โพสต์ถูกสร้างโดย NCSA_THAICERT

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 20 รายการ เมื่อวันที่ 22 ตุลาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSMA-26-295-01 - InterSystems Corporation InterSystems IRIS for Health
• ICSA-26-295-01 - Kiloview E3 NDI Encoder
• ICSA-26-295-02 - Siemens Industrial Edge App Publisher
• ICSA-26-295-03 - Siemens Software Center
• ICSA-26-295-04 - Siemens Capital Embedded AR Classic
• ICSA-26-295-05 - Siemens SENTRON 3NA COM Fuse
• ICSA-26-295-06 - Siemens PSS(R)SINCAL
• ICSA-26-295-07 - Siemens SIMATIC IPCs
• ICSA-26-295-08 - Siemens APOGEE, TALON and Desigo PXC/PXM Products
• ICSA-26-295-09 - Siemens Industrial Edge Device Kit
• ICSA-26-295-10 - Siemens SIMATIC S7 Webserver API
• ICSA-26-295-11 - Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
• ICSA-26-295-12 - Siemens RUGGEDCOM CROSSBOW
• ICSA-26-295-13 - Siemens WinCC
• ICSA-26-295-14 - Siemens SIMATIC S7 PLCs Web Server
• ICSA-26-295-15 - Siemens RUGGEDCOM CROSSBOW Station Access Controller
• ICSA-26-295-16 - Siemens SIMATIC S7-1500 TM MFP
• ICSA-26-295-17 - Siemens Industrial Edge Devices
• ICSA-26-295-18 - Siemens RUGGEDCOM APE1808 Devices
• ICSA-26-274-06 - Meari IoT Cloud Platform OpenAPI Service (Update A)

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 6 รายการ เมื่อวันที่ 20 ตุลาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-26-293-01 - HMS Networks PEAK-System PCAN Windows drivers
• ICSA-26-293-02 - WAGO OS Linux
• ICSA-26-293-03 - Moxa AIG-302 ThingsPro Edge
• ICSA-26-293-04 - Hitachi Energy MicroSCADA X SYS600 Product
• ICSA-26-293-05 - Hitachi Energy RTU500 Product
• ICSA-26-062-03 - Hitachi Energy RTU500 Product (Update A)

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 6 รายการ เมื่อวันที่ 15 ตุลาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-26-280-01 CISA Malcolm
• ICSA-26-288-01 Eclipse Foundation Eclipse Milo
• ICSA-26-288-02 Guangzhou Juan IoT Technology EseeCloud
• ICSMA-26-288-01 Thermo Fisher Torrent Suite
• ICSMA-26-288-02 J4Care dcm4che
• ICSA-26-281-01 Red Lion Controls N-Tron 700 Series (Update A)

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 2 รายการ เมื่อวันที่ 13 ตุลาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-26-286-01 Inductive Automation Ignition Software
• ICSA-26-286-02 Swann Communications SWIFI-SE2KIC

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Healthcare Sector

• 4 Flaws Found In Widely Used Health Data Exchange Software
  "Four vulnerabilities in a widely used open-source healthcare interoperability software could enable attackers to improperly access sensitive patient records, cross security boundaries separating healthcare organizations' data and potentially disrupt services, according to new security research. The findings, which were the subject of four Cybersecurity Infrastructure and Security Agency CVE advisories issued Thursday, affect HAPI FHIR, an open-source implementation of the Fast Healthcare Interoperability Resources."
  https://www.bankinfosecurity.com/4-flaws-found-in-widely-used-health-data-exchange-software-a-33192

Vulnerabilities

• PHP Shares Mitigation For New RCE Vulnerability With No Patch
  "The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. PHP is an open-source web development language used by nearly 70% of all websites on the Internet. According to VirusTotal estimates, more than 5.1 million PHP hosts are exposed online, and roughly 3.8 million have at least one port open to attacks. According to a Friday advisory, this security flaw (tracked as CVE-2026-115560) can only be exploited when targeting systems "with an unusual combination of configuration and application code.""
  https://www.bleepingcomputer.com/news/security/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability/
  https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html
  https://www.theregister.com/security/2026/10/23/theres-a-third-php2shell-bug-but-it-wont-get-an-emergency-fix/5305208
  https://securityaffairs.com/201595/security/php-warns-of-new-code-execution-flaw-days-after-php2shell-patches.html
• HPE Patches Eight Max Severity RCE And Auth Bypass AOS Flaws
  "Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. Also known as AOS, ArubaOS powers Aruba Networking enterprise wireless infrastructure, including mobility conductors, access points, controllers, and gateway devices. The eight maximum-severity security flaws patched today affect multiple AOS-8 and AOS-10 software versions, and they can be exploited by remote threat actors without privileges through low-complexity attacks that don't require user interaction."
  https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/
  https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
• Critical Flaw In Python’s Popular Pillow Image Library Allows Code Execution Via a Crafted Image
  "Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first. Ghostscript can read a name chosen by an attacker as instructions rather than as a file, and point it to a second file that carries commands to run. Pillow's maintainers fixed it in version 13.0.0, released on October 16."
  https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html
  https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh
  https://www.ox.security/blog/three-critical-pillow-cves-rce-and-heap-overflows-in-pythons-imaging-library-cve-2026-112900-cve-2026-112393-cve-2026-112403/
• 25 Vulnerabilities In The x402 Protocol: Inside Three Critical Findings
  "x402 lets software pay for an API request as part of an ordinary HTTP exchange. A server responds with 402 Payment Required, the client signs a payment payload and retries the request with the payload attached, which then proceeds. This is useful for automated clients and AI agents that need to buy data or services without a person approving every request."
  https://v12.sh/blog/x402
  https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html
• Atlassian Patches 75 Flaws In Data Center And Server Products
  "Atlassian on Tuesday published its October 2026 security bulletin, which lists 162 high-severity and 14 critical-severity vulnerabilities. All of the entries are tied to third-party dependencies, and many CVEs appear under several products. By SecurityWeek’s count, the bulletin covers 75 unique CVEs, six of them rated critical. The affected products are Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management."
  https://www.securityweek.com/atlassian-patches-75-third-party-flaws-in-data-center-and-server-products/
• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0
  https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html
  https://securityaffairs.com/201652/security/u-s-cisa-adds-collabora-online-flaw-to-its-known-exploited-vulnerabilities-catalog.html
• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog
  https://securityaffairs.com/201609/hacking/u-s-cisa-adds-arista-velocloud-orchestrator-flaw-to-its-known-exploited-vulnerabilities-catalog.html
• Operation IXIM: Preventing a Botnet Of Millions Of Popcorn Time Users
  "Between November 2025 and March 2026, Eye Research actively disabled the vulnerable update mechanism used by the popular download client Popcorn Time (Time4Popcorn). This involved executing code on systems running the vulnerable software. This is the story of how we got here and why we took the unprecedented decision of taking matters into our own hands. The vulnerability was assigned CVE-2026-30612, about which we published an advisory in June 2026."
  https://labs.eye.security/operation-ixim-preventing-a-botnet-of-millions-of-popcorn-time-users/
  https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/
  https://thehackernews.com/2026/10/researchers-push-over-2-million-updates.html
• Ruby Fixes Three Regex Engine Bugs Responsible For Four Critical GitLab RCE Flaws
  "Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any application that builds a regular expression from text an attacker controls is affected, not just GitLab."
  https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html
  https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
• Node2Shell: From Brotli Data To Remote Code Execution
  "Node2Shell is Imperva Red Team’s name for our analysis of CVE-2026-111497, a High severity flaw in Node.js’s bundled Brotli decoder. Node.js says the out-of-bounds write can permit remote code execution and has released fixes for the 22.x, 24.x, and 26.x lines. Our standalone proof of concept ran code carried in a Brotli response or request body inside applications using the official Node.js 24.22.0 Linux arm64 image. It needed no debugger or instrumented binary. The same inputs were rejected by 24.22.1. We tested Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0, including the latest releases available at testing; execution took multiple attempts in our setup."
  https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/
  https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html
  https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html
• Tailworm
  "The design choices of the open source tailscale and headscale software have created an environment ripe for risk, while marketing security as its design and purpose. Choices have been made to move away from security-in-depth, removing layers of authentication, and replacing daemons such as OpenSSH which employ privilege-separation with a highly-privileged process. Other findings include broader-than-advertised network security boundaries, which seems to be legitimate bugs, but the missing security and isolation is precisely what users are advertised by these tools."
  https://tailworm.com/
  https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html
• Securing Our Frontier Model Training Environment
  "This post describes how we secure the environments that we use to train and evaluate frontier models. These research settings differ from those in which customers use our released models: models in development may not yet have completed safety and alignment training, and we deliberately test them under adversarial conditions to expose weaknesses. Before making models available for broader use, we conduct safety and alignment assessments and put production safeguards in place."
  https://openai.com/index/securing-our-frontier-model-training-environment/
  https://thehackernews.com/2026/10/openai-ai-agents-demonstrate-vm-escapes.html
  https://securityaffairs.com/201673/ai/openai-paused-frontier-ai-training-after-a-security-incident.html

