CyberSecure Specialist

24 Oct

MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration

Information

Executive summary This report analyzes activity during which UAC‑0099 gained initial access on July 16th, 2025 and handed it off to Sandworm, which then conducted a data-wiping attack on September 17th, 2025. It particularly focuses on the MythicRatatoskr backdoor, which is unique in its use of the Yggdrasil mesh network to communicate with a C&C server hosted within it. We presented our findings about MythicRatatoskr at LABScon on September 18th, 2026, and at the Virus…

Read More
23 Oct

In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware

Information, News

SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers stay well-informed about the evolving cybersecurity environment. Here are this week’s highlights:  Heartbreaker macOS ransomware rebuilds itself from source Researcher Patrick Wardle has analyzed Heartbreaker,…

Read More
23 Oct

11 Million Impacted by Capcom Data Breach

Data Breaches, Information, News

Japanese gaming company Capcom has disclosed a data breach impacting 11 million email addresses and the personal information of a small number of individuals. The incident, the gaming giant says, was discovered on October 19 and involved unauthorized access to CAPCOM ID, its shared service used for accessing online services and for playing online games. During the intrusion, the hackers stole the email addresses of 11,774,247 people, along with account data such as creation date,…

Read More
22 Oct

Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU

Information, News

Oracle has released its Critical Patch Update (CPU) for October 2026. The latest updates bring 1,295 new fixes across dozens of products. According to an analysis conducted by Tenable, the new CPU addresses 1,209 unique CVEs, including 95 critical-severity flaws. Tenable says 439 CVEs have been assigned a high severity rating and 582 are medium severity. Oracle Fusion Middleware received the most fixes, 206, including 134 that can be exploited remotely without authentication. A significant…

Read More
21 Oct

Widespread PHP Flaw May Cause Many Site Outages Today

Information, Insights

Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these critical bugs are already being exploited in the wild. Image: Shutterstock.com, Sashkin. The flaws at issue are present in PHP, the programming language that…

Read More
21 Oct

Critical Vulnerabilities in PHP Require Immediate Patching

Attacks, Insights, Malware

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if…

Read More
21 Oct

Is the ad a scam? How to tell before you click

Information

Social Media You can trust a social media platform and still get scammed by an ad running on it Phil Muncaster 20 Oct 2026  •  , 7 min. read Fraudulent ads have been around for about as long as the advertising industry. Today, they often reach you through social media feeds, apps and search results you use every day, and the platforms showing them can also (inadvertently) help build them. In September, the US Federal…

Read More
21 Oct

PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

Information, News

Details on two critical-severity PHP vulnerabilities named PHP2Shell have been leaked online ahead of scheduled coordinated disclosure and official patches. On Tuesday, PHP warned that patches for the critical issues, both with a CVSS score of 9.2, are planned for Wednesday, 21 October 2026 at 14:00 UTC (10:00 am ET), urging defenders to prepare for immediate patching. “All PHP users are encouraged to prepare now so they can upgrade as soon as the release is…

Read More
19 Oct

Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

Information, Malware, News

Siemens revealed on Monday that threat actors have exploited a vulnerability in Siemens Software Center as part of a malware campaign. Siemens Software Center handles the download, installation, activation and updating of software that customers have bought, and it can also be used to start free trials. The vulnerability, tracked as CVE-2026-110936, exists because the program doesn’t properly restrict the locations it searches for DLL files. An authenticated local attacker could plant a malicious DLL…

Read More
19 Oct

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

Data Breaches, Information, Insights

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom. Hackers aligned with ShinyHunters have claimed credit for dozens of…

Read More