โพสต์ถูกสร้างโดย NCSA_THAICERT

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• EPICS Base
  "Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01
  https://www.theregister.com/security/2026/10/27/ai-hacker-finds-4-severe-bugs-in-popular-industrial-control-software-in-under-4-hours/5305811
• Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 And BizViz
  "Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in information disclosure, tampering with, destruction, or deletion of information, and a denial-of-service (DoS) condition of the system."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-02

Vulnerabilities

• HPE Patches Dozens Of Critical Flaws In Networking Products
  "HPE last week released patches for 72 vulnerabilities in the AOS-8 and AOS-10 wireless operating systems of its Aruba networking products, including 33 critical-severity flaws. The security updates address eight max-severity bugs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851. Successful exploitation of these security defects could allow unauthenticated attackers to achieve remote code execution (RCE), bypass authentication to gain administrative privileges, run arbitrary commands, and completely compromise the affected systems."
  https://www.securityweek.com/hpe-patches-dozens-of-critical-flaws-in-networking-products/
• Apple Backports CoreGraphics Zero-Day Patches To Older iPhones
  "Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. Apple patched the same vulnerability in September for devices running iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. Meta Product Security discovered this out-of-bounds write weakness (tracked as CVE-2026-86950) in CoreGraphics, a framework used for two-dimensional vector graphics, text drawing, and image rendering across iOS, macOS, iPadOS, watchOS, and tvOS."
  https://www.bleepingcomputer.com/news/apple/apple-backports-coregraphics-zero-day-patches-to-older-iphones/
  https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html
  https://www.securityweek.com/ios-macos-27-2-patch-286-bugs-fix-for-exploited-flaw-backported-to-ios-18/
• AuthMask: We Made Microsoft Authenticator Hand Over Tokens To An App With Zero Permissions
  "A single exported activity handed out tokens for the victim's work account. We found that an unprivileged Android app with zero permissions could impersonate any installed Microsoft first-party app and have the Microsoft Authenticator broker hand it that app's tokens. The setup is a device with Authenticator installed and one work account signed into it. The caller's identity was never used for any trust decision, so a single exported activity handed out tokens for the work account."
  https://enclave.ai/blog/authmask-we-made-microsoft-authenticator-hand-over-tokens
  https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html
  https://www.helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097/
• CISA Adds Two Known Exploited Vulnerabilities To Catalog
  "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
  CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
• Microsoft Releases Windows OOB Updates To Distrust eMudhra Certificates
  "Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. The KB5134133 update for Windows 11 versions 24H2, 25H2, and 26H2 and the KB5134125 update for Windows 10 versions 21H2 and 22H2 were released on October 26. The updates are for systems without Internet access, devices that cannot access Microsoft's certificate-update service, and those where automatic Certificate Trust List (CTL) updates have been disabled."
  https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-oob-updates-to-distrust-emudhra-certificates/
  https://www.theregister.com/security/2026/10/27/microsoft-releases-out-of-band-windows-fixes-with-certificate-updates/5305637
• Stealing OpenAI Reasoning Traces Via Compaction Smuggling
  "In August 2026, Xint researchers discovered a bug in the OpenAI API that leaks raw reasoning traces from frontier OpenAI models. Dubbed compaction smuggling, the attack bypasses the mitigations OpenAI deployed in response to the Stolen Thoughts paper published earlier this year. OpenAI confirmed the issue and deployed an undisclosed fix on October 23, 2026. The Xint team was rewarded with a $6,000 bounty."
  https://xint.io/blog/compaction-smuggling-reasoning-traces
  https://thehackernews.com/2026/10/openai-compaction-flaw-let-researchers.html
  https://www.infosecurity-magazine.com/news/openai-compaction-flaw-ai/
• Samsung TVs Without Mics May Listen Through Soundbars, Researcher Says
  "A reverse engineer claims that their Samsung smart TV has been collecting audio without their consent. The researcher, who calls themselves “log4j,” said in an X thread that their 2025 Samsung TV was delivering ads that seemed suspiciously relevant to them. Investigating, they claim to have found a package called “always on voice,” which uses the TV’s built-in microphone to collect sounds from the room. The software logged events such as dogs barking and babies crying, log4j said, adding that these events are counted and reported back to Samsung."
  https://www.malwarebytes.com/blog/privacy/2026/10/samsung-tvs-without-mics-may-listen-through-soundbars-researcher-says
• An Insecure Neighbor: How a Vulnerability Chain Led To An Isolation Bypass In Cloud Infrastructure
  "This article is published for educational purposes only, to raise awareness among information security professionals. The research was part of an official bug bounty program on a major platform. We notified the cloud provider about the vulnerabilities in line with our responsible disclosure policy, and all security issues we found were fixed in full. The infrastructure analyzed in this post has been anonymized, so the organization cannot be identified. We believe that regular pentests, bug bounty programs, and conversations between developers and independent researchers are the foundation of security for any IT product."
  https://securelist.com/cloud-infrastructure-isolation-bypass/121609/
• Choose Your Backend: Three TLS Bugs In GoAhead
  "GoAhead is used in hundreds of millions of IoT, Firewall, OT, and Military devices including those from Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing, and more. Three independent bugs in GoAhead's TLS integrations can leave revoked client certificates accepted, encrypted sessions recoverable to an observer or a configured chain-depth limit unenforced."
  https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead
  https://thehackernews.com/2026/10/goahead-tls-flaws-allow-revoked-client.html

