Firewall Daily – The Cyber Express
The Cyber Express Weekly Roundup: FBI Blames North Korea for $6B Binance Hack, Hackers Turn Up the Heat on Europe’s Fridges and More Ashish Khaitan
This weekly roundup covers the FBI's attribution of the $6 billion Binance hack to North Korea, a spreading wave of refrigeration attacks that has now reached France's blood supply, rapid exploitation of a freshly patched WordPress flaw, a Europol takedown of a fake trading platform supplier, and unauthorized trades in Stockal customer accounts. Two threads run through this week's stories. First, attackers are increasingly coming in through someone else's door: a third-party refrigeration su
6 de Novembro de 2026, 11:33

The Cyber Express Weekly Roundup: FBI Blames North Korea for $6B Binance Hack, Hackers Turn Up the Heat on Europe’s Fridges and More

6 de Novembro de 2026, 11:33

weekly roundup

This weekly roundup covers the FBI's attribution of the $6 billion Binance hack to North Korea, a spreading wave of refrigeration attacks that has now reached France's blood supply, rapid exploitation of a freshly patched WordPress flaw, a Europol takedown of a fake trading platform supplier, and unauthorized trades in Stockal customer accounts. Two threads run through this week's stories. First, attackers are increasingly coming in through someone else's door: a third-party refrigeration supplier, a scam platform provider, or data leaked by another company. Second, speed decides the outcome. Attackers moved on WordPress within two days of a patch, while fast alarms saved France's blood stocks from the fate of supermarket food.

The Cyber Express Weekly Roundup

FBI Blames North Korea for $6B Binance Hack

The FBI has attributed the theft of more than $6 billion from Binance, which took place around October 29, to North Korean hackers it tracks as "TraderTraitor." The stolen funds are being converted mainly into Ethereum, and the agency has urged crypto firms to block transactions linked to the attackers. Read more…

Hackers Heat Supermarket Freezers Across Europe

Supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia threw out spoiled food after hackers took control of refrigeration systems, in some cases setting them to 50°C. The attacks follow a similar campaign against around 400 stores in France last month that exploited outdated, internet-connected cooling equipment. Who is responsible remains unknown. Read more…

Hackers Target WordPress Flaw Days After Patch

Attackers began exploiting a critical WordPress flaw within 48 hours of its October 28 fix in version 7.1.4, with Wordfence blocking nearly 63,000 attempts in a single day. The bug affects versions 4.7 through 7.1.3 and can let hackers run code on a site during a core update. With no workaround available, site owners are urged to update immediately. Read more…

Europol Busts Supplier of Fake Trading Platforms

Authorities in seven countries seized more than 100 servers and arrested seven suspects on November 3 in an operation against a company accused of supplying fake trading platforms to scam call centres. Victims were lured with promises of quick profits, shown fake gains to draw in more money, and then blocked from withdrawing. Losses are estimated at over €4 million, with potential victims in more than 50 countries. Read more…

Freezer Hackers Hit France's Blood Supply

France's national blood service, EFS, said hackers raised temperatures in cold storage rooms at three sites by going through a third-party refrigeration supplier. Alarms caught the changes quickly, and no blood products were lost. It is the first healthcare organisation hit in a wave of refrigeration attacks now reported in at least 11 countries. No one has claimed responsibility. Read more…

Stockal Confirms Unauthorized Trades in 13 Accounts

Borderless, which runs US equities platform Stockal, said attackers logged into 26 customer accounts using valid credentials and, in 13 of them, sold large-cap stocks to buy obscure microcap shares. No funds were withdrawn. The company says its systems were not breached and suspects social engineering using data leaked in another firm's breach. Read more…

Weekly Cybersecurity Takeaway

Several of this week's incidents show that an organization's security is only as strong as the partners and data around it. Supermarkets and France's blood service were reached through refrigeration suppliers; Stockal customers were likely targeted with data stolen elsewhere, and the Europol case exposed a business that built scam platforms for others to run. Speed is the other lesson. Attackers turned the WordPress fix into a roadmap within 48 hours, while the EFS avoided losses because its monitoring flagged the problem right away. Organizations should review the remote access their suppliers have to critical systems, retire or isolate unsupported internet-connected devices, and make sure alarms on physical equipment reach someone around the clock. They should also patch critical flaws without delay, strengthen account authentication, and, for crypto firms, block addresses linked to the Binance attackers.

Firewall Daily – The Cyber Express
Stockal Confirms Unauthorized Trades in 13 Customer Accounts Ashish Khaitan
Borderless, the company that runs the US equities trading platform Stockal, has issued a statement responding to recent reports of a Stockal cyberattack in which unauthorized trades were placed in several customer accounts. The firm said it wanted to set out the facts and explain how it is assisting the customers who were affected. According to Borderless, its US brokerage and custody partner, DriveWealth, flagged unauthorized trading in 13 customer accounts on October 16 (India time), which
6 de Novembro de 2026, 05:22

Stockal Confirms Unauthorized Trades in 13 Customer Accounts

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

6 de Novembro de 2026, 05:22

Stockal cyberattack

Borderless, the company that runs the US equities trading platform Stockal, has issued a statement responding to recent reports of a Stockal cyberattack in which unauthorized trades were placed in several customer accounts. The firm said it wanted to set out the facts and explain how it is assisting the customers who were affected. According to Borderless, its US brokerage and custody partner, DriveWealth, flagged unauthorized trading in 13 customer accounts on October 16 (India time), which was October 15 during US market hours. Access to those accounts was restricted shortly afterwards to stop any further activity. The company said an unauthorized third party appears to have logged into 26 customer accounts using valid credentials. In 13 of them, existing large-cap US equity holdings were sold, and the proceeds were used to buy thinly traded microcap securities. Borderless said its investigation so far shows that no funds were withdrawn.

No Breach of Borderless Systems Found

Borderless stated that it has found no evidence that its platform, interface, infrastructure or internal systems were breached or compromised in the cyberattack on Stockal. It has brought in independent cybersecurity specialists to examine its systems. The company believes the account holders may have been targeted through a social engineering attack that used information exposed in another company's data breach several weeks earlier. However, it stressed that this link remains unconfirmed and under active investigation.

Support for Customers Hit by the Stockal Cyberattack

Borderless called support for affected customers its immediate priority. Its teams have been in direct contact with them since shortly after the incident and are working with DriveWealth to establish the facts, review the transactions and explore "appropriate avenues for a fair resolution." The company noted that this help is offered in good faith and "does not constitute an admission of liability, wrongdoing, negligence or responsibility for the unauthorized activity." It added that it will keep supporting customers while the facts and respective responsibilities are established.

New Safeguards After the Stockal Cyberattack

As a precaution, Borderless has introduced additional authentication and account-protection measures. Based on the information reviewed so far, it said the unauthorized trading identified was limited to the 13 accounts. It has found no evidence of threats to the wider Borderless platform, its other products or other customer accounts, and it continues to monitor its systems as the investigation progresses.

Cooperation With Authorities

Borderless said it is cooperating with relevant authorities and regulators over the Stockal cyberattack. It also clarified that it had responded substantively to media enquiries before reports were published, sharing the information it had at the time. The company said its statement reflects its current understanding and may be updated as further facts emerge. The firm said transparency, accountability, and protecting customers' interests remain central to how it operates. It added that it built Borderless on the belief that customers deserve "a trusted, responsible & globally connected financial platform," and that it will keep communicating as verified information about the cyberattack on Stockal becomes available.

Firewall Daily – The Cyber Express
Alpine Linux SSH Flaw Lets Attackers Log In Without a Password Ashish Khaitan
Administrators running sshd on Alpine Linux servers are being told to update openssh and restart sshd right away, since upgrading the package alone leaves the old daemon running. A flaw in the OpenSSH server lets attackers log in without a password. Those who cannot patch yet can close the hole by setting PasswordAuthentication to no and restarting sshd. How the OpenSSH Server Flaw Works An attacker who can reach the SSH port gets in with a single connection that works every time, with n
6 de Novembro de 2026, 05:12

Alpine Linux SSH Flaw Lets Attackers Log In Without a Password

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

6 de Novembro de 2026, 05:12

Alpine Linux servers

Administrators running sshd on Alpine Linux servers are being told to update openssh and restart sshd right away, since upgrading the package alone leaves the old daemon running. A flaw in the OpenSSH server lets attackers log in without a password. Those who cannot patch yet can close the hole by setting PasswordAuthentication to no and restarting sshd.

How the OpenSSH Server Flaw Works

An attacker who can reach the SSH port gets in with a single connection that works every time, with no retries. The attacker needs the name of an account whose password field is * (normal for key-only accounts) plus at least one other account with a $5$ or $6$ hash, then sends a password of 257 to 1,024 bytes. One user with a password exposes every account without one. When built without PAM, sshd hashes each attempt with crypt() and compares it to the stored field, borrowing another account's salt when that field is too short to hold one. musl's crypt() returns * as an error indicator for keys over 256 bytes, which exactly matches the stored field of passwordless accounts. OpenSSH 10.6p2 fixes this, and no CVE had been assigned at the time of writing.

Which Alpine Linux Servers Are Affected

Alpine Linux servers are vulnerable when they run openssh-server (built without PAM) or openssh-server-pam with UsePAM no, keep the default PasswordAuthentication yes, hold at least one local $5$ or $6$ hash, and have an account with a * password field. That includes root, shipped as root:* in the base image since about Alpine 3.16. The default PermitRootLogin prohibit-password shields root unless it is set to yes, but not if another account can become root through doas. Key-only users created with adduser or usermod -p '*', directory users via musl-nscd (nslcd, winbind, sssd), and the tiny-cloud alpine user also count. Every release checked is affected: 3.21 through 3.24, edge, and the older 3.16 to 3.20. Safe setups include containers not running sshd, systems with PasswordAuthentication no or UsePAM yes, locked accounts (user:! in /etc/shadow), machines with no $-style hash, and cloud-init images, which write PasswordAuthentication no.

