October 28, 2026

What happened

Kroll’s Data Breach Outlook 2026 reports that nearly seven in ten people affected by data breaches handled by Kroll were exposed through an outside supplier. [1]

Why it matters

Businesses use outside providers to store information, process transactions and operate software, so a provider breach can expose customer records across multiple organizations. [2] [3]

The affected people may include individuals who have never heard of the company holding their data. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Nearly seven in ten people affected by data breaches handled by Kroll were exposed through an outside supplier, according to its Data Breach Outlook 2026.

2. [2]

   Businesses rely on outside providers to store information, process transactions and operate software.

3. [3]

   A breach at one of those providers can expose customer records across multiple organizations, including people who have never heard of the company holding their data.

Read the original article →

What happened

NIST released a roadmap for transitioning to post-quantum cryptography, including earlier deadlines for certain sensitive federal systems. [1]

NIST IR 8547 explains which cryptographic methods need replacement, what organizations should consider, and how the transition will unfold. [2]

Why it matters

The roadmap builds on post-quantum cryptography standards that NIST released in August 2024. [3]

The article characterizes the standards as providing new ways to protect information against quantum-related threats, but the supplied text is truncated before specifying those threats. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The National Institute of Standards and Technology (NIST) has released a roadmap for moving to post-quantum cryptography (PQC), with earlier deadlines for certain sensitive federal systems.

2. [2]

   The report, Transition to Post-Quantum Cryptography Standards (NIST IR 8547), explains which cryptographic methods need to be replaced, what organizations should consider and how the transition will unfold.

3. [3]

   It builds on the post-quantum cryptography standards NIST released in August 2024.

4. [4]

   Those standards provide new ways to protect information against … More → The post NIST starts the countdown to retire quantum-vulnerable encryption appeared first on Help Net Security .

Read the original article →

What happened

AbuseBox is a free, open-source tool that checks IP addresses and domains against 60 DNS blacklists, retrieves AbuseIPDB reputation scores, inspects DNS, SSL, and email-authentication records, and alerts when something changes. [1]

The dashboard consolidates blacklist listings, expiring certificates and domains, and servers that are down into a list of items needing attention. [2]

Why it matters

DNS blacklists are consulted by mail servers and other services when deciding whether to trust an address. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   AbuseBox is a free, open-source tool that checks IP addresses and domains against 60 DNS blacklists, pulls reputation scores from AbuseIPDB, inspects DNS, SSL and email-authentication records, and sends an alert when something changes.

2. [2]

   The dashboard keeps one list of what needs attention: blacklist listings, expiring certificates and domains, servers that are down, … More → The post AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records appeared first on Help Net Security .

3. [3]

   A DNS blacklist, or DNSBL, is a list that mail servers and other services consult when deciding whether to trust an address.

Read the original article →

What happened

Researchers reported that ShinyHunters has exploited an Oracle PeopleSoft bug since May and that the issue consists of three chained flaws. [1]

Oracle patched all three flaws under CVE-2026-35273 in June. [2]

The chain begins with server-side request forgery reaching an internal management interface because PeopleSoft trusts its own loopback address. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week.

2. [2]

   Oracle patched all three under a single identifier, CVE-2026-35273, in June.

3. [3]

   Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address

Read the original article →

What happened

GMO Internet Group is offering up to $1 million total for information that helps identify attackers who breached its Onamae.com Desktop Cloud service; the company refused to pay an extortion demand. [1]

Onamae.com Desktop Cloud hosts Windows desktops used for foreign-exchange trading. [2]

The reward program opened on October 28 and pays only when a tip helps lead to an arrest or an international wanted notice. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand.

2. [2]

   The service hosts Windows desktops used for FX trading,

3. [3]

   The reward program opened on October 28 and pays only if a tip helps lead to an arrest or an international wanted notice.

Read the original article →

What happened

The U.S. Department of Justice announced the seizure of a domain associated with Virtualine, a bulletproof hosting provider. [1] [2]

The seizure was described as a response to the service being used to commit and facilitate criminal activity, including advertising sexually explicit images of minors and intentionally disclosing nonconsensual intimate visual depictions. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The U.S.

2. [2]

   Department of Justice (DoJ) on Tuesday announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine.