Malware

• Notorious Brazilian Magecart Group Hijacks Convertr Checkouts Via Plausible Analytics
  "A notorious Brazilian Magecart group, active since 2024, planted a card skimmer in the analytics script of ecommerce platform Convertr. From 24 October, Convertr checkouts sent the card details and CPF numbers of shoppers to 1x0.is. Convertr runs the online stores and checkout of dozens of Brazilian fashion brands. Convertr says its merchants have sold more than R$2 billion (about €320 million) through the platform. All of them load a tracker from analytics.convertr.app.br, Convertr's own Plausible analytics server. The attacker appended a skimmer to that one file. Every Convertr checkout loaded it."
  https://sansec.io/research/convertr-plausible-supply-chain-attack
  https://www.bleepingcomputer.com/news/security/hackers-hijack-convertr-analytics-script-to-steal-payment-card-data/
• Yoba Malware Abuses Signed ChatGPT And Claude Binaries To Target AI Users
  "As interest in new AI tools accelerates, cybercriminals are finding ways to exploit the trust surrounding them. Check Point Research (CPR) has uncovered Yoba, a malware campaign using fake GitHub projects impersonating supposed ChatGPT and Claude desktop applications, while abusing legitimate, signed OpenAI and Anthropic executables to help load malware. The campaign shows how the rush to access new AI tools is creating opportunities for social engineering, even when the AI platforms themselves have not been compromised."
  https://blog.checkpoint.com/research/yoba-malware-abuses-signed-chatgpt-and-claude-binaries-to-target-ai-users/
• Locked And Loaded: Phishing Through Fake Bids And Protected Documents
  "In the sales process, few emails carry as much weight as an invitation to bid. It opens the conversation that can eventually lead to revenue, and professionals are conditioned to treat it with urgency and care. Threat actors understand this, and they have learned to pair that urgency with a simple tactic: the password-protected document. Password protection lends the file an air of legitimacy, mimicking a practice companies use every day, while providing threat actors with a critical advantage - most email security tools cannot inspect the contents of an encrypted file. In this walkthrough, we break down how an important sales invitation and a "secured" document combine to set up a tricky and deceptive credential phishing campaign."
  https://cofense.com/blog/locked-and-loaded-phishing-through-fake-bids-and-protected-documents
• Not Only ARTEX: The Different Levels AI Is Used In Attacks Targeting Japan
  "In autumn 2026, companies and other organizations in Japan reported a succession of data leaks from their web systems. The Japanese government’s National Cybersecurity Office issued an alert to businesses on October 9, and the chair of the ruling party’s cybersecurity headquarters described cyberspace as being in a “state of emergency.” These incidents prompted growing concern about the use of AI in attacks. Our own investigations have confirmed AI use in operations targeting Japanese organizations, but its role varies considerably."
  https://www.trendaisecurity.com/en-us/resources-insights/deep-research/not-only-artex-the-different-levels-ai-is-used-in-attacks-targeting-japan
  https://thehackernews.com/2026/10/cyberstrikeai-uses-44-ai-agents-to.html
• Australia Gets Into Amadey Malware Backend, Cuts Off Access To 180,000 Infected Computers
  "A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. "The next steps that we took were to disconnect that Amadey controller from all those victims," Tauri Gregory, ASD's acting deputy director-general of intelligence, told ABC News in an interview published on October 27."
  https://thehackernews.com/2026/10/australia-gets-into-amadey-malware.html
• Malicious Apps Prey On Russians’ Anxiety About Fuel Prices, Drone Strikes
  "Cybercriminals are exploiting fuel shortages and fears of drone attacks in Russia to trick users into downloading malicious Android apps designed to steal personal and financial information, according to a new report. The latest campaign targets Russian drivers with an app that claims to show the locations of traffic police patrols, speed cameras and gas stations with fuel in stock. Instead, it delivers ZloyRAT, an Android trojan capable of collecting sensitive information and accessing functions on infected phones, according to researchers at Russian cybersecurity firm F6."
  https://therecord.media/malicious-apps-russian-anxiety-gas-prices-drone-strikes
• Oncerning Behavior From a Popular Open-Weight AI Model
  "Inside a closed testing sandbox managed by Cohere, one of Alibaba's newest Qwen3.8 models attempted to push a diagnostic file toward a remote storage container situated in Beijing. Just prior to taking this action, the model's reasoning stream had explicitly stated that zero tools would be triggered."
  https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model
  https://securityaffairs.com/201810/ai/cohere-finds-qwen-ai-model-contacting-a-server-in-china.html
• RATatouille: Today’s Special: Impersonating Companies In Korea, Payments In Cryptocurrency
  "While tracking infrastructure related to ValleyRAT, numerous suspicious websites were identified that impersonated companies and brands from Korea such as Doosan Robotics and Cheonjeong. The identified sites used the actual companies’ logos, promotional videos, and descriptions to disguise themselves as official websites. The websites offered features such as invitation-code-based registration, login, fee history inquiries, VIP membership benefits, and cryptocurrency deposit and withdrawal functions."
  https://asec.ahnlab.com/en/96151/
• Invoice Fraud Campaign Adds Prompt Injection Aimed At Email AI Agents
  "As more workers use AI agents to read incoming email and take actions from it, attackers are trying out new variations of familiar fraud campaigns that target both the human and the AI assistant reading the email. If either the AI agent or the human are tricked into following instructions from the attacker, that can increase the odds that the fraud attempt will succeed. Sublime Security has found a new version of this in the wild, where anattacker is including a new prompt injection technique in their long-standing invoice fraud campaign."
  https://sublime.security/blog/invoice-fraud-campaign-adds-prompt-injection-aimed-at-email-ai-agents/
• Analysis Of Multi-Stage Attack Infrastructure Targeting Defense, Security, And Government Organizations In The United States And Asia
  "Oasis Security analyzed files collected from an attacker server used in multiple attacks, including reconnaissance, vulnerability exploitation, SSRF, session exfiltration, and credential brute-forcing, against infrastructure associated with [Victim A], a U.S. government-funded research institute. A total of 1,665 documents related to applicants to [Victim B], an Indo-Pacific security research institute, were also identified on the server. The files also showed attacks against Malaysian government institutions and public services."
  https://oasis-security.io/blog/Analysis-of-Multi-Stage-Attacks-on-Defense-Security-and-Government-Organizations-in-the-US-and-Asia
• AI, Scripts, Operator - Inside The ConnectWise Attack
  "On October 16, Huntress first reported the abuse of a ConnectWise Cloud Backup credential to access Microsoft 365 tenants, and since then we have been continuing to investigate threat actor behavior related to this incident. Now, we're pulling on a different thread: who, or what, was doing the typing during the unauthorized activity we observed. Microsoft has published its own findings, attributing the activity to a threat actor it tracks as Storm-0940, which it says used ARTEX, an open-source multi-agent AI framework, to abuse the compromised ConnectWise application credentials and sign in to downstream Microsoft 365 tenants at machine speed. Our telemetry aligns with Microsoft's findings, but does not independently confirm them."
  https://www.huntress.com/blog/connectwise-attack-ai
• Unveiling Sirius Backdoor: A Multistage Fileless Campaign Disguised As FedEx Invoices
  "During a recent priority customer escalation, our “Trellix” Threat Response Team investigated a suspicious alert involving the unexpected execution of a PDF document. What initially appeared to be a routine phishing attempt quickly unfolded into a sophisticated, multistage campaign delivering a previously undocumented variant of the Sirius Backdoor. While the initial delivery via an email containing a ZIP archive with a PDF appeared routine, the execution flow stood out due to its heavy use of living-off-the-land (LotL) techniques."
  https://www.trellix.com/blogs/research/sirius-backdoor-fileless-campaign-fedex-invoices/
• The Pwn Request Reckoning: What Still Works Against GitHub Actions
  "For years, pull_request_target has been the canonical Pwn request vector: a workflow trigger that runs with repository secrets, yet can be triggered by anyone who opens a pull request from a fork. In 2026, GitHub responded with platform changes that make the default-case exploit significantly harder. These changes represent real progress. Checkout protections, read-only cache tokens, and event policies close the paths that made exploitation trivial. But they don't eliminate the vulnerability class. They shift it. Attackers who previously exploited any pull_request_target workflow now need to find explicit opt-ins, outdated checkout versions, unprotected triggers, or script injection."
  https://www.wiz.io/blog/github-actions-security-pwn-request-reckoning

