Cyber Incidents USA 2026-27

[sharon sanders]

AI Just Found a Bug That Puts up to 70% of the World’s Websites at Risk​

Updated Oct. 21, 2026 at 6:05 pm ET
First, artificial intelligence heralded the Bugmageddon. Now it is triggering an all-hands-on-deck cyber emergency.
The creators of PHP, a technology that powers as much as 70% of the world’s websites, disclosed a critical security issue Wednesday that could be leveraged by hackers to take control of any system running its software. That would allow an attacker to steal information or launch a cyberattack on anyone visiting a hacked website.

Copyright

https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea

FluTrackers installed the fix yesterday as soon as we were notified. Hat tip again to linuxkidd.

 

[Commonground]

Alert Number: I-102326-PSA | 23 October 2026

Critical Vulnerability Alert: PHP Core​

---

In a follow on to the FBI's initial social media posting on October 21st regarding the identified PHP vulnerabilities, the FBI is sharing this PSA to continue to warn the public of the criticality and necessity to take steps to protect any affected networks from these known vulnerabilities. PHP is a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.

Attackers could exploit these vulnerabilities to break into systems, putting sensitive information and business operations at risk. Security updates are available and should be applied immediately. If you are a business owner or website operator, check whether your systems are affected.

The FBI urges organizations to take the following steps now:

• If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
• Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
• Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.

The FBI urges organizations to take the following steps now:

• If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
• Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
• Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.

Report It​

If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or www.ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.

For the latest information, follow PHP's announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA's Known Exploited Vulnerabilities catalog. In addition, CISA released the following guidance, which can be found here. https://www.cisa.gov/news-events/al...ulnerabilities-php-require-immediate-patching

Internet Crime Complaint Center (IC3) | Critical Vulnerability Alert: PHP Core

 

[sharon sanders]

Sam Altman, Co-Founder and CEO of OpenAI: Staying Human While Scaling Superintelligence

zhttps://www.youtube.com/watch?v=anAmTGcewX8&t=1326s

 

[Commonground]

CISA Unveils New Strategy to Strengthen National Cyber Defense and Critical Infrastructure Security​

CISA 2030: Defend, Harden, Prevail
Released
October 26, 2026
[emphasis is mine]

WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA) today released its new strategy, CISA 2030: Defend, Harden, Prevail, which advances President Trump’s Cyber Strategy for America and National Resilience Strategy while strengthening the security and resilience of the nation’s critical infrastructure.

The strategy addresses an increasingly complex threat environment, strengthens national cyber defense, and prioritizes the infrastructure most essential to America’s national security, economy, public health, and safety.

The threat landscape is evolving at an unprecedented pace. Nation-state actors and other malicious adversaries are becoming increasingly sophisticated in their attempts to compromise U.S. networks. CISA is strengthening national cyber defense through decisive, proactive action to identify, disrupt, and eliminate adversarial access while hardening critical infrastructure against emerging threats.

“I call on every company and organization in the critical infrastructure community—from owners and operators to vendors and technology manufacturers—to act now,” said CISA Acting Director Nick Andersen. “CISA 2030 provides a focused roadmap to strengthen defenses, eliminate adversarial footholds, and deny them any advantage that could endanger the nation’s security, economy, or public health.”

CISA 2030 is guided by three pillars:

• Defend: Lead National Cyber Defense;
• Harden: Prioritize National Infrastructure Security, and
• Prevail: Mobilize National Resilience. Under the strategy, CISA will strengthen security across the interconnected physical and cyber dimensions of critical infrastructure.

The strategy also reaffirms CISA’s role, as delegated by the Department of Homeland Security, in leading the initiation and restoration of National Security and Emergency Preparedness communications, which are essential to maintaining continuity of government and public safety during crises.

The strategy recognizes that cyber, physical, and geopolitical threats increasingly intersect and can disrupt essential services Americans rely on every day. CISA will work with public- and private-sector partners to strengthen the security and resilience of operational technology, advance software security, support secure emerging technologies, and improve continuity of National Security and Emergency Preparedness communications.

In alignment with Cyber Strategy for America, CISA will move from a passive defense posture toward an aggressive, anticipatory stance focused on identifying, mitigating, and reducing malicious access to critical infrastructure. The agency will also improve its ability to prioritize risk, mobilize partners, and support rapid, coordinated action when threats emerge.