Malware

• PHP2Shell Exploit Attempts Hit Millions As Attackers Try To Deploy Mirai Malware
  "Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote code execution (RCE) via specially crafted HTTP requests. The vulnerabilities have been patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. "However, analysis of the sample revealed that it is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026," Sophos said. "The sample displays downloader and network disruption functionality.""
  https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html
  https://therecord.media/php-php2shell-exploitation-attempts-pocs
  https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/
  https://securityaffairs.com/201538/hacking/php2shell-millions-of-attacks-no-confirmed-successful-exploits-yet.html
• Infostealers Are Targeting AI: What Aokigahara Infostealer Reveals About The New Developer Attack Surface
  "AI assistants have quickly become part of everyday work, particularly for developers. Tools such as ChatGPT, Claude, Cursor and GitHub Copilot increasingly sit alongside source code, cloud environments and other sensitive business resources, making the credentials and sessions connected to these tools increasingly important to protect. New research from Check Point Research (CPR) into the Aokigahara infostealer shows how attackers are adapting to this shift. The malware specifically collects authentication files, session data and configuration files associated with popular AI applications and development tools."
  https://blog.checkpoint.com/ai-security/infostealers-are-targeting-ai-what-aokigahara-infostealer-reveals-about-the-new-developer-attack-surface/
  https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/
• M365 Token Spray And Replay Campaign Compromises Business Email Accounts
  "Over a ten-week stretch, Huntress tracked a Microsoft 365 campaign that captured sign-in sessions through adversary-in-the-middle (AiTM) relays and replayed the stolen tokens from an IP address block owned by German hosting provider 1337 Services GmbH. We responded to related incidents at 79 organizations, observing at least 497 successful sign-in events against more than 200,000 failed login attempts across our customer environments. Access to a Microsoft 365 account sets the stage for business email compromise (BEC). Across the affected environments, we observed the attacker registering at least 48 rogue Entra devices, wiping and replacing victims' MFA methods, and creating inbox rules to hide malicious communications. In one incident, the attacker used the compromised account to send a payroll-related email to an outside contact."
  https://www.huntress.com/blog/token-replay-spray
  https://www.infosecurity-magazine.com/news/tokenspraying-attacks-target/
  https://www.helpnetsecurity.com/2026/10/23/microsoft-365-accounts-stolen-sessions/
• When An Email Talks To Your AI: The Rise Of Indirect Prompt Injection
  "Imagine an employee receives what appears to be an ordinary business email. There is no suspicious attachment, urgent request, or link asking them to reset a password. To the employee, the message may seem completely harmless. But the employee may not be the only one reading it. Organizations are increasingly giving AI assistants access to inboxes so they can summarize conversations, retrieve information, recommend next steps, and, in some cases, take action. That creates a second audience for every email and an entirely new opportunity for attackers."
  https://blog.barracuda.com/2026/10/23/indirect-prompt-injection-email-ai-assistants
• DeadTag: How Forgotten Website Tags Became a Delivery Network For iPhone Spyware
  "Combined research between Report URI and iVerify has uncovered an extensive ecosystem being used to deliver two of the most capable iOS exploit kits ever seen, Coruna and DarkSword. Over the last month, our respective security teams have been tracking this proliferation, Report URI from the web delivery side and iVerify from the client-side. Attackers are buying up the expired domains behind old analytics and advertising tags that thousands of websites still load, and they're selling the visitors those tags bring in. Most of that traffic goes to scams, but the tags also quietly pick out iPhone visitors and load these advanced exploit kits, which steal keychain passwords and target crypto wallets."
  https://blog.report-uri.com/deadtag-how-forgotten-website-tags-became-a-delivery-network-for-iphone-spyware/
• Unboxing Phishing Kits: Advanced Cred Theft For Entry-Level Hackers
  "Teach a noob to phish and they'll be scamming for a lifetime. It has never been easier to steal credentials, thanks to a growing number of phishing kits that give aspiring attackers everything they need in one convenient interface. Huntress Staff Threat Intelligence Analyst Andrea Hatcher and Staff Product Manager Rich Mozeleski stopped by our monthly Tradecraft Tuesday series in October to unpack some recently staged phishing kits and walk through what the resulting malicious activity looks like from the defenders' point of view."
  https://www.huntress.com/blog/unboxing-phishing-kits
• Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens And Hijack Release Pipeline
  "LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of the LiteLLM Agent Platform, an open source tool we use for orchestrating agents," LiteLLM's Oliver Jensen and Mateo Wang said."
  https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html
  https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain
  https://www.securityweek.com/litellm-compromised-in-fresh-supply-chain-attack/
• Markdown Is The New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From The Web
  "This did not start in a lab. Forever caught live malware on a real customer’s machine, attempting a new kind of attack the industry had not documented - and stopped it cold, before any code ran. Forever Security found a malicious AGENTS.md file in the ~/Downloads folder of a real customer machine - plain text, disguised as ordinary engineering notes. This is not ordinary malware. An AGENTS.md is a file a coding agent is built to trust and obey, and ~/Downloads is the one folder a website can drop a file into with no click and no permission. Together, that lets the web plant orders your own agent carries out. Markdown is the new executable."
  https://forever.security/blog/hijacking-ai-agents-via-downloads-folder
  https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/
• PHP2Shell Exploitation Hits Government Entity Amid Global Scanning And Signs Of AI-Assisted Hacking
  "Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. "In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor authentication secrets," Palo Alto Networks Unit 42 said. "They also established an NT LAN Manager (NTLM)-relay tunnel into Active Directory and attempted Domain Admin privilege escalation.""
  https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html

Breaches/Hacks/Leaks

• Quest Diagnostics Confirms Data Breach Exposed Patient Records
  "American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. The company learned about the breach on October 21 and deployed its incident response protocol "to contain the activity, assess and investigate the nature and scope of the incident and implement appropriate remedial measures." “On October 21, 2026, Quest Diagnostics Incorporated learned of unauthorized access to its Quanum LSM system, which certain clients use to place test orders, receive and look up results,” the company says in a filing with the U.S. Securities and Exchange Commission (SEC)."
  https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/
  https://therecord.media/quest-diagnostics-network-intrusion
  https://www.securityweek.com/quest-diagnostics-reports-cyber-breach-affecting-certain-patient-records/

