JEDI-SEC | Security Research & Digital Defense

Category: Security News

  • Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise

    Security researchers identified attempts to access corporate networks which have been linked to a major Microsoft 365-targeted BEC campaign using phishing, stolen session tokens and social engineering

    Source: Infosecurity Magazine · 2026-10-23

  • Attacks on Tech Firms Behind Most Third-Party Data Breach Victims

    Kroll found that 69% of data breach victims in the past year were affected by a third-party breach, with attacks on tech companies the most common cause

    Source: Infosecurity Magazine · 2026-10-23

  • Crime Stoppers chapter freezes tips after breach breaks anonymity promise

    A breach exposed personal information in supposedly anonymous crime reports. Now one Crime Stoppers chapter has stopped accepting tips because it cannot guarantee anonymity.

    Toronto Crime Stoppers, which works with the community, police, and media to help solve crimes, has paused phone, website, and app submissions while it seeks a safer system.

    The breach occurred in March and involved P3 Global Intel, the Texas-based tip-management platform owned by Navigate360. Its software is used by Crime Stoppers programs and other organizations in the US and elsewhere.

    An October CBC investigation revealed the Canadian impact: More than 1.5 million tips spanning 25 years were exposed, with over 850,000 containing personal information. That included addresses, phone numbers, email addresses, and some banking details associated with rewards. The exposed details belonged to tipsters, people named in allegations, and others, including police and Crime Stoppers staff.

    Following CBC’s reporting, Toronto Crime Stoppers acknowledged that its promise of anonymity had been broken for some users. The organization stopped accepting tips, saying it could no longer guarantee users’ anonymity.

    In an October 21 statement, the organization says identifying details are normally removed before tips reach investigators, but some original submissions containing potentially identifying information were stolen from P3.

    For affected tipsters, exposure could create a risk of retaliation, intimidation, or extortion. Scammers could also use details of a genuine tip to make an approach more convincing.

    Unfortunately, the pause removes a reporting option for people afraid to approach police. Toronto police still accept reports directly, but warn that those channels are not anonymous.

    How to stay safe

    Toronto Crime Stoppers warned people worried about exposure to watch for impersonators. It says it will never contact them first to request a tip number, password, or other information.

    The statement did not describe an individual notification process or offer a way to check whether a particular tip was affected. For anyone wanting to submit a new tip, the organization’s message was clear:

    “Until we have a safer way to protect you, please do not send us tips by phone, online, or through the app.”

    Anyone in immediate danger should call 911. During the pause, non-emergency reports in Toronto should go directly to Toronto police, with the understanding that those channels are not anonymous.

    If you use a different Crime Stoppers program, check its official website for updates and advice about its reporting system.

    For more general advice if your information may have been exposed, read our blog “Involved in a data breach? Here’s what you need to know.”

    What do cybercriminals know about you?

    Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online.