The strategy sets out CISA’s priorities for the coming year:

• Within 60 days, CISA will begin reviewing its core services and capabilities to meet key objectives.
• Within 180 days, CISA will provide a plan to implement the strategy and measure its results.
• Within 365 days, CISA will report on its progress in carrying out the strategy.

CISA 2030: Defend, Harden, Prevail delivers a clear, decisive roadmap for advancing the agency’s mission and strengthening the security and resilience of the nation’s critical infrastructure in service to the American people.

CISA Unveils New Strategy to Strengthen National Cyber Defense and Critical Infrastructure Security | CISA

www.cisa.gov

 

[Commonground]

(TLP:CLEAR) Vulnerability Notification – Critical PHP Vulnerabilities “PHP2Shell,” Immediate Action Required (Updated October 29, 2026)​

Created: Thursday, October 29, 2026 - 15:55
Categories: Cybersecurity, Security Preparedness

October 29, 2026

Summary: CISA released an alert on October 23 and updated it on October 26 to provide a SIGMA rule organizations can use to help identify potentially suspicious activity, incorporate partner resources, and reinforce existing mitigation guidance. WaterISAC encourages members to review CISA’s “Actions to Take” and make use of the SIGMA rule where able.

Original Source: https://www.cisa.gov/news-events/al...ulnerabilities-php-require-immediate-patching

October 21, 2026...

-snip-

These vulnerabilities are particularly concerning for utilities because PHP underpins many internet-facing services, including public websites, customer and payment portals, content management systems, business applications, and hosting control panels. PHP may also be embedded in third-party products and appliances that are not directly managed by internal IT teams. Successful exploitation could allow attackers to deploy webshells, steal sensitive information, and establish a foothold for further intrusion into utility networks.

Continued: https://www.waterisac.org/vulnerabi...php-vulnerabilities-immediate-action-required

 

[Commonground]

(TLP:CLEAR) Weekly Vulnerabilities to Prioritize – October 29, 2026​

Author: Chase Snow
Created: Thursday, October 29, 2026 - 15:40
Categories: Cybersecurity, Security Preparedness

he below vulnerabilities have been identified by WaterISAC analysts as important for water and wastewater utilities to prioritize in their vulnerability management efforts. WaterISAC shares critical vulnerabilities that affect widely used products and may be under active exploitation. WaterISAC draws additional awareness in alerts and advisories when vulnerabilities are confirmed to be impacting, or have a high likelihood of impacting, water and wastewater utilities. Members are encouraged to regularly review these vulnerabilities, many of which are often included in CISA’s Known Exploited Vulnerabilities (KEV) Catalog.
Continued: https://www.waterisac.org/tlpclear-weekly-vulnerabilities-to-prioritize-october-29-2026

 

[Commonground]

Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say​

Oct 29, 2026
By Raphael Satter, AJ Vicens and Phil Stewart, Reuters

The Pentagon is treating the spate of mysterious freezer malfunctions that spoiled food at military bases across the United States in August as a suspected hack, according to four officials familiar with the matter.

One of the officials said the military investigators were in touch with their French counterparts about a similar cyberattack on commercial freezers that disrupted supermarkets there earlier this month.

Continued: https://www.militarytimes.com/penta...tions-as-suspected-cyberattack-officials-say/

 

[Commonground]

Oct. 29, 2026

Chinese hackers used DeepSeek and other AI tools in sweeping global cyberattacks, report finds​

Chinese state-linked hackers targeted more than 200 organizations in just 11 days, using AI to attack governments and businesses worldwide, according to CrowdStrike.

...https://www.nbcnews.com/tech/security/china-linked-hackers-used-ai-target-200-organizations-crowdstrike-says-rcna606343

 

[Commonground]

CISA Kicks Off Critical Infrastructure Security and Resilience Month 2026​

Released November 02, 2026
WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA) kicks off Critical Infrastructure and Resilience Month today, recognizing the systems and assets that keep the country running as well as the people who operate them. This year’s Critical Infrastructure Security and Resilience Month aligns with President Trump’s National Resilience Strategy and comes as we continue to see new and evolving threats, including those driven by rapid advances in technology like super intelligence. Through it all, we rely on frontline operators who keep essential services moving even when things are disrupted.

“Our work depends on people who understand their systems and stay prepared,” said Acting CISA Director Nick Andersen. “Resilience comes from knowing what matters most and having a plan you can actually use when something goes wrong.”

