Stay Safe OnlineDaily cyber news

Today's briefing

Wednesday 28 October 2026

Attackers start using the Brotli 'Node2Shell' flaw as CISA adds it and the Magento PolyShell bug to its must-patch list, Japan's GMO tells customers to unplug their PCs as stolen data is leaked, ENGIE confirms a customer data breach, a card skimmer hits Brazilian fashion shops, and Apple patches older iPhones against an exploited zero-day.

10 stories

Brotli update: attackers start using the 'Node2Shell' flaw, and CISA adds it and the Magento 'PolyShell' bug to its must-patch list
Image: The Hacker News
Vulnerability

Brotli update: attackers start using the 'Node2Shell' flaw, and CISA adds it and the Magento 'PolyShell' bug to its must-patch list

The US cyber agency CISA has added two critical flaws to its Known Exploited Vulnerabilities list: CVE-2026-111497 in Google's Brotli decompression code (also called HTTP2Shell, Node2Shell or Broccoli2Shell) and CVE-2026-48356, the 'PolyShell' file-upload flaw in Adobe Commerce and Magento online shops. Security firm ELLIO says its sensors have recorded real attack traffic carrying the public Brotli exploit against Node.js, from an address also seen attacking PHP2Shell, which it says suggests an operator focused on mass exploitation. The PolyShell listing follows Sansec's report that the flaw was used to plant hidden code on hundreds of online stores. US federal agencies have until 10 November to patch both.

Why it matters: Brotli code is built into a huge range of software, and Wiz says 91% of cloud environments have resources vulnerable to it. Anyone running Node.js should update to 22.23.4, 24.22.1 or 26.12.1 (there is no workaround), and also patch .NET, PHP for Windows, Bun, Envoy, Istio and Python packages that include Brotli. Magento and Adobe Commerce shop owners should apply Adobe's PolyShell fix and check for unexpected content blocks.

Sources
GMO update: Japanese host tells customers to unplug their PCs over a ransomware threat, as stolen data is published
Image: BleepingComputer
Ransomware

GMO update: Japanese host tells customers to unplug their PCs over a ransomware threat, as stolen data is published

GMO Internet, whose Onamae Desktop Cloud servers were broken into on 20 October, warned on 26 October that the attacker planned to leak customer information and set off ransomware that had been planted on customer servers earlier in the attack. The next day it told customers to back up their data, disconnect their PCs from the internet, shut them down and unplug all cables before noon while it worked with Trend Micro on the recovery. GMO has since confirmed that company and customer data has been published online, and says it may pay extra compensation to those affected; no ransomware appears to have been triggered. GMO is still refusing to pay the ¥8 billion (about $50 million) ransom demand.

Why it matters: This shows how a break-in at a hosting provider can turn into a threat against every customer's machine. Onamae Desktop Cloud users should follow GMO's official instructions, change passwords for trading accounts and other services used on those servers, and be suspicious of any message about the leak that asks for login details or payment.

Sources
Energy giant ENGIE says hackers stole French customers' contact and contract details
Image: BleepingComputer
Breach

Energy giant ENGIE says hackers stole French customers' contact and contract details

French energy company ENGIE has confirmed that attackers stole customer data after breaking into a tool used by its partners to find and sign up customers for energy offers. ENGIE says its own IT systems were not compromised and the incident only affects customers in France, but it has not said how many people are involved. Letters to customers say the stolen details include names, postal and email addresses, phone numbers, meter point numbers, customer IDs and contract numbers; ENGIE says no bank details were taken.

Why it matters: Criminals can use real account and contract numbers to make fake energy bills, refund offers or 'switch supplier' calls look genuine. ENGIE customers in France should be wary of unexpected contact about their energy contract and check anything suspicious by contacting ENGIE directly.

Sources
Card skimmer slipped into a shared analytics script used by dozens of Brazilian fashion shops
Image: BleepingComputer
Supply chain

Card skimmer slipped into a shared analytics script used by dozens of Brazilian fashion shops

Security firm Sansec says a card-skimming gang tampered with a website analytics script (from the open-source Plausible tool) hosted by Convertr, a Brazilian e-commerce platform that runs checkouts for dozens of major fashion brands. Because the script loaded on every merchant's checkout page, the hidden code could copy card numbers, expiry dates, security codes, cardholder names and Brazilian CPF tax numbers. The attack was spotted on 24 October; Sansec suspects the attackers got in through an unpatched flaw in Convertr's outdated Plausible installation. Convertr has removed the skimmer, updated Plausible and is notifying merchants and payment providers.

Why it matters: Shoppers can't see this kind of attack, which is why it's so dangerous. Sansec advises anyone who paid by card since 24 October on a Brazilian store whose checkout address contained 'checkout.convertr' to ask their bank to block the card. Using virtual or one-time card numbers for online shopping limits the damage from skimmers.

Sources
Crypto wallet maker Keystone to destroy 18,835 devices after hackers steal the key that proves they're genuine
Image: The Hacker News
Breach

Crypto wallet maker Keystone to destroy 18,835 devices after hackers steal the key that proves they're genuine

Hardware wallet maker Keystone says an attacker who broke into its website through a flaw in a third-party monitoring tool stole the key its devices use to prove they are genuine, along with 25,964 customer order records containing names, contact details and shipping addresses. With that key, criminals could build fake wallets that pass Keystone's online authenticity check and then steal any crypto put on them. Keystone will destroy 18,835 unsold devices carrying the old key and give new devices a new one. It says recovery phrases and wallet private keys were not affected, and no counterfeit devices or thefts have been reported.

