Stay Safe OnlineDaily cyber news

Archived edition

Thursday 29 October 2026

Attackers turn PHP2Shell on Palo Alto Networks firewalls, Moldova investigates a government hack exposing data linked to 750,000 ID numbers, Sony's So-net and Japan Airlines confirm breaches, China-linked hackers' VMware and router tricks are exposed, and the UK budget promises a look at making software firms liable for breaches.

10 stories

PHP2Shell update: attackers now hitting Palo Alto Networks firewalls through their internet-facing management pages
Image: The Hacker News
Vulnerability

PHP2Shell update: attackers now hitting Palo Alto Networks firewalls through their internet-facing management pages

Palo Alto Networks warned on Wednesday that attackers are exploiting the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) against its firewall management interfaces that are exposed to the internet. It comes days after Israeli security firm Dream said a suspected China-linked attacker had combined PHP2Shell with a Linux kernel bug called Fragnesia (CVE-2026-46300) to take full control of 25 servers across the US, Japan, Taiwan and South Korea, including three in a US government-affiliated network, all running a large vendor's firewall software. CISA has added Fragnesia to its must-patch list and given US federal agencies until 31 October to fix it. Some PAN-OS fixes are still due on 29 and 30 October.

Why it matters: Firewalls are meant to keep attackers out, so a hacked one gives them a foothold inside the network. Palo Alto says no special settings are needed to be at risk, and the danger is greatest when the management page can be reached from the internet. Admins should install the fixed PAN-OS versions as soon as they are out, restrict management access to trusted internal addresses only, and follow Palo Alto's interim mitigations where a fix is not yet available.

Sources
Moldova investigates whether a foreign state was behind a government hack exposing data linked to 750,000 ID numbers
Image: The Record
Breach

Moldova investigates whether a foreign state was behind a government hack exposing data linked to 750,000 ID numbers

Moldova's Electronic Governance Agency says hackers abused flaws in government online services that did not require a login to pull out large amounts of personal information between 19 and 23 October, making about 11 million data requests. Information linked to about 750,000 identification numbers was taken, which may include names, dates of birth, family relationships, pensions, disability records, driving licences, photos, vehicle ownership and some financial details; bank card details were not affected. The government checked 82 online services and temporarily disconnected those it considered vulnerable, along with more than 30 other systems. Prime Minister Vasile Tofan said the country is the target of 'coordinated and large-scale cyberattacks' and that possible foreign state involvement is being examined.

Why it matters: Moldova has about 2.4 million people, so a large share of the population could be affected. The government warns that the stolen information could be used by fraudsters pretending to be banks or public bodies to get passwords, authentication codes or money. Anyone in Moldova should be wary of unexpected calls or messages asking for codes or payments. For any organisation, it is a reminder that online services which do not ask users to log in still need to be checked for flaws that leak data.

Sources
China-linked 'Warp Panda' hackers used a VMware ESX flaw to hide their tracks, and CISA adds it to its must-patch list
Image: The Hacker News
Vulnerability

China-linked 'Warp Panda' hackers used a VMware ESX flaw to hide their tracks, and CISA adds it to its must-patch list

CISA has added CVE-2026-41709, a flaw in Broadcom's VMware ESX, to its Known Exploited Vulnerabilities list after CrowdStrike reported that a China-linked group it calls Warp Panda used it as a zero-day earlier this year in attacks on the US legal sector. The bug has a low severity score of 2.7 because it needs admin access, but it lets an attacker carry out certain actions without them being logged. CrowdStrike says the group breaks in through internet-facing devices, moves into VMware vCenter systems, steals cloud session tokens and has even registered its own multi-factor authentication device on a hacked account so it keeps access after a password change. Broadcom fixed the flaw in July, and US federal agencies have until 11 November to patch.

Why it matters: Low severity scores can hide real danger: this bug helped skilled attackers avoid being spotted. Organisations running VMware ESX or Cloud Foundation should install Broadcom's July updates, check which multi-factor devices are registered to staff accounts, and remove any they don't recognise. Law firms, which hold valuable client and deal information, are a clear target.

Sources
Sony's Japanese internet provider So-net confirms a breach of 2.5 million customer records
Image: BleepingComputer
Breach

Sony's Japanese internet provider So-net confirms a breach of 2.5 million customer records

Sony Network Communications, which runs the So-net internet service in Japan, says an unauthorised party accessed its member database on 19 October; it spotted the break-in four days later and shut down the affected servers. In total 2,585,481 records were exposed, including names, phone numbers, email addresses, user IDs, dates of birth, gender and connection IDs, but no bank or card details. Another 54,401 email addresses were exposed together with their account passwords. About 443,000 of the records relate to NTT Docomo's Docomo Hikari service, which Sony runs on Docomo's behalf.

Why it matters: Exposed contact details are ideal for convincing scams, and Docomo is already warning of phishing emails and fake sites using a d POINT Club and Universal Studios Japan prize lure. So-net and Docomo Hikari customers should change their passwords, especially if they reuse them elsewhere, and treat 'you've won' messages asking for personal details as a scam.

Sources
Japan Airlines says hackers at its booking system supplier took data on 92,000 customers
Image: The Record
Breach

Japan Airlines says hackers at its booking system supplier took data on 92,000 customers

Japan Airlines says Amadeus IT Group, which runs its reservation, ticketing and check-in systems, told it last week that hackers had accessed some customer booking data for Japan Airlines and Japan Transocean Air flights. About 92,000 customers had names, booking codes and flight details taken, and for about 2,000 of them passport numbers, frequent flyer numbers, email addresses and phone numbers were also stolen. The airline says flights were not affected and card numbers were not compromised. It is the latest in a run of major breaches in Japan, which led Prime Minister Sanae Takaichi to promise a package of emergency measures.

