Today's briefing

Saturday 24 October 2026

Japanese courier Sagawa Express says up to 53 million delivery records may have leaked, lab giant Quest Diagnostics confirms patient data was accessed, PHP warns of another (rarer) flaw as PHP2Shell attacks keep failing so far, and HPE rushes out fixes for eight maximum-severity Wi-Fi bugs.

9 stories

Breach23 Oct 2026

Sagawa Express says up to 53 million delivery records may have leaked in Japan

Sagawa Express, one of Japan's biggest parcel delivery companies, says personal information linked to up to 53.23 million shipments may have been exposed after hackers got into its online parcel tracking service. The data includes the names, addresses and phone numbers of people who sent or received parcels between 21 June and 30 September, and details registered with its Smart Club members' service and some corporate customers may also have leaked. Sagawa says the figure contains many duplicates, so far fewer individual people are affected, and that no credit card details or tracking-service passwords were exposed. The company first confirmed the attack on 30 September and restarted some suspended services on Friday.

Why it matters: Names, home addresses and phone numbers are exactly what scammers need for convincing fake 'missed delivery' texts and calls. If you have sent or received parcels via Sagawa, be extra wary of delivery messages asking you to click a link, pay a fee or 'confirm' your details, and check deliveries through the courier's official app or website instead.

Sources

Breach22 Oct 2026

Quest Diagnostics confirms hackers accessed patient records in its lab ordering system

US lab testing giant Quest Diagnostics says it discovered unauthorised access on 21 October to Quanum Lab Services Manager, an online system that doctors' offices use to order tests and look up results. In a filing with US regulators, Quest said it believes an unauthorised party accessed certain patient records, and its website confirms personal and health information was involved, though it has not yet said how many patients are affected or exactly what data was taken. Quest paused the system while it investigated, and said on the evening of 23 October (US time) that it had been securely restored. The company says the incident is not related to the PHP2Shell flaws.

Why it matters: Quest says it serves about one in three US adults each year, so this could affect a lot of people. Quest says it will write to affected patients and offer credit and identity monitoring; until then, be suspicious of calls, texts or emails claiming to be from Quest or your doctor about test results or bills, and do not hand over details to unsolicited contacts.

Sources

Vulnerability23 Oct 2026

PHP2Shell update: PHP warns of a new, rarer flaw as botnets try (and so far fail) to cash in

PHP has warned of another way attackers could run code on a web server, tracked as CVE-2026-115560, which is not fixed by this week's emergency updates. It only affects apps with an unusual combination of settings, so PHP will fix it in its next regular release and recommends turning off the 'session upload progress' feature until then. Meanwhile, Sophos says attackers have tried to use the original PHP2Shell flaws to install a Mirai-style botnet, but the attempts it saw failed, and SecurityWeek reports no successful real-world break-ins have been confirmed yet. Security firm VulnCheck says it has built an exploit that works against PHP's recommended production setup, and the FBI has issued a public alert urging organisations to patch or take systems offline.

Why it matters: Attackers have not cracked PHP2Shell at scale yet, but researchers expect working attacks to appear, so this is a window to patch, not a reason to relax. If you run PHP websites, install 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and set session.upload_progress.enabled=0 in php.ini (then restart PHP) until the next PHP release.

Sources

Vulnerability23 Oct 2026

HPE fixes eight maximum-severity flaws in Aruba Wi-Fi network gear

Hewlett Packard Enterprise has released updates fixing 72 security flaws in ArubaOS, the software running its Aruba enterprise Wi-Fi controllers, gateways and access points. Eight of them are rated 10 out of 10 for severity because they could let a remote attacker with no password take control of a device or run commands on it. HPE says it is not aware of public exploit code or attacks using the flaws, but strongly urges customers to update to AOS-10.8.1.2, 10.7.2.7, 10.4.1.14, AOS-8.13.3.1 or 8.10.0.24.

Why it matters: Network equipment like this is a favourite target because it sits at the heart of company networks. If your organisation uses Aruba wireless gear, patch it now and make sure its management pages cannot be reached from the internet or from ordinary staff networks.

