BleepingComputer reports over 1,000 exposed GitLab servers unpatched against an exploited RCE flaw

SecurityWeek@SecurityWeek

Max-Severity GitLab Vulnerability Exploited Against Alpine Linux securityweek.com/max-severity-g…

Bull Theory✓@BullTheoryio

🚨 October 2026 was one of the most terrifying months cyberspace has ever seen. Security researchers are already calling it "Black October." Tens of millions of people had their personal data exposed. Critical flaws were found in software that most of the internet runs on. Hospitals and local governments were knocked offline. And the month ended with one of the biggest crypto hacks ever. Most of these attacks used access that was already trusted, such as a vendor, a cloud login, a certificate or an old system. It started in the first week: • UNIVERSITY OF ILLINOIS CHICAGO: Ransomware compromised systems at its College of Medicine. • YAKINIKU KING: 10.79 million members' information leaked. • DENMARK'S CPR REGISTER: 8.8 million identity records accessed without authorization. • NIKKEI: 1.83 million records exposed, including about 150,000 with identifying information. Then one attack hit hundreds of organizations at once: • IDCF CLOUD: Ransomware on a single cloud provider disrupted services for 495 companies and local governments in Japan. The leaks kept coming through mid-October: • DAIICHI KOSHO: Around 8.7 million people's information potentially exposed. • SKYTICKET: Around 14.64 million records reportedly affected by unauthorized access. • BOOKOFF GROUP: Up to 6.43 million membership records compromised. • ZEABUR: 321,810 accounts and millions of environment-variable records accessed. • BURGER KING JAPAN: 11.18 million app account records potentially exposed. • SOURCENEXT: 22.52 million customer records potentially exposed. • CAPCOM: 11.77 million account records compromised. • UNIVERSITY OF COPENHAGEN: Personal information of about 525,000 people compromised. That's more than 100 million records in one month. Leaked names, emails and ID numbers are often used in scam emails and fake login pages. Then critical problems were found in software that most of the internet runs on. • EMUDHRA: On October 17, researchers found that the private keys behind eight of the Indian certificate authority's certificates were weak enough to be worked out. Browsers use these certificates to confirm a website is real. Chrome, Firefox, Apple, Android and Microsoft all blocked them within days. eMudhra's shares fell about 20%, and the company is now leaving the global SSL certificate business. • PHP2SHELL: On October 21, PHP released emergency fixes for two critical bugs that let attackers take over web servers without a password. PHP runs on about 70% of web servers, including WordPress sites. Within days, the US government confirmed hackers were actively exploiting the bugs and ordered federal agencies to patch within three days. • On the same day, attackers hijacked LiteLLM, a widely used AI developer tool, and pushed a malicious version that stole passwords, cloud keys and AI API keys. GitLab also patched a flaw rated 10 out of 10 in severity. The PHP bugs were found with help from an AI model. AI was also behind another security problem in October: AI agents. On October 15, India's cybersecurity agency CERT-In issued a critical warning. It said AI agents had accessed live systems at Indian organizations without authorization, including personal data and confidential business records. Some organizations did not even detect it themselves. US banks are seeing the same thing. JPMorgan, Morgan Stanley and Charles Schwab have started blocking outside AI agents from customer accounts. Schwab says a single agent can try to log in 30 to 50 times a week. In both cases, AI agents used real logins to access systems without permission. Governments are now preparing for what happens when these systems fail. On October 22, the UK launched its Be Ready campaign, advising people to keep at least three days of food and water at home. Similar guidance is in place across many countries: • Germany: Up to 10 days • Sweden: At least 7 days • Norway: 7 days • Estonia: 7 days • Japan: At least 3 days, preferably a week • France, Netherlands, Finland, Czechia: 72 hours • Denmark: 3 days • Canada: At least 72 hours These plans cover cyberattacks alongside power outages, natural disasters, sabotage and military emergencies. The biggest attacks came in the last week of October: • University of New Mexico Health: A cyberattack disrupted hospital appointments and forced ambulance diversions. • Daishin Securities: Personal information of 38,490 customers leaked. • Sony's So-net: Around 2.58 million customer records affected. • Florida Department of Education: Up to 4.9 million people potentially affected. • CryptoBilis: Up to $93 million reportedly stolen through tampered hardware wallets. • CoinDCX: Nearly $16 million lost through compromised legacy wallet infrastructure. • Binance: $6.3 BILLION stolen from compromised hot wallets. October showed how connected these risks have become. One weak certificate can let attackers impersonate websites. One software bug can expose most of the web. One cloud provider can take down hundreds of organizations. And one compromised wallet can put billions at risk.

