IT Security News Roundup: 2026-10-27 Evening

IT Security News: Evening roundup, 2026-10-27

Summary

Overnight coverage was dominated by attacks that exploit trust and legitimate access: Microsoft Teams chats used for fast malware delivery, a hijacked Convertr analytics script skimming payment cards, and a malicious file aimed at an AI coding agent. Several stories center on AI itself, from Bank of America's warning about sharing passwords with AI assistants to publishers pushing back on Meta's AI terms and OpenAI's advice on AI-generated bug reports. Vulnerability news, including the UEFI/EDK2 firmware flaw, the PHP2Shell and Brotli RCE threads, and the Navigate360 tip-line fallout, shows how one shared component can quietly expose many organizations at once.

1. Publishing and advertising groups asked EU and UK regulators to block new Meta terms due to take effect this week, arguing they would let the company scrape content from across the web for AI.
2. A security podcast roundup covers Microsoft Teams getting AI-powered, context-aware phishing detection, Quest Diagnostics confirming a breach exposing patient records, a third PHP2Shell bug, and CISA adding Collabora Online and Arista VeloCloud flaws to its exploited-vulnerabilities list.
3. Researchers say Russia-linked groups used the experimental Yggdrasil mesh network for communications in an attack on a Ukrainian logistics firm, showing attackers adopting unusual infrastructure to hide command traffic.
4. A recent Shai-Hulud supply chain attack illustrates that SBOMs alone aren't enough; defenders also need real-time visibility into production code and affected services to scope a compromise.
5. Forever Security caught a malicious instruction file in a developer's Downloads folder trying to make an AI coding agent install a known-malicious npm package. The agent was stopped before any code ran, and how the file arrived is unknown.
6. Bank of America reminded customers not to give their banking passwords to AI assistants, stressing that customers remain responsible for any activity their AI agents carry out.
7. Malwarebytes published its weekly recap of security stories covered from October 19 to 25, 2026, useful for catching up on anything missed.
8. A study finds Huawei's engineering work and its collaboration with start-up DeepSeek are narrowing the AI performance gap with Nvidia, despite Huawei's inferior resources.
9. Dark Reading outlines three frameworks to limit AI liability for CISOs and organizations: rigorous documentation, transparency, and careful contract negotiation with AI vendors.
10. A critical flaw in EDK2, the UEFI firmware code base, lets attackers execute code early in the boot process, putting most of the world's servers at risk.
11. A wide-scale social engineering campaign, possibly linked to the Black Basta ransomware gang, uses external Microsoft Teams chats and email bombing to deliver malware within about 15 minutes.
12. Meta's free cash flow turned negative as it raised the low end of this year's capital spending forecast and disclosed $825bn in future spending commitments.
13. OpenAI's Daybreak lead says open-source maintainers are so swamped by AI-generated security reports that some have stopped accepting them, and urges higher-quality findings and better coordination.
14. A card-skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr, stealing shoppers' payment data at checkout.
15. Anthropic's pre-IPO risk disclosures acknowledge that out-of-control AI poses a danger to the world, while suggesting profit considerations will also shape how it responds.
16. Several Ontario Crime Stoppers groups suspended tipline use after Navigate360's data breach and response, and U.S. state education departments are jointly pressing the vendor for answers.
17. Sweet Security is offering free virtual patching protection to all organizations affected by the HTTP2Shell vulnerability, giving a stopgap for those unable to patch immediately.
18. Ukrainian national Artem Stryzhak, 36, received a sentence of more than five years after pleading guilty to taking part in the Nefilim and Hive ransomware operations.
19. Researchers demonstrated running multiple silicon qubits simultaneously at roughly 99.9% accuracy, even with all five active, removing a major obstacle to scaling up quantum processors.
20. Palo Alto Networks Unit 42 retracted its earlier claim that a European government agency attack used PHP2Shell flaws, while exploitation attempts and suspected North Korean scanning continue.
21. A cyberattack hit email accounts at Italy's Chamber of Deputies, including one assigned to Prime Minister Meloni, raising hybrid-warfare concerns and calls for transparency and stronger defenses.
22. Europol, the European Labour Authority and 34 countries ran an action week against labour-exploitation trafficking, resulting in 27 arrests and 248 potential victims identified across high-risk sectors.
23. Risky Bulletin notes a Brotli RCE hitting the internet while attention was on PHP, plus Australia's ABC wiping some staff devices, a third PHP RCE incoming, and a new HTTP/3 DDoS vector.
24. The SANS Internet Storm Center published its Monday, October 26 daily podcast episode; the post carried no text summary of the contents.
25. The EDK2 firmware flaw lets attackers run code early in the boot process, threatening most servers worldwide and making firmware patching a priority for operators.

Summaries written with AI (Claude by Anthropic) from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Publishers Ask EU, UK Regulators To Block Meta AI Terms
2. AI-powered phishing detection, third PHP2Shell bug, Quest medical breach
3. Russian Hackers Use Experimental Network In Ukraine Strike
4. SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack
5. Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
6. Bank of America kindly asks that you don’t share your banking password with your AI assistant
7. A week in security (October 19 – October 25)
8. DeepSeek, Huawei Narrow AI Performance Gap With Nvidia
9. 3 Frameworks to Protect CISOs & Orgs Against AI Liability
10. Code-execution flaw in UEFI firmware affects most servers on planet Earth
11. External Teams Chats Anchor 15-Minute Malware Delivery
12. Meta Free Cash Flow Falls Into Red Amid Heavy Spending
13. Before you file that AI bug report, OpenAI has some advice
14. Hackers hijack Convertr analytics script to steal payment card data
15. All the security risks Anthropic is worried about before its IPO
16. Navigate360’s lack of transparency is catching up with them; More organizations tell people NOT to use their tiplines.
17. Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost
18. Nefilim, Hive ransomware operator given five-year-plus sentence after guilty plea
19. Scientists overcome a hidden obstacle to more powerful quantum computers
20. PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
21. Italy ’s Parliament Under Cyber Pressure: Why the Attack on the Chamber Matters
22. 27 arrests and 248 potential victims identified in action week against labour exploitation
23. Risky Bulletin: Brotli RCE is wrecking what's left of the internet
24. ISC Stormcast For Monday, October 26th, 2026 https://isc.sans.edu/podcastdetail/10150, (Mon, Oct 26th)
25. Code-execution flaw in UEFI firmware threatens most servers on planet Earth