3. [3]

   The move was in response to the service being used to commit and facilitate prolific criminal activity, including "the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate visual depictions

Read the original article →

What happened

Adobe released patches for eight critical security flaws in Campaign Classic; successful exploitation could result in arbitrary code execution, security feature bypass, or privilege escalation. [1]

CVE-2026-104351 has a CVSS score of 9.9 and is a code-injection vulnerability that could lead to arbitrary code execution. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation.

2. [2]

   The list of eight vulnerabilities is as follows - CVE-2026-104351 (CVSS score: 9.9) - A code injection vulnerability that could lead to arbitrary code execution.

Read the original article →

What happened

CVE-2026-97631 is a CVSS 9.5 vulnerability in TianoCore EDK II, used by hardware manufacturers, cloud providers and major UEFI vendors including AMI, Insyde and Phoenix. [1] [2] [3] [4]

The flaw is a buffer overflow in the PXE-Base Code driver, which handles network booting and ICMP errors without enforcing a 504-byte copy limit. [5] [6] [7] [8] [9]

During PXE boot over IPv4 or IPv6, an unauthenticated attacker able to deliver ICMP errors can corrupt DXE-phase memory and execute arbitrary code before the operating system, Secure Boot or measured boot verification. [10]

Affected systems include some EDK II-based devices with PXE enabled; systems that boot only from disk, including home and small-office systems described by the source, are not affected. [18] [19]

Why it matters

Successful exploitation could provide ring-0 execution, bypass attestation, and help turn limited network access into full control; invalid input can also stop booting and cause denial of service. [11] [12] [13] [14]

The attacker needs control of the local network, such as through an insider position or an existing network foothold; the source reports no evidence that the flaw provides initial external network access. [15] [16] [17]

Source-supported guidance

The source recommends contacting the system or firmware supplier, disabling network boot where possible, and monitoring logs for suspicious activity. [20] [21]

Known limitations

The source says the affected device population remains unclear, some companies had not responded, and firmware updates across many devices could take a long time. [22] [23] [24]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   CVE-2026-97631: A 16-year-old UEFI flaw (CVSS score of 9.5/10) enables pre-OS code execution.

2. [2]

   A critical flaw, tracked as CVE-2026-97631 (CVSS score of 9.5), in the firmware that boots most of the world’s servers is now public, and the patch details came out months early.

3. [3]

   The bug affects TianoCore EDK II, an open-source project used by hardware manufacturers and cloud providers to build UEFI firmware.

4. [4]

   EDK II is widely used across the industry, including by major UEFI vendors such as AMI, Insyde and Phoenix.

5. [5]

   The flaw is a 16-year-old buffer overflow in the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe).

6. [6]

   That driver lets servers, storage gear and other devices boot from code downloaded over a local network.

7. [7]

   While it does that, it listens for ICMP errors, and it never enforces the 504-byte limit on how much it copies.

8. [8]

   The driver keeps a receive request open for ICMP errors and copies each message into a fixed 504-byte field called Mode.IcmpError.

9. [9]

   So an oversized message writes attacker-controlled bytes past the field, and nothing earlier on the receive path limits its size.

10. [10]

    “While a machine is PXE-booting over IPv4 or IPv6, an unauthenticated network attacker who can deliver ICMP error messages to it can corrupt DXE-phase memory and execute arbitrary code before the operating system loads, before Secure Boot or measured boot has verified or measured any OS component.” states the advisory .

11. [11]

    Sending invalid data can stop the boot process and cause a denial of service.

12. [12]

    If the attacker knows the target’s firmware version, they can create a fake event to run their own code at ring 0, the CPU’s highest privilege level.

13. [13]

    This also bypasses attestation, which uses cryptographic checks to prove that the hardware is trustworthy.

14. [14]

    As a result, the attack can help an attacker turn limited access into full control.

15. [15]

    The attacker needs some control over the local network.

16. [16]

    This could be an insider or an external attacker who already has a foothold in the target network and is seeking to gain higher privileges.

17. [17]

    So far, there’s no evidence that this flaw can be exploited to gain initial access to a network from the outside.

18. [18]

    The flaw affects some systems that start up over a network using EDK2-based firmware with PXE enabled.

19. [19]

    Home and small-office users, and anyone who boots only from a disk drive, aren’t affected.

20. [20]

    Organizations should contact their system or firmware supplier and disable network boot where possible.

21. [21]

    They should also monitor logs for suspicious activity.

22. [22]

    Attackers can now study the fix to develop exploits, while updating firmware across many devices could take a long time.

23. [23]

    It’s still unclear which devices are affected.

24. [24]

    Several other companies hadn’t answered questions when the article was published.

Read the original article →

What happened

The FBI seized virtualine.net, a bulletproof hosting provider accused of laundering money for criminal customers and keeping a child sexual abuse material trading forum online despite repeated warnings from police and child-protection groups. [1]

The investigation, called Operation Omegaline, was led by the FBI Washington Field Office with assistance from law-enforcement agencies in Germany, the Netherlands and the United Kingdom, as well as private-sector participants. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The FBI has seized virtualine.net, the domain of a bulletproof hosting provider that laundered money for its criminal customers and kept a forum trading in child sexual abuse material online despite repeated warnings from police and child protection groups.

2. [2]

   Seizure notice (Source: US Department of Justice) The FBI Washington Field Office led the investigation, dubbed Operation Omegaline, with help from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the UK’s National Crime Agency and private sector … More → The post FBI seizes Virtualine, bulletproof hosting provider that promised to shield criminals from police appeared first on Help Net Security .

Read the original article →

What happened

A Ukrainian national who participated in ransomware attacks against hospitals, government entities, law firms, and other businesses was sentenced to five years and 10 months in prison. [1]

Artem Stryzhak, 36, pleaded guilty in December 2025 to two conspiracy counts involving fraud, extortion, and related computer activity. [2]

Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A Ukrainian national who participated in ransomware attacks targeting hospitals, government entities, law firms, and other businesses was sentenced to five years and 10 months in prison.

2. [2]

   Artem Stryzhak, 36, pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers.

3. [3]

   He was arrested in Spain in June 2024 and extradited to the United States in April 2025.

Read the original article →

What happened

Tailscale shipped fixes for several vulnerabilities, including Tailscale SSH flaws that could allow an attacker with existing access to a device in the network to gain additional privileges on other machines in the tailnet. [1]

The reported lateral movement was limited to machines that the tailnet policy file already permitted for SSH connections, according to Mike Shaver’s investigation. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Tailscale, the company behind the popular software-defined mesh networking and connectivity platform of the same name, has shipped fixes for several vulnerabilities, including some in Tailscale SSH that could let an attacker who already had access to a device in the network gain more privileges on other machines that are part of it.

2. [2]

   “Based on our investigation, an attacker could reach only machines the tailnet policy file already permitted SSH connections to,” said Mike Shaver, … More → The post Tailscale fixes SSH flaws allowing lateral movement within tailnets appeared first on Help Net Security .

Read the original article →

What happened

Upwind Security raised $400 million in Series C funding, bringing its total funding to more than $800 million. [1]

Bessemer Venture Partners led the round, with participation from Upwind’s existing investors. [2]

Canapi Ventures joined the financing as a new investor. [3]

The article describes the funding as supporting protection of AI across endpoints, code, and cloud. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Upwind Security has raised $400 million in Series C funding to expand its cloud and AI security platform, bringing the company’s total funding to more than $800 million.

2. [2]

   Bessemer Venture Partners led the round, with participation from all existing Upwind investors, including Greylock Partners, Cyberstarts, Craft, Salesforce Ventures, Alta Park, Picture Capital, Swish Ventures, Cerca Partners, TCV, Penny Jar, and Leaders Fund.

3. [3]

   Canapi Ventures joined as a new investor.

4. [4]

   The funding comes less than nine … More → The post Upwind secures $400 million to protect AI across endpoints, code, and cloud appeared first on Help Net Security .

Read the original article →

What happened

VikingCloud launched AI Governance Services, offering compliance and risk assessments that identify AI tools used across a business, expose gaps in security controls, and provide a remediation plan. [1]

Why it matters

Multi-location brands may struggle to maintain one security standard across every location. [2]

The source says shadow AI increases this challenge because employees can adopt tools locally without corporate review and vendors can enable AI features without notice. [3] [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   VikingCloud has launched AI Governance Services, a new set of compliance and risk assessments that find the AI tools in use across a business, show where security controls fall short, and deliver a remediation plan to close the gaps.

2. [2]

   Multi-location brands struggle to hold every location to one security standard.

3. [3]

   Shadow AI makes that even harder.

4. [4]

   Employees adopt tools at the location level without corporate review, and vendors switch on AI features without notice.

Read the original article →

What happened

Swimlane announced Turbine capabilities that let security teams run their own detection logic against large data volumes and send resulting alerts to Swimlane AI SOC for investigation and response. [1]

The October release adds two-way Model Context Protocol support and a Hero AI agent that uses natural-language prompts to build applications for various use cases. [2]

Why it matters

The announced capabilities expand how teams can connect tools, build workflows and operationalize security processes. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Swimlane has announced new capabilities in the Swimlane Turbine platform that allow security teams to run their own detection logic against large volumes of data and send resulting alerts directly into Swimlane AI SOC for investigation and response.

2. [2]

   The October release also adds two-way Model Context Protocol (MCP) support and new Hero AI agent that uses natural-language prompts to build applications for any use case, expanding how teams can connect tools, build workflows and operationalize … More → The post Swimlane connects custom detections to AI-led investigation and response appeared first on Help Net Security .

Read the original article →

What happened

A September 2026 breach at Germany’s AfD exposed more than 345,000 unique email addresses. [1]

Have I Been Pwned added the breach data on 27 October; the compromised information included email addresses and email messages. [2]

Why it matters

HIBP classified the incident as a sensitive breach, preventing public searches of the data. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Over 345,000 unique email addresses were exposed in the September 2026 breach at German far-right political party Alternative für Deutschland (AfD).

2. [2]

   Breach notification service Have I Been Pwned (HIBP) added the data to its database on 27 October, listing email addresses and email messages as the compromised information.

3. [3]

   HIBP has flagged the incident as a sensitive breach, so the data cannot be searched publicly.

Read the original article →

What happened

Digitate announced ignio Hummingbird, a new release of its agentic AIOps platform. [1]

Hummingbird adds AI agents for specific IT tasks that can proceed from diagnosis through approved action and verification within enterprise change, approval, and audit controls. [2]

The release lets enterprises build their own IT operations agents and includes MCP and A2A servers for interoperability with agents and assistants. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Digitate has announced ignio Hummingbird, the latest release of its agentic AIOps platform.

2. [2]

   Hummingbird introduces AI agents that bring operational expertise to specific IT tasks, move from diagnosis through approved action and verification, and operate within enterprise change, approval and audit controls.

3. [3]

   The release also enables enterprises to build their own IT operations agents and includes built-in Model Context Protocol (MCP) and Agent2Agent (A2A) servers, allowing ignio capabilities to work with the agents, assistants and … More → The post Digitate adds AI agents for patch planning, service desks, and SAP operations appeared first on Help Net Security .

Read the original article →

What happened

Huntress reported that attackers entered business networks through compromised camera management software in several incidents traced to September and October. [1]

Huntress analysts could not confidently identify the application or determine how attackers compromised it because application-related logs were unavailable. [2]

Known limitations

The supplied evidence does not establish the software vendor, the initial-access technique, the affected organizations, or the attackers’ post-compromise actions. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Attackers have been breaking into business networks through camera management software, according to new research from security firm Huntress, which traced several incidents in September and October back to a compromised application.

2. [2]

   An unidentified application The company’s analysts haven’t been able to confidently determine which software it was, and because no logs associated with the application could be found, they also couldn’t pinpoint how the attackers compromised it.

Read the original article →

What happened

ControlUp announced Pulse AI Resolve, an AI layer of its Pulse AI ecosystem for real-time investigation and endpoint issue resolution. [1] [2]

The capability, previously called ControlUp Connect, adds AI-powered investigation and remediation, governance controls, and proactive issue detection at the endpoint. [2]

Why it matters

ControlUp says Pulse AI Resolve is intended to speed IT issue resolution and reduce support tickets requiring human IT intervention. [3]

Known limitations

The supplied evidence does not specify the admin-defined control mechanisms, supported environments, rollout status, or demonstrated remediation results. [2] [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   ControlUp has announced Pulse AI Resolve, the real-time investigative AI layer of the Pulse AI ecosystem.

2. [2]

   A major enhancement of ControlUp’s endpoint self-service capability, previously ControlUp Connect, Pulse Resolve brings AI-powered investigation and remediation, built-in governance controls, and proactive issue detection directly to the endpoint.

3. [3]

   It helps organizations resolve IT issues faster while reducing the volume of support tickets that require human IT intervention.

4. [4]

   For decades, enterprise IT support has followed essentially the same escalation … More → The post ControlUp’s Pulse AI Resolve diagnoses and fixes IT issues within admin-defined controls appeared first on Help Net Security .

Read the original article →