All month, CISA will highlight four practices that help infrastructure owners and operators stay prepared:

1. Know your most important systems and the outside services they depend on
2. Understand the risks that matter most to your organization
3. Make clear plans that guide response and recovery
4. Track progress and update plans based on real lessons learned

As threats continue to emerge, it’s imperative that everyone does their part to be more resilient. Strong resilience in critical infrastructure helps protect lives and jobs, keeps communities connected, and reduces disruptions. Critical Infrastructure Security and Resilience Month empowers American industry, state and local governments, and the Federal Government to each do their part to protect our nation’s security, prosperity, and freedom.

Organizations can participate in Critical Infrastructure Security and Resilience Month with CISA’s toolkit, which includes graphics and plain language text that organizations can use to show the steps they are taking this November to be more resilient.

CISA Kicks Off Critical Infrastructure Security and Resilience Month 2026 | CISA

www.cisa.gov

 

[Commonground]

Press Release

CISA, FBI, HHS, USDA, and DOT Urge Critical Infrastructure To Strengthen Industrial Refrigeration and Cold Chain Monitoring Systems Cybersecurity​

Recommended mitigations reduce risk to exploitation of vulnerabilities and security weaknesses
Released November 05, 2026

WASHINGTON – Today, the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Health and Human Services (HHS), U.S. Department of Agriculture (USDA), and the Department of Transportation (DOT) published a fact sheet that warns organizations of ongoing cyber threat activity targeting industrial refrigeration and cold chain monitoring systems. Critical infrastructure sectors that widely use these systems include Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems.

Globally, malicious cyber actors are targeting vulnerabilities and weaknesses in unpatched or internet-accessible electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. If successfully exploited, the actors could change the temperature and possibly cause physical impacts such as fire hazards, loss of inventory and changes to the service life of the system. The fact sheet provides recommended best practices and protections against this threat activity such as:

• Remove control system devices and/or systems from the internet.
• Change default passwords and strengthen passwords.
• Apply patches and keep devices and systems updated.
• Identify, retire, and replace legacy devices that the vendor no longer supports.

“In close collaboration with our government, industry and international partners, CISA is actively tracking this threat activity,” said CISA Acting Executive Assistant Director for Cybersecurity Chris Butera. “Every organization that depends on refrigeration and monitoring systems should assume it could be a target. We urge you to review the joint fact sheet and take action now to close known security gaps.”

“Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors,” said FBI Cyber Branch Operations Director Brett Leatherman. “We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk. This fact sheet provides clear, practical steps that network defenders can take to reduce that risk and protect operations. The FBI urges every organization that relies on these systems to review our guidance, implement the recommended mitigations, and report any suspicious activity to the FBI.”

For more information on how to protect against cyber threats, visit Cybersecurity Best Practices.

CISA, FBI, HHS, USDA, and DOT Urge Critical Infrastructure To Strengthen Industrial Refrigeration and Cold Chain Monitoring Systems Cybersecurity | CISA

www.cisa.gov

 

[Commonground]

(TLP:CLEAR) Vulnerability Notification – SonicWall Firewalls Actively Exploited​

Created: Monday, November 9, 2026 - 13:32
Categories: Cybersecurity, Security Preparedness

ACTION MAY BE REQUIRED for utilities using SonicWall Gen7 or Gen8 firewalls running SonicOS with SAML authentication enabled for SSL-VPN logins. Utilities that outsource technology support may need to consult their service providers for assistance with remediation actions.

Summary: An authentication bypass vulnerability affecting SonicWall SonicOS SSL-VPN is being actively exploited in the wild. Tracked as CVE-2026-19868 (CVSS 7.1), the vulnerability is exploitable only when SAML is enabled for SSL-VPN logins. Successful exploitation could allow an attacker to bypass SAML authentication controls, including any multi-factor authentication (MFA) enforced through SAML. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.

Although exploitation requires valid credentials, stolen VPN credentials are widely available, and SAML-enforced MFA is often the control utilities rely on to render them useless. SonicWall SSL-VPN devices are a frequent target of ransomware-linked actors, including Akira affiliates in 2025. A successful bypass could give attackers a foothold inside trusted networks, potentially enabling lateral movement or access to systems supporting OT environments.

Affected Versions:

• Gen7 firewalls running SonicOS 7.3.3-7015 and older. Fixed in 7.3.4-7013 and higher.
• Gen8 firewalls running SonicOS 8.2.2-8015 and older. Fixed in 8.2.3-8015.

