--- title: 'Cybersecurity Archive' url: 'https://securteksecurity.com/news/archive/cybersecurity' markdown: 'https://securteksecurity.com/news/archive/cybersecurity.md' date: '2026-10-28' description: 'Rotated-off cybersecurity stories, grouped by week. Week of October 21, 2026 Attackers hijack 333 Tor exit relays to intercept SSH connections and steal passwords (October 21, 2026) LiteLLM 1.107.0 supply chain compromise delivers a credential stealer and backdoor; stolen credentials abused (Octob…' --- # Cybersecurity Archive Rotated-off cybersecurity stories, grouped by week. ## Week of October 21, 2026 - [Attackers hijack 333 Tor exit relays to intercept SSH connections and steal passwords](https://securteksecurity.com/news/tor-exit-relays-hijacked-ssh-interception-ebury) (October 21, 2026) - [LiteLLM 1.107.0 supply chain compromise delivers a credential stealer and backdoor; stolen credentials abused](https://securteksecurity.com/news/litellm-1-107-0-supply-chain-compromise-credential-stealer-backdoor) (October 21, 2026) - [State Bank of India confirms 3,897 customer records with PII on the dark web](https://securteksecurity.com/news/sbi-confirms-3897-customer-records-dark-web) (October 21, 2026) ## Week of October 20, 2026 - [CISA adds six flaws to the KEV catalog: Plex2Shell chain, SiteGuard and Siemens Software Center](https://securteksecurity.com/news/cisa-kev-six-flaws-plex-siteguard-siemens) (October 20, 2026) - [Plex2Shell Plex Media Server chain widely exploited; Plex says exposed older servers may be compromised](https://securteksecurity.com/news/plex2shell-plex-media-server-chain-widely-exploited) (October 20, 2026) - [APT28 Swallowtail espionage campaign targets defense firms and law enforcement in two NATO countries](https://securteksecurity.com/news/apt28-swallowtail-espionage-nato-defense-firms-hookedge) (October 20, 2026) - [eMudhra emSign intermediate CA keys were recoverable by anyone; browsers block them and remove the root](https://securteksecurity.com/news/emudhra-emsign-intermediate-ca-keys-compromised-browsers-block-root-removal) (October 20, 2026) - [SafePay ransomware joint advisory reports at least 600 victims since August 2024](https://securteksecurity.com/news/safepay-ransomware-joint-advisory-at-least-600-victims) (October 20, 2026) - [Zeabur second breach reads 321,810 accounts and 3.2 million secret records; platform to shut down](https://securteksecurity.com/news/zeabur-second-breach-leaked-credentials-321810-accounts) (October 20, 2026) - [Community Medical Center in Falls City shuts down network after cyberattack; critical patients diverted](https://securteksecurity.com/news/community-medical-center-falls-city-cyberattack-critical-patients-diverted) (October 20, 2026) - [Google Cloud outage in London region disrupts Revolut services worldwide](https://securteksecurity.com/news/google-cloud-outage-london-region-disrupts-revolut) (October 20, 2026) - [AfD confirms hosting provider was hacked; email archive published online](https://securteksecurity.com/news/afd-confirms-hosting-provider-hacked-email-archive-published) (October 20, 2026) ## Week of October 19, 2026 - [ARTEX AI pentest tool tied to attacks on about 20 Japanese companies](https://securteksecurity.com/news/artex-ai-pentest-tool-attacks-japanese-companies) (October 19, 2026) - [Stolen UpdraftCentral keys used to install backdoors on WordPress sites](https://securteksecurity.com/news/stolen-updraftcentral-keys-backdoor-wordpress-sites) (October 19, 2026) - [Attackers backdoor five OVHcloud CLI releases on GitHub to steal secrets](https://securteksecurity.com/news/ovhcloud-cli-releases-backdoored-github-secret-stealing) (October 19, 2026) - [Arcadia forensic report confirms RAIDEN attack chain; 1,423,428 unauthorized emails