TrendAI (Trend Micro) published research on 27 October 2026 (English edition) describing three attack infrastructures, rebuilt from exposed open directories, that targeted Japan with different levels of AI use. In Case A, TrendAI says a CyberStrikeAI setup with a Simplified Chinese console split work across 44 agents (reconnaissance, vulnerability search, exploitation and exfiltration), and at least 19 identifiable organisations, including at least 16 in Japan, were subjected to validation activity in October 2026; TrendAI says deep compromise was limited. In Case B, a human-led operator used LLM help, targeted AI and GPU services and, through a GIS server with default credentials, reached several hundred thousand cadastral and commercial records over about 24 days in August and September. Case C made limited use of AI and ran at least six campaigns from January to October against Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, Yamaha RTX1210 devices and WebLogic servers. TrendAI says it does not know whether the cases share an operator, withheld indicators of compromise and plans to provide its results to law enforcement. The Hacker News reported the research on 27 Oct.
TrendAI — Not Only ARTEX: The Different Levels AI Is Used in Attacks Targeting Japan (27 Oct 2026)
The US Justice Department announced on 27 October 2026 that Artem Stryzhak, 36, a Ukrainian national formerly of Barcelona, Spain, was sentenced to 70 months in prison for conspiracy to commit computer fraud over ransomware attacks on hospitals, government entities, law firms and other businesses. According to the DOJ, he joined the Nefilim conspiracy as an affiliate from about June 2021, agreeing to pay Nefilim administrators including Volodymyr Tymoshchuk 20% of ransom proceeds; his Nefilim attacks included a June 2021 data theft from an oil and gas transportation company, and he worked with Nefilim until at least October 2021. The DOJ says he was also one of Hive's earliest affiliates and deployed Hive against seven victims, including law firms, a dentist office and a healthcare provider; the FBI gave a decryption key to one of them. He was arrested in Spain in June 2024, extradited in April 2025 and pleaded guilty in December 2025 to two counts of conspiracy. The FBI's Brett Leatherman said the groups caused more than $100 million in losses. The US State Department offers up to $11 million for information on Tymoshchuk. The Record (27 Oct) reports that throughout 2021 Stryzhak used Nefilim against organisations in the U.S., Canada and Australia.
US Department of Justice — Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million in Losses (27 Oct 2026)
US prosecutors announced on 27 October 2026, in a release published by the US Secret Service, that the Justice Department's Scam Center Strike Force had charged six Africa-based scammers with connections to Southeast Asia and China. According to affidavits unsealed that day, a group linked to Malaysia and China opened scam compounds in Madagascar in early 2025, likely after law enforcement action in Cambodia. Scammers posed as women on US dating sites, persuaded victims to connect their crypto wallets to fake NFT investment sites, and then pulled money from the wallets without their knowledge. The FBI identified about 74 crypto wallets associated with about 800 victims, and funds moved to accounts associated with Chinese-based actors; websites used in the scheme were seized. Chui Kok Wa was charged with conspiracy to commit wire fraud as the leader. In August 2026 the FBI helped Madagascar police take down 13 compounds and seize more than 3,200 devices, but the release says Madagascar repatriated numerous suspects to China before the investigation was complete. The Strike Force says it has restrained $1,006,460,156.82 in crypto overall. The Record (27 Oct) reports losses of more than $516,695.
US Secret Service — Scam Center Strike Force Expands Reach to Target Global Crime Syndicates; Charges Scammers Based in Africa and Tied to China (27 Oct 2026)
Italy's Chamber of Deputies confirmed on 27 October 2026 that its IT systems were hit by a cyberattack involving some parliamentary email accounts, including one assigned to Prime Minister Giorgia Meloni as a deputy, Euronews reported. The Chamber's press office said the matter was not an emergency and that all protective measures had been taken in cooperation with Italy's national cybersecurity agency ACN, which may include temporarily disabling some system functions, and that similar attack attempts against other national, European and international institutions had intensified in recent days. Citing Corriere della Sera, Euronews said three addresses were involved: Meloni's deputy mailbox, which she does not use, and those of Andrea Delmastro (Fratelli d'Italia) and Paolo Formentini (Lega). ANSA reported the same day that Rome prosecutors were awaiting a first report from the Polizia Postale and would open an investigation into unauthorised access to a computer system.