Breaches/Hacks/Leaks

• Japan's GMO Urges Customers To Shut Down PCs Amid Ransomware Threat
  "The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company’s Onamae Desktop Cloud threatened to launch a ransomware attack today. The company later confirmed that data belonging to both the company and its customers had been published online. The alert concerns a cyberattack on Onamae Desktop Cloud, a popular VPS provider in Japan operated by GMO Internet, a member of GMO Internet Group and one of Japan's largest domain registrars."
  https://www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/
  https://www.theregister.com/security/2026/10/27/japanese-virtual-desktop-cloud-hacked-so-hard-it-asks-to-be-banned/5305610
• UNM Health Ransomware Attack Disrupts Patient Care, Surgeries
  "The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. On Monday, UNM Health, the university’s healthcare provider, began temporarily limiting new patient admissions, diverting ambulances to nearby hospitals, and suspending outpatient surgeries and appointments. In an update on the incident, UNM said UNM Hospital and Sandoval Regional Medical Center remain open, and all clinics will resume scheduled appointments and procedures starting today, Tuesday, October 27."
  https://www.bleepingcomputer.com/news/security/unm-health-ransomware-attack-disrupts-patient-care-surgeries/
  https://therecord.media/university-of-new-mexico-hospital-diverts-cyber-incident
  https://www.bankinfosecurity.com/cyberattack-disrupts-new-mexicos-only-trauma-center-a-33220
  https://www.infosecurity-magazine.com/news/cyber-unmhealth-surgeries/
  https://www.securityweek.com/cybersecurity-issue-forces-a-major-new-mexico-hospital-to-divert-patients-and-close-clinics/
  https://www.theregister.com/cyber-crime/2026/10/27/day-2-of-canceled-classes-at-university-of-new-mexico-after-health-sciences-center-cyberattack/5305690
  https://www.helpnetsecurity.com/2026/10/27/university-of-new-mexico-hospitals-cyberattack/
• Warp Discloses Breach Exposing AI Agent Logs, User Telemetry Data
  "Agent decision logs and telemetry data belonging to Warp agentic development environment users were exposed in an attack on a third-party vendor in the project’s infrastructure. The company’s founder and CEO, Zach Lloyd, estimates that "roughly 1% of Warp users may have been impacted," but external experts are helping with the ongoing investigation. Warp is a popular developer tool that started as a modern terminal and evolved into an agentic development environment (ADE) that allows developers to direct AI agents to write and test code and deploy software."
  https://www.bleepingcomputer.com/news/security/warp-discloses-breach-exposing-ai-agent-logs-user-telemetry-data/
• Energy Giant ENGIE Discloses Data Breach Affecting Customers
  "French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners. ENGIE operates in renewable energy, infrastructure, and customer energy supply in 30 countries, employs over 90,000 people, and reported €71.9 billion in revenue last year. An ENGIE spokesperson told BleepingComputer that it cut off the attackers' access to the compromised platform and that they didn't breach the company's internal systems."
  https://www.bleepingcomputer.com/news/security/energy-giant-engie-discloses-data-breach-affecting-customers/
• Vendor Key Leak Puts Data Of 238,000 Denver Health Plan Members At Risk
  "Denver Health Medical Plan (DHMP) is notifying 238,000 people that their personal and health information may have been compromised in a data breach. Based in Denver, Colorado, DHMP is a non-profit managed care organization within the Denver Health and Hospital Authority system. Through its Denver Health Medicaid Choice plan, it administers Health First Colorado (Medicaid) benefits for members in Denver and three surrounding counties. The data breach, DHMP says, involved third-party vendor SquareML, which provides a no-code platform for healthcare analytics."
  https://www.securityweek.com/vendor-key-leak-puts-data-of-238000-denver-health-plan-members-at-risk/
• Italy ’s Parliament Under Cyber Pressure: Why The Attack On The Chamber Matters
  "The cyberattack targeting email accounts at Italy’s Chamber of Deputies, including a parliamentary account assigned to Prime Minister Giorgia Meloni, raises questions that go well beyond the security of individual inboxes. At a time when European institutions face growing cyber pressure, the incident highlights how access to political communications can become part of a broader hybrid warfare strategy."
  https://securityaffairs.com/201867/hacking/italys-parliament-under-cyber-pressure-why-the-attack-on-the-chamber-matters.html