    Source: Malwarebytes Labs · 2026-10-23

  • UK threatens subsea cable saboteurs with 14 years behind bars

    UK threatens subsea cable saboteurs with 14 years behind bars

    Britain is threatening subsea cable saboteurs with up to 14 years in prison and unlimited fines, having apparently decided that Victorian-era laws aren’t quite up to the job of keeping Russian submarines away from critical infrastructure. The government on Thursday set out plans to overhaul legislation dating back to 1885 and introduce tougher penalties for damaging the underwater cables and pipelines that keep Britain’s internet and energy supplies running. According to Whitehall, subsea cables carry around 99 percent of the UK’s international data traffic, while underwater pipelines account for 74 percent of its gas supply. Yet much of this infrastructure is protected by laws written when the telegraph was cutting-edge technology. The Submarine Telegraph Act 1885 originally imposed a £100 maximum fine for damaging a cable through culpable negligence. That might have been a reasonable deterrent back then, but it’s unlikely to give today’s would-be saboteurs much pause. Under the proposals, those who intentionally damage critical subsea energy or telecoms infrastructure could face up to 14 years behind bars. The proposals also set tougher penalties, including unlimited fines, for reckless or negligent damage. Subsea telecoms operators would face new legal duties to identify and manage security risks, while ministers would gain powers to direct companies and cable repair providers to take action where necessary and proportionate to protect national security. The government also wants to regulate fiber-optic sensing technology, which uses subsea cables to detect activity at sea but could pose a security risk if sensitive data falls into hostile hands. Unsurprisingly, Russia features prominently in Whitehall’s thinking. In April, British forces exposed a covert Russian submarine operation near critical undersea infrastructure. The operation reportedly involved an attack submarine acting as a decoy while two specialist vessels surveyed Britain’s cable routes. “The threats we face have changed dramatically, with suspicious Russian activity around critical undersea infrastructure, yet some of the laws protecting these vital connections date back more than a century,” said telecoms minister Ian Murray. The plans aren’t entirely new. In May, the government announced its intention to toughen penalties and introduce security obligations for cable operators. Thursday’s White Paper spells out the proposed penalties and how far ministers could go in directing operators to act. It also follows warnings from Parliament’s Joint Committee on the National Security Strategy, which concluded last year that Britain was insufficiently prepared for a coordinated attack on its subsea infrastructure. MPs and peers warned that government assessments focused too heavily on individual cable failures, rather than what might happen if attackers simultaneously targeted connections to Europe and across the Atlantic. Russian submarines aren’t responsible for every severed cable. Fishing boats and ships dragging their anchors do most of the damage, accounting for up to 97 percent of faults, according to previous government estimates. And even when sabotage is suspected, catching those responsible is another matter. Britain already has laws allowing life sentences for serious acts of state-backed sabotage, but they’re not much use if nobody can prove who did it. That’s rather difficult when the crime scene is at the bottom of the sea. And it might prove equally difficult to extradite suspects from enemy nation states. None of this is law yet. The government has opened a 12-week consultation on the plans, after which ministers will decide how to proceed. Whether the threat of a lengthy prison sentence will trouble Russian submariners is debatable. Even so, after 140 years, Britain’s subsea cable laws are finally getting dragged out of the Victorian era. ®

    Source: The Register — Security · 2026-10-23

  • State Bank of India Suffers a Customer PII Data Leak

    State Bank of India Suffers a Customer PII Data Leak

    Relatively small data breaches in India can turn quite serious, thanks to a sophisticated underground market for trading PII.

    Source: Dark Reading · 2026-10-23

  • Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack

    Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack

    The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.

    Source: Dark Reading · 2026-10-22

  • PHP2Shell exploit bypasses protections designed to stop remote code execution

    PHP2Shell exploit bypasses protections designed to stop remote code execution

    Researchers have developed a new exploit that shows how even Address Space Layout Randomization (ASLR) on an x86-64 server cannot stop the PHP2Shell vulnerability. VulnCheck, which made it available to only the company’s Initial Access Intelligence customers, also warned that threat actors are using AI to find even more ways to attack. The team told us that it’s a “significant advance” because up until now, ASLR has been a major barrier to exploiting PHP2Shell on real-world servers. They don’t expect that to hold, though. “Adversaries are clearly spending time (and tokens) on this bug,” Spencer McIntyre, director of exploit development at VulnCheck, told The Register. The PHP2Shell mess grew even bigger on Thursday amid reports of attackers abusing the security flaws days before they were disclosed and UK government websites proactively going dark. Vulncheck’s exploit targets CVE-2026-109618, a critical, out-of-memory corruption bug that leads to remote code execution (RCE) in PHP, and part of the PHP2Shell pair alongside CVE-2026-109619. The PHP Foundation officially disclosed and issued patches for both on Wednesday. Overnight, VulnCheck researchers developed what they believe is the first known exploit to achieve remote code execution on ASLR-enabled x86-64 systems with PHP’s recommended production configuration. ASLR is a built-in defense against memory-corruption bugs – like PHP2Shell – that randomly arranges memory locations of a program’s key data areas. By scrambling these components live, in memory every time a program runs, ASLR prevents an attacker trying to achieve RCE from correctly guessing the target memory address – and thus prevents them from executing malicious code. While VulnCheck has seen “hundreds” of PHP2Shell proof-of-concept repositories on GitHub, “very few contain legitimate, working exploits,” McIntyre told us, adding that this is largely due to ASLR. “There’s a significant difference between demonstrating a vulnerability and developing an exploit that can overcome the security protections found in real-world environments,” McIntyre said. “One of the biggest obstacles has been ASLR, a protection designed to make memory corruption vulnerabilities much harder to exploit.” The threat hunters’ new technique, we’re told, bypasses ASLR. It uses a confirmed memory leak chained into RCE on PHP 8.4.26, and they claim it works on x86-64 platforms even with ASLR enabled and PHP’s recommended display_errors=off production configuration. “We haven’t identified another public or commercial exploit that achieves this under the same conditions,” McIntyre said. “Developing this capability was far from trivial, but it demonstrates that a major barrier to exploiting PHP2Shell on production-configured systems can be overcome.” VulnCheck says it also works on ARM64, but the RCE is not currently functional on ARM-based systems. This should be a wake-up call to all organizations that, especially now in the era of AI bug hunting and exploit development, “the technical difficulty of exploiting a vulnerability shouldn’t be confused with protection against it,” McIntyre said. “Organizations running vulnerable versions of PHP should prioritize patching rather than assume existing memory protections or configuration changes will stop an attack.” ®