ddimitrov22@ddimitrovv22

In case you didn't follow cybersecurity in October: >Binance lost ~$6.3B from its hot wallets in about 20 minutes, the largest crypto theft ever -Initial entry point: one engineer's compromised laptop -Chainalysis and TRM both attribute it to North Korea's TraderTraitor >PHP2Shell: two 14 year old bugs in the PHP interpreter gave unauthenticated RCE on WordPress, Drupal and Joomla servers -PHP runs ~70% of websites with a known server-side language -Found with AI help >Amazon's honeypots logged a PHP2Shell exploit attempt 4 days before the bugs were disclosed >China-aligned Storm-0940 used a stolen ConnectWise Cloud Backup credential to target 2,250+ Microsoft 365 tenants -Recon to exfiltration was run by ARTEX, an open-source multi-agent AI system -No MFA prompt, they signed in as an already-trusted app >OpenAI notified 100+ organizations that its own "misaligned" AI agents may have accessed their systems -OpenAI confirmed the agents probed SEC, Commerce and Education Department sites >LiteLLM's release pipeline was hijacked with stolen GitHub tokens and shipped a stealer to PyPI and Docker Hub -~23M weekly downloads, malicious version live for ~100 minutes -Stole cloud keys, SSH keys and Claude/Codex/Cursor auth files -Their second supply chain attack this year >Australia's cyber.gov.au went offline the night the PHP2Shell patches dropped -Along with government sites in France, Finland, Denmark and the Netherlands >A malicious Claude Code extension shipped under Anthropic's own extension ID on Cursor's marketplace -Added an attacker SSH key labeled "svc-telemetry" -Up to 5,000 users installed it in ~11 hours >Ledger X devices sold by a Malaysian reseller had a hardware implant that read seed phrases and sent them out over LTE -Researchers estimate $86M-$93M stolen from 300+ wallets >Capcom confirmed 11.77M CAPCOM ID records were accessed >Zeabur got breached twice in 2 months, then announced it's shutting down -2nd breach: long-lived admin credentials stored in plaintext -3.2M environment variable records exposed >eMudhra generated 8 intermediate CA keys with weak randomness, Chrome and Firefox blocked them, and eMudhra quit the global TLS business days later >GitLab patched two CVSS 10.0 RCEs in 9 days -The second one affects releases back to 2014 >Panasonic: an employee uploaded HR data on ~330K current and former staff and their families to a banned external AI tool -No hacker involved >Polymarket users lost ~$2.7M after a website performance script was hijacked to drain logged-in accounts -Second vendor-script drain on Polymarket this year >Rank Math PRO's own update server shipped a backdoor to WordPress sites for 11 hours >Plex2Shell got exploited a day after details went public -The attackers named their miner process "mylovelyminer" >A grey-market relay reconfigured Codex and Claude Code at 12 orgs to send all traffic through its servers and turn the sandbox off >Quest Diagnostics took its lab ordering system offline after unauthorized access, patient records believed exposed >CoinDCX confirmed a $16M loss days after its CEO called the reports a "false alarm" >Smaller crypto hits: -X100 $4.75M (flash-loan governance attack) -zkLink Nova $783K (bridge message replay) -Predict.fun $400K (compromised docs site) >Let me know what I missed If you work in security but don't have time to read 40 advisories a day - I post about web3 security every day. Follow so you catch the next recap🫡