General News

• The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest
  "Cyber headlines often focus on the flashy attacks, but the ones that actually cause OH $#!T moments are the tactics that abuse the tools and workflows you already trust. If you run a small or mid-sized organization, whether you handle IT yourself or outsource it, it’s a constant race to keep up with attackers and their evolving tactics. The bottom line is that you need to know which attacks are landing in environments like yours, and how to prioritize your defenses against them."
  https://www.bleepingcomputer.com/news/security/the-huntress-tragic-quadrant-ranking-threats-hitting-businesses-hardest/
• Ukrainian National Sentenced For Role In Hacking Hospitals, Businesses, And Governments As Part Of Ransomware Conspiracies Causing Over $100 Million In Losses
  "Artem Stryzhak, 36, a Ukrainian national, was sentenced today to 70 months in prison for conspiracy to commit computer fraud in connection with a series of ransomware attacks that targeted hospitals, government entities, law firms, and other businesses around the world. “This sentence concludes a years-long, multi-continent investigation into a defendant who participated in cyber-attacks against Americans’ businesses and health care,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “Cybercriminals who terrorize American businesses cannot evade justice by operating from abroad or hiding behind sophisticated technology. Artem Stryzhak’s sentence underscores the Justice Department’s resolve to dismantle ransomware groups, hold them accountable, and protect American businesses and people from cyber extortion.”"
  https://www.justice.gov/opa/pr/ukrainian-national-sentenced-role-hacking-hospitals-businesses-and-governments-part
  https://therecord.media/nefilim-hive-ransomware-operator-70-months-prison
  https://cyberscoop.com/nefilim-hive-ransomware-affiliate-artem-stryzhak-sentenced/
• 3 Frameworks To Protect CISOs & Orgs Against AI Liability
  "Many chief information security officers (CISOs) currently find themselves in the deep weeds of AI governance. But the question they might not be asking is how do you defend decisions around AI deployments when litigators, regulators, and customers come looking for someone to assume liability for a compromise? Cyber legal expert Daniel B. Garrie, CEO of Law and Forensics, is striving to answer that question with distinct frameworks that both help CISOs determine whether a specific AI feature is sufficiently safe to run, as well as generate an evidentiary trail of paperwork that can be used to defend their actions, should something go horribly awry down the road."
  https://www.darkreading.com/cyber-risk/3-frameworks-cisos-ai-liability
• Beware The Slasher: AI Could Kill Off Cybersecurity Pros' Skills
  "The use of AI as a tool to enhance cybersecurity operations is emerging as a double-edged knife for security professionals. While it can make them more capable, it could also spell the demise of the very skills they need to use it effectively. That's the concern of Nathan Hamiel, senior director of research at Kudelski Security, who has made a case for how evolving technology can erode technical skills since well before the generative AI boom. Now, that concern is getting much louder."
  https://www.darkreading.com/cybersecurity-operations/ai-kill-off-cybersecurity-pros-skills
• Several AI Security Market Categories Are Headed For Bigger Platforms
  "In this interview with Help Net Security, Jonathan Care, Lead Analyst and Practice Lead AI at KuppingerCole Analysts, compares AI security startups to the early fraud market he helped define at Gartner. He explains which categories will survive as products and which will become features inside bigger platforms. Care talks about Q3 funding going to fewer, larger rounds, Israel’s share of cyber venture investment, and the five controls an organization needs before an agent touches production. He names three categories he would bet on for 2028 and three he would bet against."
  https://www.helpnetsecurity.com/2026/10/27/jonathan-care-kuppingercole-analysts-ai-security-market/
• Top 7 Email Security Threats Facing Businesses In 2026
  "Email security threats are attacks that use email to steal credentials, compromise accounts, deliver malware, or expose sensitive data. Roughly 80% of data breaches begin right in an employee’s inbox because email is cheap, fast, and can bypass firewalls by targeting human psychology instead of system vulnerabilities. Email security issues have evolved far beyond simple spam. We’re now fighting AI-generated phishing, targeted credential theft, and ransomware delivery systems that traditional filters can’t catch. And the problem is only growing: The FBI’s 2025 Internet Crime Report ranked phishing and spoofing among the most commonly reported cybercrimes, with more than 1 million complaints and nearly $21 billion in reported losses overall."
  https://blog.barracuda.com/2026/10/26/email-security-threats
• US Indicts Malaysian National After Madagascar Scam Operation Uncovered
  "The Justice Department said it disrupted a Madagascar-based scam operation that allegedly stole hundreds of thousands from Americans through fictitious NFT investment schemes. On Tuesday, prosecutors announced indictments of Malaysian national Chui Kok Wa and five others for their role in stealing more than $516,695 from 74 cryptocurrency wallets associated with victims in Maryland, Oregon, Nevada, Minnesota and other states. The indictment said Wa worked with accomplices in China in coordinating and funding the scheme, which allegedly moved to Madagascar last year after law enforcement takedowns in Cambodia."
  https://therecord.media/malaysian-national-indicted-after-scam-centers-raid-madagascar
• Annual Cyber Threat Report 2025-26
  "I am pleased to present the Annual Cyber Threat Report for 2025-26. The world continues to face the most complex and challenging strategic circumstances since the Second World War. The rules-based international order, which has underpinned Australia’s security and prosperity for decades, is in transition. Nations are increasingly contesting for influence, technological advantage and economic security. Cyber operations have become a central feature of this competition, offering adversaries a means to advance their objectives below the threshold of conventional conflict."
  https://www.cyber.gov.au/publication/annual-cyber-threat-report-2025-26
  https://www.abc.net.au/news/2026-10-27/australian-signals-directorate-ai-cybersecurity-hacking-threats/107309858
  https://therecord.media/australia-spies-share-intel-and-want-victims-to-share-back
  https://securityaffairs.com/201859/ai/australias-cyber-spy-chief-expect-more-disruption-as-ai-accelerates-hacking.html
• This Is Fine: What NetScaler Zero-Days Tell Us About The New Normal
  "If you’ve been paying attention to enterprise edge security lately, the September 2026 Citrix NetScaler zero-day advisories probably gave you a familiar case of heartburn. But before everyone panics, let’s step back and look at the bigger picture: what we are seeing right now isn’t a collapse of edge defense. It is, in fact, exactly how modern active defense is supposed to work when high-value, internet-facing infrastructure comes under heavy fire. First, a quick refresher on why Citrix NetScaler ADC (Application Delivery Controller) and Gateway sit directly in the crosshairs of global threat actors. NetScaler is an everything-at-the-edge solution. It acts as a reverse proxy, load balancer, Web Application Firewall (WAF), traditional firewall, and SSL VPN all rolled into one appliance."
  https://www.securityweek.com/this-is-fine-what-netscaler-zero-days-tell-us-about-the-new-normal/
• What Happens When Security Tools Go Dark Before The Ransomware
  "On Oct. 1, threat researchers reported that the China-linked group behind Warlock ransomware, which Microsoft tracks as Storm-2603, had attacked at least four organizations in the prior two months. A water utility and a telecommunications provider were among them, along with a regional government body and a university. This all occurred in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America. The likely way in was on-premises Microsoft SharePoint. The researchers believe the group still carries the ToolShell flaws it exploited in July 2025, the same month Microsoft shipped the fixes, alongside newer SharePoint flaws. An exploit for a bug patched more than a year ago is still worth packing. Somewhere, a server is still waiting for its fix."
  https://cyberscoop.com/warlock-ransomware-storm-2603-sharepoint-attacks-op-ed/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

