer.” Once you or your organization has adopted an open source project, there is still effort (such as engineering time, costs, etc.) associated with ensuring that your version of an open source project is healthy and up to date. While efforts by the research community have investigated the ongoing costs required to maintain open source software, at Google we needed to better understand the resources required to use thousands of open source software packages."
  https://opensource.googleblog.com/2026/10/how-much-does-it-cost-to-use-open-source-software.html
  https://www.helpnetsecurity.com/2026/10/12/google-open-source-maintenance-costs-report/
• Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
  "The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up. Regardless, the tech world is mesmerized by the capabilities and potential of these services. Less than a year after the first release of the open-source agent now called OpenClaw, the juggernauts are putting their weight behind the idea that each of us needs a personal assistant."
  https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Financial Sector

• PCI SSC Calls For Human Approval Of AI Agent Actions Involving Cardholder Data
  "The PCI Security Standards Council (PCI SSC) has published Security Considerations for AI Systems, guidance covering the protection of data supplied to AI systems in payment environments and defenses against AI-assisted attacks. Developed with industry stakeholders, the document addresses governance, deployment, access controls, testing and the application of PCI standards. Its recommendations are advisory, and existing PCI requirements take precedence. “As AI is increasingly used in payment environments, there is an obligation for all parties to ensure the technology is used responsibly,” said Gina Gobeyn, Executive Director, PCI SSC. “This additional guidance provides a practical starting point for secure AI implementation.”"
  https://www.helpnetsecurity.com/2026/10/09/pci-ssc-payment-environments-ai-security-guidance/

Industrial Sector

• Thousands Of Wind And Solar Park Systems Sit Exposed On The Internet Across Europe
  "Modat and NCSC-NL, the Dutch government’s cybersecurity center, found 8,547 internet-facing systems at wind farms and solar parks in 35 countries in and around the EU that should not be reachable from the internet. The systems range from login screens to a turbine control page that offers a Stop button to anyone with a browser. Operators in Spain, Greece, Italy and Germany account for most of the confirmed systems. The real number is higher. A system only made the list once the team could link it to a specific solar or wind site."
  https://www.helpnetsecurity.com/2026/10/09/eu-renewable-energy-cybersecurity/
• Super Intelligence Reached OT Systems And Moved Equipment
  "Just 16 minutes and change. That is how long it took frontier super intelligence models in one controlled test to move from a perimeter compromise to actions inside an industrial control network. In another scenario, a model found a robotic arm, mapped its protection zones and motion limits, and moved it within minutes. The models did this without source code, engineering documents, or advanced OT guidance. Across eight scenarios, every defined test objective was achieved. More important, the models connected work that usually spans multiple people and stages, including asset discovery, device research, attack planning, troubleshooting, and execution. Building on Booz Allen’s Cyber Weapon Index, this research extends our examination of super intelligence-enabled offensive capabilities beyond enterprise networks and into operational technology (OT), where cyber actions can directly affect machinery and industrial processes."
  https://www.boozallen.com/insights/cyber/frontier-si-reaches-ot-systems.html
  https://www.boozallen.com/assets/home/docs/cyber/frontier-ai-models-in-ot-environments.pdf
  https://www.theregister.com/security/2026/10/11/ai-systems-are-fully-capable-of-carrying-out-nightmare-attacks-against-infrastructure-and-nobodys-ready/5302450

New Tooling

• Launching An Opt-In Vulnerability-Finding Service For Open-Source Software
  "We’re launching OSS Scanner, an opt-in vulnerability scanner for the open-source ecosystem informed by our experience using Claude to find vulnerabilities during Project Glasswing. Projects that join will receive thorough, periodic security scans by our strongest models at no cost. Language models have rapidly advanced in their ability to discover vulnerabilities, as we have reported extensively on this blog. On CyberGym, one academic vulnerability-finding benchmark, LLMs have gone from finding under 20% of vulnerabilities at the beginning of last year to finding over 85% this year. As a result, open source maintainers have gone from receiving mostly slop from LLMs to receiving high-quality bug reports."
  https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source
  https://github.com/anthropics/oss-scanner
  https://thehackernews.com/2026/10/anthropic-launches-free-ai.html
  https://securityaffairs.com/200685/ai/claude-helps-secure-open-source-as-anthropic-offers-free-vulnerability-scanning.html

