October 29, 2026

What happened

Last school year, MS-ISAC told 808 of its 6,116 K-12 members that staff accounts or credentials were circulating on underground and dark web marketplaces. [1] [2] [3]

The source states that attackers use stolen staff logins to enter one school district and then reach another district. [3]

In cases tracked by MS-ISAC, an attacker phished one legitimate district account and used it to send [truncated]. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Last school year, 808 K-12 school organizations got some unwelcome news.

2. [2]

   The Multi-State Information Sharing and Analysis Center (MS-ISAC) told them their staff accounts or credentials were circulating on underground and dark web marketplaces.

3. [3]

   That’s 808 of the center’s 6,116 K-12 members, and attackers are using those logins to get in the door and then reach the next district.

4. [4]

   In cases MS-ISAC tracked, an attacker phishes one legitimate district account, then uses it to send … More → The post Stolen staff logins are spreading attacks between K-12 school districts appeared first on Help Net Security .

Read the original article →

What happened

In a survey of 500 senior IT and security leaders for Sectigo, 40% said they were very prepared for monthly TLS certificate renewals because automated systems were already in place. [1]

The survey reported that only 4% said their certificate management was already automated, while 61% said their organization had experienced a certificate-related outage or incident in the previous 12 months. [2]

Why it matters

The reported preparedness assessment contrasts with the survey responses on existing automation and recent certificate-related incidents. [1] [2] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Forty percent of 500 senior IT and security leaders surveyed for certificate authority Sectigo said they are very prepared for monthly TLS certificate renewals because automated systems are already in place.

2. [2]

   Only 4% said their certificate management is already automated, and 61% said their organization had a certificate-related outage or incident in the past 12 months.

3. [3]

   Their more specific answers point elsewhere.

Read the original article →

What happened

The source emphasizes building a malware analysis lab before analyzing malware and describes virtualization snapshots as useful for lab work. [1] [2]

Why it matters

Reverting to a previous snapshot causes changes applied to the virtual machine to be lost. [3] [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Building your malware analysis lab is a key point before playing with malware.

2. [2]

   Today, thanks to virtualization, it&#;x26;#;39;s convenient to play with snapshots in your lab.

3. [3]

   But, if you need to revert to a previous snapshot, all changes applied to the VM are...

4. [4]

   lost!

Read the original article →

What happened

Help Net Security interviewed Nathan Smolenski, Qualys’s CISO, about how security teams can handle the growing volume of vulnerabilities discovered by AI. [1]

Why it matters

Smolenski says CISOs should track the average window of exposure rather than standard mean time to remediation, and that under one percent of disclosed flaws posed active risk in 2025. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   In this Help Net Security interview, Nathan Smolenski, CISO at Qualys, talks about how security teams can handle the growing volume of AI-discovered vulnerabilities.

2. [2]

   He explains why CISOs should track the average window of exposure instead of standard MTTR, and why only a small share of disclosed flaws, under one percent in 2025, pose active risk.

Read the original article →

What happened

Hackers exploited a critical Cisco Catalyst SD-WAN flaw, which had been fixed in February, to plant custom malware in systems controlling an organization’s SD-WAN network. [1]

Cisco Talos said on October 28 that the malware, called KeyDrift, is designed to copy keys used to encrypt traffic between sites and store them for later use. [2]

Known limitations

Talos characterized the attacks as historical but did not specify when they occurred in the available evidence. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network.

2. [2]

   The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28.

3. [3]

   Talos calls the attacks historical but does not specify when they

Read the original article →

What happened

The FBI seized virtualine.net after a court authorized the action; the government says Virtualine was used to commit or facilitate criminal activity, including child sexual abuse material, nonconsensual intimate-image disclosure and international money laundering. [1] [2] [3] [4]

Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech, offered “bulletproof” hosting and marketed hosting, servers and domains to customers seeking a provider that ignored abuse complaints. [5] [6] [7]

The government says Virtualine continued hosting Vendor 1 after receiving reports of child sexual abuse images and videos from authorities, NCMEC and a victim’s lawyer, and helped build a replacement website. [8] [9] [10] [11] [12]

The government says Virtualine’s “additional protection plan” moved customers’ criminal infrastructure to an unaffiliated shell company after law-enforcement contact and then reactivated the server. [13] [14] [15]

