💥 BREACHES & INCIDENTS
Cyberattacks hit University of New Mexico Health and University Hospitals of Cleveland, disrupting care
Cyberattacks struck two major hospital systems, forcing patient diversions and service outages.- University of New Mexico Health System, operator of the state's only Level 1 trauma center, diverted ambulances and canceled appointments at 30+ clinics after a cybersecurity issue
- UNM employees reported computer messages claiming theft of student, employee, and patient data; the FBI is assisting in an active law enforcement investigation
- UNM Health handles ~900,000 outpatient visits and 100,000 ER visits annually; hospitals and clinics began resuming operations in phases
- University Hospitals of Cleveland confirmed a cybersecurity incident causing a system-wide outage, with MyChart and some services still disrupted
GMO's Onamae.com Desktop Cloud breached: customer data stolen, 26,739 servers at risk, extortion demand
Attackers breached GMO Internet's Onamae.com Desktop Cloud FX-trading VPS service, stole customer information, triggered unauthorized trades, and issued an extortion demand GMO refuses to pay.- Affects customers of GMO Internet's Onamae.com Desktop Cloud, a Windows VPS marketed for FX auto-trading with MetaTrader 4/5, where trading tools and saved account credentials run on the servers.
- A third party installed malicious programs in some customers' server environments; up to 26,739 servers could be in scope, though GMO says this is not a count of confirmed compromises.
- GMO confirmed unauthorized access and that customers' information was taken outside; some customers reported unauthorized trades in their trading accounts, and trading-account logins saved in trading tools may have been viewed and misused.
- The attacker demanded money, threatening continued unauthorized trading, publication of GMO and customer information, and a ransomware attack; GMO refused to pay and referred evidence to police cybercrime units.
- All plans were shut down at 04:00 JST on 21 October 2026 and will not restart on the current infrastructure; GMO will offer migration to an alternative service on separate cloud infrastructure, free for six months, and will pay 5,000 yen per customer plus verified trade losses.
Keystone to destroy 18,835 hardware wallets after attackers steal device verification key
Attackers stole Keystone's hardware wallet device verification key via a website breach, prompting the company to destroy 18,835 unsold devices.- Keystone hardware wallet owners and buyers of devices shipped after October 20 are affected; devices delivered before October 20 that pass the authenticity check can be considered genuine.
- The stolen key lets counterfeit devices pass Keystone's online authenticity check, potentially enabling crypto theft; recovery phrases and private keys were not exposed.
- The attacker exploited a vulnerability in a third-party data monitoring tool used by Keystone's website to escalate privileges and obtain the key plus customer data.
- The breach exposed 25,964 buyer records (names, addresses, order details) from 2024-2026 purchases, plus 12,873 unpaid checkout records; payment details and government IDs were not involved.
- Keystone detected the access October 20, blocked it the same day, and will issue new devices with a new key; existing devices cannot be re-keyed.
Leaked SquareML Access Key Exposed Data of 238,000 Denver Health Plan Members
Denver Health Medical Plan is notifying 238,083 members after its vendor SquareML inadvertently leaked an access key online for 14 months.- Affects 238,083 current and former members of Denver Health Medical Plan (DHMP), a non-profit Medicaid managed care plan in Denver, Colorado.
- Vendor SquareML, which provides a no-code healthcare analytics platform, accidentally published an active access key on a public website on June 27, 2025.
- DHMP learned of the leak on August 14, 2026; the key was revoked on August 18, 2026, remaining exposed for nearly 14 months.
- The key provided read-only access to a database with names, dates of birth, ZIP codes, demographics, health metrics (BMI, HbA1c, eGFR), eligibility data, provider names, and admission/discharge/transfer information.
- No Social Security numbers or financial data were stored, and DHMP says there is no evidence the data was viewed or misused.
🔓 CVEs & KEV
- HashiCorp patches Consul-k8s cross-namespace authorization bypass (CVE-2026-110720)
CVE-2026-110720
HashiCorp has fixed a cross-namespace authorization bypass in Consul-k8s that could let an attacker gain elevated Consul privileges.- Affects Consul-k8s deployments with automated system ACL management enabled (global.acls.manageSystemACLs=true); versions 0.42.0 through 2.0.4 are affected.
- The flaw sits in component ACL binding rules, which did not consistently restrict authentication to ServiceAccounts in the namespace hosting Consul.
- An attacker with Kubernetes permissions to create a ServiceAccount and obtain its token in another namespace, plus network access to the Consul API, can authenticate as a Consul component and inherit its privileges.
- Exploitation does not necessarily grant full administrative access; no exploit code or confirmed exploitation has been reported.
- Fixed in consul-k8s 2.1.0 and 1.8.18; disclosed October 26, 2026 with a CVSS 3.1 score of 9.9 Critical.
🕵️ RESEARCH & DEEP DIVES
Yoba malware spreads via fake ChatGPT and Claude desktop apps on GitHub, using DLL sideloading
Check Point Research has uncovered a malware campaign, tracked as Yoba, that distributes malware through fake GitHub projects impersonating ChatGPT and Claude desktop applications.- Targets users searching for AI desktop apps, with fake GitHub projects posing as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, promoted via SEO poisoning to rank highly in Google results
- Each malicious ZIP contains a legitimately signed Setup.exe from OpenAI or Anthropic alongside a malicious winmm.dll, loaded via DLL sideloading to run inside a trusted process
- YobaDropper checks its process name, skips Russian and former-Soviet keyboard languages, requires admin rights, and installs YobaLoader via a scheduled task disguised as a Microsoft component
- YobaLoader derives C2 domains from a Telegram channel profile image, fetches commands hidden in DNS TXT records via DNS-over-HTTPS, and pulls the final payload from files.catbox.moe
- The final payload in this wave was an XMRig cryptocurrency miner connecting through Tor; the loader is generic and could deliver other malware such as ransomware; indicators suggest Russian origins and a UTC-4 operational timezone
Lazarus' Operation FlashHole Abuses South Korean CrossWeb EX Software With Post-Quantum Encryption
Kaspersky attributes Operation FlashHole, a Lazarus campaign using ML-KEM-1024 post-quantum encryption to deliver the Cubridge backdoor, to attacks on at least three South Korean organizations.- Targets at least three South Korean organizations in software, construction, and wired communication equipment manufacturing; active since at least July 2025 and likely more victims exist.
- Attack chain abuses INISAFE CrossWeb EX, a mandatory financial security program for online banking and government sites in South Korea, via spear-phishing links to fake portfolio/résumé pages on GitHub Pages (one with an AI-generated profile photo).
- Visiting the malicious site triggers an in-memory chain: CrossWeb EX launches fsquirt.exe to sideload TechHub, which fetches TouchHub and ClientHub from GitHub, leading to LPEClient and the Cubridge backdoor for C2, plugin delivery, credential theft, and file/browser data theft.
- LPEClient uses ML-KEM-1024 (NIST post-quantum key exchange) combined with GOST and Threefish encryption to protect payload delivery and C2 traffic, defeating network inspection; GitHub and Dropbox serve as C2 channels.
- Follows Operation SyncHole (2024-2025), which abused iniLINE Cross EX and an Innorix Agent flaw; Lazarus has abused CrossWeb EX since 2021, including 2022-2023 watering hole attacks deploying SCSKAppLink.dll.
FortiBleed 2.0 leak exposes 40,573 FortiGate secrets across 975 new domains
Newly obtained FortiGate configuration reports reveal 40,573 cleartext secrets, expanding the FortiBleed credential-leak campaign.- FortiGate appliance administrators and VPN users are affected by the FortiBleed credential-harvesting campaign.
- Leaked configuration records include 37,076 local-user records and 1,576 Active Directory LDAP bind records containing cleartext secrets.
- FortiBleed 2.0 adds 975 domain labels not seen in the original FortiBleed 1.0 leak; the material dates to around February 2026.
- Fortinet attributes the activity to threat actors reusing credentials from prior incidents (FG-IR-26-060, FG-IR-25-647) and brute-forcing devices with weak passwords and no MFA.
- Legacy SHA-256 password storage on unpatched FortiGate devices enables harvested credentials to be cracked; versions 7.4, 7.6, and 8.0 support PBKDF2 hashing.
Kaspersky details vulnerability chain that bypasses tenant isolation in cloud infrastructure
Kaspersky researchers demonstrated a vulnerability chain that fully bypasses tenant isolation in a major cloud provider's infrastructure.- Applies to tenants of managed cloud platforms, particularly those offering managed Kubernetes clusters.