The University of New Mexico is canceling classes across the medicine, nursing, and pharmacy faculties for a second day amid continued efforts to recover from a “cybersecurity event.” The attack targeted the Health Sciences Center on Monday, the Uni revealed, forcing it to shut down systems, cancel appointments and clinics at UNM Health hospitals, and divert ambulances to healthcare facilities in nearby Albuquerque and Santa Fe. Hospital appointments and clinics return to normal today, although nonessential UNM Health Sciences Center staff are being asked to remain at home. “The University of New Mexico Health Sciences Center (HSC), which includes the UNM Health clinical delivery system, experienced a cybersecurity event Monday, Oct. 26, 2026,” the university said in a statement on Monday evening. “HSC information technology security teams immediately took steps to contain the event and protect the network. They also notified state and federal law enforcement and engaged external partners to assist with the investigation. “Leadership activated an Emergency Operations Center to coordinate the response and provide guidance to HSC employees, students, and UNM Health system frontline providers.” The university announced the attack at 1430 local time, immediately cancelling all remaining clinics and classes, dismissing everyone other than critical and clinical staff, and urging patients not to attend HSC facilities. It has not commented on the nature of the cyberattack, although that hasn’t stopped researchers from speculating about ransomware’s involvement. Rumors were fuelled by the newly assembled BYOD ransomware group claiming responsibility for the attack on Monday afternoon. It’s important to note that just because a purported ransomware group took credit for the attack, it does not mean they actually were responsible, nor does it mean they deployed a ransomware/locker payload as part of the attack. However, the group’s take on the digital raid is that it compromised 36,000 machines, “both [Active Directory] forests,” two Oracle databases, the personal data belonging to every student and employee, as well as internal emails and data from other systems. As Reg readers know, a cybercriminal’s word is never one to be trusted. Yet BYOD’s claims about breaching Trump Mobile’s customer database appear to have held up It was a bold debut, even for a ransomware crew: BYOD’s first named victim was the US president’s smartphone biz, with data allegedly leaked for all 3,615 customers. A rival group, EndZone, claimed a similar breach a week earlier, and some experts suggested the two could be one and the same. In May, the Trump Mobile was found leaking thousands of people’s data via a poorly secured website. The Trump Organization did not respond to our requests for more information in either of these cases. A UNM spokesperson declined to answer our additional questions, directing us back to its public statement. ®
The University of New Mexico is canceling classes across the medicine, nursing, and pharmacy faculties for a second day amid continued efforts to recover from a “cybersecurity event.” The attack targeted the Health Sciences Center on Monday, the Uni revealed, forcing it to shut down systems, cancel appointments and clinics at UNM Health hospitals, and divert ambulances to healthcare facilities in nearby Albuquerque and Santa Fe. Hospital appointments and clinics return to normal today, although nonessential UNM Health Sciences Center staff are being asked to remain at home. “The University of New Mexico Health Sciences Center (HSC), which includes the UNM Health clinical delivery system, experienced a cybersecurity event Monday, Oct. 26, 2026,” the university said in a statement on Monday evening. “HSC information technology security teams immediately took steps to contain the event and protect the network. They also notified state and federal law enforcement and engaged external partners to assist with the investigation. “Leadership activated an Emergency Operations Center to coordinate the response and provide guidance to HSC employees, students, and UNM Health system frontline providers.” The university announced the attack at 1430 local time, immediately cancelling all remaining clinics and classes, dismissing everyone other than critical and clinical staff, and urging patients not to attend HSC facilities. It has not commented on the nature of the cyberattack, although that hasn’t stopped researchers from speculating about ransomware’s involvement. Rumors were fuelled by the newly assembled BYOD ransomware group claiming responsibility for the attack on Monday afternoon. It’s important to note that just because a purported ransomware group took credit for the attack, it does not mean they actually were responsible, nor does it mean they deployed a ransomware/locker payload as part of the attack. However, the group’s take on the digital raid is that it compromised 36,000 machines, “both [Active Directory] forests,” two Oracle databases, the personal data belonging to every student and employee, as well as internal emails and data from other systems. As Reg readers know, a cybercriminal’s word is never one to be trusted. Yet BYOD’s claims about breaching Trump Mobile’s customer database appear to have held up It was a bold debut, even for a ransomware crew: BYOD’s first named victim was the US president’s smartphone biz, with data allegedly leaked for all 3,615 customers. A rival group, EndZone, claimed a similar breach a week earlier, and some experts suggested the two could be one and the same. In May, the Trump Mobile was found leaking thousands of people’s data via a poorly secured website. The Trump Organization did not respond to our requests for more information in either of these cases. A UNM spokesperson declined to answer our additional questions, directing us back to its public statement. ®
Elections give scammers plenty to work with: urgent deadlines, familiar faces, passionate supporters, and messages asking people to take action.
Some want you to “fix” your voter registration. Others want a donation, an answer to a survey, or payment for merchandise supposedly endorsed by your favorite politician. The details change, but the objective stays the same: get your money, your personal information, or both.
Here are five election-themed scams to watch out for.