Authorities say Vendor 1 accepted direct bitcoin payments through an option labeled “BTC [NO-AML],” and accuse Virtualine of accepting some criminal-group payments and moving them through further transactions to conceal their source. [16] [17] [18] [19]

Why it matters

The article reports that the replacement website had already received at least one abuse complaint involving sexually explicit images of children and that Virtualine continued hosting it. [20] [21]

Known limitations

The supplied evidence does not establish the seizure’s effect on the replacement website or whether hosting ultimately stopped. [20] [21]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The seized domain is virtualine.net, and the government says the site was used to commit and facilitate prolific criminal activity.

2. [2]

   That includes the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate images of adults and minors, and international money laundering.

3. [3]

   A court authorized the seizure.

4. [4]

   Cox, Assistant Director in Charge of the FBI Washington Field Office, announced today the seizure of the website virtualine.net after it was used to commit and facilitate prolific criminal activity, including the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate visual depictions of adults and minors, and international money laundering designed to conceal and promote criminal conduct.” The Justice Department has the details in a press release .

5. [5]

   Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech, offers “bulletproof” hosting.

6. [6]

   It sells hosting, servers and domain names to customers who want a provider that ignores abuse complaints.

7. [7]

   It promotes its services on cybercrime forums.

8. [8]

   Court records call that site Vendor 1.

9. [9]

   In January 2026, about a month after assigning Vendor 1 an IP address, Virtualine began receiving reports of child sexual abuse images and videos on the server.

10. [10]

    The reports came from police in Germany, Canada and Australia, the US National Center for Missing and Exploited Children (NCMEC), and a victim’s lawyer.

11. [11]

    According to the government, Virtualine continued hosting Vendor 1 despite those warnings.

12. [12]

    The government also says Virtualine helped Vendor 1 build a new website.

13. [13]

    In March 2026, Virtualine promoted an “additional protection plan” for customers, offered after the company received an official request from law enforcement.

14. [14]

    Under the plan, it would move the customer’s criminal infrastructure to another shell company unaffiliated with Virtualine, and then reactivate the server.

15. [15]

    “In March 2026, Virtualine advertised its “additional protection plan,” which it offered to its customers after “receiv[ing] an official request from law enforcement agencies.” Under this plan, Virtualine would move the customer’s criminal infrastructure to “another shell company not affiliated with Virtualine, after which the server is reactivated.”” continues the press release.”As Virtualine advertised to users on the platform HackForums in June 2025, “Virtualine ignored more abuse than your last three therapists.”” Despite saying it bans child content, the government says Virtualine knowingly hosted a website that carried it.

16. [16]

    It allowed users to upload illegal material and download it after paying.

17. [17]

    The site accepted several payment methods, including an option called “BTC [NO-AML].” It used bitcoin addresses outside a hosted payment service, allowing customers to pay directly and avoid that service’s checks for illegal funds.

18. [18]

    Authorities say some payments came directly from criminal groups.

19. [19]

    They accuse Virtualine of accepting the money and moving it through further transactions to hide its source.

20. [20]

    A domain seizure doesn’t end the problem, and the government says so in plain terms.

21. [21]

    The new website Virtualine built with Vendor 1 has already drawn at least one abuse complaint about sexually explicit images of children, and the release adds: Virtualine hosts this new website to this day.

Read the original article →

What happened

Attackers accessed French ENGIE customers’ personal information through a sales tool used by some business partners to market electricity and natural-gas offers. [1] [2] [3] [4]

Exposed information included names, postal and email addresses, telephone numbers, customer and contract numbers, and energy-supply identifiers such as electricity PDLs and gas PCEs. [5] [6] [7]

ENGIE says its internal IT systems and banking information were not compromised, and its investigation indicates exposure was limited to contact details and certain contract information. [8] [9]

ENGIE says it blocked the attackers’ access, notified relevant authorities, and contacted affected customers. [13]

Why it matters

The exposed customer and contract details could help attackers impersonate ENGIE and persuade victims to disclose additional information or make payments. [10] [11] [12]

Source-supported guidance

Customers should verify unexpected requests through trusted, independently obtained official channels, even when the requester knows their personal details. [14] [15] [16]

Known limitations

ENGIE has not disclosed the affected partner or platform, the number of customers affected, or when the intrusion began or was discovered; no specific threat group has been attributed. [17] [18] [19]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   ENGIE says attackers accessed French customers’ contact and energy contract data through a partner sales tool.

2. [2]

   French multinational energy company ENGIE warned customers in France that attackers accessed personal information through a sales tool used by some business partners.

3. [3]

   According to notification emails sent to affected customers, the incident involved a tool used by partners to sell the company’s electricity and natural gas offers.

4. [4]

   The notification confirms that attackers gained unauthorized access to personal information stored in the sales tool.

5. [5]

   The compromised information includes customers’ names, postal addresses, email addresses, telephone numbers, customer IDs, contract numbers and energy supply identifiers.

6. [6]

   For electricity customers, these include the delivery point identifier (PDL).

7. [7]

   For gas customers, they include the metering and estimation point (PCE).

8. [8]

   The company says its internal IT systems weren’t compromised and banking information wasn’t affected.

9. [9]

   ENGIE says financial information wasn’t affected and that its investigation indicates the exposure was limited to contact details and certain contract information.

10. [10]

    The exposed data includes contact details and energy contract information that could help fraudsters impersonate the supplier.

11. [11]

    Attackers can use accurate customer information to persuade victims to disclose additional data or make payments.

12. [12]

    Anyway, the exposed data could support impersonation scams.

13. [13]

    It has blocked the attackers’ access, notified the relevant authorities and contacted affected customers, according to a spokesperson who spoke to BleepingComputer .

14. [14]

    The company warned customers to watch for attempts to obtain further information or induce payments.

15. [15]

    Customers should verify unexpected requests through trusted channels, even when the sender knows their personal details.

16. [16]

    If someone requests a payment, password or additional personal information, they should end the exchange and verify the request using independently obtained official contact details.

17. [17]

    The company hasn’t disclosed the partner or platform involved.

18. [18]

    It also hasn’t revealed how many customers were affected, when the intrusion began, or when it was discovered.

19. [19]

    ENGIE hasn’t attributed the attack to a specific group, and at this time no ransomware group has claimed responsibility for the attack.

Read the original article →

What happened

Alpine Linux said an attacker tried to exploit CVE-2026-97229, a critical GitLab vulnerability, on Alpine’s GitLab server one week after GitLab released a fix. [1] [2]

The CVSS 10.0 flaw can allow code execution on a GitLab server through a crafted regular expression in a CI configuration. [2]

Known limitations

Alpine Linux found no evidence that the attempted attack succeeded; the supplied evidence ends before stating any further compromise findings. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October.

2. [2]

   The flaw, CVE-2026-97229 (CVSS score: 10.0), can let an attacker run code on a GitLab server through a crafted regular expression in a CI configuration.

3. [3]

   Alpine found no evidence that the attack worked but

Read the original article →

What happened

A hacktivist group calling itself the Department of Peace leaked names, offices, contact details, and assignments for more than 41,000 U.S. DHS employees. [1] [2]

The group gave the data to DDoSecrets and Swiss hacker and journalist maia arson crimew; DDoSecrets published the dataset, named Icepick, on October 28. [3] [4]

Known limitations

The source attributes the records to an Okta single sign-on system, but the available text is truncated and provides no further details about the alleged access or verification of the dataset. [5]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Names, offices, contact details and assignments of more than 41,000 U.S.

2. [2]

   Department of Homeland Security (DHS) employees have been leaked by a hacktivist group calling itself the Department of Peace.

3. [3]

   The group handed the data to the transparency collective Distributed Denial of Secrets (DDoSecrets) and to Swiss hacker and journalist maia arson crimew.

4. [4]

   DDoSecrets published the dataset, named Icepick, on October 28.

5. [5]

   According to the hacktivists, the records were taken from an Okta single sign-on … More → The post Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents appeared first on Help Net Security .

Read the original article →

What happened

GitHub announced a package firewall, currently limited to npm packages, to block suspicious packages during installation; the feature is in public preview. [1] [2]

GitHub said the firewall inspects metadata requests and package downloads for signs of malicious activity and acts as an install-time policy gate. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time.