Vulnerabilities

• Citrix Warns Admins To Patch New NetScaler RCE Flaw Immediately
  "Citrix has warned IT administrators to patch systems immediately against a new critical vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. Tracked as CVE-2026-107406, this flaw stems from a memory overflow weakness that attackers can exploit to gain remote code execution (RCE) on targeted devices or trigger a denial-of-service state that can cause crashes. To be vulnerable, NetScaler ADC and NetScaler Gateway appliances must be configured as a Security Assertion Markup Language (SAML) Identity Provider (IdP) or Service Provider (SP)."
  https://www.bleepingcomputer.com/news/security/citrix-warns-admins-to-patch-new-netscaler-rce-flaw-immediately/
  https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/
  https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html
  https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/
  https://www.theregister.com/security/2026/10/09/citrix-gives-netscaler-admins-another-critical-reason-to-patch/5302212
  https://securityaffairs.com/200670/security/cve-2026-107406-citrix-fixes-critical-netscaler-adc-and-gateway-vulnerability.html
• Researchers Publish Working Exploit For Pre-Auth AnyDesk Linux Flaw That Gives Root Access
  "Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root access before anyone approves the connection. AnyDesk patched the flaw in version 8.0.3 in June, but its changelog described the fix only as "fixed a bug that could lead to a crash," with no CVE assigned and no security advisory. The exploit, called AnyPwn, targets a heap buffer overflow in AnyDesk's session protocol, a remote desktop tool. The code was released on GitHub on October 8."
  https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.html
• GoBalance Flaw Lets Attackers Hijack .onion Addresses By Recovering Tor-Format Keys
  "A bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's .onion address using only public information, and then take that address over. Searchlight Cyber, which disclosed the flaw on October 8, says an attacker who recovers the key can redirect the site's visitors to a copy of the site they control. Taking over the address does not grant the attacker access to the site's servers, database, or stored user data."
  https://thehackernews.com/2026/10/gobalance-flaw-lets-attackers-hijack.html