Why it matters: Keystone says devices delivered before 20 October that pass its check can be used normally, but anyone who received one after that date should contact Keystone support before using it. Treat any call, email or letter offering a refund, replacement, recall or help moving your crypto as a scam, and never enter your recovery phrase into a device you didn't order.

Sources
Apple brings its fix for an exploited iPhone zero-day to older iPhones and iPads
Image: BleepingComputer
Vulnerability

Apple brings its fix for an exploited iPhone zero-day to older iPhones and iPads

Apple has released iOS 18.7.11 and iPadOS 18.7.11 to fix CVE-2026-86950, a flaw in its CoreGraphics graphics framework that lets a booby-trapped file run code on a device. Apple says the bug may have been exploited in an 'extremely sophisticated attack against specific targeted individuals' and first fixed it on newer software in September. The update covers the iPhone XS, XS Max and XR, the iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.

Why it matters: Attacks like this are usually aimed at a small number of people, but once a fix is public, other attackers can study it. If you have an older iPhone or iPad that can't run the latest iOS, go to Settings > General > Software Update and install the update now.

Sources
Tailscale update: fix released for SSH flaws that could let one hacked device get root on other servers
Image: The Hacker News
Vulnerability

Tailscale update: fix released for SSH flaws that could let one hacked device get root on other servers

Tailscale has released version 1.104.4 to fix the 'Tailworm' flaws in its built-in SSH server that were made public before a patch was ready. The worst problems let an attacker who already controls a device that is allowed to open an SSH session with forwarding switched on reach root-only parts of the target server, such as the Docker control socket, which in the researcher's tests gave full root access. The update fixes four security bulletins and now carries out forwarding as the logged-in user rather than as root. Tailscale says there is no sign of real attacks and the proof-of-concept code has not been published.

Why it matters: Tailscale is widely used to link company servers and home labs. Anyone using Tailscale SSH should update to 1.104.4 or later; if a server can't be updated yet, Tailscale says setting TS_SSH_DISABLE_FORWARDING=1 and restarting the service blocks several of the most serious issues. Users of the self-hosted headscale server should note its latest release does not fix the reported issues.

Sources
Australia's cyber spies cut off a criminal's malware from 180,000 infected computers
Image: The Hacker News
Defence

Australia's cyber spies cut off a criminal's malware from 180,000 infected computers

The Australian Signals Directorate (ASD) says its operators got into the back end of a criminal's Amadey malware operation and disconnected it from about 180,000 infected computers around the world, including some in Australia. Amadey is rented out to criminals and is mainly used to install other malware, such as password stealers, often arriving via fake software updates or cracked software. In a separate case, ASD says it broke in and destroyed 5 terabytes of data stolen from a business before it could be sold.

Why it matters: Cutting off the controller stops new orders reaching infected machines, but it doesn't undo any theft that has already happened, and stolen logins can be used months later. Avoid cracked software and pop-up 'updates', and if you think your computer has been infected, change important passwords from a clean device and sign out of all sessions.

Sources
Ransomware hacker who worked with the Nefilim and Hive gangs jailed for nearly six years in the US
Image: The Record
Law & order

Ransomware hacker who worked with the Nefilim and Hive gangs jailed for nearly six years in the US

A 36-year-old Ukrainian national has been sentenced in the US to 70 months in prison for his part in ransomware attacks on hospitals, government bodies, law firms and businesses. Prosecutors say he rented the Nefilim ransomware in 2021 in return for 20% of ransoms, then became one of the Hive gang's earliest affiliates; the FBI says the groups' attacks caused more than $100 million in losses, and in one case a hospital hit by Hive could not take new patients. He was arrested in Spain in June 2024, extradited in 2025 and pleaded guilty in December 2025. An alleged Nefilim administrator is still wanted, with a US reward of up to $11 million.

Why it matters: Ransomware criminals often feel safe working from abroad, but cases like this show international police cooperation can still catch up with them years later. For organisations, the best defence remains offline backups, prompt patching and multi-factor authentication on remote access.

Sources
UK watchdog says hackers have repeatedly breached suppliers holding police data
Image: The Record
Policy

UK watchdog says hackers have repeatedly breached suppliers holding police data

A report from His Majesty's Inspectorate of Constabulary and Fire & Rescue Services says outside IT suppliers holding British police information were compromised in multiple cyberattacks between 2021 and 2025, although none directly hit police systems. It does not say which suppliers or forces were affected or whether data was stolen. Inspectors found most supplier contracts had no ongoing security checks, and the Police Digital Service recorded 252 cyber incidents and 796 near misses affecting policing in the first three months of 2026. The report makes 13 recommendations, including reviewing police IT contracts by May 2027, and criticises the government for leaving police and fire services out of its main cyber plans.

Why it matters: Police suppliers can hold sensitive details about victims, investigations and safeguarding, so a weak supplier can expose that data even if police networks are secure. The watchdog says 'a major cyberattack is not a hypothetical scenario'. Any organisation should check that its suppliers must report incidents quickly and meet basic standards such as Cyber Essentials.

Sources