Why it matters: Names, booking codes and flight details let scammers send very believable messages about a real trip. JAL customers should watch out for phishing emails, calls and fake websites pretending to be the airline, as it advises, and should never give card details or passwords in reply to an unexpected message about a trip.

Sources
UK budget promises a look at making software companies liable for cyber breaches, plus £154 million for cyber defences
Image: The Record
Policy

UK budget promises a look at making software companies liable for cyber breaches, plus £154 million for cyber defences

The government's budget documents say it 'will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit'. It is the first formal pledge by a British government to look at who should be held responsible when insecure products lead to breaches; until now the UK has relied on voluntary codes. The budget also sets out £154 million for cyber defences, including £70 million for a new AI-driven vulnerability-spotting centre at the NCSC and £60 million for the first phase of its 'Cyber Shield'. A further £40 million will set up a National Agentic Security Unit to deal with rogue AI agents.

Why it matters: If software makers become legally responsible for preventable security flaws, they would have a much stronger reason to ship secure products and keep them patched. Details such as who will run the consultation and when are still unclear. Until then, organisations should keep choosing suppliers with a good record on security updates, and keep their own systems patched.

Sources
China's Volt Typhoon hid its zero-day attacks behind short-lived chains of hacked home routers and office devices
Image: The Hacker News
Threat

China's Volt Typhoon hid its zero-day attacks behind short-lived chains of hacked home routers and office devices

Lumen's Black Lotus Labs says Chinese state-backed group Volt Typhoon ran a now-disrupted hidden network it calls 'Silent Train', built from rapidly changing chains of hacked home and small-office routers, smart devices and business equipment. Attack traffic was bounced through several of these devices so it appeared to come from inside the US, and every trace was wiped after each session, which lasted about four hours on average. The researchers link the network to four zero-day campaigns, including attacks on N-able N-central, Cisco Catalyst SD-WAN Controller and Arista VeloCloud Orchestrator, and say hundreds of victims were found in telecoms, government, defence, universities and critical services such as water, energy and transport.

Why it matters: Your own router or smart device could be one link in a chain like this. At least 27 kinds of device were abused, including TP-Link, NETGEAR, Zyxel, Fortinet and Cisco products. Keep router and device firmware up to date, switch off remote management you don't need, change default passwords, and replace devices that no longer get security updates.

Sources
Hackers start probing a critical Oracle E-Business Suite flaw days after it was patched
Image: The Hacker News
Vulnerability

Hackers start probing a critical Oracle E-Business Suite flaw days after it was patched

Threat intelligence firm Defused Cyber says its decoy Oracle E-Business Suite systems recorded exploratory attacks on 27 October against CVE-2026-101767, a critical flaw (CVSS 9.8) that Oracle fixed in last week's Critical Patch Update. Researchers at Horizon3.ai, who found the bug, say an attacker with no login can use it to run database commands and then system commands on the server. Depending on the setup, that could expose financial, payroll, HR and purchasing records.

Why it matters: Oracle EBS has been a favourite target: the Cl0p gang used an earlier EBS flaw to steal data from many organisations. Companies running EBS should install the October update now. If they can't, Horizon3.ai advises removing /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist, limiting access to trusted networks and watching for signs of compromise.

Sources
FBI and international police seize bulletproof hosting service Virtualine, accused of shielding criminals
Image: The Hacker News
Law & order

FBI and international police seize bulletproof hosting service Virtualine, accused of shielding criminals

The US Justice Department says the FBI has seized the virtualine.net domain in an operation with police in Germany and the Netherlands, the UK's National Crime Agency and private companies. Court documents say Virtualine advertised on cybercrime forums that its servers could be used for phishing, card fraud and spam, and even offered a plan to move customers to a shell company when police came asking. Prosecutors also accuse it of knowingly hosting a forum selling sexual abuse images despite repeated warnings, and of laundering criminal customers' Bitcoin payments. The service's operator has denied knowingly hosting such material.

Why it matters: 'Bulletproof' hosts keep phishing sites, malware and ransomware infrastructure online by ignoring abuse reports, so taking one down can disrupt many criminal operations at once. Researchers note that Virtualine has repeatedly obtained new internet address ranges and that losing one does not mean a bulletproof host has stopped, so organisations should keep blocking known bad hosting ranges rather than assume the problem is solved.

Sources
Chrome and Firefox updates fix more than 200 security flaws between them
Image: SecurityWeek
Vulnerability

Chrome and Firefox updates fix more than 200 security flaws between them

Google's Chrome 156 fixes 52 security bugs, including four rated critical; one of them (CVE-2026-118306) could let a booby-trapped web page run code outside the browser's protective sandbox. Mozilla's Firefox 159 fixes 167 security flaws, 108 of them rated high severity, with updates also out for Firefox ESR and Thunderbird. Neither company says any of the bugs are being used in attacks.

Why it matters: Browsers are your main window to the internet, so these are worth installing straight away even without known attacks. In Chrome, go to Settings > About Chrome (you should see version 156); in Firefox, open Help > About Firefox. Restart the browser to finish the update.

Sources