เมื่อวันที่ 27 ตุลาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 2 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
• CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

เมื่อวันที่ 26 ตุลาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 2 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-109618 – PHP Memory Corruption Vulnerability
• CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

เมื่อวันที่ 23 ตุลาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 2 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability
• CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog
https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

เมื่อวันที่ 22 ตุลาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 20 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• ICSMA-26-295-01 - InterSystems Corporation InterSystems IRIS for Health
• ICSA-26-295-01 - Kiloview E3 NDI Encoder
• ICSA-26-295-02 - Siemens Industrial Edge App Publisher
• ICSA-26-295-03 - Siemens Software Center
• ICSA-26-295-04 - Siemens Capital Embedded AR Classic
• ICSA-26-295-05 - Siemens SENTRON 3NA COM Fuse
• ICSA-26-295-06 - Siemens PSS(R)SINCAL
• ICSA-26-295-07 - Siemens SIMATIC IPCs
• ICSA-26-295-08 - Siemens APOGEE, TALON and Desigo PXC/PXM Products
• ICSA-26-295-09 - Siemens Industrial Edge Device Kit
• ICSA-26-295-10 - Siemens SIMATIC S7 Webserver API
• ICSA-26-295-11 - Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
• ICSA-26-295-12 - Siemens RUGGEDCOM CROSSBOW
• ICSA-26-295-13 - Siemens WinCC
• ICSA-26-295-14 - Siemens SIMATIC S7 PLCs Web Server
• ICSA-26-295-15 - Siemens RUGGEDCOM CROSSBOW Station Access Controller
• ICSA-26-295-16 - Siemens SIMATIC S7-1500 TM MFP
• ICSA-26-295-17 - Siemens Industrial Edge Devices
• ICSA-26-295-18 - Siemens RUGGEDCOM APE1808 Devices
• ICSA-26-274-06 - Meari IoT Cloud Platform OpenAPI Service (Update A)