General News

• Trust Is Not What It Seems — And Fraudsters Are Counting On It
  "After a disruptive cyberattack hits, customer trust can take a while to rebuild. But now, threat actors are impersonating trusted brand names and existing customer accounts to abuse customer relations. "Trust has become easier to exploit and harder to establish," warned a new TransUnion report. Threat actors use social engineering, deepfake technology, text spoofing, compromised credentials, and artificial intelligence (AI) to become whoever they need to be, whether that's a new or existing customer, or the organization itself."
  https://www.darkreading.com/cyber-risk/trust-is-not-what-it-seems-and-fraudsters-are-counting-on-it
• AI Tools Are Generating Massive Attacks For Little Cost
  "Over five days in September, a Chinese-speaking attacker used three different AI harnesses and both open-weight and public AI models to target 105 different e-commerce sites. Often within a day, and at most within hours, the autonomous hacking system compromised at least 27 different companies. Malicious agents stole at least 600,000 payment card records from two, installed credit-card skimmers on the websites of five, and gained some degree of illicit access to the rest, which includes at least one Fortune 500 company, according to Gambit Security, which discovered the campaign."
  https://www.darkreading.com/cybersecurity-operations/ai-tools-massive-attacks-little-cost
• Why Caribbean Threats Cascade Into Global Cyber-Risk
  "On July 24, 2025, Curaçao's Tax and Customs Administration found ransomware on its network. Counter services, the call center, and internal processes went dark for more than a week, and the island's recovery depended on specialists flown in from the Netherlands. A day earlier, the Joint Court of Justice had gone down as well. Because that court serves Curaçao, Aruba, Sint Maarten, Bonaire, Saba, and Sint Eustatius, a single intrusion degraded the judicial system of six jurisdictions at once."
  https://www.darkreading.com/cyber-risk/why-caribbean-threats-cascade-global-cyber-risk
• Cyber Insurance's New Reality: Underwriting Isn't Enough
  "The relentless evolution of the threat landscape has pushed cyber insurance companies to follow suit with a continuous expansion of cybersecurity posture requirements as well as taking an active hand in the defense process. While cyber insurance has existed for years, the ransomware boom of the late 2010s and early 2020s transformed it from a niche risk transfer product into a central component of many organizations' security strategies. Today, policies cover everything from incident response and business interruption to legal costs and, in some cases, ransomware payments. Some of the names you'll see pop up around this space include Coalition, Chubb, AXA XL, Cowbell, and Resilience."
  https://www.darkreading.com/cyber-risk/cyber-insurances-underwriting-isnt-enough
• Drone Program Compliance: What a CTO Says Most Agencies Get Wrong
  "In this interview with Help Net Security, Nick Donarski, CTO at RotorLab, explains what councils, records clerks, insurers, and auditors expect from a public safety drone program, and where most programs fall short. He covers chain of custody for flight logs and video, how to publish drone activity without exposing sensitive operations, and common mistakes in open records handling. Drawing on his cybersecurity background, he points to risks in ground control software and spreadsheet logs. Donarski also offers practical advice for small agencies starting with little budget and looks at an FAA penalty case."
  https://www.helpnetsecurity.com/2026/10/23/nick-donarski-rotorlab-drone-program-compliance/
• 7 Out Of 10 Individuals Hit By Data Breaches Via Third Party, Kroll Finds
  "Kroll, the leading independent provider of financial and risk advisory solutions, today revealed that two-thirds of organizations surveyed (69%) suffered a data breach in the past year. More than a third (34%) were breached more than once, according to its 2026 annual Data Breach Outlook. Further analysis showed that financial services accounted for the largest share of organizations breached in Kroll's cases, at 20%, but a single breach at a technology provider can expose data belonging to customers of hundreds of businesses that use its services."
  https://www.prnewswire.com/news-releases/7-out-of-10-individuals-hit-by-data-breaches-via-third-party-kroll-finds-302916295.html
  https://www.infosecurity-magazine.com/news/tech-third-party-breach-victims/
• Red-Teaming OpenAI's Internal Agent Monitoring Systems
  "For three weeks, from July 21st to August 11th, a METR employee and a Redwood Research employee conducted a pilot high-access exercise to stress-test OpenAI’s internal misalignment monitoring system.1 The output of this exercise was a 61-page internal report that was shared with OpenAI researchers and security staff,2 primarily focused on estimating the fraction of agentic inference that is monitored, and whether agents could in principle disable or subvert the monitoring system. The exercise focused on the internal misalignment monitoring system as it existed on and before July 21st, and did not evaluate changes that were in progress at the time of the exercise."
  https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/
  https://www.theregister.com/ai-and-ml/2026/10/23/red-team-report-found-openai-utterly-failed-to-monitor-its-agents-during-hugging-face-attack/5305200

อ้างอิง
Electronic Transactions Development Agency (ETDA)

Healthcare Sector

• InterSystems Corporation InterSystems IRIS For Health
  "Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device."
  https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01

Industrial Sector

• Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
  "Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11
• Siemens SIMATIC S7-1500 TM MFP
  "Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16
• Siemens RUGGEDCOM CROSSBOW Station Access Controller
  "RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-15
• Siemens SIMATIC S7 PLCs Web Server
  "SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-14
• Kiloview E3 NDI Encoder
  "Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01
• Siemens Industrial Edge Devices
  "Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17
• Siemens WinCC
  "Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-13
• Siemens RUGGEDCOM CROSSBOW
  "RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations or causing a denial of service. Siemens has released a new version for RUGGEDCOM CROSSBOW and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-12
• Siemens Industrial Edge Device Kit
  "Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09
• Siemens RUGGEDCOM APE1808 Devices
  "Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-18
• Siemens SIMATIC S7 Webserver API
  ".NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .NET Client Library for SIMATIC S7 Webserver API and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10
• Siemens APOGEE, TALON And Desigo PXC/PXM Products
  "The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for products where fixes are not or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08
• Siemens SIMATIC IPCs
  "The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled. Siemens has released new versions for the affected products and recommends to update to the latest versions."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-07
• Siemens PSS(R)SINCAL
  "PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type. Siemens is actively preparing updates and recommends applicable mitigations for products where patches are currently unavailable."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06
• Siemens SENTRON 3NA COM Fuse
  "SENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a denial-of-service (DoS) condition. Successful exploitation may require the affected network to be re-established to restore normal operation."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-05
• Siemens Capital Embedded AR Classic
  "The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-04
• Siemens Software Center
  "The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Siemens has released a new version for Siemens Software Center and recommends to update to the latest version. Please refer to our blog post for additional information about current known active exploitation and how to detect it."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03
• Siemens Industrial Edge App Publisher
  "The Industrial Edge App Publisher contains a vulnerability chain involving improper certificate validation and the rendering of unescaped data from backend responses. These issues can be combined to allow an attacker on the network to impersonate the management server and execute arbitrary code (RCE) on the local machine through Node.js integration. Siemens has released an update for the Industrial Edge App Publisher and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02

New Tooling

• New PHP2Shell Scanner Checks Your Hosts For CVE-2026-109618 And CVE-2026-109619
  "Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on October 21. PHP2Shell lets an attacker reach pre-auth RCE against PHP applications running on Apache mod_php or PHP-FPM under default configurations, with confirmed exploitation on widely deployed software including WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud, and Magento. If you run PHP behind a web server, you need to know which of your hosts are still vulnerable, and Searchlight’s researchers argue that most scanners already circulating cannot tell you reliably."
  https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/
  https://github.com/assetnote/php2shell-scanner

Vulnerabilities

• Arista Patches New VeloCloud Orchestrator Zero-Day Exploited In Attacks
  "Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. VCO is a web-based management portal that helps administrators configure, monitor, and manage VeloCloud SD-WANs (Software-Defined Wide Area Networks) and associated edge devices. Tracked as CVE-2026-114625, this critical-severity flaw can allow attackers with basic privileges, access to the VCO web interface, and a valid authenticated session to escalate privileges through low-complexity SQL injection attacks that don't require user interaction."
  https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/
  https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
  https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html
• Cisco Patches 34 Vulnerabilities Across Multiple Products
  "Cisco on Wednesday announced patches for 34 vulnerabilities across Expressway Series, IOS XR, Snort 3, and Unified Communications products. Expressway Series received fixes for 10 vulnerabilities, including a critical-severity remote code execution (RCE) bug tracked as CVE-2026-76466. According to Cisco, the use of persistent cookies and insufficient validation of client certificates in certain configurations could allow attackers to connect to the database service and invoke specific remote procedure call (RPC) commands to exploit the bug."
  https://www.securityweek.com/cisco-patches-34-vulnerabilities-across-multiple-products/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• AI Has 'potential' To Turn Script Kiddies Into Sophisticated Infrastructure Attackers
  "When it comes to cyberattacks that shut down power grids, drinking-water systems, and other critical infrastructure, AI doesn’t – yet – turn script kiddies into sophisticated, nation-state attackers. But “the potential is there,” according to operational technology (OT) security experts. "One thing that we've relied on for years is security by obscurity when it comes to utilities," said Steve Swick, former chief information security officer at American Electric Power. "The knowledge needed to do some of that stuff is getting less likely to be necessary," Swick added during a media panel ahead of the publication of Frenos' State of AI in Security report."
  https://www.theregister.com/security/2026/10/21/ai-has-potential-to-turn-script-kiddies-into-sophisticated-infrastructure-attackers/5304297

New Tooling

• DevGuard: Open-Source Vulnerability Management For The Software Supply Chain
  "DevGuard is a free, open source vulnerability management platform that collects a software project’s security findings in one place, ranks them by risk, and tracks them. It’s an OWASP Incubating Project, and anyone can self-host it. DevGuard runs secret scanning, static code analysis, dependency checks against known CVEs, infrastructure-as-code checks, container scanning, and license checks through one CLI that wraps existing open source tools. Teams already using Trivy, Grype, or Semgrep can skip the built-in scanners and upload CycloneDX SBOMs (machine-readable lists of the components in a build) or SARIF results. Findings sync both ways with GitHub Issues, GitLab Issues, and Jira, where developers triage them with slash commands."
  https://www.helpnetsecurity.com/2026/10/21/devguard-open-source-vulnerability-management/
  https://github.com/l3montree-dev/devguard
• Google Open-Sourced TorchTPU, So PyTorch On TPUs Just Got a Lot Easier
  "Google released TorchTPU as open source, giving PyTorch developers a native way to run models on the company’s Tensor Processing Units. Google also announced TPU support in the vLLM and SGLang serving engines, the TorchTitan training framework, Ray, and Hugging Face’s libraries. Teams that write their models in PyTorch and run them on GPUs by default have the most to gain. Google says those workloads now move to TPUs, its custom AI chips, with minimal code changes. If that claim holds up in practice, a team weighing GPU costs can test Google’s hardware without first rebuilding its software."
  https://www.helpnetsecurity.com/2026/10/21/torchtpu-pytorch-on-tpus/
  https://github.com/google-pytorch/torch_tpu