Sources

Threat23 Oct 2026

Hackers raided company firewalls and VPNs worldwide, exposing over 70,000 credentials

Researchers at Group-IB and NyxLab have described a large hacking campaign against internet-facing Fortinet and Palo Alto Networks firewalls and VPN gateways, run by a criminal known as 'k0t'. The attackers found targets using public internet-scanning tools, then broke in using known flaws or by guessing common passwords, before stealing more logins, installing remote-access tools and copying data out. More than 70,000 exposed credentials were linked to the campaign, and many victims were later listed by the Qilin and The Gentlemen ransomware gangs, although the exact link to those groups is not confirmed.

Why it matters: This campaign mostly relied on old, already-fixed flaws and weak passwords, which are both preventable. Organisations should patch firewalls and VPNs, keep their admin pages off the internet, use strong unique passwords with multi-factor login, and treat a hacked firewall as a sign that every password stored on it needs changing.

Sources

Vulnerability23 Oct 2026

Popular Python image library Pillow patches flaws that could let a crafted image run code

Pillow, the most widely used image library for the Python programming language, has fixed a batch of security flaws in version 13.0.0. One, CVE-2026-112900, could let an attacker run commands on a server by choosing the filename of an EPS image that Pillow passes to the Ghostscript program, and other bugs in JPEG and TIFF handling could crash programs or, in some cases, be turned into code execution. Pillow is downloaded around 436 million times a month according to OX Security, and none of the flaws is known to be under attack.

Why it matters: Pillow is hidden inside countless websites, upload forms and AI projects, so many organisations use it without knowing. Developers should upgrade to Pillow 13.0.0 (which needs Python 3.11 or newer) and rebuild any containers or apps that bundle an older copy.

Sources

The Hacker News

Defence23 Oct 2026

Researchers quietly disarmed a forgotten Popcorn Time app that left millions of PCs open to hijacking

Security firm Eye Security found that the abandoned Time4Popcorn app, a spin-off of the Popcorn Time piracy streaming app, still checked an expired web domain for updates over an unencrypted connection and would install whatever it was sent with full system rights. After registering the domain, the researchers saw up to 3 million Windows and 350,000 Mac computers checking in, including from corporate, government and military networks. Between November 2025 and March 2026 they used the update channel to switch off the vulnerable updater without collecting data or deleting files, then handed the domains to the non-profit Shadowserver Foundation. The flaw is tracked as CVE-2026-30612.

Why it matters: Old, forgotten software can become a back door years later. The Android version could not be fixed remotely and the app uses a very outdated browser engine, so if Time4Popcorn or Popcorn Time is still installed on any of your devices, uninstall it. It's also a good moment to remove other apps you no longer use.

Sources

BleepingComputer

Policy23 Oct 2026

US regulator bans its first devices for containing Huawei-linked surveillance chips

The US Federal Communications Commission has blocked a dashboard camera and a wireless video transmitter from the US market because they use chips made by HiSilicon, a Huawei subsidiary that markets its chips for surveillance with built-in face detection. It is the first ban under new rules, in force since 13 October, that stop devices containing smart components from companies on the FCC's national security 'Covered List'. Previously, otherwise legal devices could include parts made by those companies.

Why it matters: Governments are now looking inside gadgets, not just at the brand on the box, when judging security risks. Cheap cameras and other connected devices can contain components you can't see, so buy from reputable sellers and keep connected devices updated.

Sources

The Record

Policy22 Oct 2026

UK proposes up to 14 years in prison for sabotaging undersea cables

The UK government has published plans to protect the undersea cables and pipelines that carry around 99% of the country's international data and 74% of its gas supply, citing suspicious Russian activity in UK waters. Proposals include prison sentences of up to 14 years for intentional damage, 10 years for reckless damage and two years for grossly negligent damage, plus unlimited fines. Ministers would also gain powers to direct telecoms cable companies during national security emergencies, with fines of up to £17m or 10% of global turnover for firms that refuse. The plans are open to a 12-week public consultation before any new law is drafted.

Why it matters: Almost everything you do online that crosses borders, from video calls to banking, travels through these cables. The proposals would replace laws more than a century old and could shape how quickly the UK can respond if cables are cut.

Sources