IT Security News Roundup: 2026-10-28 Afternoon

IT Security News: Afternoon roundup, 2026-10-28

Summary

The PHP2Shell and Brotli-based Node2Shell/HTTP2Shell flaws dominated this window, with attack write-ups, vendor protections and even insurers' concerns about systemic losses all pointing to the same widely deployed components. A second thread is AI, which shows up on both sides: AI-assisted intrusions, scanners posing as AI crawlers, more convincing phishing pages, and new tooling to vet AI agent skills. State-linked activity, notably Volt Typhoon's "Silent Train" tradecraft, and law-enforcement outcomes against ransomware and scam operations round out the period. For defenders, the practical lesson is to patch bundled libraries as well as system packages, to be wary of identity-based attacks, and to expect regulators to start asking who is liable when software fails.

1. UC San Diego researchers showed that a shaped, shrunken ultrafast laser beam can switch magnetic states in a material, the basic step of writing data. The technique could potentially work over 1,000 times faster than conventional magnetic switching.
2. A scanner impersonates 32 AI bots, including OpenAI and Claude crawlers, to probe websites for exposed credentials, private keys and cloud configuration files. Operators can't assume traffic claiming to be an AI crawler is benign.
3. The SANS Internet Storm Center reports yet another ClickFix campaign. The source gives little detail, but it shows this social-engineering technique remains in active use.
4. Malwarebytes warns that PHP and Node.js flaws, hacked sites, fake updates and rogue certificates can put users at risk even on trusted websites, and offers practical advice for safer browsing this week.
5. Insurers fear that PHP2Shell could become a systemic cyber event, producing billions of dollars in claims that exceed current risk models. It shows how one widely used component can turn into an industry-wide financial problem.
6. NVIDIA's SkillSpector is a security scanner for third-party AI agent skills and MCP components. It targets the supply-chain risk created as developers let autonomous agents write code and manage infrastructure.
7. Microsoft released out-of-band Windows fixes that include certificate updates. The Register's piece stresses the need to stay connected to certificate trust list updates.
8. CrowdStrike says its platform protects customers from threats delivered via PHP2Shell. The source offers no further detail, but it shows vendors are rushing to cover the flaw.
9. CVE-2026-111497, a critical (CVSS 4.0 score 9.2) out-of-bounds write in Google's Brotli decoder, can lead to crashes, memory disclosure or RCE when attacker-controlled data is decompressed. Zscaler warns it affects Node.js, .NET, Envoy and more, and that bundled decoder copies need separate patching.
10. A Ukrainian Hive and Nefilim ransomware affiliate was sentenced to 70 months in US prison. The attacks hit law firms and a healthcare provider during the COVID-19 pandemic, and the case comes years after the FBI infiltrated Hive.
11. Researchers uncovered the "Silent Train" framework used by China-linked Volt Typhoon. It relies on rapidly rotating compromised devices and has been used to infiltrate hundreds of critical infrastructure networks.
12. Researchers describe an apparently AI-assisted attack, attributed to a suspected China-nexus actor on October 25, that paired PHP2Shell with a kernel privilege escalation exploit. It rooted 25 servers and breached a US government-affiliated network.
13. Rapid7 Command Platform now supports SCIM, letting customers automate user provisioning and deprovisioning through their identity provider. This reduces the risk of stale accounts lingering after staff leave.
14. Criminal IP has joined INTERPOL's Gateway Initiative to support global cybercrime efforts. The announcement is a press release rather than a security incident.
15. Keystone will destroy 18,835 hardware wallets after an attacker who breached its website stole the key devices use to prove they're genuine. The key could let criminals build counterfeit wallets that pass the online authenticity check.
16. A Kaspersky expert details a cloud isolation bypass, honored at Russian Pentest Award 2026. It chains flaws in Kubernetes, Konnectivity and the overlay network to reach RCE and compromise other tenants' services.
17. US prosecutors charged Madagascar-based scammers who used fake online dating profiles to steal NFTs. The scheme affected about 800 victims and caused losses of more than half a million dollars, according to the Justice Department.
18. Artem Stryzhak received 70 months in prison for roles in both the Nefilim and Hive ransomware gangs. Those gangs targeted businesses and a hospital during the pandemic.
19. Generative AI makes fake login pages easier to build and more convincing, including ones tailored to specific employees. Some also capture MFA codes or hijack authenticated sessions, so password theft is no longer their only goal.
20. Apple backported patches for a CoreGraphics zero-day to older iPhones and iPads. The bug was exploited in "extremely sophisticated" targeted attacks, and the fixes first shipped last month.
21. eSecurityPlanet reviews the strengths and weaknesses of multi-factor authentication, covering authentication methods, common bypass attacks and best practices. It's a useful counterpoint to the session-hijacking phishing trend.
22. Researchers finally detail the tactics behind Volt Typhoon's intrusions into US critical infrastructure. Officials had long called them highly sophisticated while sharing few specifics, and this "Silent Train" infection chain fills in some of the gap.
23. The new UK budget says the government will "consider where liability for cyber breaches should sit." That could mark a landmark shift away from the voluntary codes used so far to push software vendors toward better security.
24. South Korean financial institutions were hit by another wave of cyberattacks, which TechCrunch frames as evidence of growing AI-driven hacking risk in Asia.
25. G Data argues that high-profile incidents at Anthropic and OpenAI show powerful AI systems can independently exploit vulnerabilities and attack systems. It asks what this means for businesses.

Summaries written with AI (Claude by Anthropic) from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. A tiny laser beam could make computer memory 1,000 times faster
2. Scanner Poses as 32 AI Bots to Find Credentials and Private Keys
3. Yet Another ClickFix Campaign, (Wed, Oct 28th)
4. The web’s having a rough week. Here’s how to browse safely
5. Insurance industry fears potential impacts stemming from PHP2Shell
6. NVIDIA SkillSpector: Complete Security Scanner for AI Agent Skills & MCP
7. Microsoft releases out-of-band Windows fixes with certificate updates
8. CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
9. CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE
10. Hive ransomware affiliate jailed, years after FBI infiltrated the gang’s systems
11. Researchers uncover Volt Typhoon’s covert, ephemeral network
12. PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
13. Simplify User Access Management with SCIM on Rapid7 Command Platform
14. Criminal IP Joins INTERPOL’s Gateway Initiative to Support Global Cybercrime Efforts
15. Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key
16. An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure
17. Prosecutors charge Madagascar scammers in NFT-stealing scheme based on fake online dating profiles
18. Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles
19. AI-Generated Fake Login Pages Are Making Account Takeovers Easier
20. Apple backports CoreGraphics zero-day patches to older iPhones
21. MFA Advantages and Weaknesses: What Works and What Fails
22. Silent Train: Volt Typhoon’s Sophisticated Infection Chain into US Targets Exposed
23. UK to look at making software companies liable for cyber breaches
24. South Korea’s financial industry hit by fresh wave of cyberattacks
25. When AI becomes a hacker: New risks for cyber security