Cybersecurity News and Magazine

The Cyber Express Weekly Roundup: PHP2Shell Knocks Wikipedia Offline, ASD Retires the Essential Eight and More

Ashish Khaitan — Fri, 23 Oct 2026 11:40:10 +0000

A decade-old flaw in the language behind much of the web, found by AI and serious enough to take Wikipedia offline. Driving licenses sold for AED 10,000 to people who never sat for a test. A police sweep across 21 African countries that ended in more than 1,400 arrests. This weekly roundup covers stories where the weak point was not always a firewall, but the trust built into code libraries, license agreements, and the frameworks organizations use to measure their own security. Here are the stories that shaped the week.

The Cyber Express Weekly Roundup

PHP2Shell Flaws Knock Wikipedia and Government Sites Offline

Two critical vulnerabilities in PHP, the scripting language that powers a large share of the web, have triggered urgent patching warnings from agencies around the world. Dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have already been linked to outages at Wikipedia and a number of government websites. Read more...

INTERPOL’s Operation Serengeti III Nets 1,462 Arrests Across Africa

An INTERPOL-coordinated crackdown spanning 21 countries has ended in 1,462 arrests. Operation Serengeti III ran from June to August 2026 and targeted fraud, ransomware, business email compromise and online scams. Investigators disrupted 10,909 malicious networks and recovered more than USD 105 million. The operation also identified nearly 66,000 victims, linked to combined losses of more than USD 385 million. Read more...

ASD Essentials Replaces the Essential Eight

The Australian Signals Directorate has launched ASD Essentials, a broader successor to the Essential Eight, the security baseline Australian organizations have long been measured against. Where the Essential Eight centered on a fixed set of mitigation strategies, the new framework extends its scope to enterprise IT, operational technology and cloud environments. Read more...

Dubai Police Bust AED 10,000 Fake Driving License Scheme

Dubai Police have arrested an eight-member gang that sold driving licenses for AED 10,000 each. Customers received licenses issued in a neighboring country without ever travelling there, taking a lesson or sitting a test. The gang then helped buyers convert those licenses into UAE licenses by exploiting legitimate license exchange agreements between the two countries. Read more...

Fintechs Urged to Treat Software Supply Chain Security as Enterprise Risk

Fintech firms vet their commercial vendors closely, but the open-source libraries, container images and third-party components inside their systems often arrive with far less scrutiny. That mismatch leaves a blind spot in how financial technology companies manage risk. Vijendra Katiyar of CleanStart points to examples such as a widely used Redis image that carried 185 known CVEs, and the Shai-Hulud worm, which spread through malicious npm packages. Read more...

Conclusion

Taken together, this week’s stories show how much of today’s risk comes from what organizations already trust: decade-old code, inherited software components, official exchange agreements and security checklists that measure effort rather than results. Follow The Cyber Express for next week’s weekly cybersecurity roundup and ongoing coverage of these stories.

Fake Reviews, Deceptive Ads: FTC Targets Alleged Passport Scam

Samiksha Jain — Fri, 23 Oct 2026 10:27:39 +0000

The Federal Trade Commission (FTC) has filed a complaint against GovAssist LLC, Entry LLC and Scott Zuckerman over an alleged government impersonation scheme targeting consumers seeking U.S. passport and travel-related services. The case highlights how paid search advertising, misleading service promises and allegedly fake customer reviews can be used to make commercial websites appear connected to official government services.

According to the FTC, the defendants allegedly used websites and sponsored search results to attract travelers, collect personal and financial information, and mislead consumers about the services they would receive. The complaint was filed in the U.S. District Court for the District of Puerto Rico.

How the Government Impersonation Scheme Allegedly Worked?

The FTC alleges that, since at least October 2023, GovAssist, Entry and Zuckerman operated websites including GovAssist.com, Entry.com and IVS.us, offering passport applications, passport-related services, visa applications and visa renewals. The complaint states that the websites presented themselves as affiliated with the U.S. State Department, although the defendants were neither the federal government nor authorized government-affiliated providers of passport-related services. The alleged operation relied on paid search ads to reach people looking for official passport information. Searches such as “apply for a new passport,” “passport renewal,” and “passport renewal online” routinely returned IVS.us and Entry.com pages among Google's top sponsored results, according to the FTC. This approach allegedly placed commercial services in locations where users might expect to find official government resources. The distinction matters because consumers searching for essential documents may not recognize that a sponsored result belongs to a private company rather than a government agency.

Misleading Passport Service Claims and Hidden Costs

The FTC alleges that the defendants made false promises about what their services could deliver, including claims that they could directly issue U.S. passports. In many cases, consumers allegedly received only a completed passport application that was available for free through the State Department's website. The complaint also challenges the companies' pricing disclosures. Although their advertisements or websites reportedly stated that services started at $89, the FTC alleges that the lowest available price was $119, plus a $29 shipping fee, bringing the total to $148. Consumers also needed to pay the State Department when submitting their passport applications. According to the complaint, the defendants prominently displayed their own prices while omitting or downplaying the additional government fee, potentially leaving customers unaware that they would have to pay again. Delivery claims are another part of the case. The FTC alleges that the defendants advertised expedited passport services promising delivery in as little as six to 10 business days or three to four business days. The agency contends these promises were false because the timelines were faster than the quickest expedited service available through the State Department, the only source of U.S. passports.

Fake Reviews and Consumer Trust

The complaint further alleges that the defendants used fake positive reviews to make their services appear legitimate. Their websites reportedly highlighted excellent ratings based on consumer feedback published on Trustpilot and other review platforms. According to the FTC, those ratings relied on high numbers of fake positive reviews. If established, the allegations would show how misleading reviews can reinforce the credibility created by sponsored search placements, making it harder for consumers to distinguish legitimate services from deceptive offerings. The alleged combination of deceptive ads and fake reviews is central to the case because consumers may rely on both search rankings and customer feedback when deciding which service to trust.

FTC Alleges Violations of Three Federal Laws

The FTC alleges that the defendants violated the FTC Act, the Impersonation Rule and the Gramm-Leach-Bliley Act. The complaint targets the alleged impersonation of government services, misleading representations about passport processing and pricing, and the use of false consumer reviews. Zuckerman, identified as the owner and sole member of GovAssist and Entry, allegedly operated the scheme while subject to an FTC order in an earlier, unrelated case involving Support King LLC. That case concerned stalkerware and resulted in a final administrative order addressing data privacy. The FTC said its staff received assistance from the U.S. Postal Inspection Service, the U.S. Attorney's Office for the District of Puerto Rico and the U.S. Department of State. The Commission authorized the complaint in a 2-0 vote.

What the Case Reveals About Online Consumer Fraud

The allegations illustrate how consumer fraud can exploit the gap between what users expect from an online search and what a website actually provides. A sponsored result may appear prominently, but its placement does not establish that the service is government-operated or officially authorized. The case also highlights the role of pricing transparency and review authenticity in online trust. Claims about faster processing, low starting prices, and positive customer experiences can influence purchasing decisions, particularly when consumers need time-sensitive travel documents. The FTC has emphasized that filing a complaint does not establish that the defendants violated the law. The case will be decided by the court. For consumers, the allegations underscore the importance of distinguishing official government services from third-party providers and checking fees, processing claims, and reviewing credibility before sharing personal or financial information. The FTC also states that it will never demand money, threaten consumers, instruct them to transfer money, or promise them a prize.

INTERPOL’s Operation Serengeti III Disrupts 10,909 Malicious Networks

Ashish Khaitan — Fri, 23 Oct 2026 09:59:57 +0000

A cybercrime crackdown spanning 21 countries has led to 1,462 arrests, the disruption of 10,909 malicious networks and the recovery of more than USD 105 million in illicit funds, making Operation Serengeti III one of the largest cybercrime enforcement operations Africa has seen. Coordinated by INTERPOL between 29 June and 31 August 2026, the operation targeted cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion. Authorities identified 65,929 victims of cybercriminal networks, while financial investigations linked the activity to losses exceeding USD 385 million.

Cybercrime Crackdown Amid a Shifting Threat Landscape

The operation comes as INTERPOL’s African Cyber Threat Assessment Report 2026 describes a rapidly evolving environment, with artificial intelligence increasingly enabling cybercrime across the continent and cyber-enabled financial losses still rising. Ahead of Operation Serengeti III, investigators from 20 African countries and the United States received actionable intelligence on suspicious domains, IP addresses and command-and-control infrastructure tied to criminal activity. Private-sector partners supplied intelligence, technical analysis and operational expertise, helping authorities identify targets, map criminal networks and support investigations across the region. INTERPOL’s Director of Cybercrime, Neal Jetton, said: “Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale. “Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm.”

Operation Serengeti III: Key Results Across Africa

In Uganda, authorities dismantled two transnational fraud rings and arrested 365 foreign nationals tied to online investment and pension fraud schemes targeting victims in Asia. A suspected scam call centre ran on a rotating model, using scripted communications, fake trading platforms and fraudulent websites to lure pensioners into non-existent investments. In Angola, investigators shut down two illegal cryptocurrency mining centres, arrested nine suspects and seized more than 2,000 mining devices along with six illegal power transformation stations. The electrical infrastructure alone was valued at over USD 1 million. In Nigeria, police arrested a suspect behind a large-scale phishing and BEC operation that harvested software credentials and amassed roughly 2.1 million email addresses, and recovered a luxury vehicle believed to have been bought with criminal proceeds. A separate Nigerian probe into an international investment fraud scheme promoted via messaging apps led to another arrest, with more than USD 2.4 million in suspected proceeds traced, much of it laundered through cryptocurrency. Elsewhere, authorities dismantled a malicious mobile loan application scheme in Tanzania, disrupted a social media-based vehicle import fraud network in Gabon and arrested 30 suspects linked to a cybercrime operation in the Republic of Congo.

What Comes Next in the Cybercrime Crackdown

Several investigations stemming from Operation Serengeti III remain active, as authorities work to identify more suspects, trace illicit proceeds and analyse seized digital evidence. Supporting partners included Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security, Cybercrime Atlas, Meta, the Global Anti-Scam Alliance and the Postal and Telecommunications Regulatory Authority of Zimbabwe. The operation was co-funded by the Global Action on Cybercrime Enhanced (GLACY-e) project, a joint initiative of the European Union and the Council of Europe. Participating countries were Angola, Benin, Cameroon, Congo, Côte d’Ivoire, Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, the United States, Zambia and Zimbabwe.

Japan AI Cyberattack Simulations Planned as PHP Flaws Disrupt Services

Ashish Khaitan — Fri, 23 Oct 2026 07:19:36 +0000

Japan is preparing to set up a dedicated team to run AI-driven cyberattack simulations to expose weaknesses in technology systems. Japan's plan for AI cyberattack simulations comes as organizations worldwide scramble to address critical PHP flaws that have disrupted parts of the internet. Speaking on Friday, Industry Minister Ryosei Akazawa said those defending against cyber threats need to think like attackers, using AI proactively to uncover potential weak points before they can be exploited. His comments follow widespread disruption caused by the disclosure of the PHP flaws, which led to millions of reported hacking attempts. Businesses and governments were forced to patch their systems or temporarily take websites offline. Because PHP is widely used to build and run websites and web applications, any weakness in the language poses a risk to organizations across many sectors.

How PHP Flaws Hit Banks, Airlines and Government

The vulnerabilities triggered precautionary shutdowns across banking, transport, airline and government services in several countries. In Japan, Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway temporarily halted some online services. The Ministry of Finance, the National Tax Agency and the Meteorological Agency also suspended certain digital services as part of their security response. On Friday, JR East said some of its services were back online, while others would resume only after safety checks. Nippon Paint said it had applied a security patch and restored its website. The disruption shows how difficult it is to secure interconnected digital infrastructure when a widely used software component turns out to have serious weaknesses.

SoftBank Pauses Emergency Alerts Over PHP Flaws

The fallout also reached services people rely on in a crisis. Telecommunications company SoftBank said it was temporarily suspending its mobile emergency alert system while it carried out maintenance to fix a PHP vulnerability. While the system is down, customers will not receive early warnings through it for earthquakes, tsunami threats, disasters, or evacuation information. The case shows that cybersecurity incidents can extend well beyond ordinary websites and interrupt access to vital public safety information.

Why Japan AI Cyberattack Simulations Point to Proactive Defense

The episode has put a fresh focus on finding vulnerabilities before attackers do. The Japan AI cyberattack simulations are designed to help defenders understand how weaknesses might be targeted and to sharpen their response capabilities, in line with the approach Ryosei Akazawa outlined. Simulation alone is not enough, however. Installing patches remains essential, and organizations need to test updated systems carefully before bringing services back, especially where transport, finance, and government operations are affected. As AI tools grow more capable for both attackers and defenders, businesses and governments face the task of pairing fast vulnerability detection with effective security updates, continuous monitoring, and resilient digital infrastructure.

Why Fintechs Must Treat Software Supply Chain Security as an Enterprise Risk

Editorial — Fri, 23 Oct 2026 05:48:06 +0000

Vijendra Katiyar, Co-Founder and Chief Revenue Officer, CleanStart

Fintech businesses build and operate products across payments, lending, wealth management, insurance, financial infrastructure and embedded finance. Despite their differences, they share a common dependency: software assembled from components developed and maintained across a global ecosystem. Open-source libraries, container images and third-party components often become part of critical applications without being developed or directly assessed by the organizations deploying them. Yet these components can execute within systems responsible for financial transactions, sensitive data, risk decisions and essential business operations. This creates a gap in technology risk management. Fintechs may have established processes for securing applications and assessing commercial vendors, but the software components underpinning those applications often receive less scrutiny. Software supply chain security must therefore be treated as an enterprise risk, not just an engineering concern.

How Software Supply Chain Risks Enter Fintech

Whenever a developer adds a library, an AI coding assistant introduces a dependency, or an engineer selects a base image, external software enters the application or platform. These decisions often happen at release speed, without direct risk-team involvement. The selected components may already contain known vulnerabilities or, in some cases, malicious functionality. A scan of the official Redis 8.10.0 container image, conducted on August 21, 2026 using the open-source scanner Trivy (v0.74.0), found 185 known CVEs, including four critical and 47 high-severity findings. This illustrates how vulnerabilities in a widely used base image can become inherited exposure for applications built on it. In September 2025, the self-propagating Shai-Hulud worm compromised npm publishing credentials and spread malicious package versions through affected maintainers. The campaign returned in a larger wave in November 2025. Unit 42 reported that Shai-Hulud 2.0 had produced more than 25,000 malicious GitHub repositories across approximately 350 unique users. Both waves showed how compromised publishing credentials can expose downstream users to malicious code, even when they are not the intended targets. These examples highlight two distinct risks: vulnerabilities inherited from existing software, and malicious code introduced through trusted distribution channels. Both require controls before a vulnerability report or security incident forces a response.

Why the Current Model Leaves a Gap

Open-source risk is often treated as an engineering responsibility, managed through vulnerability scanning and patching. These controls are essential, but they typically identify problems after software has been selected, built or deployed. Vendor risk management has a separate blind spot. It assesses companies through security reviews, contracts and audit rights, but open-source libraries have no contractual relationship and may never enter that process. Their risks can remain outside enterprise risk teams' view until a vulnerability or incident draws attention to them. The answer is not to move responsibility away from engineering, but to connect technical controls with enterprise risk management. Risk owners need visibility into the components underpinning critical services and accountability for the risks they introduce.

Govern Components Like Third Parties

Risk teams apply three fundamental controls to third parties: maintain an inventory, assess them before onboarding, and limit unnecessary dependence. The same principles apply to software components.

Visibility: Know Every Component

A software bill of materials (SBOM) records the components present in an application or image, providing a foundation for vulnerability assessment, dependency tracking and incident response. Regulatory expectations vary by jurisdiction and entity. In India, SEBI's Cybersecurity and Cyber Resilience Framework includes SBOM requirements for software supporting core and critical business operations of entities within its scope. CERT-In has also published technical guidelines covering SBOMs and related software and hardware bills of materials. In the EU, DORA requires in-scope financial entities to maintain registers of their contractual arrangements with ICT third-party service providers. Though these obligations differ, they reinforce the need to understand software dependencies and manage technology risks. Visibility must also extend to the container estate as it runs today: which images are deployed, where they run and their current vulnerability status. Teams need to prioritize findings and identify a clear remediation path, whether that means applying a fix, updating an image or replacing it with a more secure alternative.

Verification: Check Before Entry

Organizations need to verify a component's publisher, provenance and integrity: who released it, how it was built and whether its contents match the expected artifact. These checks should happen at the point of selection, before a dependency enters the application, whether the request comes from a developer, an AI coding agent or a CI pipeline. Moving verification to the earliest practical stage of development, an extension of the familiar "shift left" principle, means downstream security controls build on better-informed decisions.

Minimization: Reduce Unnecessary Exposure

Every component adds to the maintenance and security burden. Minimal or hardened container images strip out unnecessary shells, package managers and utilities, reducing the number of components that need to be assessed and governed. Strong software foundations combine minimal contents with builds that can be reproduced and verified. Building from source, rebuilding regularly as security fixes become available, and retaining provenance and integrity evidence can help organizations reduce unnecessary exposure and improve auditability. Minimal images do not replace runtime protection or ongoing vulnerability management. They reduce inherited exposure and provide a more controlled foundation for applications.

Make the Compliant Path the Fast Path

Fintechs compete by shipping quickly. A security review that requires a meeting for every dependency or image becomes a queue, encouraging engineers under release pressure to work around the process. Embedding checks into existing workflows can strengthen security without adding unnecessary approval steps. Automated dependency checks at installation, verified images in internal registries and automatically generated SBOMs help teams make better-informed choices while maintaining release speed, especially when policies are clear and approved options are readily available.

Build on Foundations You Can Verify

Customers judge fintechs by the experience they deliver. Regulators, partners and boards also need evidence of what that experience is built on. Trust depends on understanding the software foundations behind critical financial services and the risks they carry. Software supply chain security belongs at the center of fintech risk management. Organizations need to know which software components underpin their products and platforms, verify their integrity, and govern the risks they introduce. For fintech businesses, resilience depends not only on the services they build, but also on the software foundations they can account for, verify and maintain.

Live API Keys Found in Public Code of AI-Built Websites, Cyble Research Shows

Samiksha Jain — Thu, 22 Oct 2026 10:59:45 +0000

A growing number of AI-built websites are going live with their most sensitive credentials visible to anyone who opens the page. New research from Cyble Research and Intelligence Labs (CRIL) found live OpenAI keys, Stripe secret keys and backend database tokens sitting in the public front-end code of sites created with AI app builders. Over one month, CRIL scanned more than 1.3 million newly registered domains. Researchers used their own classifiers to identify sites generated by AI builders, then scanned their public code for credentials. Of the 22,306 AI-built sites identified, 35 exposed a genuinely private secret in the browser.

Why the Number Is Small, but the Risk Is Not

Thirty-five sites may sound minor. Cyble says the count is deliberately strict. Most key-shaped strings found on these sites are meant to be public. A single reCAPTCHA key, for example, appeared on thousands of sites. The researchers filtered out values that are safe in a browser. These included browser-safe keys on 3,824 sites, Google API keys on 2,172 sites (a risk only if unrestricted), and Supabase or Firebase backend addresses on 1,461 sites (a risk only if backend rules are open). What remained were credentials that should never leave a server. Each of those 35 hits, Cyble notes, is a live account an attacker can reach simply by viewing the page.

How AI-Built Websites Expose OpenAI API Keys

The most direct pattern involves sites that generate content using a large language model. On these sites, the key to that model often ships inside the code the visitor downloads. Five sites carried live OpenAI API keys in client-side code, with 16 distinct keys between them. One AI-writing site shipped 12 separate OpenAI keys, one for each content category, stored as plain values in its JavaScript bundle. An OpenAI secret key works as a billing credential. Anyone who reads it can spend the owner's balance, exhaust the rate limit or run up the bill until the key is revoked.

Clone-and-Leak: One Secret, Many Domains

AI builders make the hundredth site as cheap as the first. Operators often clone a working template across many domains, and any secret in that template is copied to every site. Cyble observed this in two cases. Thirteen near-identical domains, each pairing a short word such as "hello," "chat" or "join" with one brand, served the same bundle containing the same live Slack webhook URL. Anyone reading the page could post messages into the operator's Slack workspace, opening the door to spam, channel flooding or phishing aimed at the operator's own staff. In the second case, one Stripe secret key appeared on four domains under two different brand names. A Stripe secret key gives full API access to the account, including creating charges, issuing refunds and reading customer and payout records. The Slack fleet ran on Bubble, a no-code and AI app builder, where values placed in client-accessible fields are shipped in plain text inside the app's bundle. The Stripe cluster ran on a Next.js build. According to Cyble, this shows the problem spans builders rather than tracing to a single platform.

The Highest-Impact Exposure on AI-Built Websites

Four sites exposed a Supabase service role token on their front ends. Cyble ranks this as the most severe finding. The token bypasses row-level security and grants full read and write access to the project database, allowing an attacker to steal user records, alter or delete data, or plant content the app serves to its own visitors. Across all 35 sites, the confirmed exposed API keys broke down as follows:

Exposure	Sites
Slack webhook (shared)	13
Stripe secret key	6
OpenAI API key	5
AWS access key	5
Supabase service role token	4
GitHub token or Google OAuth secret	2

Some sites appear in more than one category. Exposed AWS keys could allow cloud access, with crypto-mining often the first move, according to the research. GitHub tokens or OAuth secrets could enable access to source code or identity integrations. When a key sits on a cloned fleet, Cyble warns, an attacker who finds it on one site has effectively compromised them all.

How to Stop the Leaks

Cyble's recommendations for developers and AI builder users include:

Keep secret keys in server-side functions or backend workflows, never in client-accessible fields.
Use only publishable and anon keys on the front end, backed by row-level security, Firebase rules and API key restrictions.
Rotate any key that has ever been exposed client-side and treat it as compromised.
Search your own page source for strings such as sk-, sk_live_, service_role and hooks.slack.com before publishing.

For security teams, Cyble advises monitoring public code and newly registered domains for their own keys and webhooks. If a secret appears on one domain in a template fleet, the response should cover the entire fleet.

Yonsei University Cyberattack Hits 10,000 Students, Months After Sogang Breach

Ashish Khaitan — Thu, 22 Oct 2026 07:29:35 +0000

A Yonsei University cyberattack has compromised the personal information of roughly 10,000 students and graduates after outsiders gained unauthorized access to the school’s online portal. The breach comes months after Sogang University disclosed a far larger leak. The university’s Office of Information and Communications confirmed the breach in a notice sent to affected individuals on Thursday. “The personal information of some university members was confirmed to have been leaked following unauthorized external access to the Yonsei Portal Service,” the office stated.

What the Yonsei University Cyberattack Exposed

The compromised data included student identification numbers, mobile phone numbers, and email addresses, along with system management details such as login identification keys and the number of failed password attempts on affected accounts. Resident registration numbers were not exposed. From 1 p.m. Thursday, affected individuals could check on Yonsei University’s official website which details were compromised.

Two Hacking Attempts in Less Than a Day

The cyberattack on Yonsei University reportedly began at around 7:41 p.m. on Tuesday. “An attack on the university’s system was detected at the time, and we immediately blocked the IP [internet provider] address,” a university representative told the JoongAng Ilbo. “While we were analyzing the cause at around 10 a.m. the following day, a second hacking attempt was made from a different IP address, which we also blocked.” Yonsei reported the incident to the Personal Information Protection Commission (PIPC) on Wednesday afternoon. The Personal Information Protection Act requires organizations to report a personal data breach within 72 hours of becoming aware of it and to notify affected individuals. “We plan to gather additional evidence related to the hacking attacks and refer the case to investigative authorities,” the representative said. The university also plans a comprehensive security review of its systems, along with stronger monitoring and security measures. It urged students and graduates to be wary of text messages, phone calls, and emails claiming to be from the university, and to avoid clicking links from unknown sources or entering personal information on suspicious websites.

Sogang University and a Wider Pattern of Breaches

The cyberattack on Yonsei University follows a series of attacks on higher education institutions. On Aug. 14, Sogang University suffered an external cyberattack that exposed approximately 180,000 records containing personal information of students, graduates, and university staff, according to a notice posted on the Sogang University website. The problem goes beyond recent cases. According to data the Ministry of Education submitted to People Power Party Rep. Kim Meen-geon, personal data breaches at universities affected 2.8 million people between 2022 and July this year.

Calls for Support After Yonsei and Sogang University Incidents

Experts have called for more cybersecurity personnel and greater funding as hacking attacks grow increasingly sophisticated, including through the use of AI. “Just as the government develops information security measures for small- and medium-sized businesses, it should establish support measures to strengthen cybersecurity at universities,” said Kim Seung-joo, a professor at Korea University’s School of Cybersecurity. “Support appears particularly necessary for private universities that lack sufficient funding for cybersecurity.”

PHP2Shell Patch Rush Takes Wikipedia, Govt Sites Offline

Ashish Khaitan — Thu, 22 Oct 2026 06:54:10 +0000

Governments and cyber-security agencies worldwide are urging website operators to patch PHP2Shell, two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. Found with AI, the bugs enable remote code execution and Heartbleed-style memory disclosure. A fix arrived on Wednesday afternoon. Several agencies told organizations unable to patch in time to consider pulling their sites. Finland temporarily shut its government's public web services. In the Netherlands, the cyber-security agency, the National Institute for Public Health and the Environment, and the Tweede Kamer, parliament's lower house, all went offline. The US National Security Agency echoed this on X: "These vulnerabilities often provide a direct path to the server's file system or database." The White House said federal agencies were working with leading AI labs to speed up a fix, while Japan's Prime Minister Sanae Takaichi urged people on X to check whether their public websites ran on PHP. "We have taken down a number of other systems as a precautionary measure until they can be safely patched," the Wikimedia Foundation said, leaving parts of Wikipedia unreachable on Wednesday. Edinburgh council's website and pages for BBC programmes, including Doctor Who and The Traitors, also went dark, though neither has confirmed a PHP link. DeviantArt said only that it was "temporarily down for maintenance."

How AI found CVE-2026-109618 and CVE-2026-109619

Researchers at Calif and Wiz uncovered the flaws. Calif and the PHP Foundation were part of OpenAI's Patch the Planet program, which offered AI tools to find and fix PHP flaws. Wiz called them the "most severe vulnerabilities ever discovered" by AI. OpenAI described them as "one of the most impactful security issues in recent memory," adding that its own researcher spotted the issue around the same time. The bugs sat undetected for over a decade before surfacing August, after a few weeks of AI-assisted work. "Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours," Wiz said. It estimates "roughly 70%" of the internet is affected; a figure not independently verified. The PHP Foundation planned to disclose PHP2Shell later this month with a full patch, but details leaked on social media on Tuesday, forcing a rushed announcement.

Early PHP2Shell Attacks Emerging

The UK's National Cyber Security Centre (NCSC) and its EU and Australian counterparts urged PHP users to apply the fixes. "Where immediate remediation is not feasible, organizations should consider taking the system offline until it can be fully mitigated," the NCSC said. Japan's national cyber-security office and EU officials issued similar warnings. "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood," said security firm Huntress. Affected versions remain unclear, though CERT-EU said CVE-2026-109618 and CVE-2026-109619 could reach back to PHP 5, launched in 2004. The update covers only the latest versions; users on PHP 8.1 or older should upgrade. Built for web development, PHP runs server-side on a large share, though not all, of the internet.

FBI, CISA Warn SafePay Ransomware Has Hit 600+ Victims

Samiksha Jain — Thu, 22 Oct 2026 06:52:22 +0000

The FBI, CISA and international partners have issued a warning about SafePay ransomware, a group that has impacted at least 600 victims across multiple critical infrastructure sectors since August 2024. Published on October 20, 2026, the joint cybersecurity advisory describes SafePay as among the most active ransomware groups in 2026, with operations affecting organizations in North America, South America, Europe and Australia. The advisory was released by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the United States Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the United Kingdom's National Crime Agency and the UK's North West Regional Organised Crime Unit. It draws on investigations conducted as recently as August 2026.

How SafePay Ransomware Gains Initial Access

According to the agencies, SafePay actors break into networks by stealing or guessing passwords, running brute force attacks, using phishing and exploiting VPN access. The group uses IP addresses from the VPN provider Mullvad and phished account profiles to exploit two flaws in edge devices: CVE-2020-3259 and CVE-2023-20269. The actors also use automated scripts to exploit three vulnerabilities in internet-exposed systems: CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.

Living Off the Land Inside Victim Networks

Once inside, SafePay actors establish persistence by gaining administrative privileges on existing accounts or creating new ones. They rely on built-in tools such as PsExec, Windows Remote Management and Remote Desktop Protocol to execute commands and move laterally. To find valuable files, the group has used ShareFinder.ps1 and SharpShares.exe to enumerate network shares. Before moving laterally, the actors commonly disable security software. In some cases, they changed system users' passwords, locking legitimate users out. The advisory also notes the use of a User Account Control bypass, token impersonation and the credential dumper Mimikatz.

Data Exfiltration Before Encryption

Data exfiltration is a central part of the group's playbook. SafePay actors compress files using 7-Zip, WinRAR, FileZilla and RClone, then move stolen data out through WinSCP, RClone, OneDrive and the Backblaze command-line tool b2.exe. Remote desktop tools such as AnyDesk and TeamViewer have been installed to transfer ransomware onto victim systems. To block recovery, the actors halt the Volume Shadow Copy Service and reset network attached storage holding backups to factory settings. Files are then encrypted using a hybrid scheme combining the ChaCha20 stream cipher with RSA public-key cryptography. Encrypted files carry the .SafePay extension and, according to the advisory, cannot be recovered without the decryption key. The group typically demands a portion of company revenue in cryptocurrency. A ransom note left on the desktop or root directory directs victims to a TOR chat portal, using a victim ID to log in. A representative also makes phone calls to pressure victims. If payment is refused, stolen data is posted to SafePay's leak site. The ransomware may delete itself after encryption.

SafePay Ransomware Advisory: Recommended Defenses

To reduce the risk of ransomware attacks from SafePay, the agencies urge organizations to prioritize patching known exploited vulnerabilities, especially on firewalls and other internet-facing systems. They recommend requiring multifactor authentication for webmail, VPNs and accounts that access critical systems. Other measures include passwords of 15 to 64 characters, account lockouts after failed logins, offline backups that are encrypted and immutable, network segmentation, least privilege access and time-based admin access. The advisory also recommends restricting command-line and scripting permissions. The advisory lists IP addresses, file names, hashes and hostnames observed between November 2024 and August 2026. The agencies advise verifying these indicators before blocking, as some IP addresses may later be reassigned to benign services. The authoring agencies do not encourage paying ransom, noting payment does not guarantee file recovery. Incidents can be reported to the FBI's Internet Crime Complaint Center, a local FBI or Secret Service field office, or CISA. In the UK, victims can report through Report Fraud or their local police force.

BAE Systems Cyberattack Halts Bankruptcy Notices at Every U.S. Federal Court

Samiksha Jain — Mon, 19 Oct 2026 07:47:08 +0000

Every federal bankruptcy court in the United States has lost access to the system it uses to send out bankruptcy notices. A BAE Systems cyberattack has disrupted the Bankruptcy Noticing Center (BNC), the platform that produces and transmits notices for all federal bankruptcy courts across the country. The Administrative Office of the U.S. Courts confirmed the incident in a statement on Thursday afternoon. BAE Systems, a British multinational, operates BNC systems and websites on behalf of the Federal Judiciary. The Cybersecurity and Infrastructure Security Agency (CISA), which typically handles cyberattacks on federal agencies, referred questions to the U.S. Courts.

What the BAE Systems Cyberattack Has Taken Offline

According to the U.S. Courts, BAE Systems IT and websites that support BNC operations have been impacted by a cybersecurity incident. As a result, all access to the BNC systems and websites that BAE operates for the judiciary is currently unavailable. That includes:

bnc.uscourts.gov
bankruptcynotices.uscourts.gov
notices.uscourts.gov
the National Creditor Registration Service

The incident has also halted the BNC's production and distribution of bankruptcy notices for the courts. The Administrative Office said it has been in contact with the affected courts and is coordinating with BAE Systems. BAE is investigating the incident and working to restore operations. No timeline for recovery has been shared, and the nature of the attack has not been disclosed.

A Government Contractor Target, Again

The BNC disruption is the latest in a series of incidents where an attack on a government contractor or third-party vendor has spilled over into public services. Last week, a contact center for the Federal Motor Carrier Safety Administration (FMCSA), a Department of Transportation safety agency, was temporarily taken offline after a government contractor was targeted by a cyberattack, according to two people with knowledge of the situation who were granted anonymity because they were not authorized to speak on the record. The contact center is run by support provider Senture. The FMCSA first reported technical difficulties on social media on October 6. It remains unclear when that attack began or whether it is ongoing.

Courts Have Been Hit Through Vendors Before

In September 2026, the Kentucky Administrative Office of the Courts (AOC) confirmed that Kentucky Appellate Court data was compromised in a breach traced to a third-party vendor. West Publishing Corporation, operating as Thomson Reuters Court Management Solutions (Thomson Reuters CMS), told the AOC that the incident originated in file systems tied to its C-Track case management platform. C-Track is used by the Kentucky Supreme Court and the Kentucky Court of Appeals to manage case records. According to Thomson Reuters CMS, an unauthorized third party accessed and obtained court data from C-Track systems across several states, not just Kentucky. In Kentucky's case, exposure was limited to appellate court data stored within the C-Track infrastructure. Trial-level records that were never part of an appeal were not affected, since Kentucky does not use third-party vendors for trial court e-filing. The AOC said its appellate courts continued to operate normally throughout the incident.

Why the BAE Systems Cyberattack Matters

Taken together, the three incidents show a common thread. Courts and federal agencies increasingly depend on outside contractors to run critical systems, and when those contractors are hit, the impact lands directly on public services. In the BNC case, a single compromised contractor has stopped a core function for every federal bankruptcy court at once. How quickly BAE Systems can restore the platform, and whether any data was accessed, remain the key open questions.