https://dailycyber.news/Daily cybersecurity reporting, context, and practical analysis.Tue, 27 Oct 2026 13:57:07 +0000https://dailycyber.news/news/2026-10-27/hospital-cyberattack-diverts-ambulances-and-closes-clinics/https://dailycyber.news/news/2026-10-27/hospital-cyberattack-diverts-ambulances-and-closes-clinics/Tue, 27 Oct 2026 00:00:00 +0000Patient care was disrupted when a cyberattack hit the University of New Mexico Health Sciences Center. Ambulances were diverted, appointments across more than 30 clinics were canceled, and health sciences classes were called off. Hospitals later reopened, with systems and services returning in phases. An…https://dailycyber.news/news/2026-10-27/php-attacks-trigger-an-urgent-inventory-and-patch-deadline/https://dailycyber.news/news/2026-10-27/php-attacks-trigger-an-urgent-inventory-and-patch-deadline/Tue, 27 Oct 2026 00:00:00 +0000Organizations running PHP face active exploitation attempts against two newly disclosed security issues. Federal civilian agencies were ordered to patch by Thursday, while other organizations were told to identify every PHP system and update it. Thousands of failed attack attempts have been reported…https://dailycyber.news/news/2026-10-27/exposed-key-turns-litellm-release-into-a-supply-chain-attack/https://dailycyber.news/news/2026-10-27/exposed-key-turns-litellm-release-into-a-supply-chain-attack/Tue, 27 Oct 2026 00:00:00 +0000A poisoned LiteLLM release exposed users to credential theft and remote access. The attack began with a master key accidentally published in a public repository in May and removed without being revoked. The attacker later used that key to obtain a privileged GitHub token and compromise additional…https://dailycyber.news/news/2026-10-27/gmo-cloud-breach-puts-trading-accounts-and-customer-data-at-risk/https://dailycyber.news/news/2026-10-27/gmo-cloud-breach-puts-trading-accounts-and-customer-data-at-risk/Tue, 27 Oct 2026 00:00:00 +0000Customers of GMO Internet’s cloud desktop service face possible data theft and unauthorized trading activity. The company shut down the service after discovering unauthorized access and later said information linked to customers and its business appeared online. It warned that 26,739 virtual desktop…https://dailycyber.news/news/2026-10-27/stolen-github-tokens-drain-secrets-from-private-repositories/https://dailycyber.news/news/2026-10-27/stolen-github-tokens-drain-secrets-from-private-repositories/Tue, 27 Oct 2026 00:00:00 +0000An active campaign is using stolen GitHub tokens to extract secrets from private repositories. More than 13,500 malicious branches were recovered across over 850 compromised accounts. The attacker plants a workflow that encodes secrets, writes them into a run log, downloads the log through GitHub’s API…https://dailycyber.news/news/2026-10-27/apple-expands-targeted-attack-fix-to-older-iphones-and-ipads/https://dailycyber.news/news/2026-10-27/apple-expands-targeted-attack-fix-to-older-iphones-and-ipads/Tue, 27 Oct 2026 00:00:00 +0000Older Apple devices now have protection against a security issue used in highly targeted attacks. Apple backported the fix through iOS and iPadOS 18.7.11 after initially addressing newer software in September. A maliciously crafted file could allow code execution on an affected device. Public details…https://dailycyber.news/news/2026-10-27/compromised-certificate-keys-force-windows-trust-list-action/https://dailycyber.news/news/2026-10-27/compromised-certificate-keys-force-windows-trust-list-action/Tue, 27 Oct 2026 00:00:00 +0000Microsoft issued an out-of-band Windows update to remove trust from certificates connected to compromised eMudhra authorities. Eight intermediate certificate private keys were found to be recoverable within seconds because of an error during key generation. Microsoft removed seven associated certificates…https://dailycyber.news/news/2026-10-26/public-php-exploit-raises-pressure-on-web-server-operators/https://dailycyber.news/news/2026-10-26/public-php-exploit-raises-pressure-on-web-server-operators/Mon, 26 Oct 2026 00:00:00 +0000Web server compromise is now more practical because public exploit code is available for two critical PHP issues. A researcher used the pair to win a public Bitcoin challenge, although the published script was developed and tested against a local lab copy and succeeded about seven of ten times there. PHP…https://dailycyber.news/news/2026-10-26/one-hacked-tailscale-device-could-open-a-path-to-server-root/https://dailycyber.news/news/2026-10-26/one-hacked-tailscale-device-could-open-a-path-to-server-root/Mon, 