From the frontier AI front,

• Cybersecurity Dive reports,
  • “A suspected China-nexus actor chained flaws in PHP2Shell with a privilege escalation bug in the Linux kernel to gain root access to Palo Alto Networks firewalls, according to researchers at Dream and PAN Unit 42. The attacks reached more than two dozen targets, including multiple servers linked to the U.S. government. 
  • “The chained critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109169, along with a high-severity flaw in Fragnesia, tracked as CVE-2026-46300. The threat actor, assisted by AI, gained root access to 25 PAN-OS firewall and management servers in the U.S., Japan, Taiwan and South Korea. 
  • “After gaining access to the firewalls, the hacker targeted Microsoft Active Directory. Researchers confirmed the attacks led to directory enumeration and credentials theft. 
  • “The attacks impacted a cloud environment that researchers confirmed is linked to the U.S. government.”
• and
  • “The insurance industry is closely monitoring PHP2Shell amid concerns of a systemic event that could overwhelm the sector with billions in cybersecurity risk claims. 
  • “PHP Foundation and multiple government authorities last week warned about two critical vulnerabilities in the scripting language used in more than 70% of websites. If successfully exploited, those vulnerabilities could enable an attacker to achieve remote code execution. 
  • ‘The insurance sector has long feared that a systemic cybersecurity event could lead to billions of dollars in claims that extend well beyond any existing risk models.” 

• Tech Crunch lets us know in a detailed article,
  • “PHP2Shell explained: Timeline of the global vulnerability crisis.”
    • “PHP powers most of the web, making PHP2Shell a major risk. Here’s a timeline of what happened, who was affected and how to secure your systems now.”

• Federal News Network adds,
  • “A top Cybersecurity and Infrastructure Security Agency official has called a security vendor’s decision to break the embargo on the recently disclosed PHP vulnerabilities “dangerous” and “inappropriate,” as cyber professionals grapple with how artificial intelligence is accelerating vulnerability timelines.
  • “The company in question, Chainguard, released patches for the PHP bugs more than six hours ahead of the planned, coordinated release last week, according to the PHP Foundation.
  • “Under coordinated disclosure processes, security firms like Chainguard receive vulnerability information in advance so they can develop patches and their users can immediately update their systems upon disclosure.
  • “Chainguard’s decision has been criticized for putting others at risk, allowing hackers to study the PHP vulnerabilities before other organizations were ready to release patches.”

• Ars Technica tells us,
  • “It’s almost like Google’s got something to prove after taking a break from releasing new frontier AI models earlier this year. Just two weeks after rolling out Gemini 4 Argon, Google has announced Gemini 4 Carbon. This isn’t the Flash model equivalent we’ve been waiting for but, rather, is an improvement on Argon, and like that model, Google is working on a staged release that could take a while.
  • “Stop me if you’ve heard this one before: Google says its latest AI model reaches a new threshold in coding, agentic tasks, and scientific analysis. It’s so capable, in fact, that Google can’t let you use it just yet.
  • “Gemini 4 Carbon reportedly makes big gains in cybersecurity applications. Google says the model shows a “significant leap” in vulnerability detection, validation, and remediation. Carbon is also apparently twice as likely to generate code that is free of vulnerabilities versus Argon. Meanwhile, the Chrome team claims that Carbon is 10 times better at generating “high-quality” patches compared to non-Google models. Google also notes that Carbon has increased its score by 89 points on WebDev Arena, now ranking at number four on the leaderboard.”
    
• Anthropic informs us,
  • Anthropic’s life sciences team is working to accelerate curing disease. Over the past several months, our scientists have engaged in deep research partnerships with six organizations developing new medicines: BigHat Biosciences, Bristol Myers Squibb, Divergence Labs, Enveda, Generate Biomedicines, and The Column Group. We’ve also begun drug discovery efforts of our own. In doing so, we’ve learned a lot about how Claude can support drug development, and how we’ll need to improve Claude further to realize AI’s potential in medicine. We plan to scale this work up substantially from here.

