Cyber Threat Intel Daily Briefing — 2026-10-27

CYBER THREAT INTEL

DAILY BRIEFING · 2026-10-27 12:15 UTC · REPORT BRIEF-20261027-121543

OPEN // LE

01

iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18

Apple patched 286 vulnerabilities in iOS and macOS 27.2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones. The post iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18 appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 27 Oct 2026 11:49:57 +0000 https://www.securityweek.com/ios-macos-27-2-patch-286-bugs-fix-for-exploited-flaw-backported-to-ios-18/

02

U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the PHP PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: On Octo

SRC: Security Affairs Tue, 27 Oct 2026 10:39:41 +0000 https://securityaffairs.com/201840/security/u-s-cisa-adds-php-flaws-php2shell-to-its-known-exploited-vulnerabilities-catalog.html

03

Apple backports CoreGraphics zero-day patches to older iPhones

​Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. […]

SRC: BleepingComputer Tue, 27 Oct 2026 06:36:12 -0400 https://www.bleepingcomputer.com/news/apple/apple-backports-coregraphics-zero-day-patches-to-older-iphones/

04

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon. The post This is Fine: What NetScaler Zero-Days Tell Us About the New Normal appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 27 Oct 2026 10:02:24 +0000 https://www.securityweek.com/this-is-fine-what-netscaler-zero-days-tell-us-about-the-new-normal/

05

What happens when security tools go dark before the ransomware

A China-linked ransomware crew disabled the security tools at a critical infrastructure operator before it launched the encryptor. Most security budgets never priced that in. The post What happens when security tools go dark before the ransomware appeared first on CyberScoop.

SRC: CyberScoop Tue, 27 Oct 2026 10:00:00 +0000 https://cyberscoop.com/warlock-ransomware-storm-2603-sharepoint-attacks-op-ed/

06

Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. "A consistent pattern of attacker be

SRC: The Hacker News Mon, 26 Oct 2026 21:22:40 +0530 https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html

07

Cohere Finds Qwen AI Model Contacting a Server in China

Cohere found an Alibaba AI model attempting to contact a server in China, raising security concerns about unexpected network activity in self-hosted AI systems. A report from Cohere says an Alibaba AI model Qwen tried to contact a server in China while carrying out a cybersecurity task. “Asked to wr

SRC: Security Affairs Tue, 27 Oct 2026 09:07:11 +0000 https://securityaffairs.com/201810/ai/cohere-finds-qwen-ai-model-contacting-a-server-in-china.html

08

Authorities extradite Chinese national for alleged $37M investment scam

Zheng Zhao and his co-conspirators allegedly deceived 174 U.S. residents into sending funds to a globally coordinated fake investment operation with ties to Cambodia. The post Authorities extradite Chinese national for alleged $37M investment scam appeared first on CyberScoop.

SRC: CyberScoop Mon, 26 Oct 2026 17:33:19 +0000 https://cyberscoop.com/chinese-national-extradited-investment-scam/

09

Stolen AI Reasoning Could Help China Build Cheaper Rivals

Xint says a flaw in OpenAI’s compaction process let researchers move reasoning traces between models, potentially making it cheaper to distill a rival AI. The post Stolen AI Reasoning Could Help China Build Cheaper Rivals appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 26 Oct 2026 14:30:09 +0000 https://www.securityweek.com/stolen-ai-reasoning-could-help-china-build-cheaper-rivals/

10

Chinese man extradited for role in $36 million cryptocurrency scam

A Chinese national was arraigned in California after being extradited from the Netherlands for his alleged involvement in a cryptocurrency investment scam that stole nearly $37 million from 174 victims in the United States. […]

SRC: BleepingComputer Mon, 26 Oct 2026 09:56:44 -0400 https://www.bleepingcomputer.com/news/security/chinese-man-extradited-for-role-in-36-million-cryptocurrency-scam/

11

Energy giant ENGIE discloses data breach affecting customers

French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners. […]

SRC: BleepingComputer Tue, 27 Oct 2026 05:25:50 -0400 https://www.bleepingcomputer.com/news/security/energy-giant-engie-discloses-data-breach-affecting-customers/

12

'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets

An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.

SRC: DarkReading Mon, 26 Oct 2026 18:01:40 GMT https://www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets

13

University of Copenhagen data breach exposes data of 525,000 people

The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. […]

SRC: BleepingComputer Mon, 26 Oct 2026 18:20:36 -0400 https://www.bleepingcomputer.com/news/security/university-of-copenhagen-data-breach-exposes-data-of-525-000-people/

14

Former pentester used ARTEX AI to steal 8.2 million data records

South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks. […]

SRC: BleepingComputer Mon, 26 Oct 2026 17:08:28 -0400 https://www.bleepingcomputer.com/news/security/former-pentester-used-artex-ai-to-steal-82-million-data-records/

15

Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-p

SRC: The Hacker News Tue, 27 Oct 2026 12:04:47 +0530 https://thehackernews.com/2026/10/attackers-hijack-dahua-ip-cameras-in.html

16

Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Siemens, Schneider Electric, ABB and others have confirmed that some of their products are affected by the PHP2Shell vulnerabilities. The post Industrial Vendors Check Products for PHP2Shell Vulnerabilities appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 26 Oct 2026 14:52:14 +0000 https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/

17

Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI

Anthropic presents its own initial public offering as a step toward mitigating the risks it believes AI poses. The post Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 27 Oct 2026 10:44:20 +0000 https://www.securityweek.com/risks-spelled-out-for-anthropic-investors-include-possible-harms-from-runaway-ai/

18

Attackers Take Control of Dahua Cameras and Video Recorders Via Easy4IP

Ukraine warns that attackers can remotely access Dahua cameras and recorders via Easy4IP, viewing video and changing settings. Ukraine’s cyber incident response team CERT-UA has warned about attackers taking over video surveillance systems made by Dahua. In its alert dated October 23, 2026, it repor

SRC: Security Affairs Tue, 27 Oct 2026 09:56:54 +0000 https://securityaffairs.com/201827/hacking/attackers-take-control-of-dahua-cameras-and-video-recorders-via-easy4ip.html

19

Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover

Running at system boot, it periodically polled the update domain to execute any code served, with full privileges. The post Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 27 Oct 2026 09:44:50 +0000 https://www.securityweek.com/dead-popcorn-time-updater-put-millions-of-computers-at-risk-of-takeover/

20

Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers

A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those co

SRC: The Hacker News Tue, 27 Oct 2026 15:03:06 +0530 https://thehackernews.com/2026/10/australia-gets-into-amadey-malware.html

[ SOURCE ] OpenPhish (18 indicator(s))