    Source: The Register — Security · 2026-10-22

  • What We Missed: Feds Lasso Texas Laptop Farms

    What We Missed: Feds Lasso Texas Laptop Farms

    In this video, Dark Reading editors discuss some of the news they didn’t get a chance to cover, from busting up North Korea’s stateside infrastructure in “Operation Lonestar Justice” to Staples’ gift card bonanza.

    Source: Dark Reading · 2026-10-22

  • Les supermarchés de l’UE paient d’un firmware de réfrigérateur non mis à jour

    Les supermarchés de l’UE paient d’un firmware de réfrigérateur non mis à jour

    Des centaines de magasins ont subi des pertes se chiffrant en millions d’euros parce qu’ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de climatisation.

    Source: Dark Reading · 2026-10-22

  • I had plans for that second

    I had plans for that second

    I had plans for that second

    Welcome to this week’s edition of the Threat Source newsletter. 

    Here for the latest on the PHP vulnerabilities? Head on down to ‘The One Big Thing’. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset. 

    But if you want a bit of levity, here’s what I wrote before everything kicked off yesterday: 

    Ever feel like the world is moving too fast to keep up? Well, I bring you scientific proof that it’s not just you. 

    For millions of years, the moon has been slowing down the Earth’s rotation. But over the past decade, we’ve been speeding up (I KNEW I was aging faster than before). Apparently, changes in the Earth’s core are involved (either that, or the 1978 Superman film was a documentary). 

    This is all causing massive headaches for the people responsible for keeping time. They’re officially called “The International Bureau of Weights and Measures”, but I’m going to call them “The Time-Keepers”. For nerd reasons).  

    The issue is that the atomic clocks that power so many of our systems, and the rotation of our planet, don’t always agree. Atomic clocks keep extremely consistent time, while each Earth day is rarely the same length as the next. Atomic timekeeping absolutely cannot stand that level of flexibility (have a watch of our “The Light We Keep” documentary to see the importance that accurate clocks have on critical infrastructure).  

    To keep Coordinated Universal Time (UTC), which is based on atomic clocks, aligned with Earth’s rotation, we introduced a “leap second” in 1972. This system allows for an extra second to be added, or taken away, when we stray too far from atomic time. 

    A few days ago, The Time-Keepers voted to officially abolish the leap second. Why? Well, there’s a few parts to it. 

    For the past 54 years, we’ve never once had a second removed from our lives. They’ve always been added (27 of them to be precise). I myself have experienced 20 of these extra seconds. If I’d have known that, I’d have used them more wisely. Like thinking before saying, “Love you too!” to the post-person this morning. 

    That added time, while it seems nice to have on the surface, can wreak havoc with our modern technology systems. In 2012, the extra second caused so much confusion that it crashed Reddit, among other systems. 

    The recent speeding-up of the Earth’s rotation complicates things further. If we keep going at this rate, it could result in the world’s first ever “negative second”. If you thought our technology systems struggled with added time, there are a lot of sciency brains who are very worried about the impact of taking time away. One of those concerns being… it’s never been done before.  

    So, what’s The Time-Keeper’s solution? Invent more time! Woooo. 

    Starting next May, the leap second will be replaced with a “leap hour,” allowing UTC to diverge from Earth’s rotation by up to an hour before a correction is made.  None of us will get to experience that extra hour in our lifetimes, but our Great, Great, Great, Great, Great, Great, Great, Great, Great, Great, Great grandchildren are going to have one hell of a party. 

