2026-10-23 Daily Cyber News
Public services can disappear, trusted developer tools can turn hostile, and cloud intrusions can now unfold faster than human teams can respond. Today’s issue tracks precautionary government shutdowns as PHP attacks surged, a poisoned LiteLLM release that stole credentials and loaded remote-access tools, and a China-aligned campaign that used AI agents to accelerate abuse of trusted cloud applications. We also cover exposed Railway secrets, ransomware access patterns, urgent GitLab and network-management…
- Incident ResponseGovernment services go dark as PHP attacks surge worldwide
Public access to government services was disrupted as agencies took vulnerable PHP systems offline. UK ministers reported 32 services unavailable and four partly disrupted, mostly as a precaution while patches and mitigations were applied; no central government compromise was confirmed. Other governments…
- AI & Emerging TechnologyPoisoned LiteLLM release steals secrets across developer systems
Developer and cloud credentials were put at risk when attackers compromised LiteLLM’s release pipeline. Version 1.107.0 on PyPI and affected Docker tags carried malware across Windows, Linux, and macOS. The payload ran during Python startup, stole secrets and environment data, and could fetch additional…
- AI & Emerging TechnologyAI agents accelerate cloud breaches through trusted software
Cloud intrusions moved from initial targeting to privileged access in less than three hours in some attacks attributed to China-aligned Storm-0940. The group used the ARTEX AI penetration-testing framework and stolen ConnectWise Cloud Backup credentials to target Microsoft 365 environments. Activity…
- Supply Chain & Third PartyRailway exposure puts customer secrets and deployments at risk
Customer applications may be exposed after suspicious activity reached Railway systems that store environment variables. The company said an unauthorized third party may have accessed encrypted variables and obtained some decrypted contents, including possible API, database, registry, and cloud…
- Identity & AccessSafePay ransomware reaches 600 organizations through familiar gaps
At least 600 organizations across multiple critical infrastructure sectors have been affected by SafePay ransomware since August 2024. The group enters through exposed credentials, brute-force attempts, VPN access, and known edge-device weaknesses. It steals data, encrypts systems, and pressures victims…
- Vulnerabilities & ExploitsInternet-facing GitLab servers face maximum-severity code risk
Self-managed GitLab servers require urgent updates because an unauthenticated attacker could execute arbitrary code under certain conditions. The issue affects Community and Enterprise editions and sits in the regular-expression compiler. GitLab.com and specified Dedicated tenants were already protected…
- Supply Chain & Third PartyWeak certificate keys force eMudhra out of global trust business
Trust in eight eMudhra intermediate certificates collapsed after researchers reconstructed their weak private keys in under a second. Major browsers and software ecosystems blocked or updated trust for the affected certificates. eMudhra revoked them and announced its withdrawal from the global SSL and TLS…
- Legal & RegulatoryCrime-tip breach breaks anonymity promise and halts Toronto service
Toronto Crime Stoppers halted operations after reporting showed that supposedly anonymous tip data had exposed identifiable people. More than 1.5 million tips from Canadian chapters were involved, and about half contained personal information. The Toronto chapter said the vendor identified 176,859 Toronto…
- Phishing & Social EngineeringCapcom breach exposes email data tied to 11.7 million accounts
More than 11.7 million Capcom accounts had email addresses and related account information exposed. The data included creation dates, last-login times, login counts, and last-login IP addresses. Attackers changed passwords for 196 accounts, while smaller subsets had additional profile details exposed…
- Identity & AccessMalware discovery forces shutdown of up to 26,739 cloud servers
Customers lost access after Japan’s Onamae.com Desktop Cloud found malware in some server environments and stopped systems across every service plan. The provider listed 26,739 servers as potentially affected, not as a confirmed infection count. Information inside customer servers may have been viewed…
- Vulnerabilities & ExploitsActive attacks put VeloCloud network management systems at risk
On-premises VeloCloud Orchestrator systems are being targeted through a newly patched issue. An authenticated user with basic privileges and access to the web interface could gain operator privileges and reach internal functions. Successful exploitation could affect the orchestrator, its data, and the…
- Government & PolicyActive exploitation raises risk across Siemens Software Center users
Siemens Software Center users face active exploitation of a weakness that can execute attacker-supplied code with the application’s privileges. An authenticated local attacker can place a crafted library in a directory the application searches. Versions before 4.0.9.8 are affected, and Siemens released a…