Cyber Threat Pulse

PHP2Shell shows how quickly disclosure can become exploitation, and Northwestern's response shows what that looks like in practice.

• Exploitation is...

• Oct 21: GMO shut down its Onamae Desktop Cloud service after finding unauthorized access, and received an email demanding about 8 billion yen.
• Oct...

Several public-facing Columbia services remain disrupted almost a week after the city was targeted in a ransomware attack. The city says alternate...

NordLayer Intelligence reports ransomware attacks rose more than 50% year-over-year, an all-time high for the company. It counted 2,894 attacks in Q3...

The same playbook keeps repeating: mail floods first, then a Teams chat from a fake "IT support" identity asking for remote access. Per Sophos, these...

The article argues manufacturing has become the most targeted sector for ransomware, with Akira, Qilin, and Play the most active groups against it....

The September NetScaler zero-days are a warning about consolidated edge exposure. NetScaler combines reverse proxy, WAF, firewall and SSL VPN...

Senator Elizabeth Warren is pressing the Fed, FDIC and OCC to rescind policies that limit examiners' ability to issue supervisory warnings and pursue...

Recovery planning is nearly universal, yet doubts about defenses persist:

• 91% protect backup storage against ransomware, and 84% have a disaster...

A software system Austin ISD uses to manage employee records suffered a breach in August, traced to a flaw in a vendor's supply chain.

• Supply-chain...

The lawsuit alleges a breach affecting more than 3 mn people, with exposed data including Social Security numbers and dates of birth.

• Alleged...

53 Richmond campuses face disruption from ransomware attacks. Separately, Oneonta has reopened after a two-day closure. The report points readers to what officials know about the breaches.

Confirmed RCE on PHP2Shell honeypots marks the shift from probes to working exploits. Organizations must urgently patch CVE-2026-109618/109619, check exposures, and hunt for post-exploitation signs like memory crashes and shell commands.

TG-iPASS successfully decrypted data for 28,000 companies after a ransomware attack encrypted records on Oct 22, with officials confirming no data...

Ransomware increasingly attacks backup environments to block recovery.

• Five scenarios: Demonstrations show deletion and compromise attempts on Veeam...

Ransomware is forcing shutdowns of essential local services while both organizations scramble to assess data risks.

• Oneonta City Schools closed to...

PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 drove millions of exploit attempts within hours of disclosure.

• Trend Micro added two updated...

CVE-2026-114625 enables any authenticated low-privilege user (Enterprise Read Only) to escalate to superuser via SQL injection on exposed on-prem VCO...

Ransomware crews increasingly target backups before encryption to eliminate recovery options. Recent cases like Gunra show attackers deleting data...

• ZDI accidentally posted unpatched kernel and ConnMan reports with PoCs to public lists
• ZDI-CAN-33367 grants local root via page cache write on...