Patching the OpenSSH Server

Running apk upgrade -U -a, followed by rc-service sshd restart, applies the fix, which ships in Alpine 3.21.10, 3.22.8, 3.23.8 and 3.24.4. Fixed builds are edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1, 3.20 9.7_p1-r6, 3.19 9.6_p1-r3, 3.18 9.3_p2-r4, 3.17 9.1_p1-r7 and 3.16 9.0_p1-r6. Although 3.21 reached end of support on 2026-11-01, patched packages go back to 3.16. For the workaround, root should first confirm key login works and keep the current session open. A drop-in file, /etc/ssh/sshd_config.d/00-no-passwords.conf (read from 3.19 onward), sets PasswordAuthentication no, while a sed command flips every such line in sshd_config, Match blocks included, and saves sshd_config.bak. Running sshd -t && rc-service sshd restart, then sshd -T | grep -i passwordauthentication, should print passwordauthentication no. Deleting the drop-in and restoring the backup undoes it.

Cloud Images and Spotting Attacks on Alpine Linux Servers

Official tiny-cloud images (qcow2, VHD and AMI) from 3.18.11 through 3.24.3 ship an alpine user with a * field and passwordless doas. They are safe on first boot but become exploitable once any $6$ hash appears, such as a console password or a user-data account with hashed_passwd, giving attackers a shell as alpine and then root. Instances from earlier point releases need updating or password logins disabled. Admins should check /var/log/messages for sshd "Accepted password" lines on passwordless accounts and review doas use, new users, files, and authorized keys. If a login cannot be ruled out, the machine should be treated as compromised. Özgün Kültekin of Wakefield reported the issue. Damien Miller and Darren Tucker of the OpenSSH project delivered the fix and the 10.6p2 release; Timo Teräs helped analyze the bug, and Natanael Copa built and uploaded the updated packages.

Firewall Daily – The Cyber Express
Airline Data Breach Widens as Singapore Airlines Reports 46,000 Affected Records Ashish Khaitan
Singapore Airlines (SIA) is the newest name on a growing list of carriers affected by the Amadeus cybersecurity incident, confirming that Amadeus IT Group, the global travel technology provider, accessed roughly 46,000 of its booking records through its systems. The disclosure adds to a wave of airline cyberattacks that has now hit at least 15 carriers across Asia, Europe and Australia, and it highlights how cyberattacks on airlines reach passengers through shared third-party platforms rath
5 de Novembro de 2026, 04:55

Airline Data Breach Widens as Singapore Airlines Reports 46,000 Affected Records

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

5 de Novembro de 2026, 04:55

Amadeus cybersecurity incident

Singapore Airlines (SIA) is the newest name on a growing list of carriers affected by the Amadeus cybersecurity incident, confirming that Amadeus IT Group, the global travel technology provider, accessed roughly 46,000 of its booking records through its systems. The disclosure adds to a wave of airline cyberattacks that has now hit at least 15 carriers across Asia, Europe and Australia, and it highlights how cyberattacks on airlines reach passengers through shared third-party platforms rather than airlines' own networks.

What Singapore Airlines Disclosed About the Amadeus Cybersecurity Incident

SIA briefed the media on 3 November 2026. According to the airline, most of the affected records contained passengers' names, booking reference numbers, travel itineraries and booking classes. A smaller group of about 620 records carried more sensitive details. For these, email addresses, phone numbers, travel document information and KrisFlyer membership numbers may also have been viewed. The airline said no bank account or credit card data was exposed and no bookings were altered. SIA also stated that its own IT systems were not breached. It is reaching out directly to affected customers who have upcoming trips so they can change their booking reference numbers.

Cathay Pacific: 53,000 Bookings Accessed Over Three Years

Cathay Pacific went public with its own statement on 30 October 2026, updated at 16:11 HKT (GMT+8) that day. The Hong Kong carrier said Amadeus first notified it on 28 October 2026 and shared further details on 29 October. According to Cathay, an unauthorized party had gained access to travel reservation data in Amadeus's systems "using login credentials assigned to its system account." Data supplied by Amadeus showed that around 53,000 Cathay Pacific bookings were affected, with the unauthorized access running from August 2023 to September 2026. In most cases, the exposed information covers booking references, passenger names, and flight details. In a smaller subset, email and phone contacts, travel document details, and frequent flyer numbers may also have been accessed. Cathay said there is no evidence that financial or payment data was touched. The airline said Amadeus has contained the incident, including through a password reset, and has added enhanced monitoring and detection on its systems. Amadeus has so far found no evidence that the data has been misused. Cathay stressed that the incident "has not impacted and is not impacting" its own systems or operations. It has informed the relevant authorities that they are still analyzing the information from Amadeus and plans to notify affected customers individually once the details are confirmed. "We apologise to our customers for the concern and inconvenience caused by this incident," the airline said.

Malaysia Airlines Urges Vigilance

Malaysia Airlines issued its notice on 31 October 2026, describing Amadeus as its third-party airline reservation technology provider. The carrier said some customer information processed through Amadeus between August 2023, and September 2026 may have been affected. The airline said its own IT systems were not compromised and that there is currently no evidence that financial information was accessed. It is working with Amadeus and other relevant parties to investigate and gauge the impact. As a precaution, Malaysia Airlines asked customers to stay alert to suspicious or unsolicited messages, "particularly those requesting personal or financial information." The carrier said it would share further updates as more information emerges.

Japanese and Korean Carriers Report Similar Airline Cyberattacks

Japan Airlines (JAL) reported earlier that Amadeus had informed it of unauthorized access to reservation records for both JAL and Japan Transocean Air flights. About 92,000 customers were affected, making JAL the hardest-hit carrier so far. Names, booking references, and flight information were exposed. Korean Air and Asiana Airlines also confirmed unauthorized access to data managed by Amadeus. Both said there was no evidence that their internal systems or databases had been breached.

How Amadeus Explains the Breach

Amadeus has attributed the exposure to a software glitch that made certain booking-display data accessible. That explanation sits alongside Cathay Pacific's account, which describes an unauthorized party using system account login credentials. The company said its investigation is continuing and that it has found no evidence of payment or financial information was accessed. Amadeus also said there is no sign that the vulnerability was used for ransomware. It has since rolled out fixes, together with stronger monitoring and detection measures.

The Full Reach of These Cyberattacks on Airlines

At least 15 international airlines are either confirmed as directly affected or are investigating possible customer data exposure from the supply-chain attack on the Spanish IT and reservations company. Because the breach hit a centralized booking display environment, it reached flag carriers as well as the regional partners that route reservations through them.

Major carriers with confirmed exposure

Airline	Reported impact
Japan Airlines (JAL)	About 92,000 passenger records
Cathay Pacific Airways	About 53,000 passenger bookings
Singapore Airlines (SIA)	About 46,000 booking records
All Nippon Airways (ANA)	Up to 37,800 customer profiles
Malaysia Airlines	Customer data exposed across August 2023 to September 2026
Korean Air	Unauthorised access to customer reservation databases
Asiana Airlines	Passenger booking references exposed through system account credentials
Condor Airlines	Part of the German leisure carrier's international flight data accessed

Regional and subsidiary carriers

Several smaller airlines were drawn in because they share back-end ticketing technology or corporate ties with the larger groups:

Airline	Link to the breach
Japan Transocean Air (JTA)	Affected through parent company Japan Airlines
Air Do	Affected through shared system pathways with ANA
StarFlyer	Affected through shared system pathways with ANA
Solaseed Air	Affected through shared system pathways with ANA
Ibex Airlines	Still determining the scope of exposure via its ANA integration
Oriental Air Bridge	Still determining the scope of exposure via its ANA integration

Under investigation

Qantas Airways is formally investigating whether any Australian customer files were compromised. The airline maintains that its internal databases have not been breached.

What the Amadeus Cybersecurity Incident Means for Travelers?

With the access window stretching from August 2023 to September 2026, the Amadeus cybersecurity incident spans more than three years and stands out among airline cyberattacks for how many carriers it touched through a single provider. None of the affected carriers has reported misuse of the data so far, and no airline has said payment details were taken. Even so, names, itineraries and booking references can be enough for convincing phishing attempts. That is why carriers such as Malaysia Airlines and SIA are asking passengers to watch for suspicious messages and, where advised, change their booking references. As investigations continue, more airlines may update their figures on how far these cyberattacks on airlines have reached.

Firewall Daily – The Cyber Express
UTA Investigates Suspected Cyberattack After MachForms Service Disruption Ashish Khaitan
The University of Texas at Arlington is investigating a cybersecurity incident that may have involved unauthorized activity in some of its information technology systems. The suspected UTA cyberattack came to light Thursday, when the university sent a notice to students and employees about the situation. According to the notice, the incident has affected MachForms, an online form platform the university uses for several purposes, including event registrations, inquiries from prospective stud
4 de Novembro de 2026, 04:04

UTA Investigates Suspected Cyberattack After MachForms Service Disruption

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

4 de Novembro de 2026, 04:04

UTA cyberattack

The University of Texas at Arlington is investigating a cybersecurity incident that may have involved unauthorized activity in some of its information technology systems. The suspected UTA cyberattack came to light Thursday, when the university sent a notice to students and employees about the situation. According to the notice, the incident has affected MachForms, an online form platform the university uses for several purposes, including event registrations, inquiries from prospective students, service requests, and surveys. The university said it is still working to determine whether the UTA cyberattack has spread to other university systems or disrupted additional operations.

Timeline of the UTA cyberattack

Problems first appeared on Oct. 27, when MachForms became temporarily unavailable, according to the university's cybersecurity website. Technicians from the Office of Information Technology began investigating the issue at that time. On Wednesday, the office started corrective measures aimed at restoring services as soon as possible. Since then, public information has been limited. As of Tuesday night, the cybersecurity website had not posted any updates since Thursday.