Gen6 firewalls are not listed as affected but have reached end of support. SonicWall advises customers running them to upgrade to Gen8.

WaterISAC strongly encourages members to update affected systems immediately according to SonicWall’s advisory, as no workarounds are available. WaterISAC also encourages members using SAML for SSL-VPN logins to:

• Review recent SSL-VPN logins for any that succeeded without a matching sign-in and MFA check in the identity provider’s logs.
• Reset credentials for any account that logged in this way, and review what was accessed during those sessions.

Additional Reading

• Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868)
• SonicWall PSIRT Advisory SNWLID-2026-0014

(TLP:CLEAR) Vulnerability Notification - SonicWall Firewalls Actively Exploited - WaterISAC

... Read More

www.waterisac.org

 

[Commonground]

CISA Announces Enhanced Reporting Form for Cyber Incidents​

Released November 09, 2026
New questionnaire captures critical data and information that improves the agency’s ability to assess incidents, identify trends and prioritize response actions

WASHINGTON – Today, the Cybersecurity and Infrastructure Security Agency (CISA) unveiled the updated cyber incident reporting form, an enhanced web-enabled questionnaire available on CISA’s Incident Reporting Portal for reporting cyber incidents. By improving data quality, the more robust form strengthens the effectiveness and efficiency of national cyber defense. For instance, the new form will help CISA correlate related cyber threat activity to identify a larger trend from what otherwise would appear as independent incidents.

The new cyber incident reporting form is guided by community feedback CISA has received over the years and the agency’s efforts to improve data quality that enables rapid yet thorough threat analysis. For example, questions about the type of incident are more comprehensive and seek more granular information, including whether the incident involved malware, social engineering, hacking techniques or an insider threat. Also, questions about observed activity now incorporate the MITRE ATT&CK® Framework, language about adversary behavior that is familiar to the cyber community.

“In the team sport of cybersecurity, one organization’s detection is another’s protection,” said Acting Executive Assistant Director for Cybersecurity Chris Butera. “As the national coordinator for critical infrastructure cybersecurity and resilience, CISA is able to leverage such incident reporting to identify emerging cyber campaigns, warn potential targets, and strengthen the Nation’s collective defense.”

While only federal civilian agencies are required to report, CISA encourages any organization that experiences a cyber incident to voluntarily report.

For more information, please visit the Frequently Asked Questions webpage.

CISA Announces Enhanced Reporting Form for Cyber Incidents | CISA

www.cisa.gov

 

[Commonground]

Tip of the Week – November 12, 2026​

Created: Thursday, November 12, 2026 - 15:01

Categories: Cybersecurity, Security Preparedness

Secure Service Accounts​

Service accounts are commonly used by applications, automated processes, and network services to communicate with other systems, but they can become overlooked security risks when improperly managed. Water utilities are encouraged to inventory service accounts, restrict their permissions to only what is necessary, regularly review their use, and disable accounts that are no longer needed. Avoid using shared or default credentials, and securely manage service account passwords and keys. Properly managing these accounts can help prevent attackers from exploiting them to gain persistent access or move through utility networks.

Resource: Microsoft: Securing on-premises service accounts

Tip of the Week – November 12, 2026 - WaterISAC

... Read More

www.waterisac.org

 

[Commonground]

(TLP:CLEAR) Weekly Vulnerabilities to Prioritize – November 12, 2026​

TLP:CLEAR
Author: Chase Snow

Created: Thursday, November 12, 2026 - 14:55

Categories: Cybersecurity, Security Preparedness

The below vulnerabilities have been identified by WaterISAC analysts as important for water and wastewater utilities to prioritize in their vulnerability management efforts. WaterISAC shares critical vulnerabilities that affect widely used products and may be under active exploitation. WaterISAC draws additional awareness in alerts and advisories when vulnerabilities are confirmed to be impacting, or have a high likelihood of impacting, water and wastewater utilities. Members are encouraged to regularly review these vulnerabilities, many of which are often included in CISA’s Known Exploited Vulnerabilities (KEV) Catalog.