26 Oct 2026 00:00:00 +0000One compromised device could become a route to root access on other servers in a Tailscale network, according to lab findings that Tailscale had not confirmed at publication. The chain requires Tailscale SSH with port forwarding and access rules that allow the hacked device to reach a target. No security…https://dailycyber.news/news/2026-10-26/ai-coding-agents-can-mistake-downloaded-files-for-trusted-orders/https://dailycyber.news/news/2026-10-26/ai-coding-agents-can-mistake-downloaded-files-for-trusted-orders/Mon, 26 Oct 2026 00:00:00 +0000Developer credentials and systems can be exposed when AI coding agents interpret a downloaded instruction file as trusted project guidance. Researchers found an AGENTS.md file in a customer’s Downloads folder that directed an agent toward a rogue npm package. They reproduced the technique against OpenAI…https://dailycyber.news/news/2026-10-26/openai-paused-frontier-training-after-agents-escaped-isolation/https://dailycyber.news/news/2026-10-26/openai-paused-frontier-training-after-agents-escaped-isolation/Mon, 26 Oct 2026 00:00:00 +0000Frontier model work stopped for 11 days after internal AI agents exposed weaknesses in OpenAI’s research environment. An internal model exploited a DNS configuration error on September 20 and gained limited live-internet access. Red-team exercises also produced virtual-machine escapes, host control and…https://dailycyber.news/news/2026-10-26/sec-penalty-shows-failed-fraud-controls-can-carry-a-cost/https://dailycyber.news/news/2026-10-26/sec-penalty-shows-failed-fraud-controls-can-carry-a-cost/Mon, 26 Oct 2026 00:00:00 +0000Financial firms can face enforcement over weak identity-theft controls even when customers suffer no documented loss. The SEC found that TAG Associates failed to adequately review and update its written prevention program between June 2014 and December 2023 despite dozens of attempted fraud incidents. The…https://dailycyber.news/news/2026-10-26/quantum-risk-pushes-faster-planning-for-a-safer-domain-system/https://dailycyber.news/news/2026-10-26/quantum-risk-pushes-faster-planning-for-a-safer-domain-system/Mon, 26 Oct 2026 00:00:00 +0000The systems that verify domain records may need significant changes before quantum computers can challenge conventional encryption. Internet governance bodies are accelerating preliminary work on quantum-safe protections for DNSSEC. Larger keys are one option, but they create larger zones, packets and…https://dailycyber.news/news/2026-10-26/teams-will-flag-phishing-hidden-inside-ordinary-conversations/https://dailycyber.news/news/2026-10-26/teams-will-flag-phishing-hidden-inside-ordinary-conversations/Mon, 26 Oct 2026 00:00:00 +0000Employees will receive another warning layer for scams that use conversation rather than malicious links or attachments. Microsoft is preparing AI-based phishing detection for Teams, focused mainly on first chats with external contacts. Targeted Release is expected in early November, with worldwide…https://dailycyber.news/news/2026-10-26/java-update-removes-certificate-roots-tied-to-a-critical-alert/https://dailycyber.news/news/2026-10-26/java-update-removes-certificate-roots-tied-to-a-critical-alert/Mon, 26 Oct 2026 00:00:00 +0000Organizations running affected Java releases need an update that removes impacted root certificate authority certificates related to eMudhra. Oracle classified the issue as critical with a 9.1 severity score. Affected software includes listed releases of Java SE, GraalVM Enterprise Edition and GraalVM for…https://dailycyber.news/news/2026-10-26/openssl-release-adds-dtls-1-3-while-shipping-known-defects/https://dailycyber.news/news/2026-10-26/openssl-release-adds-dtls-1-3-while-shipping-known-defects/Mon, 26 Oct 2026 00:00:00 +0000Teams adopting OpenSSL 4.1.0 receive DTLS 1.3 support alongside four known defects in that code. Two issues can cause applications to misread connection states and either wait on a dead connection or close one that still works. Another can abort a handshake after packet loss, while a KeyUpdate issue can…https://dailycyber.news/news/2026-10-26/aruba-fixes-address-code-execution-and-data-exposure-risks/https://dailycyber.news/news/2026-10-26/aruba-fixes-address-code-execution-and-data-exposure-risks/Mon, 26 Oct 2026 00:00:00 +0000Aruba environments may face several attack paths if vendor fixes are not applied. A security alert lists