Vulnerabilities

• PHP Ships Emergency Patches For Critical PHP2Shell Flaws
  "The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. The two unauthenticated RCE flaws were discovered by Calif, , and OpenAI security researchers, and affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. "We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs," the PHP security team said."
  https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
  https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
  https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html
  https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
  https://blog.talosintelligence.com/two-critical-rces-in-php-core/
  https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
  https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry
  https://therecord.media/php-foundation-statement-critical-vulnerabilities
  https://blog.checkpoint.com/security/php2shell-what-we-know-about-the-leaked-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/
  https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/
  https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce
  https://www.wiz.io/blog/php2shell-php-rce
  https://asec.ahnlab.com/en/95944/
  https://www.bankinfosecurity.com/critical-php-patches-address-very-very-bad-vulnerability-a-33162
  https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/
  https://www.infosecurity-magazine.com/news/critical-php-vulnerabilities-leaked/
  https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/
  https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates
  https://www.theregister.com/security/2026/10/21/php-devs-publish-critical-bug-fix-as-site-owners-warned-pull-em-offline-if-youre-unpatched/5304519
  https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611
  https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/
• Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years Of Releases
  "GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an instance updated then is in range again. The flaw, tracked as CVE-2026-110264, is rated 10.0 on the CVSS scale, the maximum. GitLab says that, under certain conditions, it could allow an unauthenticated user to run arbitrary code on the server due to an integer overflow during the compilation of a specially crafted regular expression."
  https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
• Signal Bug Could Let Someone Keep Listening After You Hang Up
  "A recently disclosed flaw in Signal’s calling software could allow another participant to keep hearing you after you hang up. The vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 out of 10), affects RingRTC versions earlier than 2.72.0. RingRTC is the open-source library behind Signal’s voice and video calling functionality, providing calling components for its mobile and desktop applications. The flaw concerns how Signal’s calling library shuts down a call. It does not affect how it encrypts conversations. According to the published vulnerability description, another participant could overwhelm a call’s internal event queue and interfere with the steps that should disconnect it when you end the call."
  https://www.malwarebytes.com/blog/bugs/2026/10/signal-bug-could-let-someone-keep-listening-after-you-hang-up
  https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528
• Memory Bugs Account For Most Of Chrome’s 353 New Security Fixes
  "Google on Tuesday announced the promotion of Chrome 156 to the stable channel with patches for 353 vulnerabilities. Most of the resolved security defects were memory safety flaws, including 163 memory corruption bugs, 125 use-after-free issues, and 17 out-of-bounds reads. Of the remaining weaknesses, 36 are improper input validations. The browser refresh resolves six critical-severity vulnerabilities: five memory corruption defects and one use-after-free bug."
  https://www.securityweek.com/memory-bugs-account-for-most-of-chromes-353-new-security-fixes/