sent](https://securteksecurity.com/news/arcadia-forensic-report-confirms-raiden-attack-chain-1423428-emails) (October 19, 2026) - [FirstVDS confirms customer data theft through VMmanager 6 vulnerability](https://securteksecurity.com/news/firstvds-confirms-customer-data-theft-vmmanager-6) (October 19, 2026) - [Bullhorn cyber incident takes staffing platform offline worldwide; restoration under way](https://securteksecurity.com/news/bullhorn-cyber-incident-staffing-platform-offline-restoration) (October 19, 2026) - [One hacker used AI agents to break into more than 100 company websites, Reuters reports](https://securteksecurity.com/news/hacker-used-ai-agents-cairn-break-into-100-company-websites-reuters) (October 19, 2026) ## Week of October 12, 2026 - [CISA adds actively exploited Ivanti Connect Secure zero-day to the KEV catalog](https://securteksecurity.com/news/cisa-kev-ivanti-connect-secure-zero-day-cve-2026-104935) (October 13, 2026) - [Ledger wallets sold through CryptoBilis carried a recovery-phrase-stealing implant](https://securteksecurity.com/news/ledger-wallets-sold-through-cryptobilis-carried-recovery-phrase-implant) (October 13, 2026) - [Microsoft Patch Tuesday fixes a record 1,400-plus flaws, including an exploited Windows Shell zero-day](https://securteksecurity.com/news/microsoft-patch-tuesday-1400-flaws-windows-shell-zero-day) (October 13, 2026) - [DOJ charges 14 in North Korean remote IT worker scheme; FBI seizes about 187 laptops and KVM devices in Texas](https://securteksecurity.com/news/doj-charges-14-north-korean-it-worker-scheme-lonestar-roundup) (October 13, 2026) - [Czech NÚKIB warns Russian actors are phishing Signal users through linked devices](https://securteksecurity.com/news/czech-nukib-warns-signal-linked-device-phishing) (October 13, 2026) - [UK Housing Ombudsman case system offline after third-party incident; contact details may have been copied](https://securteksecurity.com/news/uk-housing-ombudsman-case-system-offline-third-party-incident) (October 13, 2026) - [Ahold Delhaize cyber incident shuts down Albert Heijn distribution; centres restarting](https://securteksecurity.com/news/ahold-delhaize-incident-albert-heijn-distribution-disrupted) (October 12, 2026) - [DOJ and UK NCA disrupt West African scam networks in joint operation](https://securteksecurity.com/news/doj-uk-nca-joint-disruption-west-african-scam-networks) (October 13, 2026) - [Cisco Secure Email Gateway zero-day exploited in the wild (CVE-2026-76519)](https://securteksecurity.com/news/cisco-secure-email-gateway-zero-day-cve-2026-76519-actively-exploited) (October 14, 2026) - [CISA adds Palo Alto PAN-OS flaw to the KEV catalog (CVE-2026-0322)](https://securteksecurity.com/news/cisa-kev-palo-alto-pan-os-cve-2026-0322) (October 14, 2026) - [CISA adds two Ahsay AhsayCBS flaws to the KEV catalog](https://securteksecurity.com/news/cisa-kev-ahsay-ahsaycbs-cve-2026-105133-105134) (October 14, 2026) - [UK Legal Aid Agency breach update finds stolen records dating back to 1978](https://securteksecurity.com/news/uk-legal-aid-agency-breach-update-records-dating-back-to-1978) (October 14, 2026) - [Brooklyn DA and FBI seize 241 domains in crypto investment scam takedown](https://securteksecurity.com/news/brooklyn-da-fbi-crypto-investment-scam-takedown-241-domains) (October 14, 2026) - [Microsoft and Health-ISAC take down phishing kit marketplaces behind more than a billion malicious messages](https://securteksecurity.com/news/microsoft-health-isac-phishing-kit-marketplaces-takedown) (October 14, 2026) - [Anne Arundel County confirms August breach; files copied from limited systems](https://securteksecurity.com/news/anne-arundel-county-confirms-august-breach-files-copied) (October 15, 2026) - [Nasdaq network disruption at Carteret causes data gaps across US equities