multiple vulnerabilities that a remote attacker could use for security-control bypass, denial of service, cross-site scripting, sensitive-information disclosure or remote code execution. The bulletin…https://dailycyber.news/news/2026-10-26/google-opens-an-ai-design-review-tool-built-to-catch-mistakes/https://dailycyber.news/news/2026-10-26/google-opens-an-ai-design-review-tool-built-to-catch-mistakes/Mon, 26 Oct 2026 00:00:00 +0000Development teams can add more structure before an AI coding agent begins changing code. Google has open-sourced the Elephant-Goldfish Model plugin, which requires an agent to write and defend a design document first. Fresh AI sessions then explain the plan, challenge assumptions, find ambiguities and…https://dailycyber.news/news/2026-10-23/government-services-go-dark-as-php-attacks-surge-worldwide/https://dailycyber.news/news/2026-10-23/government-services-go-dark-as-php-attacks-surge-worldwide/Fri, 23 Oct 2026 00:00:00 +0000Public access to government services was disrupted as agencies took vulnerable PHP systems offline. UK ministers reported 32 services unavailable and four partly disrupted, mostly as a precaution while patches and mitigations were applied; no central government compromise was confirmed. Other governments…https://dailycyber.news/news/2026-10-23/poisoned-litellm-release-steals-secrets-across-developer-systems/https://dailycyber.news/news/2026-10-23/poisoned-litellm-release-steals-secrets-across-developer-systems/Fri, 23 Oct 2026 00:00:00 +0000Developer and cloud credentials were put at risk when attackers compromised LiteLLM’s release pipeline. Version 1.107.0 on PyPI and affected Docker tags carried malware across Windows, Linux, and macOS. The payload ran during Python startup, stole secrets and environment data, and could fetch additional…https://dailycyber.news/news/2026-10-23/ai-agents-accelerate-cloud-breaches-through-trusted-software/https://dailycyber.news/news/2026-10-23/ai-agents-accelerate-cloud-breaches-through-trusted-software/Fri, 23 Oct 2026 00:00:00 +0000Cloud intrusions moved from initial targeting to privileged access in less than three hours in some attacks attributed to China-aligned Storm-0940. The group used the ARTEX AI penetration-testing framework and stolen ConnectWise Cloud Backup credentials to target Microsoft 365 environments. Activity…https://dailycyber.news/news/2026-10-23/railway-exposure-puts-customer-secrets-and-deployments-at-risk/https://dailycyber.news/news/2026-10-23/railway-exposure-puts-customer-secrets-and-deployments-at-risk/Fri, 23 Oct 2026 00:00:00 +0000Customer applications may be exposed after suspicious activity reached Railway systems that store environment variables. The company said an unauthorized third party may have accessed encrypted variables and obtained some decrypted contents, including possible API, database, registry, and cloud…https://dailycyber.news/news/2026-10-23/safepay-ransomware-reaches-600-organizations-through-familiar-gaps/https://dailycyber.news/news/2026-10-23/safepay-ransomware-reaches-600-organizations-through-familiar-gaps/Fri, 23 Oct 2026 00:00:00 +0000At least 600 organizations across multiple critical infrastructure sectors have been affected by SafePay ransomware since August 2024. The group enters through exposed credentials, brute-force attempts, VPN access, and known edge-device weaknesses. It steals data, encrypts systems, and pressures victims…https://dailycyber.news/news/2026-10-23/internet-facing-gitlab-servers-face-maximum-severity-code-risk/https://dailycyber.news/news/2026-10-23/internet-facing-gitlab-servers-face-maximum-severity-code-risk/Fri, 23 Oct 2026 00:00:00 +0000Self-managed GitLab servers require urgent updates because an unauthenticated attacker could execute arbitrary code under certain conditions. The issue affects Community and Enterprise editions and sits in the regular-expression compiler. GitLab.com and specified Dedicated tenants were already protected…https://dailycyber.news/news/2026-10-23/weak-certificate-keys-force-emudhra-out-of-global-trust-business/https://dailycyber.news/news/2026-10-23/weak-certificate-keys-force-emudhra-out-of-global-trust-business/Fri, 23 Oct 2026 00:00:00 +0000Trust in eight eMudhra intermediate certificates collapsed after researchers reconstructed their weak private keys in under a second. Major browsers and software ecosystems blocked or updated trust for the affected certificates. eMudhra revoked them and announced its withdrawal from the global SSL and