Malware

• Adception: Malvertising Another Search Engine’s Search Results To Redirect To a Malicious Page
  "Push recently detected an attack that began with a Google search ad for "claude mac" whose destination was a Bing search result, which passed the victim through a compromised retail website to a fake Claude installer. This led us to discover a crafty redirect and cloaking technique that we’re (unseriously) referring to as “Adception”."
  https://pushsecurity.com/blog/adception-malvertising-another-search-engines-search-results
  https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/
• Threat Actors Exploit Critical AhsayCBS Flaws To Drop Webshells And XMRig Cryptominer
  "On October 4, 2026, NVD disclosed two CVEs impacting the AhsayCBS backup utility: CVE-2026-105133 and CVE-2026-105134. Starting October 7 (23:20:15 UTC), Huntress began seeing threat actors exploiting the flaws to perform remote code execution on impacted hosts. As of October 8, Huntress has seen five organizations targeted via these flaws. Post-exploitation, threat actors are conducting reconnaissance, dropping webshells, planting XMRig cryptominers masquerading as Microsoft Edge, and more. They also dropped what appears to be an AI-assisted PowerShell script that monitors the Windows Task Manager and shuts it down if it remains open for too long in the middle of the night. AhsayCBS versions up through 10.3.4 are affected by this issue."
  https://www.huntress.com/blog/ahsaycbs-flaws-exploit
  https://www.bleepingcomputer.com/news/security/unpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto/
  https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html
  https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/
• Max Severity SonicWall SMA1000 Flaw Now Exploited In Attacks
  "Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago. Tracked as CVE-2026-102255, the flaw affects the Appliance WorkPlace interface on SMA1000 6210, 7210, and 8200v models, but does not affect the SMA 100 Series product line or SSL-VPN running on SonicWall firewalls. "By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations," SonicWall explained."
  https://www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks/
• How Luna Moth Runs Data Extortion Like a Business
  "Around October 5, 2026, an anonymous onion site called “The Luna Moth Files” claimed to expose internal material from Silent Ransom Group (SRG), also tracked as Luna Moth and UNC3753. The package includes chat exports, a vishing document, screenshots, and a purported fake employee résumé. Nobody knows who published it or how the archive was obtained, so we treat its claims as unverified unless independent sources back them up. The material contains no new exploit and no new malware. It does offer a view of how a social engineering-led extortion operation may organize its work."
  https://blog.checkpoint.com/security/how-luna-moth-runs-data-extortion-like-a-business/
• GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials From Entire Git Histories
  "On October 8, 2026, attackers operating the GhostAction GitHub Actions credential-theft campaign compromised two high-profile open-source maintainer accounts and swept 345 repositories in two automated windows lasting minutes. Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC. Eight hours later, the account of Henry Wu (henrywoo), the original author of Uber's athenadriver, was used to push the same workflow to 318 repositories in a 16-minute window, 21:10–21:26 UTC."
  https://www.stepsecurity.io/blog/ghostaction-returns
  https://thehackernews.com/2026/10/credential-stealing-github-actions.html
• Sleep, Beacon, Steal, Repeat - The Story Of P7 DarkSword Variant
  "In August 2026 we investigated a DarkSword infection that turned out to be a previously unseen variant, which we call P7 DarkSword. The name P7 comes from the threat actor’s use of the p7_ variable prefix in modifications to original DarkSword’s code. Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure. This post describes the investigation, the variant's capabilities, and the indicators that can be used to detect it."
  https://www.iverify.com/blog/darksword-variant-threat-research
  https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html
• Disrupting AI-Enabled “false Front” Operations
  "Over the past two and a half years, we’ve reported on many of the ways in which threat actors tried to use our models to conduct cyber attacks, covert influence operations (IO), scams, and other violations of our Usage Policies. We publish these reports to inform regulators, our industry peers, and wider society of how we see threat actors trying to leverage AI, and to shine a light on the vulnerabilities they try to exploit. We recently banned two IO—one from Russia and one from Iran—that used our models in combination with more traditional techniques and technologies to support sophisticated “false front” entities. They used those entities to launder geopolitical, conflict-related messaging into their target audiences."
  https://openai.com/index/disrupting-ai-enabled-false-front-operations/
  https://therecord.media/openai-disrupts-russian-iranian-operations-chatgpt
• Dire Wolf Ransomware Attacks: How To Test And Strengthen Your Defenses
  "Dire Wolf Ransomware is a double-extortion ransomware first observed in April 2025. By August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services. Its Go-based, UPX-packed encryptor gives every file a unique ChaCha20 key derived through Curve25519 and SHA-256, and encrypts only the first 1 MB of larger files for speed. Before encryption, it kills the Event Log service, deletes shadow copies and backups, disables Windows Recovery, and stops up to 75 services [1]. Afterward, it forces a reboot and deletes itself."
  https://www.picussecurity.com/resource/blog/dire-wolf-ransomware-attacks-how-to-test-and-strengthen-your-defenses
• Turning IDN Edge Cases Into Typosquats
  ""Check the address bar" is the one piece of security advice everybody has heard. It assumes the name there can be read correctly, which held while domain names could only contain English letters, digits, and a hyphen. Since 2003 they can use almost any writing system, so a Berlin bookshop can be bücher.de. Many of those characters look identical to Latin ones. Cyrillic has its own а, е, о, р, and с, which most fonts draw like Latin a, e, o, p, and c but applications treat as different characters. A name can therefore look like apple.com without being it."
  https://haveibeensquatted.com/blog/turning-idn-edge-cases-into-typosquats
  https://www.theregister.com/security/2026/10/10/two-characters-open-up-a-world-of-typosquatting-opportunities-in-chromium-browsers/5302383
• Can You Really Make More Than $200M In Six Months Without Encrypting Victims? It Seems Silent Ransom Group Can. (1)
  "DataBreaches has reported on Silent Ransom Group (SRG) since 2022, with particular interest in their numerous attacks on law firms. Those interested in the group should review our past coverage, which often includes exclusive material and details. Do you remember the Conti leaks in 2022 that were variously ascribed to either a Ukrainian researcher or a disgruntled member of Conti? Well, now Conti’s offspring, Silent Ransom Group, has experienced a leak, too, although we do not yet know to whom to ascribe it. This new leak includes material from two servers during the period August 27, 2025 – September 29, 2026 (slplsskdj2836v2jjsx[.]com and aim6umein3kee[.]com)."
  https://databreaches.net/2026/10/07/can-you-really-make-more-than-200m-in-six-months-without-encrypting-victims-it-seems-silent-ransom-group-can/
  https://securityaffairs.com/200719/cyber-crime/silent-ransom-group-allegedly-extorted-207-million-without-encrypting-files.html

Breaches/Hacks/Leaks

• Hundreds Of Thousands Impacted By Data Breach At Biosensor Firm iRhythm
  "Medical device maker iRhythm said the data of at least 360,000 people was breached in a June cyberattack. The company began filing breach notices in multiple states this week, telling regulators and victims that the incident occurred on June 8 and involved unauthorized access to third-party systems. iRhythm is best known for Zio Patch — a sensor that patients wear on their chest for long-term continuous cardiac monitoring and heart arrhythmia detection."
  https://therecord.media/irhythm-data-breach-reports
• Belarusian Hacktivists Admit To 2023 Breach Of Russian State Healthcare Network
  "Belarusian activist hackers have claimed responsibility for a years-old breach of Moscow's healthcare network, confirming their involvement in an intrusion recently disclosed by a Russian cybersecurity company. In a statement on Friday, the Belarusian Cyber Partisans said they infiltrated the Moscow Department of Health in 2023 and obtained administrator-level access to its infrastructure, including systems connected to other government agencies. The group said it spent months inside the network before abandoning the operation."
  https://therecord.media/belarusian-cyber-partisans-claim-2023-russia-healthcare-hack
• Nippon Columbia Malware Incident Exposes 8.6 Million Karaoke Fan Records
  "Daiichi Kosho, a major Japanese entertainment system maker, disclosed that a malware infection at its contractor, Nippon Columbia, exposed more than 8.7 million customer and employee records. The company is the largest karaoke maker in Japan, operating 521 karaoke venues nationwide, including the Big Echo chain, one of the most popular karaoke box chains in the country. Daiichi Kosho outsources the handling of its customers’ personal information to Nippon Columbia Group (NCG), a Japanese entertainment group whose businesses include music, video and game software production and distribution, as well as artist management."
  https://www.bleepingcomputer.com/news/security/nippon-columbia-malware-incident-exposes-86-million-karaoke-fan-records/