Scam 1. “We’ll help you vote”
Not every election-themed lure starts with a threat. Some offer to make voting easier.
“Get your ballot on autopilot,” reads one text message we reviewed. It encourages recipients to join a permanent absentee list so their ballots arrive at home for every election, adding the reassuring words: “Verified. Tracked. Counted.”
A voting-assistance text message reviewed by Scam Guard
The message is a scam, though it borrows the language of a real Minnesota voting service. Minnesota does have a permanent absentee voter list, but the link in this text is fraudulent. To check or sign up, go directly to your election authority’s official website.
Other messages take the opposite approach: instead of offering convenience, they warn that you could lose your chance to vote.
A message might say you are not registered to vote, your details are incomplete, or your registration is about to be cancelled. Then it offers a link to sort everything out.
The FBI recently warned about messages that send recipients to fraudulent voter-registration pages. Instead of helping people vote, these sites collect personal information that criminals can use for further fraud.
In Brazil, scammers used a fake WhatsApp account with the Superior Electoral Court’s logo. It claimed to be the court’s “Customer Service Department” (which doesn’t exist) and told people to download an app called “Soluciona Pendência,” roughly translated as “Resolve an outstanding issue.” The message falsely warned that people could lose access to banking or government services.
Scam 2. “Donate now to help your candidate win”
A fundraising appeal arrives just as an election reaches a critical moment. It uses the candidate’s photograph, familiar campaign language, and an urgent request for money.
That does not necessarily mean the campaign sent it.
The FBI warns that scammers impersonate candidates and political fundraising organizations to collect supposed campaign contributions. Victims believe they are supporting a legitimate organization, but the money goes to criminals instead.
Before donating, find the campaign or organization’s official website yourself and check who will receive the payment. Don’t let a countdown, a matching-donation claim, or a message about an impending defeat rush your decision. The Better Business Bureau (BBB) advises researching political fundraising requests and resisting pressure to act immediately.
Scam 3. “Take our political survey and claim your reward”
Not every political poll is suspicious. But a request for your opinion can also be an opening for a scam.
The BBB warns about fraudulent polling calls that promise a prize in exchange for answering questions. After the “survey,” the caller asks for credit card information to cover shipping, taxes, or other costs associated with the supposed reward.
At that point, the questions about candidates have served their purpose: keeping you engaged long enough to introduce a payment request.
Other election-themed messages ask people to complete surveys through links. Treat those links with the same caution you would an unexpected donation or registration request. A familiar political organization’s name does not establish who operates the website.
You can decline an unsolicited poll. You should not need to hand over payment details simply to share your political views or claim a surprise reward.
Scam 4. “Pay this electoral fine” or “Report for election duty”
Few things make a message feel urgent quite like an official-looking demand backed by a possible penalty.
Brazil’s Superior Electoral Court (TSE) has warned about messages falsely claiming people had an unresolved voting issue. The messages link to fake government websites designed to steal personal information or trick people into paying.
Brazil does have legitimate electoral fines, which can be paid through official channels, including Pix. So a fine or Pix request alone doesn’t prove a message is a scam. If a message says you owe money or must perform election duty, check with the relevant authority using contact details from its official website. Don’t use the message’s phone number, link, or QR code.
Scam 5. Your favorite politician “wants you to buy this”
A politician’s name can be used to sell more than a political message.
Criminals use candidates’ names, photographs, logos, and slogans to advertise merchandise that never arrives. What looks like a way to support a candidate becomes an ordinary shopping scam wrapped in campaign branding.
Apply the same skepticism to a “commemorative,” “patriotic,” or supposedly collectible product advertised using a politician’s name. Before buying, ask:
Is the seller actually affiliated with the politician or campaign?
What, exactly, are you buying?
Is there evidence for claims about the product’s quality, usefulness, or future value?
What are the total price, refund terms, and any recurring charges?
A product does not become useful, valuable, or a sound investment because an ad places it beside a politician’s photograph. Nor does a photograph prove that the politician endorsed it.
There is also a difference between a product you consider poor value and a fraudulent offer. A product being poor value doesn’t automatically make it a scam. Look for clear deception: a fake endorsement, false claims, hidden fees, or an order that never arrives.
How to stay safe from election scams
You don’t need to work out every detail of a suspicious message before deciding whether to act on it. Verify the message through a route the sender does not control.
Go directly to official election websites to check registration, voting requirements, deadlines, and alleged penalties.
Verify donation requests independently. Find the campaign or organization yourself and confirm where your money will go.
Keep payment details out of unsolicited surveys. A political poll that turns into a request to pay for a prize is a red flag.
Check sellers before buying political merchandise. A candidate’s name or logo does not authenticate the shop.
Don’t mistake personal details for proof. A message can contain accurate information about you and still be a scam.
Keep political choices separate from requests for money or personal information. You can support a cause without responding to an unexpected message.