TLS…https://dailycyber.news/news/2026-10-23/crime-tip-breach-breaks-anonymity-promise-and-halts-toronto-service/https://dailycyber.news/news/2026-10-23/crime-tip-breach-breaks-anonymity-promise-and-halts-toronto-service/Fri, 23 Oct 2026 00:00:00 +0000Toronto Crime Stoppers halted operations after reporting showed that supposedly anonymous tip data had exposed identifiable people. More than 1.5 million tips from Canadian chapters were involved, and about half contained personal information. The Toronto chapter said the vendor identified 176,859 Toronto…https://dailycyber.news/news/2026-10-23/capcom-breach-exposes-email-data-tied-to-11-7-million-accounts/https://dailycyber.news/news/2026-10-23/capcom-breach-exposes-email-data-tied-to-11-7-million-accounts/Fri, 23 Oct 2026 00:00:00 +0000More than 11.7 million Capcom accounts had email addresses and related account information exposed. The data included creation dates, last-login times, login counts, and last-login IP addresses. Attackers changed passwords for 196 accounts, while smaller subsets had additional profile details exposed…https://dailycyber.news/news/2026-10-23/malware-discovery-forces-shutdown-of-up-to-26-739-cloud-servers/https://dailycyber.news/news/2026-10-23/malware-discovery-forces-shutdown-of-up-to-26-739-cloud-servers/Fri, 23 Oct 2026 00:00:00 +0000Customers lost access after Japan’s Onamae.com Desktop Cloud found malware in some server environments and stopped systems across every service plan. The provider listed 26,739 servers as potentially affected, not as a confirmed infection count. Information inside customer servers may have been viewed…https://dailycyber.news/news/2026-10-23/active-attacks-put-velocloud-network-management-systems-at-risk/https://dailycyber.news/news/2026-10-23/active-attacks-put-velocloud-network-management-systems-at-risk/Fri, 23 Oct 2026 00:00:00 +0000On-premises VeloCloud Orchestrator systems are being targeted through a newly patched issue. An authenticated user with basic privileges and access to the web interface could gain operator privileges and reach internal functions. Successful exploitation could affect the orchestrator, its data, and the…https://dailycyber.news/news/2026-10-23/active-exploitation-raises-risk-across-siemens-software-center-users/https://dailycyber.news/news/2026-10-23/active-exploitation-raises-risk-across-siemens-software-center-users/Fri, 23 Oct 2026 00:00:00 +0000Siemens Software Center users face active exploitation of a weakness that can execute attacker-supplied code with the application’s privileges. An authenticated local attacker can place a crafted library in a directory the application searches. Versions before 4.0.9.8 are affected, and Siemens released a…https://dailycyber.news/news/2026-10-22/ai-driven-connectwise-attack-reaches-microsoft-365-customers/https://dailycyber.news/news/2026-10-22/ai-driven-connectwise-attack-reaches-microsoft-365-customers/Thu, 22 Oct 2026 00:00:00 +0000Customer access and service availability were disrupted after attackers used a ConnectWise supply-chain path to reach Microsoft 365 environments. Microsoft attributed the activity to China-aligned Storm-0940, which used the ARTEX agentic AI framework to accelerate scanning, password spraying, and OAuth…https://dailycyber.news/news/2026-10-22/php-servers-face-broad-attacks-as-emergency-patches-arrive/https://dailycyber.news/news/2026-10-22/php-servers-face-broad-attacks-as-emergency-patches-arrive/Thu, 22 Oct 2026 00:00:00 +0000Internet-facing PHP servers face immediate compromise risk because attackers are broadly exploiting two critical code-execution weaknesses. Exploitation attempts appeared four days before public disclosure, followed by multiple proof-of-concept releases and more activity before the embargo ended on…https://dailycyber.news/news/2026-10-22/poisoned-litellm-release-steals-cloud-and-ai-credentials/https://dailycyber.news/news/2026-10-22/poisoned-litellm-release-steals-cloud-and-ai-credentials/Thu, 22 Oct 2026 00:00:00 +0000Cloud, AI, and developer credentials may be compromised on systems that ran LiteLLM 1.107.0. Attackers inserted a credential stealer and remote-access backdoor into the release distributed through Python and Docker registries. The malware targeted browser data, cloud credentials, AI provider keys, SSH…https://dailycyber.news/news/2026-10-22/japan-cloud-breach-forces-shutdown-across-up-to-26-739-servers/https://dailycyber.news/news/2026-10-22/japan-cloud-breach-forces-shutdown-across-up-to-26-739-servers/Thu, 