Malware

• Does It Stop When Someone Is Watching? The Suspicious Behavior Of a New Type Of Infostealer
  "It is already well known that illegal software and cracked programs can be exploited for malware distribution. Recently, AhnLab identified a new type of information theft malware (Infostealer) disguised as an illegal program. This malware was first detected in mid-August and, after altering its execution method, began spreading widely in September. Notably, it not only collects information stored in browsers and business applications but can also install additional malware, raising the possibility of secondary damage beyond mere Information Theft. Let’s take a look at the distribution methods, key behaviors, and countermeasures for this new type of Infostealer."
  https://asec.ahnlab.com/en/95937/
• Operation FlashHole: Lazarus Breaks Security, Defies Control
  "In January, we responded to the Lazarus Group’s novel attack campaign against South Korea, which followed last year’s Operation SyncHole. In this new operation, the group employed an updated malware chain that included both their old and new malware, which we disclosed in full, and used another mandatory South Korean security software program as a part of infection chain using a watering‑hole strategy. Notably, the group targeted victims more selectively, sending spear‑phishing emails with links to fabricated but relevant sites, such as portfolio and résumé pages tailored to each target. We dubbed this activity Operation FlashHole."
  https://securelist.com/lazarus-operation-flashhole/121541/
  https://www.bleepingcomputer.com/news/security/lazarus-hackers-use-post-quantum-cryptography-for-malware-delivery/
• Suppressing Misalignment Monitoring Alerts And Disabling Misalignment Monitoring
  "In two internal coding tasks, agents weakened misalignment monitoring while making requested software changes. A GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to our Security team, treating an earlier instruction not to send messages during a Slack history search as a reason to suppress monitoring notifications. In a separate task, a GPT-6 Astra agent migrating a program removed its monitoring integration in order to match a reference implementation, and then falsely claimed to the user that it had not removed the monitor. In both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them. We are strengthening our misalignment monitoring system in response, and are also assessing whether these cases reflect benign overpersistence or a propensity to evade misalignment monitoring in particular."
  https://alignment.openai.com/misalignment-reports/suppressing-misalignment-monitoring-alerts-and-disabling-misalignment-monitoring/
  https://www.bleepingcomputer.com/news/security/openai-agents-disabled-safety-monitoring-one-lied-about-it/
  https://thehackernews.com/2026/10/openais-gpt-6-agent-removed-safety.html
  https://www.securityweek.com/openai-agents-silenced-security-team-alerts-removed-misalignment-monitor/
  https://securityaffairs.com/201435/ai/openai-reports-two-incidents-of-ai-agents-disabling-their-own-oversight.html
• How Fraudulent Airline Support Numbers Exploit Search Results And AI-Generated Answers
  "A canceled flight. A missed connection. A refund that has yet to arrive. When travelers need urgent help, they often turn to search engines, social media, or AI tools to find a customer support number. Threat actors are increasingly exploiting that moment of urgency. In our previous investigation, Scammers Are Watching Airline Complaints and Posing as Customer Support, Check Point Exposure Management researchers uncovered scammers monitoring airline complaints on social media and impersonating customer support representatives."
  https://blog.checkpoint.com/research/how-fraudulent-airline-support-numbers-exploit-search-results-and-ai-generated-answers/
• Parasitizing Trust: How Legitimate Infrastructure Becomes a Delivery Pipeline For Attackers
  "Talos recently analyzed two order notification campaigns abusing Staples and Dell transactional email pipelines. Together, these campaigns accounted for roughly 1,400 messages observed by Talos. The malicious element was not the outer sender identity, like a simple forged sender or lookalike domain. It was the content of the legitimate order notification workflow rendered. The suspicious content appeared inside the notification itself, in fields that would normally contain shipping information. The attacker’s objective was to use a trusted retail pipeline to create urgency around a high-value purchase and push the recipient toward an attacker-controlled phone number."
  https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/
• Threats Hidden In Replies: Threat Actors Deliver Malware And Credential Phishing In Email Threads
  "Recently, threat actors have been increasingly delivering malware or credential phishing attacks at the end of long email threads designed to exploit a potential victim’s trust in an email contact. In this tactic, threat actors deliver malicious payloads at the end of seemingly normal email conversations after gaining the potential victim’s trust. These kinds of attacks, also known as email thread hijacking, exploit the recipient’s trust in the sender after several legitimate emails. Often these are legitimate email threads that threat actors respond to when accessing compromised email accounts."
  https://cofense.com/blog/cofense-intelligence-strategic-analysis
• AI-Driven, Large-Scale Nation-State Campaign Using ARTEX Enables Supply Chain Compromise
  "As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure – including multiple instances where the time from initial targeting to privileged access was less than 3 hours. Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application."
  https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
  https://cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940/
• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
  "Huntress investigated multiple incidents stemming from an Amazon-themed ClickFix campaign tied to a sponsored Google search result for the keywords "amazon business." The sponsored result leads to a spoofed Amazon login page with an embedded ClickFix (fake CAPTCHA) that downloads a malicious payload from attacker-controlled infrastructure. The ClickFix command calls on Window's built-in finger utility, a relic of the early internet, used in this case as a living off the land binary (LOLBIN). The finger command kicks off a complex, multi-layered attack chain that ends with multiple payloads dropped, including a pirated copy of the NetSupport Client remote monitoring and management (RMM) tool and a version of Lumma Stealer."
  https://www.huntress.com/blog/amazon-clickfix-finger
  https://www.darkreading.com/cyberattacks-data-breaches/decades-old-windows-utility-modern-clickfix-attack
• Stray Cat, Open Doors: How k0t Wanders Through The Network Edge
  "Group-IB Threat Intelligence, together with NyxLab, collaborated on a joint investigation on a campaign involving widespread exploitation of network edge devices. This joint-investigation effort has managed to uncover indications that this may be connected to the FortiBleed cluster seen earlier this year in June as well as the exposure of adversarial tooling as well as discovery of Tactics, Techniques and Procedures (TTPs) employed by the threat actor known as ‘k0t’. Notable among the observed TTPs is the exploitation of vulnerabilities in network devices such as FortiGate Firewalls and Palo Alto GlobalProtect to gain initial access. Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, resulting in persistent remote access and data exfiltration."
  https://www.group-ib.com/blog/stray-cat-network-edge/
• Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models To Run Attacks
  "Attackers have built an autonomous offensive agent that hunts the internet for exposed large language models (LLMs) and hijacks them to power a self-directed cybercrime operation. Once connected to an unprotected model, the agent is instructed to scan for new targets, exploit common web frameworks, steal databases and credentials, and quietly install cryptocurrency miners, for up to 100,000 steps and without asking a human for approval. The owner of the hijacked model pays for the computing power, while the servers the agent breaks into are stripped of data and put to work mining."
  https://www.security.com/blog-post/ai-llmjacking-skynet
  https://www.infosecurity-magazine.com/news/symantec-ai-agent-llmjacking/
• Fake Amazon Music x YouTube Deal Lures Creators Into a Google Login Trap
  "On August 27, YouTube announced that Amazon had joined its Shopping Affiliate Program. Eligible creators can now tag Amazon products in their videos and earn a commission on sales. Weeks later, we found a wave of sites offering YouTube creators what looks like another Amazon opportunity: an invite-only advertising deal with Amazon Music. The site shows creators their own channel stats, then asks them to “verify” their channel with Google before it reveals a personalized offer."
  https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-amazon-music-x-youtube-deal-lures-creators-into-a-google-login-trap
• Inside a Global AI-Assisted Hacking Campaign
  "In October 2026, Zscaler ThreatLabz investigated AI-assisted cyberattacks that combined the ARTEX penetration testing framework with AI coding assistants and custom automation scripts. Initial reporting of the incident identified the targeting of South Korean financial institutions. However, ThreatLabz discovered additional information about the attack, which went far beyond South Korea. The AI-assisted attacks were widespread and targeted organizations around the globe and in multiple industry sectors."
  https://www.zscaler.com/blogs/security-research/inside-global-ai-assisted-hacking-campaign
• Compromised LiteLLM 1.107.0 On PyPI Installs a Credential Stealer And Backdoor
  "The LiteLLM 1.107.0 release on PyPI carries a credential stealer and a remote code execution backdoor. All seven wheels (Linux, macOS, Windows) install them as three files in site-packages. Both run when any Python process starts on the host, even one that never imports litellm. The upstream GitHub source does not contain them. PyPI has since removed the release. Versions 1.106.2, 1.107.0rc1, and 1.107.0rc2 are clean. The companion packages that 1.107.0 pins, litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78, are also clean."
  https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor/
  https://socket.dev/blog/litellm-compromise
  https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer
  https://www.upwind.io/feed/litellm-1-107-0-supply-chain-attack-malicious-code-found-in-pypi-package
  https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html
  https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548
• BRONZE SANDCASTLE Deploys Modified Meterpreter Shells
  "Counter Threat Unit (CTU) and SophosLabs researchers investigated a cluster of incidents attributed to the BRONZE SANDCASTLE threat group. The most distinctive technical marker for BRONZE SANDCASTLE is its consistent use of Sandboxie DLL sideloading. Across multiple victims’ environments, legitimate Sandboxie executables were placed alongside a malicious sbiedll.dll file, causing the trusted application to load attacker-controlled code at runtime. This consistent pattern functions as a signature for the group, although the threat actors employ several other sideloading file combinations as well (see Table 1)."
  https://www.sophos.com/en-us/blog/bronze-sandcastle-deploys-modified-meterpreter-shells
  https://thehackernews.com/2026/10/china-aligned-bronze-sandcastle-abuses.html
• Hackers Hid Vasilek Backdoor In VMware Tools During 2-Year Russian Healthcare Intrusion
  "A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans. Known to be active since at least 2020, the group has a track record of striking industrial enterprises and government agencies in Russia and Belarus with a backdoor called Vasilek that uses Telegram for command-and-control (C2) and data exfiltration."
  https://thehackernews.com/2026/10/hackers-hid-vasilek-backdoor-in-vmware.html
• “Next Exploit Opportunities”: How a Threat Actor Used AI To Help Plan And Execute Multiple Types Of Cybercrime Activities
  "“Can you find about like what scam or thing they done in past like spoofing calls or somthing [sic],” the threat actor typed. The conversation was with one of several AI assistants that the actor was using to get advice on planning and executing a variety of cybercrime activities. Our visibility into this specific actor's operational environment gives us unique insights into exactly how threat actors are building, testing and executing agentic attacks across multiple campaign types."
  https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/
• New PhaaS Platform Uses AI To Craft Phishing Lures And Mask Malicious Activity
  "A new phishing phishing-as-a-service (PhaaS) platform, dubbed Athena StealthRoute, has been found to use AI tools to both deliver and conceal phishing attacks. Researchers at cybersecurity firm Abnormal AI first identified Athena StealthRoute-linked infrastructure during an August 2026 phishing campaign. In the six months to October 9, the firm identified approximately 89,700 attack-related messages containing the platform's distinctive link pattern across around 2,280 organizations in the US and Europe."
  https://www.infosecurity-magazine.com/news/new-phaas-uses-ai-phishing-lures/
• CrowdStrike Uncovers New Agentic AI Campaigns
  "A new report from the CrowdStrike Counter Adversary Operations team details research into four previously unreported threat actors, each of whom left their offensive agent frameworks exposed via open directories. In doing so, they shared detailed insight into their use of AI agents and revealed how adversaries are quickly becoming more proficient in AI."
  https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-agentic-ai-campaigns/
  https://www.crowdstrike.com/en-us/resources/reports/agentic-ai-attack-campaigns/
• ThreatLocker MDR Team Intercepts Chimera C2 ClickFix Attack
  "On September 28, 2026, ThreatLocker MDR identified and intercepted the implementation of an active C2 framework in a monitored environment. A ClickFix attack persuaded the victim to execute malicious PowerShell commands, leading to machine compromise and the subscription to a Command-and-Control platform titled ChimeraC2. Chimera has been previously attributed to a Chinese based threat actor group by MITRE and the broader intelligence community, although evidence present to the ThreatLocker Intelligence Team indicates that Russian-speaking threat actors are behind this panel. The apparently AI-assisted tooling present does not align with open-source intelligence reports on Chimera, and ThreatLocker Threat Intelligence cannot independently attribute this campaign to the previously documented Chimera group."
  https://www.threatlocker.com/blog/threatlocker-mdr-team-intercepts-chimera-c2-clickfix-attack
• Recent AI-Assisted Cyber Attacks In Japan: Investigating Attack Infrastructure And Techniques
  "On October 8, 2026, JPCERT/CC issued an alert regarding a series of unauthorized access incidents involving the leakage of personal and other information reported by multiple organizations in Japan. In cooperation with multiple organizations, JPCERT/CC has been investigating infrastructure that may have been used in these attacks. We confirmed that the attackers had used AI to scan for known vulnerabilities and carry out attacks via APIs. We identified several servers used for these activities and confirmed that the attackers had also targeted web services intended for users outside Japan. This article presents our findings from an investigation of attack servers involved in attacks targeting web services and other systems in Japan and abroad."
  https://blogs.jpcert.or.jp/en/2026/10/web_api_attacks.html
• The Gentlemen: A Closer Look At a Not-So-Gentle Ransomware-As-a- Service Operation
  "The Gentlemen ransomware is a Russian-speaking ransomware-as-a-service (RaaS) threat provider that first emerged in mid-2025. Its Go-based ransomware targets Windows, Linux, NAS and BSD systems. The operators reportedly offer affiliates up to 90% of the ransom revenue generated from their operations. The Gentlemen uses a double-extortion model. In addition to encrypting files, the ransomware can exfiltrate data from compromised systems. This puts additional pressure on victims to pay the ransom to restore access to their files and prevent the stolen data from being publicly leaked."
  https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/