Euronews (Italian) — Attacco hacker alla Camera dei Deputati, verifiche su alcune email tra cui quella di Meloni (27 Oct 2026, 12:07 CET)
CISA added CVE-2026-48356, an unrestricted upload of file with dangerous type flaw in Adobe Commerce and Magento Open Source, to its Known Exploited Vulnerabilities catalog on 27 October 2026, with a remediation due date of 10 November 2026 for US federal agencies; CISA lists known ransomware use as Unknown and points to Adobe bulletin APSB26-73. According to the CVE record from Adobe (published 14 July 2026), the flaw could result in arbitrary code execution in the context of the current user, exploitation requires user interaction (a victim visiting a crafted URL or interacting with a compromised page), and the scope is changed. The record lists Adobe Commerce 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier, Adobe Commerce B2B, Magento Open Source and Adobe Commerce Events 1.20.0 and earlier as affected. Adobe's own bulletin APSB26-73 (published 14 July 2026) rates CVE-2026-48356 Critical with a CVSS 3.1 base score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L), lists its impact as privilege escalation and says no authentication is required to exploit it; the CVE record gives 9.3 and arbitrary code execution. Both are shown here as each source states them. Correction (28 Oct 2026): Adobe's bulletin APSB26-73, which was unreadable on the previous pass, is now readable and gives a CVSS score of 9.6 with privilege escalation as the impact, while the CVE record gives 9.3 and arbitrary code execution; the card now shows both, each credited. (source: Adobe)
CISA Known Exploited Vulnerabilities Catalog — CVE-2026-48356 (added 27 Oct 2026)
BleepingComputer reported on 27 October 2026 (US time) that Warp, the developer tool that started as a terminal and became an agentic development environment, has disclosed a breach in which agent decision logs and telemetry data belonging to Warp users were exposed in an attack on a third-party vendor in its infrastructure. According to BleepingComputer, Warp founder and CEO Zach Lloyd said: "On Friday, we became aware of what we believe to be an active and narrow-banded exploitation of a vendor in Warp's infrastructure", and "We detected the operation within hours and were able to remediate and mitigate the impact." Lloyd estimates that "roughly 1% of Warp users may have been impacted", BleepingComputer reports. BleepingComputer says agent traces and telemetry were identified as potentially affected data, and that the company did not clarify whether the exposed information included source code, prompts, credentials or other sensitive details. According to BleepingComputer, Lloyd said analysis suggests the attack was powered by "an agent swarm" relying on "a very sophisticated penetration and escalation technique", and that Warp has contacted the vendor about the vulnerability but no details have been shared. BleepingComputer also reports that Warp has notified users identified as affected, engaged CrowdStrike to assist with the investigation and informed law enforcement. BleepingComputer does not name the vendor. Wire: BleepingComputer (27 Oct, US time). Correction (28 Oct 2026): the card was dated 28 October; its only source, BleepingComputer, is dated 27 October 2026 and shows no time zone, so the card now carries that date. (source: BleepingComputer)
BleepingComputer — Warp discloses breach exposing AI agent logs, user telemetry data (27 Oct 2026)
CISA published ICS advisory ICSA-26-300-01 on 27 October 2026 for EPICS Base from the EPICS community, listing four CVEs in EPICS Base release 7.0.10 and prior. According to CISA, CVE-2026-114595 (CVSS 3.1 9.8, CVSS 4.0 9.3, Critical) is an integer overflow in network request processing that can cause memory to be allocated with an incorrect size, and subsequent handling of attacker-supplied data may result in memory corruption, denial of service or potential remote code execution; CVE-2026-114596 (CVSS 3.1 8.2, CVSS 4.0 8.8) is improper validation of message length values during protocol parsing that can trigger an integer overflow and an out-of-bounds memory write, causing process instability or denial of service; and CVE-2026-114597 and CVE-2026-114598 (CVSS 3.1 7.5, CVSS 4.0 8.7) are insufficient validation of element or length values in a network message that can cause reads beyond an allocated buffer, leading to denial of service and possible exposure of adjacent memory. CISA says the EPICS community has made updates available in the epics-base GitHub repositories and users should update to the 7.0.11 release; EPICS Base R7.0.11 is published on GitHub, dated 27 October. CISA says no known public exploitation specifically targeting these vulnerabilities has been reported to it, lists the product as deployed worldwide in critical manufacturing, and credits Shubham Raj of Cipher / Causal Security with reporting the flaws. Primary: CISA advisory. UPDATE (28 Oct 2026, Perth; The Register): Causal Security co-founder Shubham Raj told The Register (27 Oct, 19:11 UTC) that the company's autonomous AI agent, Cipher, independently found all four previously unknown EPICS flaws, investigating and testing the system and validating the four exploits, in three hours and 49 minutes. (source: The Register)
CISA ICS advisory ICSA-26-300-01 — EPICS Base (27 Oct 2026)
His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) published a report on Tuesday 27 October 2026 finding that hackers have repeatedly compromised third-party suppliers holding British police data since 2021, The Record reported. According to The Record, the inspectorate said the Police Digital Service and the National Police Chiefs' Council shared "information on multiple cyberattacks" affecting "third-party ICT supply chains which held police information", but the report does not say how many attacks took place, which suppliers or forces were affected, or whether data was stolen, and the inspectorate said it removed operational details it considered unsuitable for the public domain. The Record reports the Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first three months of 2026, plus 796 "near misses", and warned that police data held on suppliers' systems is among the sector's biggest risks because it sits outside its monitoring. Inspectors found most police supplier contracts included no ongoing cybersecurity assurance, that in some cases staff could not say whether suppliers had to report incidents promptly, and that in several organisations supplier-held system logs were not routinely visible to in-house teams, according to The Record. The inspectorate also criticised the government for leaving policing and fire services out of the National Risk Register 2025, the Government Cyber Action Plan and the Cyber Security and Resilience Bill. "A major cyberattack is not a hypothetical scenario," said His Majesty's Inspector of Constabulary Michelle Skeer, as quoted by The Record. The Record says neither the Home Office nor the National Police Chiefs' Council responded to questions about whether police data was compromised in the supplier attacks. Wire: The Record (27 Oct). The HMICFRS page could not be read by this desk.
The Record — Hackers repeatedly breached suppliers holding UK police data, watchdog finds (27 Oct 2026)
Mozilla released Firefox 159 on 27 October 2026 with advisory MFSA 2026-118, which is rated high overall and lists 167 CVEs: 108 rated high, 52 moderate and 7 low. Mozilla notes that it no longer rolls internally found memory safety bugs into a single CVE and now issues an advisory for every individual bug, which is why the count is large. High-rated issues include sandbox escapes in the DOM: Navigation component (CVE-2026-117861), the Form Manager component (CVE-2026-117864) and the DOM: Networking component (CVE-2026-117868); privilege escalations in the Networking component (CVE-2026-117862), the Graphics: Canvas2D component (CVE-2026-117866) and WebRTC (CVE-2026-118006, CVE-2026-117892); a same-origin policy bypass in DOM: Navigation (CVE-2026-117860); and JIT miscompilation and use-after-free bugs in the JavaScript engine (for example CVE-2026-117890 and CVE-2026-117891). Mozilla credits OpenAI Codex Security (kylebot) with 34 of the high-rated bugs and Amy Burnett of OpenAI with 7. The advisory does not say any of the bugs are exploited in the wild. The same day Mozilla published MFSA 2026-120 for Firefox ESR 153.6, listing 145 CVEs (95 high, 44 moderate, 6 low), and MFSA 2026-119 for Firefox ESR 115.44. Primary: Mozilla security advisories.
Mozilla — MFSA 2026-118 Security Vulnerabilities fixed in Firefox 159 (27 Oct 2026)
French energy company ENGIE has confirmed that attackers accessed customer data after breaching a tool used by its partners to market energy offers, BleepingComputer reported on 27 October 2026. An ENGIE spokesperson told BleepingComputer: "ENGIE's internal IT systems were not compromised. ENGIE recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers." According to BleepingComputer, ENGIE cut off the attackers' access to the platform, says the incident is limited to customers in France, has notified the relevant authorities and has contacted affected customers, but did not say how many customers were affected. ENGIE told BleepingComputer that "the data concerned is limited to customers' contact details and certain information relating to their energy contracts. No banking data is affected." BleepingComputer says ENGIE's breach notification letters to customers list first and last names, mailing address, email address, phone number, the electricity delivery point (PDL) or gas metering point (PCE) number, customer ID and contract number. ENGIE did not attribute the attack to a specific group, and BleepingComputer says no ransomware or extortion gang had claimed it before publication. Wire: BleepingComputer (27 Oct).
BleepingComputer — Energy giant ENGIE discloses data breach affecting customers (27 Oct 2026; includes ENGIE spokesperson statement)
South Korean police have identified and arrested seven suspects linked to a cybercrime operation whose leader, a former penetration tester, used the ARTEX AI penetration-testing framework in most of the attacks, BleepingComputer reported on 26 October 2026, citing the Seoul Metropolitan Police via local media including Yonhap News. According to BleepingComputer, the leader, a self-taught 32-year-old who worked at a cybersecurity company between 2019 and 2022, began attacking organisations in September 2025 with conventional tools and adopted AI tools in late August 2026; he was arrested on 15 October, formally detained two days later and referred to prosecutors on 23 October, while the other six remain under investigation without detention. Police said the operation breached more than 90 organisations in South Korea, including educational institutes, hospitals, large corporations and golf courses, stole about 8.2 million records and demanded 360 million won (about US$270,000) in 38 of the incidents, according to BleepingComputer citing Yonhap (figures not independently verified). BleepingComputer reports police opened the case after a victim complaint in June, traced the suspects through server logs from the breached organisations, and told Yonhap it was the first arrest in Korea for a large-scale hacking and personal-information theft case that exploited generative AI; police are now checking whether stolen data has been leaked on the dark web. BleepingComputer says ARTEX is the same autonomous framework used in attacks on multiple South Korean banks attributed to a Chinese-speaking threat actor. Correction (27 Oct 2026): the card date has moved from 26 to 27 October 2026, the Perth date of BleepingComputer's report (26 October US time; 5:08 am 27 October Perth). (source: BleepingComputer)
BleepingComputer — Former pentester used ARTEX AI to steal 8.2 million data records (26 Oct 2026)
The Parliamentary Information and Cyber Resilience (PICR) program has a budget of about $40 million over four years, Department of Parliamentary Services (DPS) chief operating officer and deputy secretary Nicola Hinder told Senate estimates, iTnews reported on 27 October 2026; the figure had been left out of budget papers, and Ms Hinder said the funding was first provided on a not-for-publication basis for commercial sensitivities. According to iTnews, Ms Hinder said the money is split across three streams: information assurance, cyber uplift and work on the Parliamentary Computing Network (PCN), and the electronic security systems that underpin Australian Parliament House. iTnews reports she said one of the first PICR streams is segmenting the PCN, which is used by parliamentarians, senators and staff and connects Parliament House to ministerial and electorate offices, so that parliamentary departments set and are accountable for their own staff's settings rather than sharing the broad permissions applied to parliamentarians; the multi-year uplift runs to 2029/30. iTnews also reports that after an audit found DPS lacked a single source of truth for cyber security risks, a new cyber governance, risk and assurance team built a centralised risk register and identified 104 historical risk assessments that were marked complete but had no assessment evidence, which it is now reviewing, and that Ms Hinder said the cyber security branch has been fully staffed for close to 12 months.
iTnews — Parliamentary Information and Cyber Resilience upgrade has $40m budget (27 Oct 2026)