• Silicon Angle adds,
  • “Anthropic PBC today [October 6] expanded its Cyber Verification Program into three tiers of access for vetted security teams, with fewer blocks on cybersecurity work at each step up.
  • “The overhaul is aimed at a restriction Anthropic built into its own products. Because the company treats cybersecurity as dual-use, its generally available models carry conservative classifiers that block most cyber work. When Claude Opus 5.5 launched Sept. 22, most security tasks sent to it were routed to the older Opus 4.8.
  • “Anthropic is folding Project Glasswing into the program at the same time. Since April, Glasswing has given Claude Mythos access to organizations that secure critical software, and Anthropic widened it to 150 more organizations in June. Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1 are available at every tier of the new structure, and later models will be added as they ship.” * * *
  • “The program is available through the Claude Platform, Google LLC’s Vertex AI and Microsoft Corp.’s Foundry service. On Amazon Web Services Inc.’s Bedrock, it is limited to customers eligible for Enterprise Frontier Safeguards.”

From the cybersecurity policy and law enforcement front,

• Per a Cybersecurity and Infrastructure Security Agency (CISA) news release,
  • “The Cybersecurity and Infrastructure Security Agency (CISA) today [October 26] released its new strategy, CISA 2030: Defend, Harden, Prevail, which advances President Trump’s Cyber Strategy for America and National Resilience Strategy while strengthening the security and resilience of the nation’s critical infrastructure.
  • “The strategy addresses an increasingly complex threat environment, strengthens national cyber defense, and prioritizes the infrastructure most essential to America’s national security, economy, public health, and safety.
  • “The threat landscape is evolving at an unprecedented pace. Nation-state actors and other malicious adversaries are becoming increasingly sophisticated in their attempts to compromise U.S. networks. CISA is strengthening national cyber defense through decisive, proactive action to identify, disrupt, and eliminate adversarial access while hardening critical infrastructure against emerging threats.
  • “I call on every company and organization in the critical infrastructure community—from owners and operators to vendors and technology manufacturers—to act now,” said CISA Acting Director Nick Andersen. “CISA 2030 provides a focused roadmap to strengthen defenses, eliminate adversarial footholds, and deny them any advantage that could endanger the nation’s security, economy, or public health.”

• Federal News Network adds,
  • “Agency chief information security officers are working together through an unofficial “CISO working group” to help accelerate the migration to post-quantum cryptography.
  • “Bill Newhouse, cybersecurity engineer and project lead at the National Institute of Standards and Technology’s National Cybersecurity Center of Excellence, said Wednesday that the June executive order and corresponding Office of Management and Budget memo gave leaders a push to collaborate more. Newhouse added that the White House’s guidance allowed for more conversations to help agencies identify what gaps remain in the migration process.
  • “We need to think about what tools do we have in common and how do you leverage those to gain information about cryptographic use and functions so that we can take advantage of what the [content delivery network] program has accomplished and is still trying to accomplish,” Newhouse said at Red Hat’s Government Symposium.

• Cybersecurity Dive tells us,
  • “Small and rural healthcare organizations are among the most vulnerable critical infrastructure organizations in the nation.
  • “The U.S. government will help protect rural hospitals from cybersecurity threats as part of a new pilot program that could generate lessons for how to secure healthcare infrastructure nationwide.
  • “The White House’s Office of the National Cyber Director (ONCD) and the Department of Health and Human Services (HHS) on Monday launched Project Lifeline 250, a six-month program through which technology and cybersecurity firms will offer free hardware and services to rural hospitals. Partner companies, including Cisco, Cyera, Microsoft, Trellix and Zscaler, will upgrade hospitals’ basic defenses, provide them with backup hard drives in case of outages and help them identify and replace insecure legacy technology.
  • “The order requires agencies to transition “high value assets” and “high impact systems” to post-quantum cryptographic keys by Dec. 31, 2030, and PQC digital signatures by the end of 2031.”