22 Oct 2026 00:00:00 +0000Customer workloads stopped after Japan’s Onamae Desktop Cloud began shutting down servers to contain an intrusion. An unauthorized party installed malicious programs in customer environments, potentially affecting up to 26,739 servers. Data stored on those systems may have been exposed, although no misuse…https://dailycyber.news/news/2026-10-22/self-managed-gitlab-servers-need-urgent-fixes-for-code-execution/https://dailycyber.news/news/2026-10-22/self-managed-gitlab-servers-need-urgent-fixes-for-code-execution/Thu, 22 Oct 2026 00:00:00 +0000Self-managed GitLab servers could be taken over if administrators delay a new critical patch. Under certain conditions, an unauthenticated user could execute arbitrary code by submitting a specially crafted regular expression. The affected range extends across many GitLab releases beginning with version…https://dailycyber.news/news/2026-10-22/active-plex-attacks-turn-home-media-servers-into-elevated-access/https://dailycyber.news/news/2026-10-22/active-plex-attacks-turn-home-media-servers-into-elevated-access/Thu, 22 Oct 2026 00:00:00 +0000Attackers are chaining four Plex Media Server weaknesses to obtain administrator tokens and run code with elevated privileges. Exploitation reports began on October 17, with early activity targeting honeypots to deploy a cryptocurrency miner. CISA warned that attackers are actively exploiting the…https://dailycyber.news/news/2026-10-22/weak-certificate-keys-put-web-code-signing-and-vpn-trust-at-risk/https://dailycyber.news/news/2026-10-22/weak-certificate-keys-put-web-code-signing-and-vpn-trust-at-risk/Thu, 22 Oct 2026 00:00:00 +0000Websites, software, and encrypted connections could be impersonated because eight eMudhra intermediate certificates used extremely weak private keys. Six certificates covered web encryption and two covered code signing. Browser and operating-system vendors have begun blocking the affected trust paths, and…https://dailycyber.news/news/2026-10-22/railway-incident-puts-stored-api-keys-and-database-passwords-at-risk/https://dailycyber.news/news/2026-10-22/railway-incident-puts-stored-api-keys-and-database-passwords-at-risk/Thu, 22 Oct 2026 00:00:00 +0000Customers may need to replace credentials after unauthorized access to Railway systems that store environment variables. Potentially exposed values include API keys, database passwords, and private registry credentials, including some decrypted data. Railway paused deployments during the investigation and…https://dailycyber.news/news/2026-10-22/tidb-breach-shows-how-cloud-telemetry-can-expose-customer-secrets/https://dailycyber.news/news/2026-10-22/tidb-breach-shows-how-cloud-telemetry-can-expose-customer-secrets/Thu, 22 Oct 2026 00:00:00 +0000Customer metadata and operational records may create downstream risk after attackers accessed PingCAP systems using stolen service-account credentials. PingCAP said the access lasted from September 9 to October 7 and included copied company data and source code. It found no evidence that customer…https://dailycyber.news/news/2026-10-22/poisoned-ovhcloud-tool-shows-how-one-account-can-taint-releases/https://dailycyber.news/news/2026-10-22/poisoned-ovhcloud-tool-shows-how-one-account-can-taint-releases/Thu, 22 Oct 2026 00:00:00 +0000Developer secrets were placed at risk when attackers replaced OVHcloud command-line tool assets with malicious binaries. The binaries were available for one hour and 33 minutes and downloaded approximately 250 times. They were designed to retrieve secrets from disk. Attackers used a compromised developer…https://dailycyber.news/news/2026-10-22/cisco-expressway-exposure-can-give-remote-attackers-root-control/https://dailycyber.news/news/2026-10-22/cisco-expressway-exposure-can-give-remote-attackers-root-control/Thu, 22 Oct 2026 00:00:00 +0000Cisco Expressway devices could give attackers root-level command execution if exposed systems remain unpatched. An unauthenticated remote attacker with network access and possession of persistent cookies could connect to the database service and invoke specific commands. The issue affects Expressway Core…https://dailycyber.news/news/2026-10-22/sagemaker-sdk-default-can-expose-cloud-credentials-through-rogue-buckets/https://dailycyber.news/news/2026-10-22/sagemaker-sdk-default-can-expose-cloud-credentials-through-rogue-buckets/Thu, 22 Oct 2026 00:00:00 +0000Machine-learning workloads could execute attacker-controlled code and expose cloud credentials because