Security Community

❓What:

• Since late October 2026, Arctic Wolf has seen more attackers use stolen cloud credentials to run generative AI workloads at the victim’s expense. This is called LLMjacking.

• Stolen credentials have included AWS IAM access keys, Lambda execution role sessions, and Entra ID service principal secrets.

• Targets include Amazon Bedrock, Azure OpenAI, Azure AI Foundry, and Google Cloud AI services.

• Attackers check which models and limits they can reach. Then they run premium models at high volume or resell the access through underground “mixer” proxy services.

❓What:

• Binance says hackers used a fake job interview to compromise an employee’s computer, then exploited an internal AI tool to carry out unauthorized transactions totaling $6.3 billion. foxbusiness

• Binance previously said the compromised laptop belonged to a DevOps engineer and may have given attackers access to a service container used to submit unauthorized withdrawal requests. foxbusiness

• The exchange said it found no evidence that private key wallets were compromised. foxbusiness

• The FBI attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit. It’s the same group behind last year’s $1.5 billion Bybit hack. thenationalnewsnbcnewyork

❓What:

• On October 21, Node.js released security updates for CVE-2026-111497, nicknamed Node2Shell.

• Node.js is another widely used behind-the-scenes web technology. It powers many websites, apps, and online services.

• The flaw is in the Brotli decoder, the component that unpacks compressed data. A specially crafted file could let an attacker run code, crash the service, or read memory.

• It’s rated high severity. Public proof-of-concept code exists, but published exploits are unreliable and depend heavily on the environment.

❓What:

• PHP has released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. Public reporting calls the vulnerabilities PHP2Shell. patchstacksecurityweek

• They are tracked as CVE-2026-109618 and CVE-2026-109619, and the PHP security team rates both Critical (CVSS v4.0 9.2). patchstack

• Details leaked online on October 20, before coordinated disclosure and before patches were available. PHP moved the release up from October 22 in response. huntressrescana

• PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to fix both flaws. huntress

❓What:

• Frontline says its security team identified a vulnerability in a third-party software product on August 14, 2026, which allowed unauthorized access to part of its environment. infosecurity-magazine

• Exposed data includes Social Security numbers, email addresses, and physical addresses. Bleeping Computer

• In at least one district, all employees were affected. Another district’s notice listed 1,210 affected employees. Bleeping Computer

• It is unclear how many districts or individuals were affected in total. Bleeping Computer

❓What:

• Comparitech counted an average of 3.33 ransomware attacks per day on healthcare in Q3 2026. That is up 40 percent from Q2 and more than double the same period last year. itnerd

• Of 192 total attacks, 40 were confirmed and 152 unconfirmed. itnerd

• The Gentlemen (18) and INC (14) made the most claims against healthcare providers. itnerd

• A separate Proofpoint and Ponemon report found 74 percent of U.S. healthcare organizations hit by cyberattacks in the past year reported disruptions to patient care. que

❓What:

• The FBI and US Secret Service issued a warning on October 6 that the FortiBleed campaign against Fortinet FortiGate firewalls and SSL VPN gateways is still ongoing. infosecurity-magazine

• The notice cites SOCRadar figures of 86,644 compromised devices across 194 countries. infosecurity-magazine

• The advisory cites no CVE. Fortinet believes attackers are reusing previously stolen credentials and brute-forcing devices with weak passwords and no MFA. dailysecurityreviewcybersecuritydive

• Attackers create new accounts and, in some cases, delete existing ones to block organizations from their own devices. helpnetsecurity

❓What:

• Proofpoint released its 2026 Voice of the CISO report, surveying 1,600 CISOs worldwide and comparing five years of results.

• 78% of CISOs now call GenAI a security risk, up from 54% in 2024.

• 78% say their organization blocks or restricts employee GenAI use, up from 59% in 2025.

• 79% name human risk as their biggest cyber vulnerability.

❓What:

• Attackers are exploiting two critical flaws in Citrix NetScaler ADC and NetScaler Gateway, and both were exploited before a patch existed. thenextweb

• CVE-2026-88771 lets an attacker run commands without logging in and affects all NetScaler ADC and Gateway deployments, including the default setup. thenextweb

• CVE-2026-88772 is a memory overflow that can lead to remote code execution or a crash; it requires DTLS, which is enabled by default on VPN servers. thenextweb

• Both flaws carry CVSS 4.0 scores of 9.5. bankinfosecurity