• Per an HHS news release,
  • “The United States Department of Health and Human Services (HHS) Office for Civil Rights (OCR) today [October 29] announced a settlement with Lehigh Valley Health Network (LVHN) and its affiliated covered entities concerning potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules. Under the terms of the resolution agreement, LVHN agreed to a three-year corrective action plan, and paid $800,000 to OCR.
  • On May 15, 2023, LVHN, a health system in Pennsylvania, filed a breach report stating that on February 4, 2023, LVHN discovered suspicious activity in their IT system that was subsequently determined to be ransomware. As a result of this ransomware attack, protected health information (PHI) was exfiltrated and posted on the dark web. The attack affected the PHI of 248,359 individuals and included sensitive photographs of cancer patients receiving radiation oncology treatment, names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial information, diagnoses and conditions, lab results, medications, and treatment information.” * * *
  • “The resolution agreement and corrective action plan may be found here [PDF, 337 KB].”

• Cyberscoop reports,
  • “Authorities seized the domain of Virtualine, a bulletproof hosting provider that cybercriminals used to commit a large-scale sextortion scheme, ransomware, data theft, malware hosting and money laundering, the Justice Department said Tuesday. 
  • “Virtualine facilitated prolific criminal activity, including the distribution of child sexual abuse material (CSAM), the Justice Department said. The Russian-speaking bulletproof hosting provider was among the most active this year in crypto-related crime in particular, researchers said. 
  • “The site and its associated infrastructure stands out among the dozens of bulletproof hosting providers currently tracked by TRM Labs. “It was not among the largest by total inflows, but it received the most illicit-attributed value in 2026 to date,” the blockchain and cryptocrime research firm wrote in a blog post.”
• and
  • “A defense contractor with top secret security clearance pleaded guilty to aiding North Korea’s remote worker scheme by allowing co-conspirators to use his identity to apply for jobs, including positions with national security implications, the Justice Department said Wednesday. 
  • “John Allen Kurrle Jr. participated in a short-lived but prolific conspiracy that spanned at least 88 job applications at U.S.-based companies, resulting in nine job offers, according to court records.
  • “The 62-year-old allowed co-conspirators to use his identity and government clearance for prospective sensitive work, often with U.S. government contractors. The nine job offers Kurrle’s co-conspirators received between June and October 2025 had annual salary ranges of $120,000 to $190,000.
  • “The scheme had a limited success rate. The longest and most lucrative job a co-conspirator landed under Kurrle’s identity lasted about three weeks, netting a total pay of $4,800.”

From the cybersecurity breaches and vulnerabilities front,

• This bullet is astounding. The Wall Street Journal reports,
  • “Last week, the founder of the world’s largest crypto exchange delivered a chilling warning that read more like a tagline to a horror movie than a reminder to be vigilant on cybersecurity.    
  • “No crypto wallet is 100% safe,” Binance’s Changpeng Zhao wrote on X, the social-media platform. “No tech is 100% secure.”  
  • “Binance’s own users were soon caught in a whirlwind of recent software hacks, widespread panic and bitter recriminations. In the latest, and biggest, cyberattack that has buffeted the world this “Black October,” North Korean hackers ransacked Binance on Thursday afternoon [October 29]. In 20 minutes, they had made off with at least $6.3 billion.
  • “The speed, scale and sophistication of the heist has left the crypto industry reeling, and renewed questions about the digital-asset markets and whether they will ever fulfill their promise as a viable alternative to the traditional financial system or even a safe place to store money. The momentum that had lifted bitcoin and other cryptocurrencies to record highs last year had already stalled. But the recent spate of attacks, punctuated by Binance’s hit, threatens to deal a more serious blow.
  • “It’s a really tough moment for the crypto industry,” said Ari Redbord, global head of policy at crypto intelligence firm TRM Labs.” * * *
  • “At 10:30 p.m., The Wall Street Journal reported findings from cybersecurity research firms TRM Labs and Pangolin Intelligence that the attack was linked to North Korea’s state-sponsored TraderTraitor hacking unit. The same group has been behind many of the largest crypto attacks, including the $1.5 billion ByBit attack in 2025, previously the largest hack in crypto history.”

• Cyberscoop relates,
  • “A company working on behalf of the Department of Homeland Security sought to cut off online access to information on more than 41,000 employees that hacktivists said they obtained from a database breached at DHS.
  • “A search tool for the database, named Icepick, went offline for a spell before coming online again Thursday [October 29] under a different registrar.
  • “Icelandic hosting company FlokiNET said Thursday that it received a request from DHS contractor ZeroFox to remove the data, which it refused.
  • “By mid-morning, icepi.cx no longer resolved. Its registrar, CentralNic, had placed the domain on serverHold,” FlokiNET said in a blog post. “Our refusal kept nothing online. The request that decided the outcome to take the site down was not the one sent to us. A registrar reached the opposite conclusion the same morning, published nothing, and a global audience lost access to the site. In the meantime the site is online again under a domain from a different registrar.”
• and
  • “China state-backed threat group is using ARTEX, the automated agentic AI penetration testing framework, to achieve remarkable speed, scale and success in a campaign that already compromised about 140 sensitive targets in 11 days, according to CrowdStrike. 
  • “The threat group, which CrowdStrike tracks as Vapor Panda, targeted more than 200 organizations in at least 14 countries since Oct. 17, the security company said in a threat report Thursday. Targets and confirmed victims include foreign ministries, a European country’s presidency and prime minister’s office, defense and intelligence agencies; 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors; and telecom providers in the United States, Belgium and the Philippines. 
  • “CrowdStrike told CyberScoop about 70% of Vapor Panda’s targets were confirmed compromised or had evidence indicating moderate confidence of a successful intrusion. 
  • “Vapor Panda’s use of ARTEX, paired with DeepSeek, allowed it to accomplish more tasks with shocking speed — requests occurring as often as every 10 seconds — and pursue multiple attack paths concurrently. 
  • “This is the first time that we’re seeing an agentic adversary nation-state threat actor at this scale, and I think that this is probably, unfortunately, something we’ll see more of,” Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, told CyberScoop.”
    
• Cybersecurity Dive tells us,
  • “Hackers are increasingly targeting internet of things devices, including on home networks, in attacks that can serve as launching pads for campaigns against enterprises, security firm Bitdefender and networking vendor Netgear said in a report on Wednesday [October 28].
  • “As enterprises get better at protecting their digital infrastructure, cybercriminals are turning to connected home devices,” the report said, describing home IoT devices as “an ideal foothold,” because they are “always on, reliable, and rarely monitored.”
  • “While the report focuses on home networks, it has implications for businesses that run similar devices on enterprise networks, as well as for companies whose executives are vulnerable to compromise at home.”

• HIPAA Journal informs us,
  • “An analysis of data breaches affecting 500 or more individuals reported to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) in August 2026 shows a considerable improvement from the previous month. Data breaches are down 34% month-over-month, with August’s total of 52 data breaches, the second-lowest monthly total in the past 12 months, well below the 12-month average of 66 data breaches per month.
  • “While August was a relatively good month for healthcare data breaches, the year-to-date figures show that 2026 is turning out to be another bad year for healthcare data breaches. Last year was the worst-ever year for healthcare data breaches, with 807 incidents reported. So far this year, 593 large healthcare data breaches have been reported to OCR. At this time last year, the total stood at 556 data breaches. That’s a 6.7% year-over-year increase.”
• and
  • “Blueberry Pediatrics, a telemedicine service provider that offers subscribers access to board-certified pediatricians, has been affected by a data security incident involving a third-party tool called Metabase. The incident resulted in the theft of the sensitive data of 340,915 individuals.
  • “Metabase, a business intelligence and data visualization platform used by more than 100,000 organizations, was found to contain a critical vulnerability. On August 22, 2026, Blueberry Pediatrics learned that the vulnerability had been exploited by a hacker who obtained a copy of patient data. Metabase was also used by Photon, a prescription service provider used by Blueberry Pediatrics, that exposed a subset of the same information. On August 24, 2026, Photon advised Blueberry Pediatrics that the vulnerability had also been exploited by a different threat actor, who also obtained a copy of patient data.”