What the University of Texas Is Asking Students and Employees to Do

The university's email outlined several steps for students and staff to follow while the investigation into the cyberattack on UTA continues. First, the university asked everyone to follow official guidance from the Office of Information Technology and the Information Security Office, and to pay close attention to university communications. Second, anyone who notices suspicious activity, such as unusual computer behavior, a suspicious email or anything else that raises cybersecurity concerns, should report it to the Information Security Office at opsec@uta.edu. Third, students and employees were told not to investigate the incident on their own or circulate unverified information. Questions should be directed to a department head or the Office of Information Technology, and people should rely on official updates for confirmed information. If a journalist reaches out, students and employees are asked to refer them to UTA's media relations team. Finally, the notice asked the campus community to follow any additional instructions. If action involving passwords, devices, systems, or work practices becomes necessary, students and employees will receive specific guidance through official university channels. MachForms remains affected for now. Students and employees who need access to the platform for urgent and significant operational needs can contact the Office of Information Technology service desk at uta.edu/help. The University of Texas at Arlington has not said how long the investigation will take or when full service will be restored.

Firewall Daily – The Cyber Express
Hackers Exploit WordPress Flaw Within 48 Hours of Security Patch Ashish Khaitan
Attackers needed less than two days to start going after a freshly patched WordPress vulnerability. The flaw sits in WordPress core itself, and it can let an attacker run code on a website while that site is installing an update. WordPress shipped version 7.1.4 on October 28, 2026, to close the hole. Within 48 hours of that release, exploitation attempts were already underway. Security firm Wordfence said it blocked 62,969 attacks aimed at this vulnerability in WordPress over a single 24-hou
3 de Novembro de 2026, 10:25

Hackers Exploit WordPress Flaw Within 48 Hours of Security Patch

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

3 de Novembro de 2026, 10:25

WordPress vulnerability

Attackers needed less than two days to start going after a freshly patched WordPress vulnerability. The flaw sits in WordPress core itself, and it can let an attacker run code on a website while that site is installing an update. WordPress shipped version 7.1.4 on October 28, 2026, to close the hole. Within 48 hours of that release, exploitation attempts were already underway. Security firm Wordfence said it blocked 62,969 attacks aimed at this vulnerability in WordPress over a single 24-hour period. Anyone running WordPress for a business, a nonprofit, or a healthcare facility is being urged to update right away.

What WordPress 7.1.4 Fixes Beyond the WordPress Vulnerability

Version 7.1.4, released on October 28, is mainly a security release. Alongside the critical code execution fix, it patches several stored cross-site scripting (XSS) flaws, a denial-of-service issue, and two separate information leaks. The update also refreshes WordPress's bundled root certificates after eMudhra revoked its certificates. Of everything in the release, the code execution bug is the one attackers zeroed in on. Aaron Jorbin, who wrote the release announcement, told users to “update your sites without delay.” A GitHub security advisory published the next day described the issue as a timing weakness in the update system. If an unauthorized user moves quickly enough while an upgrade is running, they may be able to execute their own code on the server. No CVE number has been assigned to it so far.

How the Vulnerability in WordPress Works

When WordPress performs a full-package core update, it first extracts the new files into a dedicated directory inside the upgrade folder. According to the advisory, that directory had a predictable name and was reachable from the public web. That combination is the problem. An attacker who requests the right file at the right moment, before WordPress finishes cleaning up, could trick the server into running arbitrary PHP code. Pulling this off is not trivial. The attacker needs four conditions to line up: a full-package update in progress, web access to the temporary folder, a path they can guess, and a short window before the files are deleted. Under controlled conditions, that window may last only a few seconds.

Which Sites the WordPress Vulnerability Affects

The advisory lists every WordPress release from 4.7 through 7.1.3 as vulnerable. It also names the fixed version for each branch, including 7.0.8, 6.9.11, 6.8.12 and 5.9.20. The WordPress project said it backported the patch to all branches still receiving security maintenance, reaching as far back as 4.7. It also stressed that only the newest version is actively supported. Not every site can be taken over through this bug. The risk rises sharply, however, if an attacker hits a site while it is running a full-package update. Smaller websites face extra exposure. Many sit on shared servers with default settings, which makes them attractive targets for cybercriminals.

How Attackers Are Targeting the Vulnerability in WordPress

Wordfence traced the root cause to full-package upgrades repeatedly using web-accessible paths that are easy to guess. Alex Thomas, a threat analyst at Wordfence, said attackers quickly understood the race condition and turned their attention to it. Two of the biggest attack sources reportedly kept polling small groups of websites for roughly 14.5 hours. Other sources tried out different folder names and version names. The pattern looks like large-scale automated guessing rather than attacks on chosen victims. So far, no confirmed reports have put a number on how many sites have actually been compromised.

How Serious Is This WordPress Vulnerability?

Sources disagree on how severe the flaw is. The Hacker News gave it a CVSS score of 8.1, which falls in the high range. The GitHub advisory, by contrast, rates it as low severity. That gap most likely comes down to how hard the bug is to exploit successfully. Even so, the sheer volume of attack attempts and the simplicity of the fix make it sensible to treat this as a serious threat.

What Comes Next for This Vulnerability in WordPress

The probing is unlikely to stop soon. Once a vulnerability is patched, the fix itself becomes a detailed roadmap for anyone hunting sites that have not been updated. The WordPress project says backports to older branches are still in progress. The next major release, WordPress 7.2, is scheduled for December 8. The advisory credits researcher Umut Bayram with discovering the flaw and reporting it responsibly. There is currently no alternative workaround, so applying the patch is the only fix available.

Firewall Daily – The Cyber Express
South Korea President Eyes Cybersecurity Task Force After North Korea-Linked Crypto Heist Ashish Khaitan
South Korean President Lee Jae-myung has directed officials to look into creating a cybersecurity task force. A wave of hacking incidents at financial firms and a massive cryptocurrency theft linked to North Korea have raised alarm over the country's digital defenses. Lee instructed on Tuesday, Nov. 3, 2026, during a Cabinet meeting at Cheong Wa Dae in Seoul. The proposed task force would focus solely on strengthening online security. Cybersecurity Task Force and North Korea's Binance Heis
3 de Novembro de 2026, 05:10

South Korea President Eyes Cybersecurity Task Force After North Korea-Linked Crypto Heist

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

3 de Novembro de 2026, 05:10

cybersecurity task force

South Korean President Lee Jae-myung has directed officials to look into creating a cybersecurity task force. A wave of hacking incidents at financial firms and a massive cryptocurrency theft linked to North Korea have raised alarm over the country's digital defenses. Lee instructed on Tuesday, Nov. 3, 2026, during a Cabinet meeting at Cheong Wa Dae in Seoul. The proposed task force would focus solely on strengthening online security.

Cybersecurity Task Force and North Korea's Binance Heist

The directive follows a string of attacks on domestic financial companies that exposed customer data. The most recent targets were Mirae Asset Global Investments, cryptocurrency exchange Bithumb, and Daishin Securities. It also comes after the hacking of Binance, the world's largest crypto exchange, in which more than US$6 billion in cryptocurrency was stolen. The U.S. Federal Bureau of Investigation (FBI) has since attributed the theft to North Korea, which gives the incident a national security dimension beyond financial crime. Lee said cyber threats have grown severe enough to endanger the national economy, national security and the daily lives of ordinary citizens. He called for "a comprehensive prevention system" to address them. According to the president, hacking methods are becoming more sophisticated and widespread, driven partly by advances in artificial intelligence (AI). He said this trend is exposing clear limits in the systems currently used to maintain security.

A Possible "Czar Agency" Amid North Korea Threats

Lee's plans go further than a single task force. He stressed the need for talks on setting up a pan-government agency responsible for cybersecurity across both the public and private sectors. He specifically told officials to "proactively consider the formation of a cybersecurity czar agency" that could act as a strong and effective control tower for security management. The president also ordered officials to thoroughly fix security weaknesses at major state institutions and key national infrastructure, naming information communications, energy, and finance. Because hackers tied to North Korea have repeatedly targeted financial assets, the finance sector is a particularly pressing concern.

Social Media Limits for Teens Also on the Agenda

Cybersecurity was not the only digital issue raised at the meeting. Lee also called for quick discussions on the government's plan to restrict adolescents' use of social media. "The harmful effects (of social media on teenagers) appear to be greater than what we think," Lee said. The government is pursuing measures to limit social media sign-ups by young teens and to restrict their use of certain services, including algorithm-based ones. The goal is to shield adolescents from the harms of social media. Lee told Kim Jong-cheol, chairman of the Korea Media and Communications Commission, to "conduct relevant discussions thoroughly and promptly." He pointed to similar efforts already under way in Europe, Australia and Canada. Kim replied that the plan should be pursued on the basis of social consensus. He said the commission intends to gather public input and finalize the measures in the first half of next year. Officials will now weigh whether to form a cybersecurity task force and a broader czar agency. Their decisions will shape how South Korea responds to escalating digital threats, including attacks attributed to North Korea.

Firewall Daily – The Cyber Express
The Cyber Express Weekly Roundup: Binance Hit by $6.3 Billion Security Incident, South Korea Busts AI-Powered Hacking Ring and More Ashish Khaitan
This weekly roundup covers a $6.3 billion security incident at Binance, the arrest of a South Korean hacking ring that used generative AI to breach about 90 companies, Columbia University’s $16.1 million settlement over its 2025 data breach, a 70-month prison sentence for a Ukrainian ransomware affiliate tied to Nefilim and Hive, and Discord’s decision to let search engines index messages from its public servers. Two threads run through this week’s stories. First, attackers are getting more
30 de Outubro de 2026, 10:00

The Cyber Express Weekly Roundup: Binance Hit by $6.3 Billion Security Incident, South Korea Busts AI-Powered Hacking Ring and More

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

30 de Outubro de 2026, 10:00

weekly roundup October 30

This weekly roundup covers a $6.3 billion security incident at Binance, the arrest of a South Korean hacking ring that used generative AI to breach about 90 companies, Columbia University’s $16.1 million settlement over its 2025 data breach, a 70-month prison sentence for a Ukrainian ransomware affiliate tied to Nefilim and Hive, and Discord’s decision to let search engines index messages from its public servers. Two threads run through this week’s stories. First, attackers are getting more out of less: one compromised laptop put billions of dollars in crypto at risk, and AI tools let a small, self-taught crew scale its attacks to dozens of victims. Second, the fallout from a breach lasts far longer than the breach itself, as lawsuits, prison sentences, and bounties land years after the original attacks, while a simple default setting can create new exposure.