General News

• FBI Arrests Executive At Ransomware Negotiation Firm
  "Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel."
  https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/
  https://www.bleepingcomputer.com/news/security/fbi-arrests-another-suspected-shinyhunters-hacker-after-agency-breach/
  https://www.bleepingcomputer.com/news/security/cyber-exec-arrested-in-case-allegedly-tied-to-shinyhunters-hackers/
  https://thehackernews.com/2026/10/fbi-arrests-another-shinyhunters.html
  https://therecord.media/shinyhunters-arrest-fbi-data-breach-investigation
  https://www.bankinfosecurity.com/suspected-shinyhunters-extortion-hacker-arrested-by-fbi-a-33059
  https://cyberscoop.com/edward-dubrovsky-cypfer-arrested-fbi-extortion-charges/
• Ukrainian-Russian Dual Citizen Pleads Guilty To Running International Money Laundering Organization For Cybercriminals
  "Oleg Korniev, 42, a dual citizen of Ukraine and Russia, pleaded guilty today to running a sophisticated international money laundering organization that laundered millions of dollars stolen from United States victims by cybercriminals around the world. In total, this international criminal organization recruited over 15,000 U.S.-based money mules to launder at least $10 million stolen by hackers from over 750 U.S. bank accounts."
  https://www.justice.gov/opa/pr/ukrainian-russian-dual-citizen-pleads-guilty-running-international-money-laundering
  https://www.bleepingcomputer.com/news/security/ukrainian-russian-dual-citizen-admits-to-laundering-millions-for-cybercriminals/
  https://therecord.media/leader-of-money-mule-operation-for-cybercriminals-pleads-guilty
• Hackers Get $1,262,000 For 98 Zero-Days At Pwn2Own Ireland
  "The Pwn2Own Ireland 2026 hacking contest has concluded, with hackers collecting $1,262,000 in rewards after exploiting 98 zero-day flaws. Ikotas Labs security researchers won this year's Pwn2Own Ireland edition with 42.5 Master of Pwn points and $361,000 earned over the three-day contest after hacking the Samsung Galaxy S26, OpenAI Codex, and the Oracle Autonomous AI Database. They also collected the competition's top reward of $300,000 on the third day after chaining multiple zero-days to hack the Google Pixel 10."
  https://www.bleepingcomputer.com/news/security/hackers-earn-1262000-for-98-zero-days-at-pwn2own-ireland/
  https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html
  https://www.securityweek.com/google-pixel-10-exploits-earned-hackers-560000-at-pwn2own/
• ASOS Breach Reveals The Risks In Customer-Facing SaaS
  "The hackers who breached ASOS this week unearthed a serious security gap around customer-facing marketing and notifications platforms. On Oct. 6, a threat actor identifying itself as "Xuanye Group" announced that it had breached the multibillion-dollar British retailer. The group claimed to have stolen a wealth of personally identifying information (PII) about ASOS customers, of which there are around 17 million, according to the company. Remarkably, of ASOS's 2,800 employees, the threat actor only needed access to one's login credentials to snowball an attack that eventually led them to compromising multiple, deep-seated corporate systems. One of those systems allowed it to broadcast messages to all of ASOS' mobile app users."
  https://www.darkreading.com/cyberattacks-data-breaches/asos-breach-risks-customer-facing-saas
• Security Threats Don't Stop At The Office: Why Executives' Families Need Training, Too
  "An attacker attempts to breach an executive's personal laptop, but effective multifactor authentication (MFA) blocks them. Actually, it was only a deterrent. The attacker then discovers that the executive's son did not enable MFA on his gaming console and uses that compromised box to move laterally on the home network to eventually reach the corporate network. Cybercriminals' increasingly brazen techniques have expanded beyond office walls to target top executives' family members and friends who may not know how to protect themselves. Worse, these people don't even know that the attackers are coming for them."
  https://www.darkreading.com/cyber-risk/security-threats-don-t-stop-at-the-office-why-executives-families-need-training-too
• Social Engineering AI Agents: The New BEC For 2026
  "Cybersecurity Awareness Month traditionally focuses on teaching employees how to recognize social engineering efforts and how to avoid consequences associated with business email compromise (BEC). But as companies give AI agents authority to interact with business systems, threat actors can target AI agents and manipulate them into taking authorized actions instead — which should reshape how organizations train on BEC attacks. Consider a classic BEC scenario: an accounts-payable employee receives what appears to be a legitimate message from a vendor saying its banking information has changed. The employee believes the request and, using their own legitimate access, redirects a future payment to an attacker-controlled account. The attacker must convince an employee with authority to take the wrong action."
  https://www.darkreading.com/cybersecurity-operations/social-engineering-ai-agents-bec-2026
• What The BPFDoor Backdoor Tells Us About Attacks On The Network Edge
  "A backdoor that makes no noise is hard to catch, and that’s the point of BPFDoor. The Linux malware waits for a special “magic packet” before it acts. In this interview with Help Net Security, Christiaan Beek, VP of Rapid7 Intelligence, explains why its operators go after mail gateways and other edge devices that can’t run endpoint agents, and why a hacked telecom network can put a whole nation at risk. Beek also covers how CISOs should report “no findings” to the board and which simple Linux checks teams can run this week."
  https://www.helpnetsecurity.com/2026/10/09/christiaan-beek-rapid7-bpfdoor-backdoor/
• Companies Want Autonomous IT Operations But Hesitate To Let AI Act Alone
  "Ninety percent of companies want to move toward autonomous IT operations over the next two years, with agentic AI, software that plans and carries out multi-step tasks on its own, doing the work. Yet 77 percent say their own organization hesitates to let AI make an operational decision without a human approving it. Most of those companies mean autonomy with a person at the approval step, and few have the groundwork for even that. Only 41 percent say their IT environment is prepared for autonomous operations, and 19 percent of their IT operations are automated. Businesses are planning around a technology their own environments cannot support."
  https://www.helpnetsecurity.com/2026/10/09/move-toward-autonomous-it-operations/
• Q3 2026 Sets New Record For Ransomware Attacks
  "Ransomware attacks reached their highest ever quarterly volume in the third quarter of 2026, according to an analysis by Comparitech. The firm identified a total of 2627 claimed attacks during the three-month period from July to September 2026. This is a 27% increase on the previous quarter, Q2 2026, and a 61% rise compared to Q3 2025."
  https://www.infosecurity-magazine.com/news/q3-new-record-ransomware/
• Formula Predicts When AI Chatbots Are At Risk Of Turning Bad
  "Researchers from George Washington University have published a paper examining whether the time and cause of AI going rogue can be predicted; and if predicted, prevented. Since 50% of the world’s population carry devices that can run personal AI companions with no internet connection and limited security, they focused their research here. The lack of cloud-based safety filters, real-time telemetry, live monitoring, or the ability to patch weights once deployed provides a good test bed for analyzing AI’s chat-style transformer behavior when left to its own devices."
  https://www.securityweek.com/formula-predicts-when-ai-chatbots-are-at-risk-of-turning-bad/
  https://www.cell.com/patterns/fulltext/S2666-3899(26)00175-3
• AI Transformation Across The Infrastructure Lifecycle: From Supply Chain To Fleet Operations
  "AI infrastructure is a system, and every part of that system is connected. Decisions made in silicon and systems design influence how infrastructure is sourced, deployed, and operated across the fleet. And what we learn once that hardware is running can inform what we build next. This feedback matters because the system never stands still. Demand shifts, component constraints emerge, new capacity comes online, and hardware requirements evolve across the fleet. Keeping infrastructure reliable means continually learning and adapting as requirements change."
  https://azure.microsoft.com/en-us/blog/ai-transformation-across-the-infrastructure-lifecycle-from-supply-chain-to-fleet-operations/
• Former Employee Of Industrial Company Sentenced To 32 Months In Prison For Computer Attack And Extortion
  "A Kansas City, Missouri man was sentenced to 32 months in prison for crimes related to his intentional damage to computer networks and extortion of employees, U.S. Attorney Robert Frazer announced. Daniel Rhyne, 59, previously pleaded guilty before U.S. District Judge Michael A. Shipp to a two-count Information that charged him with extortion in relation to a threat to cause damage to a protected computer and intentional damage to a protected computer. Judge Shipp imposed the sentence on September 28, 2026 in Trenton federal court."
  https://www.justice.gov/usao-nj/pr/former-employee-industrial-company-sentenced-32-months-prison-computer-attack-and
  https://www.securityweek.com/insider-cyber-extortion-plot-against-industrial-firm-lands-engineer-in-prison/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 12 รายการ เมื่อวันที่ 6 และ 8 ตุลาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-26-279-01 Johnson Control EasyIO FG
• ICSA-26-279-02 Savannah lwIP
• ICSA-26-279-03 Hitachi Energy Asset Suite
• ICSA-26-279-04 Hitachi Energy SOI
• ICSA-26-279-05 Hitachi Energy REB500
• ICSA-26-279-06 Hitachi Energy RTU500 series CMU Firmware
• ICSA-26-281-01 Red Lion Controls N-Tron 700 Series
• ICSA-26-281-02 Grid Protection Alliance openPDC and openHistorian
• ICSA-26-281-03 Satel Netco Design
• ICSA-26-069-02 Lantronix EDS3000PS and EDS5000 (Update B)
• ICSMA-26-223-02 Pulsetto Vagus Nerve Stimulator (Update A)
• ICSA-25-259-02 Hitachi Energy RTU500 series (Update A)

