Weekly digest, Monday 19 October 2026

This week: AI-Driven Breach Exposes Data of 16 South Korean… (+8 more)

Vulnerabilities

Palo Alto Networks Firewalls Exploited Amid AI Security Concerns

Palo Alto Networks and Cisco products have been identified as vulnerable to active cyberattacks, with critical vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog. The vulnerabilities, including CVE-2026-0322, could allow attackers to gain root privileges on affected systems. Palo Alto Networks confirmed limited exploitation targeting its PAN-OS management interface, which is crucial for firewall administration. The vulnerabilities were disclosed on October 14, 2026, and a patch was released the same day. Security leaders are increasingly worried about AI-driven cyber threats, as highlighted in a recent report by Palo Alto Networks. The report indicated that 68% of critical infrastructure security leaders lack real-time visibility into their operational technology networks, raising concerns about potential impacts from such vulnerabilities.

Vulnerability · 2 sources · score 73 · CVE-2026-0322, CVE-2026-76519

Urgent Update Required for Vulnerable Plex Media Servers Amid Active Exploitation

Plex Media Server users are urged to update their software immediately due to the active exploitation of a vulnerability chain known as Plex2Shell, which allows unauthenticated remote code execution. This chain involves four CVEs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, affecting versions prior to 1.43.3.10861. Despite Plex notifying users to upgrade by September 1, many servers remain vulnerable, with over 36,000 instances still exposed. A proof-of-concept was published on October 16, 2026, and attacks were observed on October 17, delivering cryptocurrency miners and proxy applications. The exploitation method includes server-side request forgery and arbitrary file writes, leading to remote code execution. Community reports of compromised servers have not been confirmed by Plex or CISA. Users are advised to check for unexpected processes and files in their installations.

Vulnerability · 3 sources · score 72 · CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656, Myawesomeproxy

Broadcom Wi-Fi Vulnerability Allows Remote Code Execution

A 16-year-old vulnerability in Broadcom's 802.11 implementation enables attackers to execute code on affected routers without authentication. This flaw has existed in Broadcom's SDK since at least 2010 and was partially patched in 2018. Researchers have demonstrated exploitation on devices from major Belgian ISPs, including Orange and Proximus, with no patches available as of October 15, 2026. The vulnerability allows attackers to gain unauthenticated remote code execution and extract Wi-Fi passwords from the routers' memory. Broadcom has not assigned a CVE to this vulnerability, which affects millions of devices worldwide. The attack can be executed from a distance, making it a significant risk for users of affected routers.

Vulnerability · 2 sources · score 68 · WPS EAP Reassembly Overflow

Ransomware

Massive Data Leaks Exposed on Dark Web Amid Ransomware Surge

In a recent surge of cyber incidents, three significant data leaks occurred on the dark web within five days, affecting various organizations. The leaks involved sensitive information, including driver's license data and stolen identity documents, linked to the Qilin and Rhysida ransomware groups. The incidents highlight the ongoing threat posed by double extortion ransomware tactics, where attackers not only encrypt data but also threaten to leak it. Organizations are urged to enhance their monitoring of dark web activities to mitigate risks associated with credential exposure and identity theft. Current investigations are ongoing, with law enforcement agencies focusing on tracing the origins of these leaks. The situation remains fluid as more data may surface in the coming days.

Ransomware · 2 sources · score 52 · Qilin Ransomware, Rhysida Ransomware

Breaches

AI-Driven Breach Exposes Data of 16 South Korean Financial Institutions

Since October 2026, 16 South Korean financial firms, including Shinhan and KB Kookmin banks, have been breached, resulting in the exposure of approximately 100,000 records. A lone hacker in China is suspected of utilizing ARTEX, an open-source AI penetration-testing tool, to exploit vulnerabilities in peripheral systems of these banks. The breaches targeted lower-priority systems, such as loan-agent inquiry portals and mobile employee support tools, rather than core banking systems. Investigators from South Korea's Financial Services Commission confirmed the breaches on October 14, 2026, and police have assigned 28 cyberterrorism investigators to the case. The investigation revealed the attacker's infrastructure in Guangdong, China, and traces of AI tools used in the attacks. The government is now pushing for vulnerability assessments by white-hat hackers and the development of security-focused AI to combat such threats.

Breach · 2 sources · score 75

Hollys Coffee Membership Data Breach Exposes Customer Information

Hollys Coffee, a South Korean coffee franchise, confirmed a data breach affecting its membership system, which exposed personal information of customers who joined before February 11, 2020. The breach was confirmed on October 16, 2026, and is believed to have occurred between September 3 and October 7, 2026. Compromised data includes user IDs, passwords, names, dates of birth, phone numbers, addresses, and email addresses. The company has blocked unauthorized access and enhanced security measures while cooperating with investigations. Customers are advised to change their passwords immediately and to be cautious of phishing attempts. The exact number of affected customers has not been disclosed, raising concerns about potential identity theft and fraud. Hollys Coffee's mobile app and website remain inaccessible as of October 18, 2026.

Breach · 3 sources · score 61

$1.18 Billion Stolen in Q3 Crypto Hacks Due to Audit Gaps

Hacken's report revealed that $1.18 billion was stolen across 107 crypto attacks in Q3 2026, a 55% increase from the previous quarter. The majority of losses, totaling $906.8 million, were linked to compromised vendor tools, uninstalled security patches, and components excluded from audits. Hacken's co-founder, Andrii Matiukhin, emphasized that audits often miss critical parts of systems, leading to vulnerabilities. The largest incident was the Bitget attack in September, where $352 million was stolen through a third-party security vulnerability. Hacken also noted that over $700 million in assets at two platforms relied on inadequate key management setups. The report calls for continuous monitoring and prompt application of security patches, rather than relying solely on past audits.

Vulnerability · 2 sources · score 56

Bank Executives Face Parliamentary Audit Over Cyberattacks

On October 19, 2026, CEOs of five major South Korean banks will testify at a National Assembly audit due to recent cyberattacks that compromised customer and employee data. The banks affected include Shinhan, KB Kookmin, Hana, Woori, and NH NongHyup, with Shinhan Bank experiencing the most significant breach affecting 25,000 customers. The audit will focus on the banks' cybersecurity measures, vulnerability management, and executive accountability. Reports indicate that 4,770 vulnerabilities were identified in simulated hacking tests, with 109 remaining unaddressed as of August 2026. The audit will also address the banks' performance in supporting low-income finance and consumer protection. Legal advice has been sought by the banks in preparation for the audit, which is the first time all five CEOs have been summoned since 2022.

Breach · 3 sources · score 52

Also worth knowing

Army Officer's Wife Booked for Espionage Linked to Chinese Operatives

The Jammu and Kashmir Police have registered an espionage case against the wife of a senior Army officer for allegedly sharing sensitive information with foreign intelligence operatives, including those linked to China. The woman, a resident of Telangana, is accused of communicating sensitive documents and data through encrypted channels after being approached by individuals posing as academics. The FIR was filed under the Official Secrets Act and the Bharatiya Nyaya Sanhita, with investigations focusing on her research activities and digital communications. Although she has not been arrested, she has been questioned and is cooperating with authorities. The investigation was prompted by intelligence inputs regarding suspicious communications. The woman reportedly used AI tools like ChatGPT and Claude to prepare analytical papers on defense-related topics for these operatives.

Other Threats · 15 sources · score 60

New on leak sites

321 victims listed on ransomware leak sites by 42 groups in the 7 days before this issue. The most active:

Get the next one by email

The digest is free and arrives once a week. One click to leave.

Subscribe to the digest

A free account turns the digest into a personal watchlist: choose what you want to follow.