The Cyber Express Weekly Roundup

Binance Hit by $6.3 Billion Security Incident, Nearly $3 Billion Frozen

Binance says a security incident affected about $6.3 billion in crypto assets, making it one of the largest in the industry’s history. Close to $3 billion has already been frozen on-chain, including 1.567 billion USDT frozen by Tether and 800 million USDC frozen by Circle. Read more...

South Korean Police Bust AI-Powered Hacking Ring That Targeted 90 Companies

Seoul police have arrested seven people accused of using generative AI to hack about 90 companies and steal 8.2 million personal records, then demanding payment to keep the data private. The group’s 32-year-old ringleader, who taught himself to hack, used AI tools in roughly 60 of the attacks. Read more...

Columbia University Settles $16.1 Million Lawsuit Over 2025 Data Breach

Columbia University will pay $16.1 million to settle a class action over its June 2025 cyberattack. The breach exposed Social Security numbers, health information and financial aid data belonging to about 870,000 applicants and affiliates. An internal investigation concluded the attack was politically motivated, with the hacker looking for evidence of affirmative action in admissions, and found no sign that the data was sold. Read more...

Ukrainian Ransomware Affiliate Sentenced to 70 Months for Attacks on Hospitals and Businesses

Artem Stryzhak, 36, has been sentenced in the U.S. to 70 months in prison for his part in the Nefilim and Hive ransomware operations, which caused more than $100 million in losses. Working as an affiliate, he attacked companies, law firms and healthcare providers, including during the COVID-19 pandemic. Stryzhak was arrested in Spain in 2024, extradited in 2025, and pleaded guilty to two conspiracy counts. Read more...

Discord to Let Google Index Public Server Messages, Raising Privacy Concerns

Discord will allow search engines to index content from its Discoverable Servers, the more than 63,000 public communities with at least 1,000 members. Server web pages and discussion summaries go live on November 16, and individual messages follow from mid-December. Usernames and avatars will be hidden, and older messages are excluded. Read more...

Weekly Cybersecurity Takeaway

Several incidents this week show how far a single foothold can reach. At Binance, one engineer’s compromised laptop was enough to push through unauthorized withdrawals worth billions. In South Korea, generative AI helped a self-taught attacker run dozens of intrusions that would once have needed a larger, more skilled team. The other common thread is that the consequences of a breach outlast the breach. Columbia is paying $16.1 million more than a year after its attack, Stryzhak was sentenced years after the Nefilim and Hive campaigns, and the U.S. is still chasing his alleged partner with an $11 million bounty. Discord’s change is a reminder that exposure doesn’t always come from attackers: a default-on setting can make years of casual conversation searchable going forward. Organizations should treat the devices of privileged staff as high-value targets and require multi-party approval for sensitive actions such as large withdrawals. They should assume AI is lowering the cost of attacks and keep basic defenses tight, minimize how much sensitive data they keep and for how long, and review default privacy settings on the platforms their teams and communities use.

Firewall Daily – The Cyber Express
Binance Security Incident Affects $6.3 Billion in Crypto Assets, $3 Billion Frozen Ashish Khaitan
Binance, the world's largest cryptocurrency exchange, said on Thursday that a "security incident" on its platform affected roughly $6.3 billion worth of assets. It is one of the largest security events in the crypto industry so far, though the exchange said close to $3 billion of the affected funds had already been frozen on-chain. Stablecoin issuers moved quickly after the data breach at Binance. Tether said it had frozen more than 1.567 billion USDT linked to the incident, and Circle froze
30 de Outubro de 2026, 07:58

Binance Security Incident Affects $6.3 Billion in Crypto Assets, $3 Billion Frozen

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

30 de Outubro de 2026, 07:58

Binance Data Breach

Binance, the world's largest cryptocurrency exchange, said on Thursday that a "security incident" on its platform affected roughly $6.3 billion worth of assets. It is one of the largest security events in the crypto industry so far, though the exchange said close to $3 billion of the affected funds had already been frozen on-chain. Stablecoin issuers moved quickly after the data breach at Binance. Tether said it had frozen more than 1.567 billion USDT linked to the incident, and Circle froze 800 million USDC. The Arbitrum Security Council also reportedly executed a transaction to freeze about $30.5 million connected to the Binance exploit.

How the Binance Data Breach Happened

According to the exchange, early findings point to a compromised employee device. Initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," Binance said in an update. The statement, titled "Security Incident Update," was published on October 30, 2026, at 07:53. It said the company had found no evidence that any wallet private key was leaked. Binance added that it would release a detailed technical post-mortem once the investigation is complete and the facts are fully verified.

Who Will Cover the Losses

Binance said it will cover all losses from the cyberattack on Binance using its Secure Asset Fund for Users (SAFU) and the company's own funds. "User funds are safe," the exchange stated. It also said it had worked with blockchain partners to freeze the affected assets. Once remediation is complete, it plans to publish an updated Proof of Reserves.

Immediate Steps Following the Binance Data Breach

As an immediate precaution, the exchange said it has:

Temporarily suspended deposits and withdrawals while security checks are completed;
Revoked the affected address authorization;
Engaged law enforcement and blockchain intelligence partners to trace and recover the funds.

The company said its teams are working around the clock to resolve the issue. "We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice," Binance said. The exchange asked users to rely only on official Binance channels for updates and to contact Binance Customer Support with any further questions.

Withdrawals Expected to Resume Within 48 Hours

In a later update, Binance said it expects withdrawals to resume in 48 hours, after its team "completes a security revamp of the withdrawal service and its related addresses." Until then, users cannot move funds on or off the platform. Binance has not yet said how the attacker gained access to the engineer's laptop. The company has said those technical details will be in its upcoming post-mortem on the Binance data breach.

Firewall Daily – The Cyber Express
Three Cyberattack Campaigns Target Japan, Exposing AI’s Growing Role Ashish Khaitan
A wave of data leaks from Japanese web systems in autumn 2026 has sharpened concern over AI's role in cyberattacks on Japan. The National Cybersecurity Office alerted businesses on October 9, and the chair of the ruling party's cybersecurity headquarters said cyberspace was in a "state of emergency." Researchers reconstructed three attack infrastructures from files left in attackers' open directories. All three are separate from those in earlier reports on ARTEX, an autonomous AI penetration
29 de Outubro de 2026, 06:10

Three Cyberattack Campaigns Target Japan, Exposing AI’s Growing Role

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

29 de Outubro de 2026, 06:10

Cyberattacks on Japan

A wave of data leaks from Japanese web systems in autumn 2026 has sharpened concern over AI's role in cyberattacks on Japan. The National Cybersecurity Office alerted businesses on October 9, and the chair of the ruling party's cybersecurity headquarters said cyberspace was in a "state of emergency." Researchers reconstructed three attack infrastructures from files left in attackers' open directories. All three are separate from those in earlier reports on ARTEX, an autonomous AI penetration-testing system. AI's role varied widely. Without victim-side logs, the findings cannot confirm each attempt's success, the full damage, or the attackers' identities. Victims are described only by count, industry, size, and country.

Case A: Automated Cyberattacks on Japan

In a short burst in October 2026, Case A abused CyberStrikeAI, an open-source agent-based penetration-testing tool with a Simplified Chinese console. Entries like "credential-search agent 8/44" show 44 agents dividing up reconnaissance, exploitation, command and control, persistence, exfiltration, and reporting. The platform produced Japanese forms and fake login pages. It also throttled traffic to each target to avoid detection. At least 19 organizations received identical reports, including at least 16 in Japan and others in Taiwan and Hong Kong. Most were smaller businesses and local public bodies. Yet many entries read "no session, no web shell, no exfiltration." The deepest intrusion began at an unauthenticated administration interface on a legacy system.

Case B: Human-Led, AI-Assisted

Over about 24 days in August and September, a human operator used an LLM for planning and tooling. The operator scanned at least 6,000 Japanese IP addresses and also probed AI assets in South Korea. One LLM-written plan targeted AI and GPU services. To get it, the operator framed the request as an authorized assessment to bypass the model's guardrails. Other tools sought to hijack and pool access to other people's AI services, likely to get cheap inference capacity. One company suffered full control through FTP, a database, administrator rights, a web shell, and SSH, and the attacker repeatedly restored backdoors after cleanup. At another, a GIS server left on default credentials exposed several hundred thousand cadastral and commercial records, Windows credentials, and email. Several hundred attempts on one cluster failed.

Case C: Limited AI Role

From January to October, a seasoned operator ran at least six campaigns, several in parallel from September onward. They targeted at least 1,300 WebLogic candidates and 35 VPN entry points, mainly in Japan and South Korea. The target lists also included the UK, France, Italy, Qatar, and Colombia. Devices included Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, and Yamaha RTX1210. On the RTX1210, leftover credentials in configuration files opened direct access to corporate networks. Section headings such as echo '=== ... ===' in the command history and emoji status markers in scripts point, with high confidence, to AI-written tools. A skilled human mimicking that style cannot be excluded.

Lessons Beyond ARTEX

All three operations worked in Simplified Chinese and sorted results under names like jp_success, jp_attack, and jp_cve_attack. Each picked targets opportunistically, and most of their activity came before the ARTEX reports. Whether they share an operator is unconfirmed, and their language is only a weak clue to origin. AI increased scale, speed, localization, and reporting. It did not change the types of vulnerabilities exploited, the entry points, or how many targets were deeply compromised. The AI also logged planned steps as finished and overstated success. LLMs can also invent vulnerability IDs. These flaws can help with detection and honeypots. Defenders found the PHP2Shell flaws, disclosed in October 2026, through an AI-assisted audit, but no AI-found zero-day was exploited in these cases.

Defending Against Cyberattacks on Japan

Recommended steps:

Inventory public-facing systems and update or isolate legacy ones.
Remove exposed default credentials and admin interfaces.
Secure VPN and edge-device configurations against credential reuse.
Check internal AI and GPU services for exposure.
Monitor for low-frequency, distributed attempts.
Prepare for LLM misuse through requests built on false premises.

Fast patching and virtual patching matter more as the time between disclosure and exploitation shrinks. The attackers' identities, the AI models used, and the full damage remain unknown.