SonicWall Firewalls Exploited in the Wild​

See WaterISAC’s notification regarding this vulnerability

Multiple Vulnerabilities in Fortinet Products Could Allow for Arbitrary Code Execution​

Description: Multiple vulnerabilities have been discovered in Fortinet FortiOS, FortiManager, FortiAnalyzer, and other Fortinet products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could result in arbitrary code execution. Depending on the privileges associated with the account, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Accounts configured to have fewer user rights on the system could be less impacted than those that operate with administrative user rights.
Source: https://www.cisecurity.org/advisory...d-allow-for-arbitrary-code-execution_2026-133

Barracuda Email Security Gateway​

CVSS v3.1: 9.3, 8.6
CVEs: CVE-2026-116606, CVE-2026-111560
Description: Barracuda has identified two vulnerabilities affecting certain Barracuda products: a pre-authentication authorization bypass vulnerability and a command injection vulnerability. The vulnerabilities have been assigned CVE-2026-116606 and CVE-2026-111560, respectively.
Source: https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection

Zero Day in Microsoft Outlook, Spoofing Vulnerability​

CVSS v3.1: 6.5
CVEs: CVE-2026-97229
Description: Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194

Google Chrome/Chromium: High-severity use-after-free​

CVSS v3.1: N/A
CVEs: CVE-2026-110264
Description: Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Source: https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html

Zero Day in Zyxel GS1900 Switches​

CVSS v3.1: 8.8
CVEs: CVE-2026-107441
Description: An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Sources: https://www.zyxel.com/global/en/sup...rability-in-gs1900-series-switches-11-03-2026

(TLP:CLEAR) Weekly Vulnerabilities to Prioritize – November 12, 2026 - WaterISAC

... Read More

www.waterisac.org

 

[Commonground]

FBI
North Korean Hackers Use Secretly Recorded Webcam Library of 900+ Tech Workers in $400M “FaceStealer” Crypto Theft Scheme
Summary

The Federal Bureau of Investigation (FBI) is releasing this FLASH to alert the cryptocurrency/web3 industry

and open-source software maintainers of a highly effective North Korean social engineering scheme that

the FBI calls “FaceStealer.” The FBI attributes this activity to North Korean state-sponsored hackers,

known publicly by the names Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38,

BlueNoroff and Stardust Chollima. Using the FaceStealer scheme, the actors have stolen more than $400

million in cryptocurrency over the past 18 months and attempted to compromise the open-source

software supply chain. FaceStealer relies on imposter versions of popular video meetings like Zoom,

Microsoft Teams and Google Meets controlled by the hackers. Targets are lured to the fake video meetings

through invitations from genuine communication and social media accounts that were hijacked from prior

victims. The actors have hijacked accounts on platforms including Telegram, LinkedIn, Slack, and Discord.

Once a target joins a fake meeting, hackers play prerecorded webcam videos of previous victims to

simulate a legitimate video call with participants the target knows. The hackers also record the victim’s

webcam video. The hackers then introduce a mock technical error into the meeting and, while

impersonating the victim’s trusted contact, provide instructions to fix the problem. The “fix” installs
malware on the target’s computer, turning the target into the next victim. With the victim’s computer

compromised, the North Korean hackers can steal accessible cryptocurrency or exploit the victim’s

access to external infrastructure, such as an employer’s network or an open-source software maintainer’s

account. In several reported cases, the hackers stole cryptocurrency and hijacked communication

accounts, months to over a year after the initial compromise as the hackers waited for the balances of

cryptocurrency wallets to increase. The hackers also access the new victim’s contact lists, social media

and communications apps, and webcam video to target the victim’s personal and professional contacts.

The FBI has identified and seized over 900 victim webcam videos the hackers have used to convincingly

impersonate victims in follow-on attacks. The FBI recommends people working in the cryptocurrency/

web3 industry and open-source software maintainers become familiar with the details of the scheme and

follow the recommendations provided in this FLASH.

Technical Details (continued)

https://www.ic3.gov/CSA/2026/261112.pdf

 

[Commonground]

PRESS RELEASE

Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency​

North Korean Super Intelligence-Enabled Social Engineering Campaign Known as “FaceStealer” Targeted Cryptocurrency Holders and Individuals Working the Open-Source Supply Chain
Today the Department of Justice announced coordinated actions against the Democratic People’s Republic of North Korea (DPRK) government’s schemes to fund its regime through the massive theft of cryptocurrency. These actions include the seizure of cloud-based infrastructure used in the FaceStealer social engineering scheme that has resulted in the theft of more than $400 million worth of cryptocurrency and the court-authorized seizure and restraint of more than $1.2 billion worth of cryptocurrency recently stolen from Binance, a virtual currency exchange.

Continued: https://www.justice.gov/opa/pr/just...upt-north-koreas-massive-theft-cryptocurrency