2. [2]

   The feature, which currently supports only npm packages, is available in public preview

3. [3]

   "The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate," GitHub said.

Read the original article →

What happened

A flaw in Telegram for Android reportedly allowed an attacker to run code on a victim’s phone after the victim answered a voice call. [1]

Exploitation required only an ordinary Telegram account, according to the supplied report. [2]

Telegram fixed the flaw in app version 12.10.4, released in late September. [3]

Known limitations

The affected version range is not available because the supplied evidence ends mid-sentence. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec.

2. [2]

   The attacker needed only an ordinary Telegram account.

3. [3]

   Telegram fixed the flaw in version 12.10.4 of the app, released in late September, and NebuSec disclosed it on October 29.

4. [4]

   The flaw can be triggered in every version from

Read the original article →

What happened

Canonical has restarted work on Ubuntu Core Desktop, an immutable and attestable Ubuntu version that it says will eventually become the default Ubuntu desktop. [1]

Canonical’s engineering VP Jon Seager said the 2023 developer preview fell short of the company’s intended result. [2]

Ubuntu Core Desktop packages its bootloader, kernel, desktop environment and background services as snaps, Canonical’s sandboxed package format. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Canonical has restarted work on Ubuntu Core Desktop, the immutable and attestable version of Ubuntu that the company says will over time become the default Ubuntu desktop.

2. [2]

   Jon Seager, Canonical’s VP of engineering, laid out the plan and admitted that the 2023 developer preview “fell short” of what the company had in mind.

3. [3]

   On Core Desktop, everything ships as a snap, Canonical’s sandboxed package format: the bootloader, the kernel, the desktop environment, background services and … More → The post Ubuntu Core Desktop returns as Canonical’s plan for an immutable default desktop appeared first on Help Net Security .

Read the original article →

What happened

Exploitation attempts have reportedly begun against CVE-2026-101767, a recently patched Oracle E-Business Suite vulnerability. [1]

Defused said its Oracle E-Business Suite decoys recorded exploratory exploits on October 27 against CVE-2026-101767, described as an unauthenticated SQL injection in the Thin Client Framework servlet that chains to remote code execution. [2]

Why it matters

The vulnerability is reported as having a CVSS score of 9.8. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw.

2. [2]

   “Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS’s Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27,” Defused posted on X, noting that no public report of the flaw being attempted in the wild had existed before.

3. [3]

   About CVE-2026-101767 The flaw carries a CVSS score of 9.8 and … More → The post Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) appeared first on Help Net Security .

Read the original article →

What happened

Lumen’s Black Lotus Labs reported that Volt Typhoon, described as a Chinese state-sponsored APT group focused on cyberespionage and U.S. critical infrastructure, used a covert, constantly rotating relay network for sensitive intrusions. [1]

Researchers named the relay network Silent Train; it consists of chains of compromised SOHO and IoT devices, including TP-Link and Netgear routers, as well as enterprise systems such as Fortinet and Cisco appliances, PRTG servers, and CyberPanel servers. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen’s Black Lotus Labs revealed on Wednesday.

2. [2]

   This network, dubbed Silent Train by the researchers, consists of chains of compromised SOHO and IoT devices (e.g., TP-Link and Netgear routers) and enterprise systems (e.g., Fortinet and Cisco appliances, PRTG and CyberPanel servers).

Read the original article →

What happened

Forever Security reported ways out of built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and Anthropic’s Claude Desktop. [1]

In all five cases, a web page or local file reached the computer behind the browser. [2]

The reported impacts differed: Cursor ran attacker code, Copilot displayed a fake address, and Codex, VS Code and Claude Desktop allowed a single local file to read the rest of the disk. [3]

Known limitations

The supplied excerpt states that two of the holes were still unresolved, but it is truncated before identifying them or describing their status. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Forever Security found ways out of the built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and Anthropic’s Claude Desktop.

2. [2]

   In all five, a web page or a local file reached the computer behind the browser.

3. [3]

   Cursor ran attacker code, Copilot showed a fake address, and Codex, VS Code and Claude Desktop let a single local file read the rest of the disk.

4. [4]

   Two of those holes are still … More → The post Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop appeared first on Help Net Security .

Read the original article →