Firewall Daily – The Cyber Express
INJ3CTOR3 Malware Steals FreePBX Credentials, Enabling Toll Fraud After Cleanup Ashish Khaitan
The INJ3CTOR3 toll-fraud operation has given its FreePBX implant a dangerous new capability. Cyble Research & Intelligence Labs (CRIL) documented the JOMANGY PHP webshell in May. It has since analyzed artifacts collected from the operator’s staging servers on 9 September 2026 and found that the implant now sends victims’ SIP trunk, AMI, database, and mail-relay credentials off the server. As a result, wiping an infected host no longer ends the fraud. INJ3CTOR3 has targeted Asterisk-based
28 de Outubro de 2026, 04:25

INJ3CTOR3 Malware Steals FreePBX Credentials, Enabling Toll Fraud After Cleanup

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

28 de Outubro de 2026, 04:25

INJ3CTOR3

The INJ3CTOR3 toll-fraud operation has given its FreePBX implant a dangerous new capability. Cyble Research & Intelligence Labs (CRIL) documented the JOMANGY PHP webshell in May.

It has since analyzed artifacts collected from the operator’s staging servers on 9 September 2026 and found that the implant now sends victims’ SIP trunk, AMI, database, and mail-relay credentials off the server. As a result, wiping an infected host no longer ends the fraud.

INJ3CTOR3 has targeted Asterisk-based phone systems since at least 2020. That November, Check Point Research named the group for exploiting CVE-2019-19006 in FreePBX. Unit 42 linked it to attacks on Elastix in 2022, and Fortinet documented its EncystPHP webshell in January 2026.

How JOMANGY Now Exfiltrates FreePBX Secrets

INJ3CTOR3 attack chain, September generation. (Source: 0x1da5 GitHub)

The September version of the k.php script ends with two new base64-encoded lines. Each line holds 17 curl commands that upload configuration files from FreePBX, Issabel, and Elastix systems to /hima_data/index.php.

Cron beacons rerun k.php every minute, so the theft repeats constantly. If a victim changes passwords while the system is still infected, the new passwords leak within minutes. With a stolen trunk secret, attackers can register with the carrier from anywhere and place calls that never touch the victim’s PBX. The only exception is when the carrier limits the trunk to the victim’s IP addresses.

The “hima” name matches a backdoor account the malware creates. It also matches a Telegram user Check Point spotted in 2020 sharing a tool that scanned and cracked SIP ranges.

Plain-text commands now point to 160[.]119[.]69[.]4, while base64-encoded commands still reach 45[.]95[.]147[.]178. The credential upload targets both hosts. Both hosts stopped responding in late September. CRIL is urging law enforcement agencies and national CERTs to work with hosting providers to preserve the server data and sinkhole the addresses.

INJ3CTOR3 Rotates the Indicators Defenders Relied On

The core JOMANGY code is largely unchanged, but the identifiers defenders were told to hunt for have changed:

Watermark: The single April watermark (trace_e1ebf9066a951be519a24140711839ea) has been replaced by per-build values: trace_bd42a8a0d23ae16c85dede7d2abaec05 and trace_7544725ebaaadac217dfaa7ca8e8fe7e.
Gate hash: The MD5 gate hash shared by JOMANGY and ZenharR moved from a2f6863413c4192a4abfa360577b9961 to 8b3a1d970fda0c17a0b785a990fb7b6a.
Takeover script: The /x script grew from 367 to 620 lines, mostly to remove rival actors’ implants and SSH keys.

The panel can also forge a FreePBX admin session through the ampuser class and setAdmin(). This means changing the admin password does not lock the attacker out.

Hidden Doors in Compromised FreePBX Systems

The malware plants an .htaccess file in /var/www/html/admin/views/. It routes any request containing an encoded space or tab, such as %20 or %09, to config.php. Access logs record only the requested path, never the webshell’s filename, so searching logs for the shell by name can come up empty.

Lab trunk, known to Asterisk and carrying calls, invisible in the FreePBX console

Trunks written directly to /etc/asterisk files such as pjsip_custom.conf also stay invisible in the FreePBX console. Administrators should audit through Asterisk CLI commands such as pjsip show endpoints and compare the results with what the console lists.

Cleaning Up After INJ3CTOR3

Shadowserver counted more than 900 compromised FreePBX instances in February 2026, and over 700 were still infected in May. Sangoma’s patch for CVE-2025-57819 blocks new exploitation but does not clean systems that are already compromised.

CRIL recommends this order:

Isolate the host from the internet.
Preserve crontabs, logs, and the ampusers table.
Remove the cron entries and the zen2 watchdog.
Delete the eight crontab backups and the login stagers.
Remove extra UID-0 accounts and accounts with $1$nRz1Cbtk$ password hashes.
Delete the 12 webshell copies and the freepbxusers row.
Only then, rotate credentials across all 17 files.

CRIL’s report-only beagle.sh script can help with triage. Because the operator keeps rotating hashes and hosts, detection based on behavior and file origin will outlast hunting for specific hashes.

Firewall Daily – The Cyber Express
Discord to Let Google Index Public Server Messages, Raising Privacy Concerns Ashish Khaitan
Discord plans to let Google and other search engines index selected Discord Messages from Discoverable Servers, pushing parts of its public community conversations onto the open web. The company announced the change on October 27. Server Web Pages and discussion summaries arrive first, on November 16, 2026. Individual messages follow in mid-December rather than November, giving users and moderators time to check their privacy settings before anything becomes searchable. Discord says the
28 de Outubro de 2026, 03:40

Discord to Let Google Index Public Server Messages, Raising Privacy Concerns

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

28 de Outubro de 2026, 03:40

Discoverable Servers

Discord plans to let Google and other search engines index selected Discord Messages from Discoverable Servers, pushing parts of its public community conversations onto the open web. The company announced the change on October 27. Server Web Pages and discussion summaries arrive first, on November 16, 2026. Individual messages follow in mid-December rather than November, giving users and moderators time to check their privacy settings before anything becomes searchable. Discord says the goal is to make useful answers reachable without searching inside the platform first. It argues that knowledge in gaming guides, support discussions, and community forums often stays hard for outsiders to find.

Which Discord Messages From Discoverable Servers Qualify?

Only Discoverable Servers are affected. Anyone can find and join these communities without an invitation, and each must have at least 1,000 members, be eight weeks old and meet activity and safety rules. Discord puts the current total above 63,000. Private servers, direct messages, and group direct messages are excluded. From November 16, every Discoverable Server gets a Server Web Page. Where moderators haven't published one, Discord builds a default page from the Server Profile. Automated Channel Summaries covering discussions from that date onward may also appear the same day. Individual Channel Messages roll out gradually from mid-December, and only eligible messages sent from then on can appear. Older message histories won't be published through the feature. Usernames and avatars are hidden, and messages initially appear as text. Under Discord's member guidance, participating channels display an icon and a notice before users post. Public threads and forums can qualify, while private threads and private forums cannot.

Keeping Discord Messages Off Discoverable Servers' Web Pages

Users can open User Settings > Data & Privacy and disable "Show my message content from Discoverable channels on web pages." The account-wide switch covers every Discoverable Server a user belongs to. It can be changed in the desktop app or a browser and applies across devices, including mobile. The setting is on by default in most regions but off by default in the EU/EEA, UK, Canada, Brazil, Australia, and South Korea. Teen accounts are excluded and cannot enable it. Server and channel eligibility rules still apply where the setting is on. Switching it off only protects messages sent afterward. Posts made while it was enabled can still appear, even if they haven't reached a web page yet, so users must delete them to remove them from Discord's pages. Search engines may keep indexed or cached copies longer, requiring separate removal steps. This is a planned publishing feature, not a security breach, which sets it apart from Discord's earlier customer support data breach involving unauthorized access through a third-party provider.

Moderator Controls and Security Concerns

Moderators can manage participation through Server Settings > Web Presence, excluding selected channels or disabling channel participation entirely. Without changes, public channels stay enabled. User opt-outs don't disable Channel Summaries, which have separate admin controls. Communities unwilling to maintain a Server Web Page can leave Discovery and remain Community Servers. For security teams, the concern is wider exposure rather than a new flaw. Hiding usernames doesn't strip identifying details written inside Discord Messages, so public support channels deserve review before publication, particularly where members discuss workplace systems or share personal information. Search visibility also isn't proof of trust. Earlier reporting on expired Discord invite links used to spread malware showed attackers steering visitors into fake communities. Readers who find Discord answers through Google should check destinations and avoid running commands presented as account verification steps.

Firewall Daily – The Cyber Express
Columbia University Settles $16.1M Data Breach Lawsuit After 2025 Cyberattack Ashish Khaitan
An internal investigation into the June 2025 Columbia University cyberattack found no evidence that the stolen data was sold or distributed on the dark web, Columbia University Information Technology announced Friday. The probe, which largely concluded over the summer, determined the attack was politically motivated and found no sign the hacker sought financial gain. The University also said claims administrator Angeion Group LLC will contact affected individuals about submitting claims und
27 de Outubro de 2026, 05:49

Columbia University Settles $16.1M Data Breach Lawsuit After 2025 Cyberattack

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

27 de Outubro de 2026, 05:49

Columbia University cyberattack

An internal investigation into the June 2025 Columbia University cyberattack found no evidence that the stolen data was sold or distributed on the dark web, Columbia University Information Technology announced Friday. The probe, which largely concluded over the summer, determined the attack was politically motivated and found no sign the hacker sought financial gain. The University also said claims administrator Angeion Group LLC will contact affected individuals about submitting claims under Columbia's $16.1 million settlement over the breach.

The Motive Behind Cyberattack

In June 2025, the hacker told Bloomberg they were looking for evidence that Columbia still used affirmative action in admissions after the Supreme Court struck down the practice in 2023. The same hacker claimed responsibility for a March 2025 breach at New York University, where admissions data was posted to NYU's website. That data purported to show that Asian and white students admitted to NYU had higher average GPAs and test scores than admitted Black and Hispanic students. About a month after the cyberattack on Columbia University, the school agreed to share applicants' admissions data with President Donald Trump's administration. The move was part of a broader deal to restore federal funding that had been canceled over allegations of campus antisemitism. The hacker stole contact information, Social Security numbers, health data, and financial aid data belonging to around 870,000 Columbia applicants and affiliates. In September, the University agreed to pay $16.1 million to settle a class action lawsuit over the breach.

