Cyber Threat Intel Daily Briefing — 2026-10-24

CYBER THREAT INTEL

DAILY BRIEFING · 2026-10-24 12:15 UTC · REPORT BRIEF-20261024-121523

OPEN // LE

01

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite pa

SRC: The Hacker News Sat, 24 Oct 2026 16:39:29 +0530 https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html

02

U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical Arista VeloCloud Orchestrator flaw, tracked as CVE-2026-114625 (CVSS

SRC: Security Affairs Sat, 24 Oct 2026 08:30:44 +0000 https://securityaffairs.com/201609/hacking/u-s-cisa-adds-arista-velocloud-orchestrator-flaw-to-its-known-exploited-vulnerabilities-catalog.html

03

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-

SRC: The Hacker News Sat, 24 Oct 2026 11:55:57 +0530 https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html

04

Abandoned Popcorn Time app exposed millions of devices to RCE attacks

Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. […]

SRC: BleepingComputer Fri, 23 Oct 2026 16:55:05 -0400 https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/

05

Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions

Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be

SRC: The Hacker News Fri, 23 Oct 2026 23:20:47 +0530 https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html

06

AI Tools Are Generating Massive Attacks for Little Cost

One campaign targets 105 sites using open-weight models; in another, public models gained full domain control for $12. Cyber-defense will have to change.

SRC: DarkReading Fri, 23 Oct 2026 17:26:59 GMT https://www.darkreading.com/cybersecurity-operations/ai-tools-massive-attacks-little-cost

07

BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations

Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a

SRC: The Hacker News Sat, 24 Oct 2026 00:20:13 +0530 https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html

08

In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware

Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe. The post In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware appeared first on SecurityWeek.

SRC: SecurityWeek Fri, 23 Oct 2026 14:23:37 +0000 https://www.securityweek.com/in-other-news-tor-exit-relays-hijacked-banks-spot-rogue-ai-agents-self-rebuilding-macos-ransomware/

09

Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline

LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLL

SRC: The Hacker News Sat, 24 Oct 2026 16:33:33 +0530 https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html

10

Capcom Data Breach Exposes 11.7 Million Email Addresses

Capcom disclosed a data breach exposing 11.7 million email addresses and account details after hackers accessed its CAPCOM ID service. Japanese gaming company Capcom has disclosed a data breach discovered on October 19 involving its CAPCOM ID service, which provides access to online services and gam

SRC: Security Affairs Sat, 24 Oct 2026 10:21:53 +0000 https://securityaffairs.com/201626/data-breach/capcom-data-breach-exposes-11-7-million-email-addresses.html

11

Trust Is Not What It Seems — And Fraudsters Are Counting on It

Threat actors don't need to rely on malware to breach organizations anymore. They're simply calling help desks and politely asking for access, with a little help from artificial intelligence.

SRC: DarkReading Fri, 23 Oct 2026 20:57:56 GMT https://www.darkreading.com/cyber-risk/trust-is-not-what-it-seems-and-fraudsters-are-counting-on-it

12

Exposed to PHP2Shell? Cyber Experts Weigh in With Advice

Fixing the critical PHP flaws is not as simple as clicking "Update." Here's how to assess your risk, and what you can do to protect yourself.

SRC: DarkReading Fri, 23 Oct 2026 19:41:23 GMT https://www.darkreading.com/application-security/exposed-php2shell-cyber-experts-advice

13

Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads

Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services. "You may choose to allow certain Google services, i

SRC: The Hacker News Sat, 24 Oct 2026 16:06:33 +0530 https://thehackernews.com/2026/10/google-says-gmail-and-photos-data.html

14

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belongs to Time4Popcorn, an abandoned copy o

SRC: The Hacker News Sat, 24 Oct 2026 14:34:24 +0530 https://thehackernews.com/2026/10/researchers-push-over-2-million-updates.html

15

Microsoft Teams to get AI-powered, context-aware phishing detection

Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026. […]

SRC: BleepingComputer Fri, 23 Oct 2026 14:54:41 -0400 https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-get-ai-powered-context-aware-phishing-detection/

16

Cyber Insurance's New Reality: Underwriting Isn't Enough

Rising AI, social engineering, and cloud risks are pushing carriers beyond risk transfer and deeper into cybersecurity itself.

SRC: DarkReading Fri, 23 Oct 2026 13:30:00 GMT https://www.darkreading.com/cyber-risk/cyber-insurances-underwriting-isnt-enough

[ SOURCE ] OpenPhish (18 indicator(s))