Threats & incidents
-
Ransomware groups exploit PAN-OS VPN bypass to enter corporate and virtualised systems
Palo Alto Networks Unit 42 says ransomware operators including Qilin and Inc have exploited a PAN-OS authentication bypass, with investigators observing follow-on access to virtualisation and backup infrastructure.
-
Railway warns customers to rotate secrets after suspected access to environment variables
Railway says attackers may have obtained decrypted customer environment variables. It began restoring builds in stages on 22 October while asking users to rotate secrets and reconnect affected integrations.
-
LOXONE restores logistics after internal cyberattack as data exposure investigation continues
LOXONE says an 18 October attack affected internal CRM and applicant systems. By 21 October, worldwide logistics had resumed, while the company reported no impact on customer building controls.
-
TAKKT cyberattack restricts orders and deliveries across European industrial distribution
German industrial distributor TAKKT has taken affected IT systems offline following a cyberattack, significantly restricting order processing, customer service and deliveries in its European and North American operations.
-
ESET traces Ukrainian grain company cyberattack from espionage access to destructive wiping
ESET has linked a 2025 attack on a Ukrainian grain company to UAC-0099 and Sandworm, disclosing new details of the MythicRatatoskr backdoor in research published on 22 October 2026.
-
Education ransomware claims rise 54% as European institutions report attacks
Comparitech recorded 77 confirmed ransomware incidents and unverified criminal claims affecting education in the third quarter, including four UK cases and confirmed incidents involving European universities.
-
Fake Amazon Business advert delivers credential stealer through ClickFix campaign
Huntress has uncovered a malicious Google search advert impersonating Amazon Business, leading visitors through a fake verification step to Windows malware capable of stealing credentials and enabling remote access.
-
32 UK government services offline over PHP2Shell
Thirty-two UK government services are offline amid critical PHP2Shell vulnerabilities, as security agencies warn of active exploitation and experts highlight the risks posed by ageing infrastructure and hidden software dependencies.
-
Chrome adds scam detection and warnings for ClickFix commands
Google has expanded Chrome’s Enhanced Protection with suspicious-site warnings, server-side Gemini analysis and detection of malicious commands copied from deceptive websites.
-
SafePay ransomware advisory documents at least 600 affected organisations
US, British and German authorities have documented at least 600 organisations affected by SafePay ransomware, identifying compromised credentials, vulnerable network devices and attacks on backup infrastructure.