Settlement Terms for the Cyberattack on Columbia University

A federal court overseeing the settlement appointed Angeion Group, LLC, as claims administrator. The group has launched a website with settlement information and will send claim instructions to affected individuals. Columbia directed questions about the process to Angeion Group. Each plaintiff may claim two years of credit monitoring services and either an estimated $100 payment or up to $8,500 in reimbursement for documented losses. The court granted preliminary approval in September. Affected individuals have until Dec. 22 to submit objections, comments, or exclusions. An exclusion removes a person from the plaintiff group but preserves their right to take independent legal action against Columbia. Claims are due in late January, and a final approval hearing, where the court will review objections and decide whether the settlement is reasonable, is set for Feb. 23, 2027.

Security Upgrades After the Columbia University Cyberattack

In its Friday statement, Columbia said it took “proactive steps to strengthen our data security and governance practices” after the attack, adding that the settlement includes a commitment to further enhancing cybersecurity. The University worked with cybersecurity companies to recover its compromised systems. In June, it said it was removing Social Security numbers of nonaffiliates from its systems “subject to relevant legal restrictions.” A University official told Spectator that Columbia has since increased network segmentation, which divides networks into smaller sections to contain threats. The official said the school also deployed additional endpoint detection and response tools, which monitor systems in real time to flag unusual activity. “We regret the concern that this incident has caused our community and believe the actions we have taken and commitments we have accepted in the agreement reflect the seriousness with which we are approaching this matter,” the statement concludes.

Firewall Daily – The Cyber Express
GMO Internet Compensates Users as Cyberattacks Hit Japanese Companies Ashish Khaitan
Japanese companies are starting to compensate customers after a run of cyberattacks disrupted internet services and stirred concerns about economic stability. GMO Internet is the latest to do so, pledging payouts after hackers breached its foreign exchange trading service. In a blog post on Oct 25, chief executive Masatoshi Kumagai said customers would be compensated for losses caused by unauthorized access, and each would receive 5,000 yen (S$41) as “an initial gesture of good faith.” K
26 de Outubro de 2026, 07:36

GMO Internet Compensates Users as Cyberattacks Hit Japanese Companies

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

26 de Outubro de 2026, 07:36

GMO Internet

Japanese companies are starting to compensate customers after a run of cyberattacks disrupted internet services and stirred concerns about economic stability. GMO Internet is the latest to do so, pledging payouts after hackers breached its foreign exchange trading service. In a blog post on Oct 25, chief executive Masatoshi Kumagai said customers would be compensated for losses caused by unauthorized access, and each would receive 5,000 yen (S$41) as “an initial gesture of good faith.” Kumagai, whose group spans internet infrastructure and cryptocurrency trading, warned that “the internet itself is now starting to break down.” He added: “The internet is increasingly being transformed into a tool that malicious actors use to threaten and rob people.” GMO Internet shares, worth US$2.6 billion (S$3.3 billion) in market value at the Oct 23 close, fell 11% in Tokyo morning trade while the benchmark index was flat. The company said a party believed to be behind the attack had demanded money and threatened to disclose company and customer information. GMO Internet refused and said it would handle the incident with police and other authorities. It will give customers a free alternative service for six months, though it cannot yet calculate how the goodwill payments and compensation will affect earnings. Kumagai said the company’s white-hat hackers had identified security issues, but the depth and speed of the response were insufficient.

AI and PHP Flaws Put Japanese Companies at Risk

Experts say AI is helping attackers automate tasks from scanning for software vulnerabilities to crafting phishing campaigns, making cybercrime faster, cheaper and harder to detect. On Oct 23, Japan said it would set up a team to simulate cyberattacks using AI to find weaknesses in technology systems. Organisations were rushing to limit risks from flaws in PHP, the programming language underpinning much of the internet. Last week, government and company websites in Japan, Europe and elsewhere went offline after critical PHP vulnerabilities were disclosed, prompting millions of hacking attempts.

GMO Internet Chief Seeks Stronger Cyberdefence

Kumagai has asked the Japanese government to apply cyberdefence measures in response to the attack, following the introduction of a cyberdefence system in October. That system could involve steps such as attacking hostile servers to neutralise threats. “Now is the time for the public and private sectors to work together to protect Japan,” he wrote.

Rising Security Costs for Japanese Companies

The recent attacks have exposed weaknesses in how Japanese companies protect their large stores of customer data, raising the prospect of steep costs to shore up defences. “Companies already have standard security measures in place, so if they want to strengthen them further, there is a possibility that the additional cost burden could be quite substantial,” said Shoichi Arisawa, an analyst at IwaiCosmo Securities. TrendAI data shows 723 cybersecurity incidents in the year to Oct 20, more than the annual totals for 2025 and 2024. Satoshi Nagano, president of ESET Japan, said: “Reports may reflect both the threats organisations face and greater visibility into incidents that would previously have gone undetected, been underinvestigated, or remained undisclosed.” GMO Internet is not alone in paying customers. Park24, which runs the Times car-sharing service, said on Oct 23 it would pay customers 3,000 yen each after a personal data breach. It will stop keeping identity document images once registration checks are done and expects an extraordinary loss of 5.5 billion yen from its response to the attack and compensation payments.

Firewall Daily – The Cyber Express
South Korea Police Dismantle AI-Driven Cybercrime Ring That Hit 90 Companies Ashish Khaitan
Police in South Korea have broken up a cybercrime ring accused of using generative AI to hack about 90 domestic companies, steal roughly 8.2 million personal records, and demand money in exchange for silence. Investigators believe the group's leader, who never studied IT, used AI to rapidly expand the range of targets. Seven Suspects Tied to the Cybercrime Ring On the 26th, the Cyber Investigation Division of the Seoul Metropolitan Police Agency said it had apprehended seven people, includin
26 de Outubro de 2026, 06:21

South Korea Police Dismantle AI-Driven Cybercrime Ring That Hit 90 Companies

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

26 de Outubro de 2026, 06:21

cybercrime ring

Police in South Korea have broken up a cybercrime ring accused of using generative AI to hack about 90 domestic companies, steal roughly 8.2 million personal records, and demand money in exchange for silence. Investigators believe the group's leader, who never studied IT, used AI to rapidly expand the range of targets.

Seven Suspects Tied to the Cybercrime Ring

On the 26th, the Cyber Investigation Division of the Seoul Metropolitan Police Agency said it had apprehended seven people, including the 32-year-old ringleader, identified as A, on suspicion of extortion and violating the Information and Communications Network Act. A has been detained, while the other six are being investigated without detention. The group allegedly broke into the systems of around 90 companies from September last year through this month, taking personal information and internal data. Victims included private academies, hospitals, golf courses and affiliates of major conglomerates. The suspects reportedly warned, "If you don't pay, we'll leak the information," and pointed to the reputational harm, surcharges and damages lawsuits a public breach could bring as extra pressure.

How AI Widened the Attacks Across South Korea

A is believed to have learned hacking through blogs and other sources and worked in penetration testing at a cybersecurity company from 2019 to 2022. Early on, A used automated tools to find website vulnerabilities, but from August this year expanded the attacks using generative AI and an AI-powered autonomous penetration system. Police believe about 60 of the roughly 90 victim companies were hacked with AI's help. Digital forensic evidence, A's statements, and other materials pointed to about 8.2 million stolen records. The cybercrime ring demanded a total of 360 million won from 38 companies, but swift arrests limited its takings to just 300,000 won. Police are also examining whether other companies paid quietly or never reported the threats.

Tracking Down the Cybercrime Ring

The investigation began after one victim company filed a report in June. As similar cases surfaced nationwide, police consolidated them in August. From July to September, officers arrested five accomplices involved in the threats one after another, and early this month caught another who had directed the crimes via Telegram. Police searched A's residence in Yeoksam-dong, Gangnam-gu, Seoul, on the 13th, inspecting the generative AI running on a computer used in the crimes. After tracing access logs from victim companies and other records, they arrested A on the 15th and seized computers, hacking tools and accounts used to send threats. On the 23rd, A was sent to prosecutors in custody on suspicion of stealing about 900,000 records from 15 companies that had filed reports. Police plan to investigate allegations involving the roughly 75 remaining companies that have yet to report.

A First for South Korea

Police called it the first case in South Korea in which suspects were caught running a large-scale hacking and data theft operation that exploited generative AI. They said it shows the barriers to cybercrime are falling, as individuals, not just professional hacker groups, can now use AI to attack multiple companies in a short time. Authorities will keep identifying additional victims and accomplices while tracing the proceeds of the crimes.

Firewall Daily – The Cyber Express
The Cyber Express Weekly Roundup: PHP2Shell Knocks Wikipedia Offline, ASD Retires the Essential Eight and More Ashish Khaitan
A decade-old flaw in the language behind much of the web, found by AI and serious enough to take Wikipedia offline. Driving licenses sold for AED 10,000 to people who never sat for a test. A police sweep across 21 African countries that ended in more than 1,400 arrests. This weekly roundup covers stories where the weak point was not always a firewall, but the trust built into code libraries, license agreements, and the frameworks organizations use to measure their own security. Here are the st
23 de Outubro de 2026, 08:40

The Cyber Express Weekly Roundup: PHP2Shell Knocks Wikipedia Offline, ASD Retires the Essential Eight and More

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

23 de Outubro de 2026, 08:40

weekly roundup October 23

A decade-old flaw in the language behind much of the web, found by AI and serious enough to take Wikipedia offline. Driving licenses sold for AED 10,000 to people who never sat for a test. A police sweep across 21 African countries that ended in more than 1,400 arrests.

This weekly roundup covers stories where the weak point was not always a firewall, but the trust built into code libraries, license agreements, and the frameworks organizations use to measure their own security.

Here are the stories that shaped the week.

The Cyber Express Weekly Roundup

PHP2Shell Flaws Knock Wikipedia and Government Sites Offline

Two critical vulnerabilities in PHP, the scripting language that powers a large share of the web, have triggered urgent patching warnings from agencies around the world. Dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have already been linked to outages at Wikipedia and a number of government websites. Read more…

INTERPOL’s Operation Serengeti III Nets 1,462 Arrests Across Africa

An INTERPOL-coordinated crackdown spanning 21 countries has ended in 1,462 arrests. Operation Serengeti III ran from June to August 2026 and targeted fraud, ransomware, business email compromise and online scams. Investigators disrupted 10,909 malicious networks and recovered more than USD 105 million. The operation also identified nearly 66,000 victims, linked to combined losses of more than USD 385 million. Read more…

ASD Essentials Replaces the Essential Eight

The Australian Signals Directorate has launched ASD Essentials, a broader successor to the Essential Eight, the security baseline Australian organizations have long been measured against. Where the Essential Eight centered on a fixed set of mitigation strategies, the new framework extends its scope to enterprise IT, operational technology and cloud environments. Read more…

Dubai Police Bust AED 10,000 Fake Driving License Scheme

Dubai Police have arrested an eight-member gang that sold driving licenses for AED 10,000 each. Customers received licenses issued in a neighboring country without ever travelling there, taking a lesson or sitting a test. The gang then helped buyers convert those licenses into UAE licenses by exploiting legitimate license exchange agreements between the two countries. Read more…

Fintechs Urged to Treat Software Supply Chain Security as Enterprise Risk

Fintech firms vet their commercial vendors closely, but the open-source libraries, container images and third-party components inside their systems often arrive with far less scrutiny. That mismatch leaves a blind spot in how financial technology companies manage risk. Vijendra Katiyar of CleanStart points to examples such as a widely used Redis image that carried 185 known CVEs, and the Shai-Hulud worm, which spread through malicious npm packages. Read more…

Conclusion

Taken together, this week’s stories show how much of today’s risk comes from what organizations already trust: decade-old code, inherited software components, official exchange agreements and security checklists that measure effort rather than results. Follow The Cyber Express for next week’s weekly cybersecurity roundup and ongoing coverage of these stories.

Verify you are human

Checking your browser before accessing this site.

Click to verify →

Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

Verify you are human

Checking your browser before accessing this site.

Click to verify →

Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

Firewall Daily – The Cyber Express
INTERPOL’s Operation Serengeti III Disrupts 10,909 Malicious Networks Ashish Khaitan
A cybercrime crackdown spanning 21 countries has led to 1,462 arrests, the disruption of 10,909 malicious networks and the recovery of more than USD 105 million in illicit funds, making Operation Serengeti III one of the largest cybercrime enforcement operations Africa has seen. Coordinated by INTERPOL between 29 June and 31 August 2026, the operation targeted cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion. Authorities identified 65,929 vict
23 de Outubro de 2026, 06:59

INTERPOL’s Operation Serengeti III Disrupts 10,909 Malicious Networks

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

23 de Outubro de 2026, 06:59

Operation Serengeti III

A cybercrime crackdown spanning 21 countries has led to 1,462 arrests, the disruption of 10,909 malicious networks and the recovery of more than USD 105 million in illicit funds, making Operation Serengeti III one of the largest cybercrime enforcement operations Africa has seen.

Coordinated by INTERPOL between 29 June and 31 August 2026, the operation targeted cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion. Authorities identified 65,929 victims of cybercriminal networks, while financial investigations linked the activity to losses exceeding USD 385 million.

Cybercrime Crackdown Amid a Shifting Threat Landscape

The operation comes as INTERPOL’s African Cyber Threat Assessment Report 2026 describes a rapidly evolving environment, with artificial intelligence increasingly enabling cybercrime across the continent and cyber-enabled financial losses still rising.

Ahead of Operation Serengeti III, investigators from 20 African countries and the United States received actionable intelligence on suspicious domains, IP addresses and command-and-control infrastructure tied to criminal activity. Private-sector partners supplied intelligence, technical analysis and operational expertise, helping authorities identify targets, map criminal networks and support investigations across the region.

INTERPOL’s Director of Cybercrime, Neal Jetton, said:

“Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale.

“Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm.”

Operation Serengeti III: Key Results Across Africa

In Uganda, authorities dismantled two transnational fraud rings and arrested 365 foreign nationals tied to online investment and pension fraud schemes targeting victims in Asia. A suspected scam call centre ran on a rotating model, using scripted communications, fake trading platforms and fraudulent websites to lure pensioners into non-existent investments.

In Angola, investigators shut down two illegal cryptocurrency mining centres, arrested nine suspects and seized more than 2,000 mining devices along with six illegal power transformation stations. The electrical infrastructure alone was valued at over USD 1 million.

In Nigeria, police arrested a suspect behind a large-scale phishing and BEC operation that harvested software credentials and amassed roughly 2.1 million email addresses, and recovered a luxury vehicle believed to have been bought with criminal proceeds. A separate Nigerian probe into an international investment fraud scheme promoted via messaging apps led to another arrest, with more than USD 2.4 million in suspected proceeds traced, much of it laundered through cryptocurrency.

Elsewhere, authorities dismantled a malicious mobile loan application scheme in Tanzania, disrupted a social media-based vehicle import fraud network in Gabon and arrested 30 suspects linked to a cybercrime operation in the Republic of Congo.

What Comes Next in the Cybercrime Crackdown

Several investigations stemming from Operation Serengeti III remain active, as authorities work to identify more suspects, trace illicit proceeds and analyse seized digital evidence.

Supporting partners included Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security, Cybercrime Atlas, Meta, the Global Anti-Scam Alliance and the Postal and Telecommunications Regulatory Authority of Zimbabwe. The operation was co-funded by the Global Action on Cybercrime Enhanced (GLACY-e) project, a joint initiative of the European Union and the Council of Europe.

Participating countries were Angola, Benin, Cameroon, Congo, Côte d’Ivoire, Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, the United States, Zambia and Zimbabwe.

Verify you are human

Checking your browser before accessing this site.

Click to verify →

Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

Verify you are human

Checking your browser before accessing this site.

Click to verify →

Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

Firewall Daily – The Cyber Express
Japan AI Cyberattack Simulations Planned as PHP Flaws Disrupt Services Ashish Khaitan
Japan is preparing to set up a dedicated team to run AI-driven cyberattack simulations to expose weaknesses in technology systems. Japan’s plan for AI cyberattack simulations comes as organizations worldwide scramble to address critical PHP flaws that have disrupted parts of the internet. Speaking on Friday, Industry Minister Ryosei Akazawa said those defending against cyber threats need to think like attackers, using AI proactively to uncover potential weak points before they can be exploited.
23 de Outubro de 2026, 04:19

Japan AI Cyberattack Simulations Planned as PHP Flaws Disrupt Services

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

23 de Outubro de 2026, 04:19

AI cyberattack simulations

Japan is preparing to set up a dedicated team to run AI-driven cyberattack simulations to expose weaknesses in technology systems. Japan’s plan for AI cyberattack simulations comes as organizations worldwide scramble to address critical PHP flaws that have disrupted parts of the internet.

Speaking on Friday, Industry Minister Ryosei Akazawa said those defending against cyber threats need to think like attackers, using AI proactively to uncover potential weak points before they can be exploited.

His comments follow widespread disruption caused by the disclosure of the PHP flaws, which led to millions of reported hacking attempts. Businesses and governments were forced to patch their systems or temporarily take websites offline.

Because PHP is widely used to build and run websites and web applications, any weakness in the language poses a risk to organizations across many sectors.

How PHP Flaws Hit Banks, Airlines and Government

The vulnerabilities triggered precautionary shutdowns across banking, transport, airline and government services in several countries.

In Japan, Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway temporarily halted some online services. The Ministry of Finance, the National Tax Agency and the Meteorological Agency also suspended certain digital services as part of their security response.

On Friday, JR East said some of its services were back online, while others would resume only after safety checks. Nippon Paint said it had applied a security patch and restored its website.

The disruption shows how difficult it is to secure interconnected digital infrastructure when a widely used software component turns out to have serious weaknesses.

SoftBank Pauses Emergency Alerts Over PHP Flaws

The fallout also reached services people rely on in a crisis. Telecommunications company SoftBank said it was temporarily suspending its mobile emergency alert system while it carried out maintenance to fix a PHP vulnerability.

While the system is down, customers will not receive early warnings through it for earthquakes, tsunami threats, disasters, or evacuation information. The case shows that cybersecurity incidents can extend well beyond ordinary websites and interrupt access to vital public safety information.

Why Japan AI Cyberattack Simulations Point to Proactive Defense

The episode has put a fresh focus on finding vulnerabilities before attackers do. The Japan AI cyberattack simulations are designed to help defenders understand how weaknesses might be targeted and to sharpen their response capabilities, in line with the approach Ryosei Akazawa outlined.

Simulation alone is not enough, however. Installing patches remains essential, and organizations need to test updated systems carefully before bringing services back, especially where transport, finance, and government operations are affected.

As AI tools grow more capable for both attackers and defenders, businesses and governments face the task of pairing fast vulnerability detection with effective security updates, continuous monitoring, and resilient digital infrastructure.

Verify you are human

Checking your browser before accessing this site.

Click to verify →

Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

Verify you are human

Checking your browser before accessing this site.

Click to verify →

Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

Firewall Daily – The Cyber Express
Yonsei University Cyberattack Hits 10,000 Students, Months After Sogang Breach Ashish Khaitan
A Yonsei University cyberattack has compromised the personal information of roughly 10,000 students and graduates after outsiders gained unauthorized access to the school’s online portal. The breach comes months after Sogang University disclosed a far larger leak. The university’s Office of Information and Communications confirmed the breach in a notice sent to affected individuals on Thursday. “The personal information of some university members was confirmed to have been leaked following unaut
22 de Outubro de 2026, 04:29

Yonsei University Cyberattack Hits 10,000 Students, Months After Sogang Breach

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

22 de Outubro de 2026, 04:29

Yonsei University cyberattack

A Yonsei University cyberattack has compromised the personal information of roughly 10,000 students and graduates after outsiders gained unauthorized access to the school’s online portal. The breach comes months after Sogang University disclosed a far larger leak.