feeds, now resolved](https://securteksecurity.com/news/nasdaq-network-disruption-carteret-data-feeds) (October 15, 2026) - [AdFection: zero-click Candiru spyware delivered through targeted online ads](https://securteksecurity.com/news/adfection-zero-click-candiru-spyware-delivered-through-targeted-ads) (October 15, 2026) - [BAE Systems cybersecurity incident halts Bankruptcy Noticing Center nationwide](https://securteksecurity.com/news/bae-systems-cybersecurity-incident-halts-bankruptcy-noticing-center) (October 15, 2026) - [CISA adds Atlassian flaw to the KEV catalog (CVE-2026-21589)](https://securteksecurity.com/news/cisa-kev-atlassian-cve-2026-21589) (October 15, 2026) - [BeyondTrust Remote Support zero-day exploited since August (CVE-2026-102764)](https://securteksecurity.com/news/beyondtrust-remote-support-zero-day-cve-2026-102764-exploited-since-august) (October 15, 2026) - [Malware found in some Rank Math SEO PRO 3.0.123 downloads in supply-chain compromise](https://securteksecurity.com/news/rank-math-seo-pro-30123-downloads-malware-supply-chain) (October 16, 2026) - [Attackers tampered with AOMEI Backupper update servers in minutes-long windows to deliver a backdoor](https://securteksecurity.com/news/aomei-backupper-update-servers-tampered-backdoor-unc7017) (October 16, 2026) - [Energize Lab Eilik and Eiliko robots expose millions of private chats and can be remotely hijacked](https://securteksecurity.com/news/energize-lab-eilik-eiliko-robots-expose-chats-fleet-hijackable) (October 16, 2026) - [CISA adds Fortinet flaw to the KEV catalog (CVE-2025-61624)](https://securteksecurity.com/news/cisa-kev-fortinet-cve-2025-61624-peerstitch) (October 16, 2026) - [Compromised ConnectWise Cloud Backup credential used to sign in to 173 Microsoft 365 tenants](https://securteksecurity.com/news/connectwise-cloud-backup-credential-173-microsoft-365-tenants) (October 17, 2026) - [OpenCode discloses breach; provider keys may have been exposed in distillation attack](https://securteksecurity.com/news/opencode-discloses-breach-provider-keys-may-have-been-exposed) (October 17, 2026) - [Cysic halts cross-chain bridge after unauthorized mint of 10 million CYS](https://securteksecurity.com/news/cysic-bridge-unauthorized-mint-10-million-cys) (October 18, 2026) ## Week of October 5, 2026 - [Leak exposes ransom payments to Silent Ransom Group](https://securteksecurity.com/news/leak-exposes-ransom-payments-to-silent-ransom-group) (October 7, 2026) - [Denmark national population register (CPR) data taken through IT firm Pays ApS](https://securteksecurity.com/news/denmark-cpr-register-data-taken-through-pays-aps) (October 5, 2026) - [ASOS confirms social-engineering root cause in October breach](https://securteksecurity.com/news/asos-confirms-social-engineering-root-cause-in-october-breach) (October 8, 2026) - [Lawson discloses breach of 2.15 million Lawson ID accounts](https://securteksecurity.com/news/lawson-discloses-breach-of-2-15-million-lawson-id-accounts) (October 8, 2026) - [TFG London cyberattack takes IT systems offline at Phase Eight, Hobbs and Whistles](https://securteksecurity.com/news/tfg-london-cyberattack-phase-eight-hobbs-whistles-offline) (October 11, 2026) - [Gates warns of AI-powered cyberattacks within a year](https://securteksecurity.com/news/gates-warns-of-ai-powered-cyberattacks-within-a-year) (October 11, 2026) ## Week of September 28, 2026 - [Osaka Metropolitan University ransomware disrupts campus, 130,000 records at risk](https://securteksecurity.com/news/osaka-metropolitan-university-ransomware-disrupts-campus-130000-records-at-risk) (October 2, 2026) --- ## Navigation - Parent: [News Archive](https://securteksecurity.com/news/archive.md) - Previous: [Breaches Archive](https://securteksecurity.com/news/archive/breaches.md)