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

เมื่อวันที่ 20 ตุลาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 6 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
• CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
• CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
• CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability
• CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
• CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

เมื่อวันที่ 15-16 ตุลาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 3 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
• CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability
• CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/10/15/cisa-adds-one-known-exploited-vulnerability-catalog
https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

เมื่อวันที่ 14 ตุลาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 4 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability
• CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability
• CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability
• CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 3 รายการ เมื่อวันที่ 27 ตุลาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-26-300-01 EPICS Base
• ICSA-26-300-02 Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
• ICSA-26-267-02 Eufy Omni C20, Omni X10 Pro (Update A)

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

เมื่อวันที่ 27 ตุลาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 2 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
• CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• Industrial Vendors Check Products For PHP2Shell Vulnerabilities
  "Industrial giants such as Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have published advisories to inform customers about the impact of the recently disclosed PHP2Shell vulnerabilities on their products. Several of these companies have confirmed that some of their industrial and operational technology (OT) products are affected. Others are still assessing exposure or have determined that their products are not impacted. PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP engine that can be exploited for unauthenticated remote code execution. PHP patched them on October 21 with versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, after information leaked online ahead of the planned disclosure."
  https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/

New Tooling

• Witness: Open-Source Framework For Verifying How Your Software Was Built
  "Witness is an open-source command-line tool that records how software gets built, signs that record, and checks it against a policy before the software ships. TestifySec built Witness and donated it to the in-toto ecosystem within the Cloud Native Computing Foundation, and an open community now maintains it. A compiled binary doesn’t say which machine built it or what code went in. Witness lets a team check which command produced the file, which materials went into it, and whether a trusted key signed each step. When a check fails, witness verify exits with a non-zero status and states the reason, which gives a CI job something concrete to stop on."
  https://www.helpnetsecurity.com/2026/10/26/witness-open-source-software-supply-chain-tool/
  https://github.com/in-toto/witness
• Introducing The Elephant-Goldfish Model Plugin: Scaling Design-Driven AI Software Development
  "AI-powered velocity is transformative; however, it has silently introduced a potential reliability crisis by also increasing the velocity of “slop,” bugs, and session context collapse. Generative AI tools excel at increasing coding speed, but pure speed without structured guardrails means we are often auto-scaling our mistakes rather than simply writing code faster. We need a paradigm shift, aligning the human need for system comprehension with AI’s capacity for execution."
  https://opensource.googleblog.com/2026/10/introducing-elephant-goldfish-model-plugin.html
  https://github.com/google/elephant-goldfish-model
  https://www.helpnetsecurity.com/2026/10/26/google-elephant-goldfish-model-plugin/

Vulnerabilities

• Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
  "Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say. An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems. Fixed versions were released on October 19 and 20, and the maintainers have not reported any attacks."
  https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html
• Microsoft Releases Emergency .NET Patches For Critical Brotli Flaw
  "Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. Tracked as CVE-2026-111497, this critical-severity flaw stems from an out-of-bounds write in the Brotli decoder, which expands data compressed using Google's widely used Brotli lossless compression algorithm. HTTP2Shell impacts HTTP clients and servers, as well as other applications and tools that rely on vulnerable Brotli implementations."
  https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-net-patches-for-critical-brotli-flaw/
  https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/
  https://thehackernews.com/2026/10/php-issues-second-windows-security.html
  https://www.infosecurity-magazine.com/news/microsoft-patch-update-net-flaw/
  https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/
  https://www.theregister.com/security/2026/10/26/microsoft-releases-emergency-net-security-fixes-for-google-brotli-bug/5305515
• Detecting And Mitigating ZDI-CAN-33367 And Five Other Linux Flaws
  "A working root exploit for a Linux kernel bug is now public, before it has a CVE or a merged fix. On October 20, 2026, Trend Micro’s Zero Day Initiative (ZDI) sent one report, a bug in the ConnMan network manager, to the public ConnMan mailing list. On October 21, ZDI sent five reports to the Linux kernel security team and copied public mailing lists on every one. The reports included reproduction details, showing that several had no patch attached and no fix in any released kernel. Two of the Linux flaws have been rated as CVSS 9.0."
  https://www.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws
  https://www.infosecurity-magazine.com/news/linux-flaws-exposed-before-fixes/
• An Alignment Assessment Of The UK AISI Cybertesting Incident
  "On August 4, 2026, the UK AI Security Institute (AISI) published a report that detailed some concerning behavior it observed from Claude Mythos 5 during its testing of the model’s cyber capabilities. In AISI’s evaluation, Mythos 5 was given a capture-the-flag (CTF) cybersecurity challenge, in which it was asked to retrieve a protected piece of data (the “flag”) from a simulated network. Internet access was deliberately enabled (this was standard for AISI’s cyber testing at the time, but is no longer). The cyber safeguards we deploy with general release models like Fable 5 were disabled. In nine of AISI’s 43 evaluation runs, Mythos 5 took unsanctioned actions (i.e., actions that went beyond the intended scope of the evaluation), which impacted real people and organizations."
  https://www.anthropic.com/research/alignment-assessment-ukaisi
  https://securityaffairs.com/201729/ai/anthropic-reveals-how-claude-mythos-5-crossed-security-testing-boundaries.html
• CISA Adds Two Known Exploited Vulnerabilities To Catalog
  "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching:
  CVE-2026-109618 – PHP Memory Corruption Vulnerability
  CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

Malware

• Gheist: Attempted Scaled Abuse Of Stolen GitHub Tokens Stumbles
  "Since September 15, 2026, Wiz Research has been tracking Gheist: a new campaign performing mass abuse of compromised GitHub tokens. The attack commits a workflow named sync-check to every repository to which each token has access. The workflow seeks to print the repository's secrets into its own workflow log. Then, the tool downloads the log through the GitHub API and deletes the run seconds later. The tool's API requests carry the user agent gheist, which gives the campaign its name. We have recovered more than 13,500 planted branches from more than 850 compromised accounts, ranging from personal projects to enterprise organizations' private repositories."
  https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles
  https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html
  https://www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets
  https://www.infosecurity-magazine.com/news/gheist-attackers-abuse-stolen/
• Deepveindrilling[.]com: Magento CMS Block Loader Hits 953 Stores
  "deepveindrilling[.]com is the newest web address of a criminal group that breaks into online stores. The group adds a small piece of code to the store's pages. When you visit, that code makes your browser ask the group's server what to do next. The server first checks whether you are a real shopper or a security scanner, so scanners get nothing. The group has done this to 953 stores since July 2025, mostly Magento shops. It moves to a new address every few months."
  https://sansec.io/research/magento-cms-block-loader-deepveindrilling
  https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html
  https://www.securityweek.com/953-online-stores-infected-in-long-lasting-malware-campaign/
  https://securityaffairs.com/201795/malware/magento-campaign-infects-953-online-stores-across-five-domains.html
• Beyond The Inbox: How Threat Actors Abuse Microsoft Teams External Chat For Initial Access
  "Arctic Wolf Labs has observed a recurring social engineering pattern in hundreds of cases where threat actors have used Microsoft Teams’ external chat creation feature for impersonation scams, or to deliver malicious files. A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same “IT Support (Internal)” display names, the same remote-access tools, and increasingly, the same payload domains."
  https://arcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access/
  https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html
• uCreator: Virtualization-Based Android Spyware Platform Targeting WeChat, Telegram And Other Messaging Apps
  "uCreater (the vendor's own name for the product is YingGai) is a commercial Android surveillance platform built around 群控 (“mass control”). Branded through packages in the com.ucreator.* namespace, it is not a single malware family but a productized framework: a VirtualApp/LSPatch engine, a library of per-application hook modules, a Redis and HTTP control plane, a cloud-phone farm for live screen control, and a Windows operator console. Customers can rent the platform and deploy its capabilities against different applications on a target device. Despite this breadth and multi year usage, I found little public threat reporting documenting the platform's architecture."
  https://www.0x0v1.com/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps/
  https://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html
  https://securityaffairs.com/201764/malware/researchers-uncover-rentable-android-spyware-ucreater-targeting-wechat-and-telegram.html
• Ukraine Warns Hackers Are Exploiting Chinese-Made Dahua Surveillance Cameras
  "Ukrainian government cybersecurity researchers have warned that hackers are gaining unauthorized access to surveillance cameras made by Chinese manufacturer Dahua, potentially exposing video feeds and allowing attackers to remotely control the devices. Ukraine's computer emergency response team, CERT-UA, said late last week that it had identified cases in which hackers compromised the internet-connected cameras and video recorders, changed their settings and created unauthorized user accounts. The agency did not say how many devices had been compromised, when the attacks occurred or who was responsible. Chinese-made surveillance equipment remains widely used in Ukraine, including by government institutions and military units."
  https://therecord.media/ukraine-cert-ua-warning-chinese-dahua-cameras-hacked
• Testmetest Npm Packages Carry a Miasma-Family Worm
  "An operator is testing a Miasma-family npm worm in public. Between 19 and 25 October 2026, npm received 18 packages from the same operator. The accounts alexjoipamiba, testnewtestme and iobandamwer published seven of them. The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the home directory when the victim revokes the stolen GitHub token."
  https://safedep.io/testmetest-npm-worm-miasma-variant/
  https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570
• CYFIRMA Threat Advisory: Suspected DPRK Campaign Staging PHP2Shell Targeting Against Global PHP Infrastructure
  "Early Warning – PHP2Shell (v3): Suspected DPRK Campaign Staging PHP2Shell Exploitation Against Global PHP Infrastructure. Korean-speaking operators have filtered a 216-host target set and are running low-and-slow PHP weakness checks from 21 compromised nodes against CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2, unauthenticated RCE in PHP core). This update carries the full Version 1–2 assessment forward."
  https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/
  https://securityaffairs.com/201748/hacking/php2shell-suspected-north-korean-campaign-targets-216-vulnerable-php-hosts.html
• Qilin And Japan: Attackers Probing Japanese Networks
  "Japan is in an unusually intense run of cyber incidents, and Qilin is the ransomware group to watch. This report combines network analysis in KELA CONTROL with KELA’s monitoring of leak sites and cybercrime forums. It shows a Qilin affiliate server scanning Japanese VPN portals, sets out how Qilin became the most frequent ransomware claimant against Japan in KELA’s data, maps the affiliates and brokers behind it, and closes with recommendations and indicators of compromise."
  https://www.kelacyber.com/resources/research/qilin-ransomware-japan/
• Enter 666: Unmasking Beast Ransomware
  "AttackIQ has released a new assessment that emulates the Tactics, Techniques, and Procedures (TTPs) associated with Beast Ransomware to help customers validate their security controls and their ability to defend against this threat. By using this emulation in the AttackIQ Adversarial Exposure Validation (AEV) Platform, security teams will be able to: Evaluate security control performance against baseline behaviors associated with Beast Ransomware. Assess their security posture against an opportunistic adversary. Continuously validate detection and prevention pipelines against a realistic playbook."
  https://www.attackiq.com/2026/10/23/beast-ransomware/