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

เมื่อวันที่ 1-4 ตุลาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 4 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability
• CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability
• CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Vulnerability
• CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/10/01/cisa-adds-one-known-exploited-vulnerability-catalog
https://www.cisa.gov/news-events/alerts/2026/10/02/cisa-adds-two-known-exploited-vulnerabilities-catalog
https://www.cisa.gov/news-events/alerts/2026/10/04/cisa-adds-one-known-exploited-vulnerability-catalog

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 6 รายการ เมื่อวันที่ 1 ตุลาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

ICSA-26-274-01 Armatura LLC Armatura One
ICSA-26-274-02 Monta monta.app
ICSA-26-274-03 ABB Protection and Control IED Manager PCM600
ICSA-26-274-04 Johnson Controls EasyIO Neo Series EC and CW Controllers
ICSA-26-274-05 Johnson Controls EasyIO Neo Series EC and CW Controllers
ICSA-26-274-06 Meari IoT Cloud Platform OpenAPI Service

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

เมื่อวันที่ 29-30 กันยายน 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 2 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-86950 Apple Multiple Products Out-of-Bounds Write Vulnerability
• CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/09/29/cisa-adds-one-known-exploited-vulnerability-catalog
https://www.cisa.gov/news-events/alerts/2026/09/30/cisa-adds-one-known-exploited-vulnerability-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand