💥 BREACHES & INCIDENTS
Ransomware group breaches ~40 shipping companies via supply chain compromise
A ransomware group used a supply chain compromise to hack around 40 shipping companies.- Around 40 shipping companies were compromised after attackers breached a shared supplier in the shipping sector.
- The attack is a supply chain compromise: hitting a trusted third party to gain access to multiple downstream victims at once.
- The story was reported in Risky Business's Risky Bulletin podcast episode alongside other items including Pentagon tech sabotage unit and GoDaddy cert revocations.
Quest Diagnostics discloses breach of Quanum Lab Services Manager platform
Quest Diagnostics disclosed unauthorized access to its Quanum Lab Services Manager platform involving patient information.- Affects healthcare clients using Quanum Lab Services Manager to order lab tests and view results; discovered October 21, 2026.
- Patient health information or personally identifiable information was involved, but the number of patients and specific records affected remain undetermined.
- Quest suspended Quanum LSM access while investigating; direct lab information system and EMR ordering interfaces were unaffected and core operations continue.
- Per its SEC filing, Quest activated incident response, engaged outside cybersecurity experts, and notified federal law enforcement; attackers and entry method have not been identified.
Sources 📄 Source: sec.gov · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)Everest ransomware group claims theft of 590 GB of PwC data
The Everest ransomware group has listed PwC on its leak site, claiming to have stolen 590.69 GB of data.- Applies to PwC, the Big Four professional services firm, with alleged data spanning operations in Australia, China, Canada, and the UK
- Everest claims 590.69 GB stolen, including HR records, training materials, internal audit methods, and single sign-on source code and configuration files
- Hackmanac reported 108,426 files allegedly taken from internal HR and learning systems, including a directory named pwc-stg.csod.com with Cornerstone OnDemand materials; one HR dataset reportedly contains 213,084 records
- The listing appeared on Everest's leak site on October 22, 2026, with a screenshot threatening publication after a countdown and a reported October 28 release deadline
- The claim is unverified: no ransom amount, initial access method, or evidence of encrypted systems has been established, and PwC has not responded
Sources 📄 Source: ctiwatch.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)State Bank of India confirms 3,897 customer records exposed in dark web data leak
State Bank of India disclosed that 3,897 customer records containing personal data were found in a dark web leak of about 375,000 records.- Affects customers of State Bank of India, India's largest state-owned lender with over 500 million customers
- Exposed data includes names, genders, mobile numbers, email addresses, home addresses, dates of birth, CIF/branch identifiers, and loan metadata; account numbers, balances, passwords, and card details were not listed
- A threat actor named 'Siriusim' posted the dataset on BreachForums on October 16, claiming 375,000 rows and 2,722 PDFs including loan applications and KYC documents
- SBI was alerted by CERT-In, the Defence Cyber Agency, and its threat intelligence provider; the source of the leak remains unknown and is under investigation
- Free Press Journal verified sample records as genuine, including matching WhatsApp photos and KYC documents
🕵️ RESEARCH & DEEP DIVES
Cisco patches critical Expressway RCE flaw (CVE-2026-76466, CVSS 9.8) in clustered deployments
CVE-2026-76466
Cisco has patched a critical vulnerability (CVE-2026-76466) that lets remote attackers run OS commands as root on clustered Expressway devices.- Affects Cisco Expressway-C and Expressway-E, virtual and appliance, running X15.5.3 or earlier with clustering enabled; X15.5.20 is the first fixed release.
- The flaw sits in the database service and involves persistent cookies; an attacker with the required cookies and network access can invoke RPC commands that run with root privileges.
- Cisco also found client certificates are not properly validated when TLS Verify Mode is enabled for clustering; no workarounds are available.
- Cisco published the advisory on October 21, 2026; the fix is also included in the October 2026 Expressway hardening release, and no malicious use was known at publication.
Iran's Prince of Persia APT Hosts C&C Server in US for First Time Since 2016
Iran's Prince of Persia APT resumed operations after a three-month lull and hosted a Tornado C&C server on US shared hosting for the first time since 2016.- Targets: Iranian dissidents plus government and private entities in the US, Europe, and the Middle East; the group (also tracked as Infy) has operated for nearly 20 years.
- Impacted: file theft via Tonnerre and Tornado malware — within seven days of resuming on May 27, Tonnerre siphoned over 1,800 files from a single victim.
- How: the group took servers offline after SafeBreach's February 2026 report, paused for three months during the Iran–US/Israel war, then relocated; in August it deployed a Tornado second-stage server on Namecheap shared hosting instead of VPSs.
- Tornado supports stealing files through a Telegram bot, and a newer server is hidden behind Cloudflare; the group's toolset also includes Infy, Foudre, and Tonnerre with DGA-based C2.
- IOCs tied to Prince of Persia's infrastructure have been shared by Semperis; the Telegram bot setup included a Persian group named 'sarafraz' and username @ehsan8999100.
📋 ADVISORIES
Oracle issues emergency Java update for critical 9.1 HTTPS certificate trust flaw CVE-2026-91403
CVE-2026-91403
Oracle has released an emergency Java update addressing CVE-2026-91403, a critical 9.1-severity certificate trust vulnerability in the JSSE component.- Affects Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; GraalVM for JDK 17.0.21 and 21.0.13; and GraalVM Enterprise Edition 21.3.20.
- The flaw is in the Java Secure Socket Extension (JSSE) component, rooted in eMudhra-issued intermediate CA certificates with weak private keys.
- An attacker with network access could forge certificates for arbitrary hostnames, making malicious HTTPS sites appear trusted to Java clients.
- Exploitation is easily exploitable, unauthenticated, and low complexity via multiple protocols, with high confidentiality and integrity impact but no availability impact.
- The update distrusts the affected intermediate certificates; no confirmed attacks have been reported, and sandboxed Web Start apps and applets loading untrusted code are also exposed.
Sources 📄 Source: oracle.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)Splunk Patches 24 Vulnerabilities in Enterprise and SOAR, Four Critical (CVSS up to 9.9)
Splunk has released October 2026 security updates fixing 24 vulnerabilities in Splunk Enterprise and Splunk SOAR, including four critical flaws.- Affects Splunk Enterprise (fixed in 10.4.4, 10.2.8, 10.0.11, 9.4.16), Splunk SOAR (fixed in 8.7.0), and Splunk Secure Gateway (fixed in 3.10.12, 3.9.26, 3.8.73)
- Four critical flaws: CVE-2026-76299 and CVE-2026-76302 in Splunk Enterprise (CVSS 9.9, improper access control and improper neutralization), CVE-2026-76531 in SOAR (9.9, files accessible to external parties), and CVE-2026-76407 in SOAR (9.3, improper access control)
- CVE-2026-76298 (8.8) lets a low-privileged user derive the PostgreSQL sidecar superuser password and run OS commands on search head cluster members; CVE-2026-76291 (8.8) lets users with scheduled-search rights bypass safeguards to run risky SPL commands
- CVE-2026-76293 (7.2) enables remote code execution via Splunk Web Manager XML by users with edit_manager_xml capability
- Two unauthenticated denial-of-service bugs, CVE-2026-76288 and CVE-2026-76290, can crash Splunk services via crafted web requests or repeated package downloads
Sources 📄 Source: advisory.splunk.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)