Cybersecurity briefing, 2026-10-21

A joint advisory says SafePay has affected at least 600 organizations since August 2024.

• SafePay’s 600-victim campaign spans credentials and vulnerabilities
• OVHcloud CLI archives served secret-stealing malware for 94 minutes
• Plex exploit chain drops miners and proxy software
• AOMEI update tampering leaves infected clients uncounted
• APT28 steals credentials and tunnels into naval shipbuilder
• Qilin and INC carry Palo Alto VPN access into hypervisors
• DHS ban reaches DeepSeek hidden in agency AI gateways
• eMudhra key compromise extends cleanup to Cloudflare clients
• ConnectWise app access confirmed across 162 Microsoft 365 tenants
• Lazarus routes malware through South Korea’s CrossWeb EX
• PHP's critical flaws may reach forgotten applications
• Hitachi Energy RTU500 fixes vary by firmware branch
• Pegasus targeting reaches Serbian rector and suspected prosecutor
• Nikkei’s compromised logins expose 1.83 million records
• Microsoft Project Perception security update
• Cairn’s exposed dashboards became footholds for website attacks

Recent editions

• Tuesday, October 20, 2026: Rank Math PRO backdoor outlives the plugin · 15 stories
• Monday, October 19, 2026: CISA puts BeyondTrust zero-day on the clock · 17 stories
• Sunday, October 18, 2026: PwnEscape breaks Linux VM isolation at the host layer · 1 story
• Saturday, October 17, 2026: CISA puts BeyondTrust zero-day on the clock · 11 stories
• Friday, October 16, 2026: Cisco Secure Email Gateway flaw can spread in clusters · 19 stories
• Thursday, October 15, 2026: UAT-6275 mixes lures with public exploits · 16 stories
• Wednesday, October 14, 2026: Danfoss controllers turned refrigeration into a remote switch · 17 stories