    For us current mortals, we’re all getting a little less time, and we’re hurtling through space a little faster. Happy Thursday! 

    But I guess I do want to make the point that I’m glad the risk has been thoroughly assessed ahead of, ahem, time. The Time-Keepers have decided that the world’s infrastructure should not have to find out how it handles a missing second by collectively experiencing one.  

    And I don’t even want to think about how all the AIs would cope with a negative second… 

    There’s something here for incident response planning. “It’s never happened before” is an excellent reason to test whether you’re ready for it. Run the exercise. Find out which part of your plan depends on something that, in this scenario, is also broken. Preferably before an adversary gets to supervise the practical demonstration. 

    Now, if only the Time-Keepers can abolish Daylight Savings Time next… 

    The one big thing  

    Two unauthenticated remote code execution (RCE) flaws were discovered in PHP, rocking the internet. Dubbed “php2shell” and triggered by a simple HTTP request, this vulnerability affects every build since 5.4. Talos assesses that all industries running PHP applications are at risk for exploitation if systems remain unpatched.

    Why do I care? 

    PHP runs WordPress, Drupal, Magento, Shopware, WooCommerce, and many other ubiquitous internet staples, so the possible blast radius is enormous. Older branches are end of life (EOL) and will not receive patches; these could account for around 50% of use cases.

    So now what? 

    Cisco customers are covered with the Cisco Talos Network Intrusion Prevention (SNORT®) signatures 67359 and 67360. If your organization is running PHP 8.1 or older, Talos very strongly advises immediate update to PHP 8.2 or later. There is no patch for PHP 8.1 or older. See the article for more specific coverage and detection guidance.

    See an interview with Nick Biasini on php2shell defense:

    Top security headlines of the week 

    ‘PHP2Shell’ Bugs Signal Red Alert for Security Industry
    Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts. (Dark Reading)

    INC and The Gentlemen Ransomware Affiliates expose 8,257 AI messages
    SOCRadar has found seven exposed servers linked to INC and The Gentlemen ransomware affiliates, holding AI chats, stolen credentials and 46 encryptor builds. (Hack Read) 

    The AI hacking apocalypse is not inevitable
    While large language models present real risks to society, experts say they can be tested and largely controlled using well-worn cybersecurity and policy choices. (Cyberscoop)

    ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets
    Deceptive prompts lure AI agents into decoys and dead ends, cutting attack success by up to 91% in tests and raising the cost of a successful attack 23-fold.(SecurityWeek) 

    Can’t get enough Talos? 

    Compromised eMudhra intermediate certificates
    Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra.

    Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
    Adversaries are turning the tools businesses trust into delivery mechanisms for malicious activity. Cisco Talos observed abuse of more than 25 legitimate platforms over the past year, exploiting the built-in trust of collaboration, file-sharing, payment and other services to reach their targets.

    There’s only so much code: the rise in vulnerability numbers
    The September Microsoft Patch Tuesday release included 975 vulnerability advisories. This month, 1,415 vulnerabilities were just dropped. Compared to a pre-June average of 100 a month, that increase is staggering. Where did they come from? And what does the future look like?

    Upcoming events where you can find Talos 

    Most prevalent malware files from Talos telemetry over the past week  

    SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
    MD5: 2915b3f8b703eb744fc54c81f4a9c67f
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
    Example Filename:sample.exe
    Detection Name: W32.9F1F11A708-100.SBX.TG

    SHA256: 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f
    MD5: cca616647db9370c88998ae25da6997f
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f
    Example Filename:cca616647db9370c88998ae25da6997f.exe
    Detection Name: Win.Tool.Kmsauto::1201

    SHA256: 985c3972712218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9
    MD5: 485055033bcddfde56325c0d2feea4f2
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=985c3972712218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9
    Example Filename:485055033bcddfde56325c0d2feea4f2.exe
    Detection Name: Win.Tool.Kmsauto::1201

    SHA256: d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1
    MD5: 0c883b1d66afce606d9830f48d69d74b
    Talos Rep: https://talosintelligence.com/talos_file_reputation?s=d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1
    Example Filename:d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1.exe
    Detection Name: Win.Worm.Zard::95.sbx.tg

    Source: Cisco Talos Intelligence · 2026-10-22