The university’s Office of Information and Communications confirmed the breach in a notice sent to affected individuals on Thursday. “The personal information of some university members was confirmed to have been leaked following unauthorized external access to the Yonsei Portal Service,” the office stated.

What the Yonsei University Cyberattack Exposed

The compromised data included student identification numbers, mobile phone numbers, and email addresses, along with system management details such as login identification keys and the number of failed password attempts on affected accounts. Resident registration numbers were not exposed.

From 1 p.m. Thursday, affected individuals could check on Yonsei University’s official website which details were compromised.

Two Hacking Attempts in Less Than a Day

The cyberattack on Yonsei University reportedly began at around 7:41 p.m. on Tuesday.

“An attack on the university’s system was detected at the time, and we immediately blocked the IP [internet provider] address,” a university representative told the JoongAng Ilbo. “While we were analyzing the cause at around 10 a.m. the following day, a second hacking attempt was made from a different IP address, which we also blocked.”

Yonsei reported the incident to the Personal Information Protection Commission (PIPC) on Wednesday afternoon. The Personal Information Protection Act requires organizations to report a personal data breach within 72 hours of becoming aware of it and to notify affected individuals.

“We plan to gather additional evidence related to the hacking attacks and refer the case to investigative authorities,” the representative said.

The university also plans a comprehensive security review of its systems, along with stronger monitoring and security measures. It urged students and graduates to be wary of text messages, phone calls, and emails claiming to be from the university, and to avoid clicking links from unknown sources or entering personal information on suspicious websites.

Sogang University and a Wider Pattern of Breaches

The cyberattack on Yonsei University follows a series of attacks on higher education institutions. On Aug. 14, Sogang University suffered an external cyberattack that exposed approximately 180,000 records containing personal information of students, graduates, and university staff, according to a notice posted on the Sogang University website.

The problem goes beyond recent cases. According to data the Ministry of Education submitted to People Power Party Rep. Kim Meen-geon, personal data breaches at universities affected 2.8 million people between 2022 and July this year.

Calls for Support After Yonsei and Sogang University Incidents

Experts have called for more cybersecurity personnel and greater funding as hacking attacks grow increasingly sophisticated, including through the use of AI.

“Just as the government develops information security measures for small- and medium-sized businesses, it should establish support measures to strengthen cybersecurity at universities,” said Kim Seung-joo, a professor at Korea University’s School of Cybersecurity. “Support appears particularly necessary for private universities that lack sufficient funding for cybersecurity.”

Verify you are human

Checking your browser before accessing this site.

Click to verify →

Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

Firewall Daily – The Cyber Express
PHP2Shell Patch Rush Takes Wikipedia, Govt Sites Offline Ashish Khaitan
Governments and cyber-security agencies worldwide are urging website operators to patch PHP2Shell, two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. Found with AI, the bugs enable remote code execution and Heartbleed-style memory disclosure. A fix arrived on Wednesday afternoon. Several agencies told organizations unable to patch in time to consider pulling their sites. Finland temporarily shut its government’s public web services. In the Netherlands, the cyber-security age
22 de Outubro de 2026, 03:54

PHP2Shell Patch Rush Takes Wikipedia, Govt Sites Offline

Firewall Daily – The Cyber Express

Por:Ashish Khaitan

22 de Outubro de 2026, 03:54

CVE-2026-109618

Governments and cyber-security agencies worldwide are urging website operators to patch PHP2Shell, two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. Found with AI, the bugs enable remote code execution and Heartbleed-style memory disclosure. A fix arrived on Wednesday afternoon.

Several agencies told organizations unable to patch in time to consider pulling their sites. Finland temporarily shut its government’s public web services. In the Netherlands, the cyber-security agency, the National Institute for Public Health and the Environment, and the Tweede Kamer, parliament’s lower house, all went offline.

The US National Security Agency echoed this on X: “These vulnerabilities often provide a direct path to the server’s file system or database.” The White House said federal agencies were working with leading AI labs to speed up a fix, while Japan’s Prime Minister Sanae Takaichi urged people on X to check whether their public websites ran on PHP.

“We have taken down a number of other systems as a precautionary measure until they can be safely patched,” the Wikimedia Foundation said, leaving parts of Wikipedia unreachable on Wednesday. Edinburgh council’s website and pages for BBC programmes, including Doctor Who and The Traitors, also went dark, though neither has confirmed a PHP link. DeviantArt said only that it was “temporarily down for maintenance.”

How AI found CVE-2026-109618 and CVE-2026-109619

Researchers at Calif and Wiz uncovered the flaws. Calif and the PHP Foundation were part of OpenAI’s Patch the Planet program, which offered AI tools to find and fix PHP flaws. Wiz called them the “most severe vulnerabilities ever discovered” by AI. OpenAI described them as “one of the most impactful security issues in recent memory,” adding that its own researcher spotted the issue around the same time.

The bugs sat undetected for over a decade before surfacing August, after a few weeks of AI-assisted work. “Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours,” Wiz said. It estimates “roughly 70%” of the internet is affected; a figure not independently verified.

The PHP Foundation planned to disclose PHP2Shell later this month with a full patch, but details leaked on social media on Tuesday, forcing a rushed announcement.

Early PHP2Shell Attacks Emerging

The UK’s National Cyber Security Centre (NCSC) and its EU and Australian counterparts urged PHP users to apply the fixes. “Where immediate remediation is not feasible, organizations should consider taking the system offline until it can be fully mitigated,” the NCSC said. Japan’s national cyber-security office and EU officials issued similar warnings.

“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” said security firm Huntress.

Affected versions remain unclear, though CERT-EU said CVE-2026-109618 and CVE-2026-109619 could reach back to PHP 5, launched in 2004. The update covers only the latest versions; users on PHP 8.1 or older should upgrade. Built for web development, PHP runs server-side on a large share, though not all, of the internet.

Verify you are human

Checking your browser before accessing this site.

Click to verify →

Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

Visualização normal

The Cyber Express Weekly Roundup

FBI Blames North Korea for $6B Binance Hack

Hackers Heat Supermarket Freezers Across Europe

Hackers Target WordPress Flaw Days After Patch

Europol Busts Supplier of Fake Trading Platforms

Freezer Hackers Hit France's Blood Supply

Stockal Confirms Unauthorized Trades in 13 Accounts

Weekly Cybersecurity Takeaway

No Breach of Borderless Systems Found

Support for Customers Hit by the Stockal Cyberattack

New Safeguards After the Stockal Cyberattack

Cooperation With Authorities

How the OpenSSH Server Flaw Works

Which Alpine Linux Servers Are Affected

Patching the OpenSSH Server

Cloud Images and Spotting Attacks on Alpine Linux Servers

What Singapore Airlines Disclosed About the Amadeus Cybersecurity Incident

Cathay Pacific: 53,000 Bookings Accessed Over Three Years

Malaysia Airlines Urges Vigilance

Japanese and Korean Carriers Report Similar Airline Cyberattacks

How Amadeus Explains the Breach

The Full Reach of These Cyberattacks on Airlines

Major carriers with confirmed exposure

Regional and subsidiary carriers

Under investigation

What the Amadeus Cybersecurity Incident Means for Travelers?

Timeline of the UTA cyberattack

What the University of Texas Is Asking Students and Employees to Do

What WordPress 7.1.4 Fixes Beyond the WordPress Vulnerability

How the Vulnerability in WordPress Works

Which Sites the WordPress Vulnerability Affects

How Attackers Are Targeting the Vulnerability in WordPress

How Serious Is This WordPress Vulnerability?

What Comes Next for This Vulnerability in WordPress

Cybersecurity Task Force and North Korea's Binance Heist

A Possible "Czar Agency" Amid North Korea Threats

Social Media Limits for Teens Also on the Agenda

The Cyber Express Weekly Roundup

Binance Hit by $6.3 Billion Security Incident, Nearly $3 Billion Frozen

South Korean Police Bust AI-Powered Hacking Ring That Targeted 90 Companies

Columbia University Settles $16.1 Million Lawsuit Over 2025 Data Breach

Ukrainian Ransomware Affiliate Sentenced to 70 Months for Attacks on Hospitals and Businesses

Discord to Let Google Index Public Server Messages, Raising Privacy Concerns

Weekly Cybersecurity Takeaway

How the Binance Data Breach Happened

Who Will Cover the Losses

Immediate Steps Following the Binance Data Breach

Withdrawals Expected to Resume Within 48 Hours

Case A: Automated Cyberattacks on Japan

Case B: Human-Led, AI-Assisted

Case C: Limited AI Role

Lessons Beyond ARTEX

Defending Against Cyberattacks on Japan

How JOMANGY Now Exfiltrates FreePBX Secrets

INJ3CTOR3 Rotates the Indicators Defenders Relied On

Hidden Doors in Compromised FreePBX Systems

Cleaning Up After INJ3CTOR3

Which Discord Messages From Discoverable Servers Qualify?

Keeping Discord Messages Off Discoverable Servers' Web Pages

Moderator Controls and Security Concerns

The Motive Behind Cyberattack

Settlement Terms for the Cyberattack on Columbia University

Security Upgrades After the Columbia University Cyberattack

AI and PHP Flaws Put Japanese Companies at Risk

GMO Internet Chief Seeks Stronger Cyberdefence

Rising Security Costs for Japanese Companies

Seven Suspects Tied to the Cybercrime Ring

How AI Widened the Attacks Across South Korea

Tracking Down the Cybercrime Ring

A First for South Korea

The Cyber Express Weekly Roundup

PHP2Shell Flaws Knock Wikipedia and Government Sites Offline

INTERPOL’s Operation Serengeti III Nets 1,462 Arrests Across Africa

ASD Essentials Replaces the Essential Eight

Dubai Police Bust AED 10,000 Fake Driving License Scheme

Fintechs Urged to Treat Software Supply Chain Security as Enterprise Risk

Conclusion

Cybercrime Crackdown Amid a Shifting Threat Landscape

Operation Serengeti III: Key Results Across Africa