ISC2’s new Cyber-AI Workforce Coalition serves as a “vendor-neutral convener” to map the future of AI security careers, ISC2 CEO Scott Beale told Infosecurity
The US government’s cybersecurity watchdog has confirmed attackers are exploiting both critical PHP2Shell vulnerabilities, giving federal agencies three days to patch the bugs that have wreaked havoc across the web over the past week. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on Monday, setting an October 29 deadline for federal civilian agencies to address the flaws. The move marks a shift from last week, when the agency warned of the danger posed by PHP2Shell but said it had not yet observed successful exploitation in the wild. Both bugs are rated 9.2 on the CVSS scale and can be exploited without authentication to run code on vulnerable PHP servers. That’s bad news given how much of the web still relies on PHP, and just how many sites could be left exposed. Patches landed on October 21, but attackers had already beaten the maintainers to it. AWS spotted attempts to exploit the flaws as early as October 17, four days before the bugs were publicly disclosed. CISA’s confirmation comes amid growing evidence that attackers are doing more than simply knocking on the door. On October 24, Perplexity security researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php. The attacks came from two IP addresses and used memory exhaustion and disclosure to achieve remote code execution. The attackers then tried to contact external servers using PHP, curl, and wget, although no additional malware was successfully downloaded. Karimi’s findings were consistent with exploitation of CVE-2026-109618, but he found no evidence that the second PHP2Shell flaw was involved. He also warned that the honeypots used a favorable single-worker configuration, so the results don’t necessarily reflect how reliably the exploit works against production servers. Still, attackers appear to be giving it a good go. Delft University’s Threat Intelligence Lab has tracked more than 50,000 PHP2Shell exploitation requests from over 600 IP addresses across 70 countries. Of those, 171 addresses went beyond probing for vulnerable servers and started sending exploit code or malware droppers. CISA’s confirmation also comes after some of the earlier reports of successful PHP2Shell attacks turned out to be rather premature. Sophos walked back its initial assessment after determining that the activity it observed amounted to scanning and failed attempts, while Palo Alto Networks withdrew claims linking the vulnerabilities to an intrusion at a European government agency. CISA has not disclosed which organizations have been compromised or provided details of the attacks behind its decision to add the flaws to KEV. The listing confirms that the agency considers both vulnerabilities actively exploited, but it does not confirm how many production systems have been successfully breached. For federal agencies, the clock is now ticking. CISA is also urging organizations outside the federal government to prioritize the fixes, although the deadline does not apply to them. Admins should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch. Those running older, unsupported versions face the added headache of upgrading or obtaining vendor-supported fixes, while systems that cannot be secured should be taken offline until the risk is addressed. And with CISA now officially acknowledging exploitation, anyone still waiting for more proof before patching may be waiting a little too long. ®
The US government’s cybersecurity watchdog has confirmed attackers are exploiting both critical PHP2Shell vulnerabilities, giving federal agencies three days to patch the bugs that have wreaked havoc across the web over the past week. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on Monday, setting an October 29 deadline for federal civilian agencies to address the flaws. The move marks a shift from last week, when the agency warned of the danger posed by PHP2Shell but said it had not yet observed successful exploitation in the wild. Both bugs are rated 9.2 on the CVSS scale and can be exploited without authentication to run code on vulnerable PHP servers. That’s bad news given how much of the web still relies on PHP, and just how many sites could be left exposed. Patches landed on October 21, but attackers had already beaten the maintainers to it. AWS spotted attempts to exploit the flaws as early as October 17, four days before the bugs were publicly disclosed. CISA’s confirmation comes amid growing evidence that attackers are doing more than simply knocking on the door. On October 24, Perplexity security researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php. The attacks came from two IP addresses and used memory exhaustion and disclosure to achieve remote code execution. The attackers then tried to contact external servers using PHP, curl, and wget, although no additional malware was successfully downloaded. Karimi’s findings were consistent with exploitation of CVE-2026-109618, but he found no evidence that the second PHP2Shell flaw was involved. He also warned that the honeypots used a favorable single-worker configuration, so the results don’t necessarily reflect how reliably the exploit works against production servers. Still, attackers appear to be giving it a good go. Delft University’s Threat Intelligence Lab has tracked more than 50,000 PHP2Shell exploitation requests from over 600 IP addresses across 70 countries. Of those, 171 addresses went beyond probing for vulnerable servers and started sending exploit code or malware droppers. CISA’s confirmation also comes after some of the earlier reports of successful PHP2Shell attacks turned out to be rather premature. Sophos walked back its initial assessment after determining that the activity it observed amounted to scanning and failed attempts, while Palo Alto Networks withdrew claims linking the vulnerabilities to an intrusion at a European government agency. CISA has not disclosed which organizations have been compromised or provided details of the attacks behind its decision to add the flaws to KEV. The listing confirms that the agency considers both vulnerabilities actively exploited, but it does not confirm how many production systems have been successfully breached. For federal agencies, the clock is now ticking. CISA is also urging organizations outside the federal government to prioritize the fixes, although the deadline does not apply to them. Admins should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch. Those running older, unsupported versions face the added headache of upgrading or obtaining vendor-supported fixes, while systems that cannot be secured should be taken offline until the risk is addressed. And with CISA now officially acknowledging exploitation, anyone still waiting for more proof before patching may be waiting a little too long. ®
The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups.
The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked
