Today's briefing

Friday 23 October 2026

Capcom confirms 11.7 million gaming accounts were exposed, cloud platform Railway tells every customer to change their secrets, PHP2Shell attack attempts climb into the millions, and a browser-trusted certificate authority quits the business.

9 stories

Breach22 Oct 2026

Capcom confirms hackers accessed 11.7 million gaming account records

Japanese games publisher Capcom says a third party gained unauthorised access to CAPCOM ID, the account needed to play games such as Street Fighter, Monster Hunter and Resident Evil online. Email addresses and account details (creation date, last login time, number of logins and last-login IP address) from 11,774,247 records were affected worldwide, and 43 records also exposed date of birth, gender, country and nickname. Passwords were changed without permission on 196 accounts, which Capcom has since reset. Capcom spotted the attack on 19 October, says credit card details were not involved, and its games and services are still working.

Why it matters: With almost 12 million email addresses in criminal hands, expect phishing emails and messages pretending to be from Capcom. Capcom warns customers not to click links or open attachments in suspicious messages. If you have a CAPCOM ID, be wary of anything asking you to 'verify' your account, and use a unique password and two-step login where you can.

Sources

Vulnerability22 Oct 2026

PHP2Shell update: 32 UK government services offline as attack attempts reach the millions

Organisations are still rushing to patch the critical PHP2Shell flaws in the PHP web programming language. The UK's tech minister told the House of Lords that 32 government services were unavailable and four partly unavailable, mostly as a precaution while updates were applied, and France's Orange suspended some services worldwide while it deployed fixes. Cloudflare's chief executive said attempts to exploit the flaws on its network rose from thousands before the announcement to millions. The UK's National Cyber Security Centre called the event 'unprecedented' but said there were no signs of successful breaches so far.

Why it matters: Attackers are now trying these flaws at enormous scale, so any unpatched PHP server on the internet is at real risk. If you run a website or web app, update PHP to a fixed version (8.5.12, 8.4.27, 8.3.36 or 8.2.35) now, or take it offline until you can. For everyone else, some websites and online services may be slow or unavailable for a while.

Sources

BBC News

Breach22 Oct 2026

Cloud platform Railway tells all users to change their secret keys after a breach

Railway, a platform developers use to host apps, says an unauthorised third party may have accessed the encrypted 'environment variables' where customers store secrets such as API keys and database passwords, and decrypted some of them. Railway believes it was one of a series of attacks on platform companies aimed at reaching AI inference providers. Although it thinks only some users were affected, it is urging everyone to change all secrets stored on Railway, and it has reset storage bucket and GitHub credentials itself. Deployments were paused during the investigation and have been restored in stages.

Why it matters: Stolen API keys and database passwords let attackers log in as if they were the real owner. If you or your business uses Railway, change every key and password stored there, reconnect GitHub, redeploy your services and check logs for unusual activity.

Sources

Vulnerability22 Oct 2026

Arista patches VeloCloud zero-day already being used in attacks

Arista Networks has fixed a critical flaw (CVE-2026-114625, rated 9.9 out of 10) in VeloCloud Orchestrator, the management system for VeloCloud SD-WAN business networks. Anyone with a login, even a read-only account, can use a SQL injection bug to gain top-level operator control of the orchestrator. Arista says the flaw is being actively exploited; hosted versions are already patched, and on-premises customers need versions 5.2.3.18, 6.1.3.10 or 6.4.2.12.

Why it matters: Whoever controls the orchestrator controls the network equipment it manages. This is the third exploited VeloCloud Orchestrator flaw Arista has reported since late July, so organisations running their own orchestrators should patch, restrict access to the web interface and check logs for the attacker IP addresses Arista published.

Sources

Defence22 Oct 2026

Certificate authority eMudhra quits web certificates after browsers drop its root

Indian certificate authority eMudhra says it will withdraw from the global SSL/TLS certificate business, days after a researcher found that the private keys of eight of its intermediate certificates were so weak they could be worked out, which would let anyone create trusted HTTPS certificates for any website. Chrome blocked the affected keys within hours of the 17 October report, and Mozilla and Google are removing the eMudhra root certificate above them; Google expects the Chrome change to reach all devices on 27 October. eMudhra says no website certificates were issued from the eight weak intermediates and it will help affected customers replace their certificates.

Why it matters: The padlock in your browser depends on certificate authorities keeping their keys secret. Browsers acted fast here, but devices and software that ship their own list of trusted certificates may take longer to update. Website owners with certificates chaining to 'emSign ECC Root CA - G3' must replace them now or their sites will break in Chrome.

Sources

Ransomware23 Oct 2026

Ransomware gang lists 40+ port and shipping firms in suspected supply-chain attack

A new ransomware and data extortion group called n0n has listed more than 40 port authorities, maritime and shipping companies on its leak site, with victims in 18 countries. Security firm CyDome says half of them are known customers of CyberLogitec, a South Korean provider of IT platforms for the maritime sector whose website has been down for weeks, which strongly suggests the attack came through that supplier. The gang's listings demand ransoms totalling $1.2 billion; most victims refused to pay and had their data leaked.

Why it matters: Hacking one IT supplier can open the door to dozens of its customers at once, and ports and shipping are critical to global trade. It is being described as one of the largest cyberattacks on the maritime sector since NotPetya, and a reminder for organisations to check what access their software suppliers have to their networks.

Sources

Risky Business News

Outage22 Oct 2026

Cyberattack knocks out online services in Columbia, South Carolina's state capital

The city of Columbia, South Carolina, says its IT team found suspicious activity on its network, and the South Carolina Law Enforcement Division is leading the investigation. The MyColaSC app residents use to report problems, along with online business licensing, parks and recreation, planning, mapping (GIS) and animal services, are affected. Police, fire, 911, water systems and the city's payment centre, including online payments, are still working. The city has not said whether it is ransomware, and no hacking group has claimed the attack.

Why it matters: Local councils are a frequent target: The Record notes that cities and counties in at least eight other US states have had cyberattack-related outages in the last three weeks. Residents should use official phone lines for city services while systems are down and be wary of anyone contacting them claiming to be from the city.

Sources

Law & order22 Oct 2026

Interpol's Operation Serengeti III: 1,462 arrests and $105 million recovered in Africa

Interpol says police in 21 countries (20 in Africa plus the United States) arrested 1,462 suspects and disrupted 10,909 malicious networks between 29 June and 31 August, recovering more than $105 million. The operation targeted online fraud, ransomware, business email compromise, scams and digital extortion, and identified 65,929 victims with losses of over $385 million. In Uganda alone, police broke up two fraud rings and arrested 365 foreign nationals linked to investment and pension scams aimed at victims in Asia.

Why it matters: Many of the scams that reach inboxes worldwide are run by organised groups, and international operations like this take infrastructure offline and get money back to victims. It is a reminder that 'too good to be true' investment offers and urgent payment requests are often part of large criminal operations.

Sources

Policy21 Oct 2026

Meta ordered to pay $25bn for misleading Facebook users about their data

A New Mexico judge has ordered Meta to pay $25bn, its largest penalty ever, after a jury found the company misled the public for years about how Facebook user data was handled and shared. The case grew out of the Cambridge Analytica scandal, and the jury found Meta broke state law more than 40 million times; the full calculated penalty of $219bn was reduced to $25bn. Meta says it will appeal.

Why it matters: The ruling shows regulators and courts are prepared to impose very large penalties when companies mislead people about privacy. It is also a reminder to review which apps and third parties can access your social media data in your account settings.

Sources