Threats & incidents
-
SPIP fixes pre-authentication RCE and critical plugin flaws
SPIP 4.4.27 fixes multiple serious vulnerabilities, including pre-authentication remote code execution, while separate updates address critical weaknesses in the Crayons and Simple logs plugins.
-
PoeLLM turns exposed AI servers into cryptomining botnet
PoeLLM malware has compromised more than 3,400 servers by targeting exposed AI and developer infrastructure, then reusing infected systems for mining, scanning and further exploitation.
-
Russian hostile activity costs UK at least £2bn a year, report estimates
A new study estimates that Russian hostile activity imposes at least £2bn to £2.5bn in annual costs on the UK, while acknowledging substantial limits in available evidence.
-
Revolut to cover document replacement costs after customer data breach
Revolut will reimburse customers who need to replace identity documents after personal information was disclosed through fraudulent requests impersonating an Italian government authority.
-
Phishing campaign hides behind Microsoft Power BI links
Huntress has uncovered a phishing campaign using legitimate Microsoft Power BI pages to reach victims before installing redundant ScreenConnect clients for persistent remote access.
-
EY breach exposes financial data held for major clients
Personal and financial information held by EY for clients including Man Group was exposed after attackers compromised technology used within the professional services firm’s tax operations.
-
NHS warns of active exploitation of new NetScaler flaw
NHS England has warned that CVE-2026-88779 is being actively exploited and assesses further attacks against affected NetScaler systems as highly likely.
-
ASOS investigates third-party platform incident after customer notification
ASOS is investigating unauthorised activity involving third-party customer communications platforms after an unauthorised notification was sent on 6 October.
-
ClingSTUN turns exposed devices into proxy nodes
FortiGuard Labs has identified a Linux backdoor that exploits known flaws across internet-facing devices, establishes persistence and abuses public STUN infrastructure to keep compromised systems reachable.
-
Roundcube flaw moves into active exploitation
A pre-authentication SQL injection vulnerability patched in Roundcube Webmail in May is now being exploited, increasing exposure for organisations still running affected versions with the vulnerable plugin enabled.