Sekoia linked a large-scale watering hole campaign against iOS and Android users to the Russian group APT29, tied to the SVR foreign intelligence service. Found in mid-October 2026, it used hacked or cloned high-profile websites in the US, Ukraine, the Czech Republic and Bulgaria, plus a supply-chain compromise of Plerdy, a Ukrainian web analytics script loaded by thousands of websites.
Debian, Ubuntu and APT's developers disclosed a flaw in the APT package manager that lets an attacker able to modify package downloads swap a verified package for their own, whose code then runs as root. The attack relies on APT retrying failed downloads, which it does by default from Debian 12.
Zyxel patched a zero-day in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. Binarly found the earlier fix did not block the exploit, which lets anyone reaching the web management interface run commands without logging in; Zyxel has released new firmware for 10 GS1900 models.
CISA added CVE-2024-27834 (CVSS 5.5), a flaw in Apple's operating systems and Safari, to its Known Exploited Vulnerabilities catalog. An attacker who already has arbitrary read and write capabilities on a device can use it to bypass Pointer Authentication (PAC), weakening defenses against memory-corruption attacks. CISA says it is being exploited to deliver info-stealing malware.
SonicWall warned of two vulnerabilities in end-of-life Global Management System (GMS) 9.5.2 and earlier that it will not patch, including CVE-2026-109593 (CVSS 9.1), an unauthenticated file read that lets an attacker with network access read internal GMS files.
Blockchain analytics company Chainalysis said some information belonging to all of its users, which include law enforcement and national security customers, was exposed in a cyberattack involving agentic techniques.
DreamHost confirmed a data breach after attackers had access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords, along with webmail sessions.
The developers of Goddess of Victory: NIKKE confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data.
A flaw dubbed GhostMap lets a specially crafted Android app that needs no permissions force a device into a continuous boot loop once installed. Bitdefender warns the unfixed bug can force users to factory reset their device.
Canadian Ryan James Roach was extradited to the US on October 28 to face charges with Mathiew James Stubbings over a scheme from June 2016 to December 2019 in which the pair allegedly hacked computers at educational institutions in New York, Tennessee, North Carolina and Massachusetts, stole logins and used the machines to mine cryptocurrency.
IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune, UNC3524, Midnight Blizzard