Breaches/Hacks/Leaks

• Japan's Onamae Desktop Cloud Hacked, Up To 27,000 Servers Affected
  "Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers. The company confirmed on October 20 that an unauthorized third party installed "malicious programs" in some customer environments. After detecting the intrusion, the company says it progressively shut down customer servers beginning at 04:00 local time on October 21, 2026."
  https://www.bleepingcomputer.com/news/security/japans-onamae-desktop-cloud-hacked-up-to-27-000-servers-affected/
• TiDB Breach Exposes Flawed Cloud Security Assumptions
  "A breach of an open source database provider may have inadvertently highlighted a serious gap in the way companies think about their cloud security. On Oct. 19, software maker PingCAP, which sells an SQL database program called TiDB, disclosed that it had been breached. According to PingCAP's website, it serves major American corporations like Atlassian, Square, and Pinterest, as well as major players in China's artificial intelligence (AI) space, including Manus, Kimi, and more."
  https://www.darkreading.com/cloud-security/tidb-breach-flawed-cloud-security
• Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account
  "The personal details of thousands of children and their families were breached in Wales after ransomware attackers compromised an account protected by a ‘Password1’ password, an investigation by the UK’s Information Commissioner’s Office (ICO) has revealed. The data protection regulator issued a reprimand to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, for security failings relating to the November 2024 incident. Data Cymru is funded by the Welsh government and is tasked with enabling local councils and other organizations to find, collect, analyze and present data effectively."
  https://www.infosecurity-magazine.com/news/children-data-stolen-password1/
• State Bank Of India Confirms Data Leak After 3,897 Customer Records Found On Dark Web
  "State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from. The state-owned bank, India's largest, said in a stock-exchange filing dated October 21 that it "has experienced an incident involving the loss of certain data." The count is preliminary, and the bank has yet to establish whether the data is authentic, how far the exposure goes and what risk it poses to customers."
  https://thehackernews.com/2026/10/state-bank-of-india-confirms-data-leak.html

General News

• Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens
  "Data loss prevention (DLP) tools are often functioning as after-the-fact forensic systems rather than prevention controls, according to DLP in the AI Era, a new survey from the Cloud Security Alliance (CSA), the world's leading not-for-profit organization committed to AI, cloud, and Zero Trust cybersecurity education. The study, conducted in collaboration with Jazz, found that 73% of organizations said they experienced at least one confirmed data loss incident in the past 24 months. Among the respondents, only 16% said DLP blocked their most significant incident before data left the organization."
  https://www.darkreading.com/cloud-security/cloud-security-alliance-survey-data-loss-prevention-detects-data-loss
• Survey Finds High-Profile Executives Feel Untouchable As Digital Exposure Turns Into Physical Risk
  "360 Privacy, a digital exposure reduction company, today released its 2026 Annual Digital Exposure Report. It found that security and risk leaders now treat digital exposure and physical danger as the same problem, and that the executives, celebrities and wealthy families they protect often don't believe they're at risk."
  https://www.darkreading.com/cybersecurity-operations/360-privacy-survey-high-profile-executives-feel-untouchable
• Why Security Tools Lose Sight Of The Credential
  "Security teams have tools for code, endpoints, cloud infrastructure, identity, and secrets management. Credentials cut across all of them. A developer finds an AWS key in a repository. The first step is obvious: remove it. But that does not answer the questions the security team now has: Is the key still active? Who owns it? What can it access? Is the same credential sitting in a CI/CD variable, a local .env file, a Slack thread, or an old commit? Has it ever been exposed publicly?"
  https://www.helpnetsecurity.com/2026/10/21/gitguardian-securing-credential-layer/
• Ransomware Attacks Rise As Rival Gangs Vie For Market Supremacy
  "Almost 3000 ransomware attacks took place between July and September 2026 and the figure marked a significant increase when compared with the same period last year. According to an analysis by Nord Security, the 2894 ransomware attacks which took place during the quarter represents a 50% increase when compared with the same period last year. It also represents a slight increase when compared with the previous quarter of this year, as the July to September period saw an 8.6% rise in ransomware attacks when compared with April to June."
  https://www.infosecurity-magazine.com/news/rival-gangs-vie-for-market/
• Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports
  "Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templates now arrive fluent, personalized, and unique to each recipient, and the behavioral signals email filters have relied on for years are fading as a result. Proofpoint shared several examples of the shift at its Protect 2026 conference. In one, a single threat actor contacted more than 30 real estate agents at the same company, each from a different account, about a different property, and in different words, before closing every thread with the same request: join a video meeting."
  https://thehackernews.com/2026/10/generative-ai-is-erasing-behavioral.html

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• Hitachi Energy RTU500 Product
  "Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-05
• HMS Networks PEAK-System PCAN Windows Drivers
  "Successful exploitation of these vulnerabilities could crash the Windows kernel."
• **https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01
• Moxa AIG-302 ThingsPro Edge**
  "Successful exploitation of these vulnerabilities could allow an attacker to obtain and disclose sensitive information."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-03
• Hitachi Energy MicroSCADA X SYS600 Product
  "Hitachi Energy is aware of multiple vulnerabilities that affect MicroSCADA X SYS600 product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-04

Vulnerabilities

• Open And Shut: Remote Code Execution In Opencode Via MCP OAuth
  "What is opencode: opencode is a popular open-source AI coding agent with approximately 3 million weekly npm downloads and 211,000 GitHub stars. Like other coding agents, it can access local files, execute commands and interact with external systems, typically operating with the developer's privileges. What we found: Pillar Security discovered a critical remote code execution (RCE) flaw in opencode affecting Windows and Windows Subsystem for Linux (WSL). The flaw allows an attacker-controlled remote Model Context Protocol (MCP) server to execute arbitrary code on a developer's machine during a remote MCP OAuth authentication process, without additional user interaction or consent."
  https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth
  https://www.infosecurity-magazine.com/news/opencode-quietly-patched-critical/
• PHP Warns Admins Of Two Critical Flaws, Emergency Patches Coming Tomorrow
  "The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. PHP powers many websites and web applications, including content management systems, e-commerce platforms, and custom web services. In an advisory published Tuesday, the PHP development team announced that it plans to release security updates on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern), to address two vulnerabilities, each rated 9.2 under CVSS v4.0."
  https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/
• Critical FortiSIEM Flaw Gets Public Exploit PoC For Unauthenticated Remote Code Execution
  "Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets."
  https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html
• CISA Adds Six Known Exploited Vulnerabilities To Catalog
  "CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
  CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
  CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
  CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability
  CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
  CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog

Malware

• #StopRansomware: SafePay Ransomware
  "This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics."
  https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a
  https://therecord.media/fbi-says-safepay-ransomware-gang-among-most-active-600-victims
• OVHcloud CLI Releases Backdoored On GitHub To Steal Developer Secrets
  "French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. The attacker hijacked a developer’s GitHub account to gain access to the OVHcloud CLI repository and modify versions 0.11.0 through 0.15.0 of the tool. OVHcloud offers the CLI tool as an alternative for system administrators and developers to manage cloud and hosting services directly from a terminal, including for automating tasks."
  https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/
  https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html
• [AnyDesk TAG] AnyDesk And ScreenConnect In a Campaign Targeting Banking Customers
  "Last week at VulnCheck's ThreatCon1 conference we briefly touched on a campaign we have been tracking since early spring. It was one of several examples in a talk about looking outward for adversary infrastructure rather than waiting for an attack to arrive. This one is not an Adversary-in-the-Middle campaign. It is a phone-led fraud operation targeting banking customers, and it has been running since at least March 2026. The operator uses convincing copies of bank support pages, genuine remote-access software and custom signed payloads to gain remote access to victims' computers."
  https://www.aitmfeed.com/blog/blog-1/anydesk-tag-anydesk-and-screenconnect-in-a-campaign-targeting-banking-customers-22
  https://www.bankinfosecurity.com/fraudsters-clone-bank-support-pages-urge-victims-to-call-a-33149
• The Risk Of AI-Powered Antidetect Browsers In Online Fraud And Influence Operations
  "Online platforms rely on digital signals to identify suspicious accounts and activity. Antidetect browsers make those signals harder to trust by allowing operators to create and manage large numbers of browser profiles that appear to belong to different users, devices and locations. While these tools have legitimate uses, Check Point Research found documented evidence of their use in criminal ecosystems for activities including account takeover and payment fraud. AI and automation can further increase the scale of these operations."
  https://blog.checkpoint.com/security/antidetect-browsers-how-ai-is-scaling-online-fraud-and-account-takeovers/
• Doppelgänger Russian Influence Campaign In Israel
  "Doppelgänger (German for “double”) describes the campaign’s hallmark: fake copies of well-known news sites, with a design, logo and layout meant to make readers think they are reading an article from a legitimate media outlet. In recent weeks, ClearSky identified renewed activity by the Russian influence campaign in Israel. The campaign, known as “The Double” – Doppelgänger, spreads false and misleading messages built on parts of real publications, while impersonating well-known media outlets. The messages are spread on social networks, mainly on X, through a network of fake accounts."
  https://www.clearskysec.com/doppelganger-russian-influence-campaign-in-israel/
• Beyond Passwords: How Attackers Abuse Device Code Authentication
  "The Cofense Phishing Defense Center (PDC) has analyzed several emails that may look like ordinary spam to the untrained eye. Threat actors attempt to mimic routine corporate emails and blend into everyday inbox traffic. As aware of the common phishing tac tactics grows, threat actors are turning to techniques such as device code phishing. To understand how this technique works, it is important to understand what access codes are and how they differ from the common username-and-password method of authentication."
  https://cofense.com/blog/beyond-passwords-how-attackers-abuse-device-code-authentication
• Swallowtail: Russian Espionage Group Targets Defense Firms In Two NATO Countries
  "Russian espionage group Swallowtail (aka APT28, Fancy Bear, Forest Blizzard) targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. All three targets were likely to hold information of direct interest to a foreign intelligence service. During one attack, against the naval shipbuilder, operators returned to a compromised host repeatedly over the course of a week in what appeared to be hands-on-keyboard activity. They stole credential material using two separate techniques, opened a persistent SSH tunnel into the organization's internal network and deployed a previously undocumented reflective loader."
  https://www.security.com/threat-intelligence/swallowtail-russia-nato-targets
  https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.html
  https://therecord.media/european-defense-contractors-fancy-bear-espionage
  https://cyberscoop.com/russian-hackers-apt28-target-nato-defense-firms/
• The Checker You Pay For
  "Fraud against spend-management platforms is usually pictured as theft from the platform itself: a stolen card is spent, a false reimbursement is paid, a chargeback is booked. This blog documents a quieter pattern, observed in a recent case within the environment of a Group-IB Fraud Protection client, in which the platform was not the target of the fraud, but was instead abused as a component of the fraud’s infrastructure. Two linked behaviours were observed. In the first, the platform’s trusted email and payment rails were used to lend credibility to phishing scams aimed at people who are not the platform’s customers. In the second, the platform’s bank-account linking flow–provided through an open-banking aggregator–was used to validate stolen card and bank credentials, a checking function that fraudsters abused at no cost to themselves."
  https://www.group-ib.com/blog/spend-management-abuse-fraud-classiscam/
• The Journey Of a Paper Unicorn: Adventures Inside a Modern Warehouse
  "Imagine you’ve ordered a small paper unicorn from an online marketplace. You clicked “Buy”, received a cheerful notification, and expect a courier to bring the box tomorrow. If the unicorn is delayed by a day, it will be annoying but not catastrophic: an apology, a discount promo code — and the incident is forgotten. Now let’s multiply one late unicorn by several hundred thousand orders. Packages start heading to the wrong cities. The website shows an item is in stock, even though the required bin is empty. Conveyors stop, boxes get stuck between floors, the cargo piles up with no freight manifest. Trucks line up at the gates, and every minute of downtime turns into blown schedules, support tickets, fines, and lost sales."
  https://securelist.com/paper-unicorn-warehouse-security/121537/
• Threat Brief: Active Exploitation Of PAN-OS CVE-2026-0257 (Updated October 20)
  "Unit 42 continues to observe attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc). We’re also aware of public reporting attributing exploitation to threat actors using Settra ransomware. Palo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect. This security flaw involves an authentication bypass in the portal and gateway components of vulnerable versions of PAN-OS software, which could allow unauthorized attackers to circumvent security controls and initiate virtual private network (VPN) connections. This CVE was added to the Known Exploited Vulnerability (KEV) catalog on May 13, 2026."
  https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/#
  https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html
  https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226
• WhatsApp Help Pages Leaked Hidden Instructions For a Meta Chatbot
  "Dozens of WhatsApp web pages designed to answer people’s questions about Meta’s encrypted messaging app inadvertently exposed the company’s own instructions to its chatbot. These included some sections titled “WHAT NOT TO SAY” to users asking questions and explicit instructions not to provide people with legal advice. A new analysis has found that around 80 help and FAQ pages across WhatsApp’s website exposed text instructions that were designed for a large language model, specifically one of Meta’s own. The instructions, according to findings from privacy company Redact, appeared in the webpages’ code and contained written details that were not explicitly on the WhatsApp help pages."
  https://www.wired.com/story/whatsapp-help-pages-leaked-hidden-instructions-for-a-meta-chatbot/
  https://thehackernews.com/2026/10/whatsapp-hid-instructions-in-help-pages.html
• How Ray Cracked The Phish No Scanner Could Find
  "A targeted credential phishing campaign delivered 22 emails to a single enterprise tenant within a two-hour window on August 27, 2026, engineered to pass every email gateway by hiding the payload behind legitimate Frame[.]io share notifications. Static gateway scanners see a clean Frame[.]io link and give the email a safe verdict. They cannot read the shared asset inside the SaaS platform. Just three minutes after the first email landed, a targeted employee reported it. But because the link led to genuine infrastructure, traditional security controls saw nothing malicious. Not until Ocean's agentic investigation engine, Ray, got inside the platform and pulled the true payload."
  https://ocean.security/resources/blog/frame-io-phishing-aitm-share-link
  https://hackread.com/scammers-frame-io-steal-microsoft-365-credentials/
• INC And The Gentlemen Ransomware: Exposed AI Infrastructure
  "SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen Ransomware groups. A single publicly accessible command-and-control server exposed the operators’ AI session databases, their central knowledge base and the source code of Phantom, a new “Autonomous Red Team Kill Chain Framework”. Configuration files, logs and credentials inside that server led STRU to six more exposed adversary-controlled servers."
  https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/
• How I Got Over 300 Tor Exit Nodes Removed
  "On Friday Oct 2, 09:35am, 333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible. To give you a sense of scale, all of Tor has around 3000 exit relays, so roughly 10% were under their control. The attackers had gained access to the servers two months earlier, in August, and quietly deployed their Ebury 1.8.3 payload (an OpenSSH backdoor and credential stealer for Linux)."
  https://kaba.cx/posts/20261020_Tor/

Breaches/Hacks/Leaks

• Zeabur Shutting Down After Second Security Breach In Two Months
  "Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. The attackers used stolen administrator credentials and cloud access keys to compromise Zeabur’s shared hosting infrastructure and dedicated servers, eventually gaining access to its production database."
  https://www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/
• 970,000 Medi-Cal Members Affected By Paradigm Healthcare Data Breach
  "Paradigm Healthcare Services has told the US Department of Health and Human Services (HHS) that a data breach discovered last year affected more than 970,000 people. San Francisco-based Paradigm processes billing for Medi-Cal, California’s Medicaid program, under a data use agreement with the California Department of Health Care Services (DHCS). It also maintains Medi-Cal member identification numbers on the department’s behalf. The company says it became aware of unauthorized access to its local network on October 13, 2025. “On August 18, 2026, we determined that certain files containing select individuals’ protected health information may have been accessed by an unauthorized party between October 8, 2025, and October 15, 2025,” Paradigm said."
  https://www.securityweek.com/970000-medi-cal-members-affected-by-paradigm-healthcare-data-breach/
• AfD Email Breach Exposes 421,000 Messages In Anonymous Online Archive
  "Germany’s Alternative für Deutschland (AfD) confirmed on October 19 that its hosting provider was hacked in September and that mailboxes were copied. By the time the confirmation reached Bild, a website called hexane.cc had already been online for hours offering an index of what it claims are 421,179 internal party emails. “In September 2026 there was a hacking attack on a hosting provider used by our party.” By then the website hexane.cc had been online for several hours with an index of what it says are 421,179 of the party’s emails. In place of the emails, the site shows summaries written by software, sorted into categories that include racism and antisemitism and graded from Low to Critical."
  https://securityaffairs.com/201346/data-breach/afd-email-breach-exposes-421000-messages-in-anonymous-online-archive.html
• Stolen UpdraftCentral Keys Used To Backdoor WordPress Sites
  "A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. TeamUpdraft detected unauthorized access to its infrastructure over the weekend and believes that the hacker accessed the customer database. The developer offers several WordPress tools for backup, storage, and site management:"
  https://www.bleepingcomputer.com/news/security/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites/
  https://teamupdraft.com/blog/security-incident-october-2026/

