The last 30 days of cyber threats for education and government (358 items).
AI-assisted summaries and fixes, sources cited.
Medium · BleepingComputer ·
A tracked intrusion set, UAT-11473, used CVE-2026-20127 in Cisco's Catalyst SD-WAN controller systems to bypass authentication and plant KeyDrift malware, prompting defenders to check exposure and logs.
High · Graham Cluley ·
A ransomware incident at UNM's Health Sciences Center this week led to diverted ambulances, canceled surgeries and classes, and students being sent home.
High · Hackread ·
Artem Stryzhak, a Ukrainian citizen linked to the Nefilim and Hive ransomware operations, has been jailed for his role in attacks on healthcare, public-sector, and business targets in the U.S. and abroad.
Medium · Cisco Talos ·
A historical APT campaign leveraged CVE-2026-20127 in Cisco SD-WAN and Catalyst Controller to skip authentication, obtain access, and plant KeyDrift malware.
Medium · The Hacker News ·
Attackers began probing internet-facing Oracle E-Business Suite instances within days of a patch for a maximum-severity remote code execution bug in the Application Object Library.
High · Help Net Security ·
Artem Stryzhak, a Ukrainian citizen accused of aiding the Nefilim ransomware group, was extradited, entered a U.S. guilty plea, received a prison term, and later saw an $11 million reward announced.
Medium · The Hacker News ·
Adobe has issued a fix bundle for Campaign Classic that addresses eight security defects, one of which is CVE-2026-104351, with impacts ranging from code injection to privilege escalation.
High · BleepingComputer ·
A Ukrainian national linked to the Nefilim and Hive ransomware operations has been sentenced for attacks on hospitals, governments, and businesses worldwide from 2018 to 2021.
Medium · SecurityWeek ·
Attackers are scanning for and attempting to exploit an unauthenticated SQL injection issue in Oracle EBS that can lead to remote code execution.
Medium · The Hacker News ·
Two reported intrusions used Teams help-desk impersonation to gain remote access, then abused AD CS to issue certificates and escalate privileges.
Medium · The Hacker News ·
Unknown operators are using a .NET-based loader to inject code and load assemblies on Windows 10 hosts inside government organizations across Asia, Kaspersky reports.
Critical · Security Affairs ·
Federal cyber officials added Ivanti's remote-access product to the must-patch list in mid-October, while Volexity published details of an attack sequence already seen in the wild.
Medium · BleepingComputer ·
Microsoft resolved an Always On VPN connectivity problem on Windows 11 through security updates in September 2026, with no CVE attached.
Medium · SecurityWeek ·
Three vendors have disclosed security weaknesses that can lead to code execution, access-control bypass, or elevated privileges, making timely updates the priority.
High · Help Net Security ·
China-linked Volt Typhoon is reported to use compromised SOHO routers, IoT devices, enterprise appliances and servers as rotating relays to hide intrusions and reach critical infrastructure control planes.
Critical · CISA Known Exploited Vulnerabilities ·
A critical GitLab vulnerability tracked as CVE-2026-97229 lets an unauthenticated attacker run code and compromise the server; patching and exposure checks are urgent.
Medium · Help Net Security ·
CISA has refreshed its ScubaGear and ScubaGoggles assessment tools, adding a new baseline and stronger Gemini controls for Microsoft 365 and Google Workspace environments.
Critical · SecurityWeek ·
CISA is alerting defenders to attempted exploitation involving Node2Shell and Brotli, after honeypot operators recorded activity from a malfunctioning exploit and the item was placed in the KEV catalog.
Medium · Security Affairs ·
Cisco Talos reports VOLTA operators using VOLTA and VOLTA-AUTODOXER on Windows to collect personal data, assess victim value, and prioritize targets with LLM assistance.
Medium · Help Net Security ·
Cisco Talos researcher Ryan Fetterman detailed VOLTA-AUTODOXER, Windows malware that exfiltrates data, feeds it to an AI model, scores stolen assets, and builds victim profiles.
Medium · Hackread ·
Guardz and Palo Alto Networks announced on 2 November 2026 a partnership to integrate Prisma Browser into Guardz's security offering for smaller organizations.
Medium · BleepingComputer ·
Microsoft has resolved a documented Windows 11 problem that left Smart App Control unavailable for a subset of users after update KB5127648, with no CVE assigned.
Medium · Hackread ·
Cybercriminals are using counterfeit Adobe Acrobat download pages to push digitally signed installers that configure ConnectWise ScreenConnect for intruder-controlled remote access, CloudSEK reports.
Medium · Help Net Security ·
Byoky debuts as a multi-platform offering from Help Net Security, combining browser add-ons and mobile apps with key storage and access-request processing.