Vulnerabilities & remediation
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
The Hacker News reports: Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections.
Cybercrime & Fraud
ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident
The Hacker News reports: ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup.
Nation-State & Espionage
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
The Hacker News reports: The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO).
Ransomware & Extortion
#StopRansomware: SafePay Ransomware
CISA reports: Advisory at a Glance Title #StopRansomware: SafePay Ransomware Original Publication October 20, 2026 Executive Summary This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia.
Cloud, Identity & SaaS
Authentication Shouldn’t End After MFA Succeeds
Security Magazine reports: Attackers have adapted to MFA defenses, finding ways to steal authentication tokens or trick users into approving requests.
Vulnerabilities & remediation
Hitachi Energy MicroSCADA X SYS600 Product
CISA reports: View CSAF Summary Hitachi Energy is aware of multiple vulnerabilities that affect MicroSCADA X SYS600 product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
Vulnerabilities & remediation
HMS Networks PEAK-System PCAN Windows drivers
CISA reports: View CSAF Summary Successful exploitation of these vulnerabilities could crash the Windows kernel.
Security Operations
Security Leaders Share Concerns About California Student Data Breach
Security Magazine reports: California students and families were recently notified of a data security incident, and security leaders are sharing their concerns.