• CISA added ten known exploited vulnerabilities to its catalog this week.
  • October 26, 2026
    • CVE-2026-109618 – PHP Memory Corruption Vulnerability 
    • CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability 
      • See the frontier AI discussion above.
  • October 27, 2026
    • CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
    • CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability
      • The Hacker News discusses these KVEs here.
  • October 28, 2026
    • CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability
    • CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability
      • Security Affairs discusses these KVEs here.
  • October 29, 2026
    • CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound vulnerability
    • CVE-2026-76418 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
      • The Hacker News discusses these KVEs here.
  • October 30, 2026
    • CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
    • CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
      • The Hacker News discusses these KVEs here.

From the ransomware front,

• HIPAA Journal reports,
  • The University of New Mexico Health System (UNM Health) has experienced a cyberattack that has prevented access to critical electronic systems. The incident was detected on October 26, 2026, and as a precaution to ensure patient safety, all ambulance traffic was temporarily diverted to alternative hospitals. A decision was made to cancel all appointments at UNM Health facilities on October 26. UNM Health explained in a 2:30 p.m. update on October 26 that it was also temporarily limiting the acceptance of new patients while efforts continued to restore access to key systems.” * * *
  • “Law enforcement has been notified, and the incident is under criminal investigation, so limited information about the nature of the attack can be disclosed at this time. It is naturally too early to determine the extent to which patient data was involved. While UNM Health has not disclosed details about the nature of the attack, this appears to have been an attempted ransomware attack. A new ransomware group called Byod has claimed it was responsible. The group’s data leak site currently lists 10 victims.
  • “The group’s post about the attack suggests that 36,000 systems at the UNM main campus and UNM Health were compromised, and that patient, student, and employee data was exfiltrated, along with payroll information, internal emails, and Cerner EHR rosters. The group later backtracked to a degree, adding a further post stating it was unaware that “[UNM Health] was running machines related to assisting patients in real-time,” and offered to provide certain decryption keys for free. “(we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only… To any patient that was affected, we will pay you up to $2,500 each for the inconvenience. We are sorry once again. We have morals, and we have a heart, we are not villains, but we will still hold companies responsible for bad security leading to compromise of any customer data.”
    
• The Hacker News relates,
  • “Cybersecurity researchers are calling attention to what they say is a “recurring social engineering pattern” across hundreds of cases in which threat actors use Microsoft Teams’ external chat creation feature to conduct impersonation scams or to deliver malware.
  • “A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same ‘IT Support (Internal)’ display names, the same remote-access tools, and increasingly, the same payload domains,” Arctic Wolf Labs said in a report shared with The Hacker News.
  • “The attacks consistently employ IT-themed display names or friendly-sounding first names to subvert external-user warnings in Teams. These messages originate from Teams identities established through newly created or acquired Microsoft 365 tenants.”

• Info Security Magazine tells us,
  • “Cybersecurity leaders can now use a new framework to find and address weaknesses that could leave their AI systems vulnerable to ransomware attacks.
  • “The tool is the Ransomware Assessment and Incident Defense Framework for AI Systems (RAID-AI) and is fully available for anyone to use online for free.
  • “Behnaz Karimi, co-lead of the Open Worldwide Application Security Project’s (OWASP) AI Bill of Materials (AIBOM) initiative, developed RAID-AI over the past two years with the help of Yuvaraj Govindarajulu, also co-lead at OWASP AIBOM.” * * *
  • “Speaking to Infosecurity, Karimi said RAID AI focuses on ransomware attacks against AI systems, whether or not an attacker uses AI. The framework’s approach is hands-on, asking security teams to assess their own controls rather than connecting to or scanning their systems.
  • “Right now, we are slowly seeing that ransomware attacks targeting AI systems are happening,” Karimi said.
  • “She highlighted a April 2025, a report by Zoran, Mitrovic head of engineering at Kintra Health, which detailed how ransomware actors used data poisoning techniques, as well as an alleged cyber-attack on Novo Nordisk in June 2026, where hackers claimed to have stolen AI models used by the pharmaceutical company.”

• Bloomberg adds,
  • “When hackers crippled the computer network of a Canadian retailer, its owners asked Surefire Cyber Inc. to bargain with the cybercriminals on their behalf. Negotiator Joe Tarraf knew a few things about his opponents: The Russian-speaking hackers respond badly to low-ball counters. Keep them waiting too long, and you risk infuriating them. And when they offer to “split the difference,” there may still be room to bargain.
  • “But Tarraf, 41, also had some extra help. Hackers, like everyone else, have habits — and few are better positioned to learn them than artificial intelligence technology that can analyze hundreds of negotiations at once. Earlier this year, Surefire had introduced an AI tool for just that, using it internally to help its staff tailor their tactics based on lessons drawn from past negotiations with various cybercrime crews.”

From the cybersecurity business and defenses front,

• The Harvard Business Review lets us know,
  • “To build cyber resilience, organizations need to think about fostering internal relationships instead of just compliance. Social capital—the relationships, trust, and shared understanding that support cooperation—is an integral feature of how business units interact, cooperate, and pursue shared organizational goals, and in this cybersecurity is no different than anything else. Yet it is often overlooked in how companies address cyber risk. New research offers three important findings for leaders:
    • 1) security benefits from compliance activities have a ceiling,
    • 2) shared social capital effectively increases AI and cybersecurity, and
    • 3) large, complex organizations see bigger payoffs from social capital.
  • Taking a social capital approach to drive increased AI and cybersecurity is more a mindset than a process redesign, but leaders can take several concrete steps to invest in building it.

• NTT Data adds,
  • “Artificial intelligence is reducing the cost and complexity of cybercrime, helping attackers automate reconnaissance, improve phishing, adapt campaigns and analyze vulnerabilities more quickly. At the same time, many organizations still rely on decision-making processes, governance layers, patching cycles and manual controls designed for a slower environment.
  • “That creates a growing asymmetry.
  • “For business leaders, the question is no longer simply whether the organization has the right security technologies in place. It is whether it can recognize risk, make decisions and act quickly enough when the environment changes.
  • ‘The goal therefore cannot be perfect prevention. It has to be resilience: knowing what matters most, detecting threats early, containing disruption and recovering quickly enough to keep the business operating.”

• The Cybersecurity Hub, writing in LinkedIn, reports,
  • “Microsoft is preparing to add an artificial intelligence-powered security feature to Teams that examines conversation context for signs of phishing, impersonation and social engineering.
  • “The update addresses a weakness in workplace messaging security: an attacker does not necessarily need to send malware or a suspicious website to begin compromising an organisation. A convincing introduction from someone claiming to represent IT support can be enough to persuade an employee to share information or grant access to a device.
  • “Microsoft plans to begin a targeted release in early November 2026 and complete that phase by mid-November. Worldwide general availability is expected between early and mid-December. Administrators will not need to take action to enable the protection, according to the announcement. These remain planned rollout dates.”

• Cyberscoop points out,
  • “Fresh off the PHP2Shell advisory, former DHS CISO and acting deputy CIO Hemant Baidwan — now executive CISO at Knox Systems, the largest federal managed cloud — joins Safe Mode to break down what actually happens in the hours after a high-severity vulnerability drops. He walks through why “patch it and move on” gives teams a false sense of security, how to map internet reachability in environments that change by the hour, and what a CISA KEV listing really signals to defenders. Baidwan also reflects on writing DHS’s first-ever AI cybersecurity guidance, what he’d add to that playbook today — starting with AI agent identity — and why he thinks compliance has drifted into security theater.”

• Here’s a link to Dark Reading’s CISO Corner.