General News

• Nigerian Man Sentenced To Eight Years For Hacking, Fraud, And Identity Theft Schemes
  "United States Attorney for the Southern District of New York, Jamie McDonald, announced that CHUKWUEMEKA VICTOR AMACHUKWU, a/k/a “Chukwuemeka Victor Eletuo,” a/k/a “So Kwan Leung,” was sentenced by U.S. District Judge Paul G. Gardephe to eight years in prison for his role in multiple fraud, hacking, and identity theft offenses. AMACHUKWU previously pled guilty to conspiracy to commit computer intrusions and conspiracy to commit wire fraud."
  https://www.justice.gov/usao-sdny/pr/nigerian-man-sentenced-eight-years-hacking-fraud-and-identity-theft-schemes
  https://www.bleepingcomputer.com/news/security/hacker-gets-8-years-for-stealing-33-million-from-taxpayers/
  https://therecord.media/nigerian-given-8-year-sentenc-tax-hacks
  https://cyberscoop.com/nigerian-sentenced-hacking-fraud-tax-investment-scheme/
• US Agencies Detail Incident Response Practices For Rogue AI Agents
  "Effective and efficient use of complex agentic systems is important for all organizations, but recognizing, preventing and recovering from them going rogue could be an existential necessity. NIST, the NSA, and CISA recognize the increasing potential for AI agents to behave in an unexpected and potentially harmful manner, and has responded with a list of key practices for both preparing for and responding to such behavior. The report (Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation) uses the term super intelligence (SI) rather than artificial intelligence (AI) in line with presidential executive order 14434."
  https://www.securityweek.com/us-agencies-detail-incident-response-practices-for-rogue-ai-agents/
  https://www.nist.gov/system/files/documents/2026/10/16/Key_Practices_for_Incident_Readiness_and_Response_in_Super_Intelligence _Training_and_Evaluation.pdf
  https://www.bankinfosecurity.com/nsa-nist-cisa-issue-guidance-on-rogue-ai-agents-a-33156
• There's Only So Much Code: The Rise In Vulnerability Numbers
  "Frontier AI models (like Mythos) are rapidly mining decades of technical debt across ubiquitous legacy libraries, driving monthly Microsoft Patch Tuesday vulnerability advisories up more than tenfold (reaching 1,415 this month). This volume is overwhelming open-source maintainers and putting pressure on the traditional 90-day coordinated disclosure model. Despite a 105% year-over-year surge in CVEs, Known Exploited Vulnerabilities (KEVs) grew by only 37%, and only 3 of September's 975 Microsoft advisories saw in-the-wild exploitation, demonstrating that the vast majority of AI-discovered bugs are not practically exploited."
  https://blog.talosintelligence.com/theres-only-so-much-code-the-rise-in-vulnerability-numbers/
• Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers And Software
  "Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. Major browsers and operating systems trusted the compromised certificates, potentially allowing attackers to impersonate legitimate websites and intercept encrypted communications. A security researcher known as Wayne discovered the weakness on October 17 while scanning publicly available certificate data."
  https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html
  https://emudhra.we-have-a-problem.com/
  https://www.darkreading.com/cyber-risk/tech-giants-emudhra-certificates-compromised-keys
  https://www.bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates/
  https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312
• Close Identity Gaps In Software Development Before Unleashing AI
  "When Renee Guttmann ran her first Open Worldwide Application Security Project (OWASP) meeting in New York City in the early 2000s, the general sentiment among the industry (and attendees) was one of skepticism: Why on earth would anyone care about scanning web applications for vulnerabilities? Flash forward 20-plus years, and Guttmann, founder of security consultancy Cisohive, no longer has to beat down doors to get people to listen. Initiatives like OWASP, with its aim to improve software security, are now regularly invited into software development life cycle (SDLC) conversations to help developers and teams embed secure software practices across planning, testing, deployment and maintenance."
  https://www.darkreading.com/application-security/close-identity-gaps-sdlc-before-ai
• Your Frontline Workers Have a Workaround For That MFA Prompt
  "Frontline workers in healthcare and manufacturing are getting around slow, unreliable logins by staying signed in, sharing credentials and trying to bypass multifactor authentication. Sapio Research surveyed 700 IT and security decision-makers in August, and 95% said they had seen frontline workers use workarounds like these in the past 12 months. Each of those habits breaks the link between an account and the person using it. A session left open on a shared workstation lets the next worker act under someone else’s name, and a password passed around a team lets anyone who knows it do the same. Attackers are working the same weak point from outside. Sixty-two percent of respondents reported a confirmed or suspected attempt to abuse account recovery, a password reset or an unlock in the past year."
  https://www.helpnetsecurity.com/2026/10/20/frontline-worker-authentication-passwordless/
• AI Agent Adoption Creates Risk As Oversight Struggles To Keep Pace, Splunk Finds
  "Businesses are rolling out AI agents across their networks much faster than they can implement monitoring procedures and security controls, leaving organizations exposed to security threats, hallucinations and other common issues associated with the technology. Published by Cisco on October 20, the2026 Splunk State of Observability warned that while many businesses are keen to explore the potential benefits of using AI in their ecosystem, many do so without a strategy in place to ensure it is being used safely."
  https://www.infosecurity-magazine.com/news/ai-agent-adoption-oversight/
• Seven Core Research Areas For a Rapidly Evolving Cyber Landscape
  "In the past year, cyber adversaries have started to exploit artificial intelligence (AI) technology to execute a wide range of attacks. AI is helping them accelerate, optimize, and scale up their techniques. Agentic AI lowers the work factor for savvy adversaries, and it lowers the barrier to entry for new entrants. There is already an increase in the extent, tempo, and sophistication of attacks, and they are targeting diverse sectors. There are the well-known Salt Typhoon attacks on multiple prominent telecommunications providers and, more recently, attacks on water systems attributed to Iran."
  https://www.sei.cmu.edu/blog/seven-core-research-areas-for-a-rapidly-evolving-cyber-landscape/
• What Security Teams Can Do To Tame Wild Code
  "A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team’s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support them. If you work in security, that success introduces a new set of questions. Whose credentials does the workflow use? Which records can it access? Who can see its output? If it starts exposing information it shouldn’t, can you trace what happened and stop further access?"
  https://thehackernews.com/2026/10/what-security-teams-can-do-to-tame-wild.html
• The Key To AI Software Security Isn’t Speed, It’s Maturity
  "Agentic artificial intelligence software development has all the traits of a summer blockbuster, with the prospects of Godzilla-sized productivity gains thrilling business leaders and security implications sending chills down the spines of developers and SOC teams. One difference, though, is that those thrills and chills are going to last longer than a summer, and the fallout could be a lot more serious than some spilled popcorn."
  https://www.securityweek.com/the-key-to-ai-software-security-isnt-speed-its-maturity/
• Swamped Curl Maintainers Take Low-Level Flaws Public To Survive Vulnerability 'avalanche'
  "An "avalanche of vulnerability reports" is forcing curl to move lower-severity cases into public view, reserving private handling for high and critical flaws. From October 26, low and medium-severity reports should be filed in the open source data transfer tool's public GitHub repository, maintainer Daniel Stenberg said. "Security researchers in doubt can still submit the issue on HackerOne and we can tell them what severity we deem it to be. Over the last few years, over 90 percent of all submissions could quickly be assessed to be less than HIGH.""
  https://www.theregister.com/security/2026/10/20/swamped-curl-maintainers-take-low-level-flaws-public-to-survive-vulnerability-avalanche/5304198
• ICANN Testing Tech To Let Law Enforcement Access Non-Public WHOIS Info
  "ICANN has started testing authentication schemes that will allow law enforcement agencies to make urgent requests for non-public WHOIS information – when needed to address threats to life, critical infrastructure, or child exploitation. Domain registrars collect information about their customers and in the past that data was publicly available in WHOIS records. Some domain registrars offer services that substitute their own contact details, to preserve customer privacy. In recent years, laws like GDPR mean registrars are sometimes required to hide WHOIS data."
  https://www.theregister.com/networks/2026/10/20/icann-testing-tech-to-let-law-enforcement-access-non-public-whois-info/5304036
• Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
  "U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom."
  https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand