Daily digest,
AI-Driven Cyber Espionage Campaigns Surge (+7 more)
Vulnerabilities
Critical PHP RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Disclosed
On October 20, 2026, details of two critical remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, leaked ahead of their scheduled disclosure. The PHP security team confirmed the vulnerabilities, both rated 9.2 under CVSS v4.0, and announced an emergency patch release for October 21, 2026, at 14:00 UTC. These vulnerabilities potentially affect PHP versions 5 through 8, allowing attackers to execute arbitrary code on affected servers. Security firm watchTowr verified the existence of the vulnerabilities and warned of possible following the release of the patch. Administrators are urged to prepare for immediate updates as the vulnerabilities pose significant risks to web applications powered by PHP. No active exploitation has been reported as of now, but the situation remains urgent.
Vulnerability · 20 sources · score 71 · CVE-2026-103849, CVE-2026-109618, CVE-2026-109619, CVE-2026-75650, CVE-2926-109618
Compromised eMudhra Certificates Allow Forged SSL Certificates
On October 19, 2026, Cloudflare disclosed that eight eMudhra intermediate certificates were compromised due to weak private keys generated in April 2025. These keys, which were integers below 256, allowed attackers to forge certificates for any domain, posing a significant risk of impersonation and traffic interception. Major browsers like Firefox, Chrome, and Apple quickly blocked these certificates starting October 17, 2026. However, software outside of browsers remains vulnerable, as tools like curl on macOS continued to accept the compromised chain. Cloudflare has released updates for its services and urged customers to take action on their own servers, especially those using mutual TLS or running containers. The issue has been tracked as CVE-2026-111943, published on October 21, 2026. No active exploitation has been reported on Cloudflare services, but the potential for abuse exists.
Vulnerability · 4 sources · score 58 · CVE-2026-111943
Ransomware
SafePay Ransomware Targets Over 600 Organizations Globally
The SafePay ransomware group has breached at least 600 organizations since August 2024, according to a joint advisory from the FBI and cybersecurity agencies in Germany and the U.K. This group employs tactics such as password guessing, exploiting vulnerabilities, and phishing to gain access to networks. Once inside, they establish control by creating new accounts or taking over existing ones, using legitimate tools to navigate networks and disable security measures. SafePay has been particularly active in 2026, affecting critical infrastructure across North America, South America, Europe, and Australia. The advisory highlights multiple vulnerabilities exploited by SafePay, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. The group employs a double extortion model, demanding ransom payments in cryptocurrency and threatening to leak stolen data. Recent attacks include significant incidents involving major IT service providers and government contractors.
Ransomware · 3 sources · score 74 · CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766
Breaches
Assurance Retraite Data Breach Affects 70,372 Accounts
In September 2024, the French national pension fund Assurance Retraite experienced a data breach impacting approximately 370,000 assistance beneficiaries. The breach exposed 70,372 unique email addresses, along with personal information such as names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers, and details of relatives. Assurance Retraite attributed the breach to a compromised partner account. The breach was disclosed on October 20, 2026, with the affected accounts now listed on Have I Been Pwned. Users are advised to change their passwords and implement two-factor authentication where possible.
Breach · 2 sources · score 54
Computer Task Group Data Breach Exposes Sensitive Personal Information
Computer Task Group, Inc. (CTG) reported a data breach affecting thousands of individuals, with personal information potentially accessed by cybercriminals. The breach was discovered following suspicious activity on CTG's network, leading to a forensic investigation. Compromised data may include Social Security numbers, financial account information, credit/debit card details, driver’s license numbers, and health insurance information. The breach has prompted investigations by law firms, including Murphy Law Firm and Federman & Sherwood, which are evaluating legal claims on behalf of affected individuals. The incident has raised concerns about identity theft and fraud, as the exposed data could be exploited by cybercriminals. Legal options are being explored for those impacted by the breach.
Breach · 2 sources · score 52
Threat actors and malware
AI-Driven Cyber Espionage Campaigns Surge
In late 2025, a Chinese state group reportedly utilized Anthropic's AI tool, Claude Code, to orchestrate a cyber espionage campaign against approximately 30 organizations, including tech firms and government agencies. The AI framework enabled the group to automate up to 90% of the attack process, requiring minimal human intervention. The campaign exemplifies how AI tools can discover vulnerabilities and generate exploit code at speeds, often within hours of public disclosure. This shift in attack methodology presents significant challenges for defenders, who must now contend with the rapid pace of exploit development and the novelty of attack vectors. Agencies are advised to rethink their security strategies, focusing on proactive measures to address vulnerabilities as they emerge. The current landscape necessitates continuous adaptation in defensive policies and technologies to keep pace with evolving threats.
APT · 2 sources · score 76 · Mitre Att&ck Campaign C0062
Large Ethereum Laundering from Drift Exploit: $61 Million Transferred
On October 20, 2026, wallets linked to the April 1 Drift Protocol exploit transferred 25,700 Ethereum, valued at approximately $61.5 million, to the Tornado Cash mixer. The hackers, identified as a North Korean group, UNC4736, had previously withdrawn $44 million in July using similar methods. The exploit, which drained $295 million from Drift Protocol, involved a six-month operation where attackers posed as a legitimate trading firm. Currently, the exploiter's wallets still hold around 81,454 ETH, worth roughly $198 million. The use of Tornado Cash complicates recovery efforts for affected investors, as most of the stolen funds remain untouched. Law enforcement previously managed to freeze only $9.2 million of the stolen assets. Drift Protocol has initiated a recovery program for affected users, but early redemption values are significantly low.
APT · 2 sources · score 72 · Citrine Sleet, UNC4736, UNC6862, Drift
Also worth knowing
Cybersecurity Risks in UK Water Infrastructure Amid Drought
A report by Schneider Electric highlights that 60% of UK business leaders view cyber threats as a top Business Continuity risk, particularly in the context of aging water infrastructure. The report indicates that 75% of water system decision-makers consider external cyberattacks on connected water infrastructure a significant threat. This comes during the UK's severe drought, raising concerns about water resilience. The report emphasizes the need for better cybersecurity measures alongside infrastructure modernization. While smart technologies are widely adopted, only 25% of decision-makers have implemented digital-twin technology, which could help identify vulnerabilities. The findings suggest a critical need for investment in both infrastructure and cybersecurity to mitigate risks.
Other Threats · 2 sources · score 52
New on leak sites
25 victims listed on ransomware leak sites by 10 groups in the 24 hours before this issue. The most active:
Also moving
- APT groups: APT28, Armory Castle, Citrine Sleet
- CVEs: CVE-2026-111943, CVE-2015-20128, CVE-2020-3259, CVE-2023-20269, CVE-2023-27532
- Malware: Infostealer, Bareclaw, ClickFix
- Ransomware groups: Safepay
- Campaigns: Axios Software Supply Chain Attack, Combating Foreign Threats To Main Street Act, Combined Resolve 26-07, Community Cyber Resilience Foundation
- Vulnerabilities: Broadcom eCos Wi-Fi Remote Code Execution Vulnerability, CoreBreak
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.