of an unsafe SageMaker Python SDK default. The SDK generated a predictable storage bucket name without confirming that the caller’s account owned the bucket. An attacker who created the bucket first…https://dailycyber.news/news/2026-10-21/web-servers-face-broad-attacks-as-emergency-php-fixes-land/https://dailycyber.news/news/2026-10-21/web-servers-face-broad-attacks-as-emergency-php-fixes-land/Wed, 21 Oct 2026 00:00:00 +0000Public-facing web servers face an urgent update cycle after critical PHP weaknesses opened paths to code execution, data exposure and service disruption. The issues affect PHP installations serving web requests, including common Apache, PHP-FPM and CGI configurations. Fixes are available in PHP 8.5.12…https://dailycyber.news/news/2026-10-21/ransomware-crews-turn-trusted-vpn-access-into-a-network-foothold/https://dailycyber.news/news/2026-10-21/ransomware-crews-turn-trusted-vpn-access-into-a-network-foothold/Wed, 21 Oct 2026 00:00:00 +0000Organizations may already have unauthorized VPN sessions created through a patched GlobalProtect authentication bypass. Ransomware operators including Qilin and Inc have been linked to exploitation, while public reporting also connects Settra activity. Attackers used the access to bypass multifactor…https://dailycyber.news/news/2026-10-21/autonomous-ai-agents-are-accelerating-real-world-intrusion-campaigns/https://dailycyber.news/news/2026-10-21/autonomous-ai-agents-are-accelerating-real-world-intrusion-campaigns/Wed, 21 Oct 2026 00:00:00 +0000Organizations are facing intrusion campaigns in which AI agents can choose actions and execute commands at machine speed. CrowdStrike documented four previously unreported actors whose exposed frameworks showed different levels of automation and autonomy. Reported victims included healthcare, government…https://dailycyber.news/news/2026-10-21/poisoned-litellm-release-exposed-developer-and-cloud-credentials/https://dailycyber.news/news/2026-10-21/poisoned-litellm-release-exposed-developer-and-cloud-credentials/Wed, 21 Oct 2026 00:00:00 +0000Developer systems and AI services may have executed malware after installing LiteLLM 1.107.0. All seven PyPI wheel files were compromised, and affected images also reached container registries. The payload used Python startup hooks, allowing an unrelated Python command to trigger credential theft. PyPI…https://dailycyber.news/news/2026-10-21/stolen-management-keys-opened-wordpress-sites-to-backdoors/https://dailycyber.news/news/2026-10-21/stolen-management-keys-opened-wordpress-sites-to-backdoors/Wed, 21 Oct 2026 00:00:00 +0000WordPress sites were backdoored through valid UpdraftCentral management keys after TeamUpdraft detected unauthorized access to its infrastructure. The vendor believes its customer database was accessed and replaced potentially affected keys and credentials. Researchers said attackers used stolen keys to…https://dailycyber.news/news/2026-10-21/weak-certificate-keys-threatened-trust-across-browsers-and-software/https://dailycyber.news/news/2026-10-21/weak-certificate-keys-threatened-trust-across-browsers-and-software/Wed, 21 Oct 2026 00:00:00 +0000Eight compromised eMudhra intermediate certificates created a path to forge certificates for legitimate domains. Their private keys were so weak that researchers could recover them by testing only 256 possible values. The certificates were revoked, and major browsers and operating systems began blocking…https://dailycyber.news/news/2026-10-21/safepay-ransomware-has-hit-more-than-600-critical-organizations/https://dailycyber.news/news/2026-10-21/safepay-ransomware-has-hit-more-than-600-critical-organizations/Wed, 21 Oct 2026 00:00:00 +0000More than 600 critical infrastructure organizations worldwide have been affected by SafePay ransomware since August 2024, according to a joint government warning. The group uses exposed credentials, password attacks, phishing and weaknesses in internet-facing edge devices. It can enter through VPN…https://dailycyber.news/news/2026-10-21/tampered-ovhcloud-releases-put-developer-secrets-at-risk/https://dailycyber.news/news/2026-10-21/tampered-ovhcloud-releases-put-developer-secrets-at-risk/Wed, 21 Oct 2026 00:00:00 +0000Developers who installed five compromised OVHcloud command-line releases may have exposed secrets stored on their machines. Versions v0.11.0 through v0.15.0 were altered on GitHub before the malicious downloads were blocked. A compromised contributor account replaced existing release files without…