Breaches/Hacks/Leaks

• DreamHost Forces Password Resets In Ongoing "incident"
  "DreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface. The latest update from the web hosting provider notes that all affected account owners have received recovery instructions. Users will be unable to log in until their account owner sets new credentials. DreamHost is a U.S. web hosting provider and domain registrar that offers WordPress hosting, business email, virtual private servers, dedicated servers, and cloud services."
  https://www.bleepingcomputer.com/news/security/dreamhost-forces-email-ftp-sftp-password-resets-in-ongoing-incident/
• University Of Copenhagen Data Breach Exposes Data Of 525,000 People
  "The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. The educational organization detected the breach last Tuesday and disclosed it on Friday. In an update yesterday, the university added another 20,000 staff and students whose PIN codes were exposed. “The University of Copenhagen has confirmed a cyber attack in which hackers gained access to one of the university’s test environments,” the university says."
  https://www.bleepingcomputer.com/news/security/university-of-copenhagen-data-breach-exposes-data-of-525-000-people/
• Genesys Hack Exposes Customer Data From Internal Systems
  "Customer experience company Genesys says it has contained a cyberattack that involved unauthorized access to data. Headquartered in Menlo Park, California, Genesys is a provider of customer experience and call center technology for mid-sized and large organizations. On October 19, the company announced that hackers had accessed internal business systems, including a learning management system (LMS) and a customer relationship management (CRM) environment."
  https://www.securityweek.com/genesys-hack-exposes-customer-data-from-internal-systems/

General News

• Former Pentester Used ARTEX AI To Steal 8.2 Million Data Records
  "South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks. According to local media citing the Seoul Metropolitan Police, the gang leader has a background in penetration testing and worked at a cybersecurity company between 2019 and 2022. In 38 of the incidents, the threat actor demanded ransom payments of 360 million won ($270,000), promising in exchange not to leak stolen data."
  https://www.bleepingcomputer.com/news/security/former-pentester-used-artex-ai-to-steal-82-million-data-records/
• Risks & Rewards: How AI Is Redefining The CISO's Role
  "The CISO role is evolving around AI, with security leaders now expected to help the business gain a competitive edge with it while also using the technology to help manage cyber-risk. Doing both jobs at once means keeping up with technology that changes by the month, Mark Weatherford, Nvidia's head of cybersecurity policy and strategic engagement, said this week at the ISC2 Strategic Congress 2026."
  https://www.darkreading.com/cybersecurity-careers/risks-rewards-ai-redefining-ciso-role
• Security Pros Reckon The Biggest AI Risk Comes With An Employee Badge
  "Employees pasting company data into AI tools worry security teams more than AI-powered attacks do. AI-generated phishing, the attack they run into most often, made the list of top concerns for only a quarter of the 209 security professionals O’Reilly surveyed in September. Mike Loukides, VP of content strategy at O’Reilly Media, believes the fear of AI wiping out humanity distracts from harm happening today. “We don’t need panic. We need an assessment of where we are: What are the threats? Where are the skills gaps? Where is the budget?” he wrote."
  https://www.helpnetsecurity.com/2026/10/26/ai-tools-security-worry-survey/
• AI Slop Is Piling Up Highest On The Biggest Open-Source Projects
  "The maintainers of large open source projects are taking the worst of the AI slop. In a Linux Foundation survey of 234 open source contributors and maintainers, people running projects with more than 50 contributors estimated that close to a third of the code changes landing in their queue are low quality or AI-generated. Those maintainers now worry more about burning out than about the code itself. Across all projects, the estimate comes to about one in four. Each of those submissions, called a pull request, has to be read by a person before it gets merged or rejected. That person is a maintainer, and every piece of junk in the queue takes time away from the work that keeps the project running."
  https://www.helpnetsecurity.com/2026/10/26/linux-foundation-open-source-ai-slop/
• Forgotten AI Agents May Still Access Sensitive Company Data
  "AI agents that have not run recently retain credentials and connections to company systems, according to Arrakis Security’s 2026 Autonomous Agents Threat Report. About 76% of enabled agents examined had not run in 60 days, leaving access available through inactive software. The analysis covered thousands of agents in customer production environments over a 12-week period. These programs can read and write data, call tools and start workflows, giving them the ability to perform tasks across business services."
  https://www.helpnetsecurity.com/2026/10/26/arrakis-dormant-ai-agent-risks-report/
• AI-Generated Fake Bank Calls And NFC App Enabled €380,000 Fraud, Dutch Police Say
  "Rotterdam police have arrested two men over a new type of bank fraud that used AI-generated phone calls, a fake banking app, and NFC technology to steal bank card data. In just three weeks, the scheme allegedly cost 170 victims around €380,000. “Rotterdam police arrested two suspects accused of a new form of bank-helpdesk fraud. The operation allegedly caused around €380,000 in losses for 170 victims in just three weeks.” NL Times reports. “The suspects allegedly used AI-generated phone calls and a fake banking app to copy victims’ bank cards remotely, allowing accomplices to withdraw thousands of euros. Victims came from across the Netherlands and ranged in age; dozens were in their twenties and thirties.”"
  https://securityaffairs.com/201786/cyber-crime/ai-generated-fake-bank-calls-and-nfc-app-enabled-e380000-fraud-dutch-police-say.html
  https://www.securityweek.com/dutch-police-arrest-two-over-nfc-relay-attacks-that-drained-400000/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand