BMC Daily Cyber News

Daily Cyber News: Google shuts down global botnet running on certified Android devices

More than 1.3 million Android devices were turned into a botnet through malware built into products sold by an approved manufacturer. The backdoor appeared mainly in TV set-top boxes, but it was also found in telehealth devices, karaoke machines, and digital signs. Operators used these devices for ad fraud, data theft, and routing malicious traffic through residential connections.

Key context: Consumers and businesses may unknowingly host criminal traffic through equipment they consider low risk.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, malware, Google, shuts, down, global, botnet, running.

Daily Cyber News: Stolen Cloud Access Can Trigger $1 Million in AI Charges

Stolen cloud identities can now produce fraudulent AI charges exceeding one hundred thousand dollars in one day, with cumulative costs reaching one dollar million before access is revoked. Multiple incidents in 2026 affected financial services, retail, technology, and transportation organizations across three global regions. The dominant entry route involved exposed or stolen identity tokens, service account keys, personal access tokens, and active sessions.

Key context: Any organization using cloud-hosted models, or holding credentials that can enable them, is exposed.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, Stolen Cloud Access Can Trigger, AI Charges, Stolen, Cloud, Access, Trigger, Million.

Daily Cyber News: Chinese hackers use ARTEX AI in automated attacks against 200 orgs

AI-assisted cyberespionage has expanded to simultaneous attacks against more than 200 organizations across 14 countries. The operation began October 17th and compromised at least nine organizations. At least 12 other high-value targets faced password spraying and credential scans.

Key context: The targets included government, telecommunications, pharmaceutical, semiconductor, defense, nuclear, and financial organizations.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, credential theft, windows, ARTEX AI, Chinese, hackers, ARTEX, automated.

Daily Cyber News: One Compromised Laptop Opened a Path to Binance's $6.3 Billion Loss

A compromised employee laptop became the starting point for a reported six point three dollars billion theft from Binance. The attackers reportedly reached an internal service container that could initiate withdrawals. From there, they used additional compromise points and an Ethereum delegation mechanism to gain approval authority over a hot wallet.

Key context: The important point is that a valid-looking transaction can still produce the wrong business outcome.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, One Compromised Laptop Opened, Billion Loss, Compromised, Laptop, Opened, Path, Binance.

Daily Cyber News: Hidden Android messages can disrupt calls and emergency access

A hidden, zero-click Android message can crash the process responsible for phone service and interrupt active calls. The specially crafted WAP Push message is processed automatically, and it doesn’t appear like a normal text. Repeated processing can extend the disruption and may affect calls to emergency services.

Key context: This is an availability and safety problem, not a claim that attackers are stealing data or taking full control of the phone.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, Hidden Android, Hidden, Android, messages, disrupt, calls, emergency.

Daily Cyber News: Alpine rebuilds GitLab after attack leaves compromise uncertain

Alpine Linux rebuilt its GitLab server and reset all passwords after attackers targeted a critical code-execution weakness. The attempts repeatedly crashed GitLab processes, and some came close to succeeding. Alpine found no evidence that attackers executed code or tampered with packages and releases.

Key context: That uncertainty matters because the server hosts repositories, code reviews, continuous integration jobs, and package build recipes used throughout Alpine’s development process.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, linux, Alpine, rebuilds, GitLab, attack, leaves, compromise.

Daily Cyber News: Update 03 — English headline pending

Financial institutions are putting AI into production faster than many are maturing their ongoing oversight. A UK survey found that eighty six percent of respondents use AI. It also found that eighty percent reported having AI agents deployed, with another fourteen percent planning deployment within 12 months.

Key context: Adoption is widespread, but risk is concentrating in vendors, cloud providers, and operational systems.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, English, headline, pending.

Daily Cyber News: Active Ivanti attacks raise the urgency for secure access updates

Organizations using Ivanti Connect Secure face active attacks against two newly identified weaknesses. One can support privilege escalation for a local authenticated attacker. The other can let a remote authenticated attacker place controlled content at a known location on disk.

Key context: Successful exploitation could lead to data manipulation, higher privileges, and a path toward deeper control of the targeted system.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, privilege escalation, Active Ivanti, Active, Ivanti, attacks, raise, urgency.

Daily Cyber News: $6.3 billion Binance theft puts privileged access in focus

A theft estimated at six point three dollars billion forced Binance to suspend withdrawals and absorb a massive financial shock. The FBI attributed the attack to North Korea-linked TraderTraitor. Early findings pointed to a compromised DevOps engineer’s laptop, which reportedly enabled access to a service container and unauthorized withdrawals.

Key context: Crypto exchanges and related services now face both recovery pressure and an active laundering problem.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, billion, Binance, theft, privileged, access, focus.

Daily Cyber News: Oracle business systems face attacks after critical fix arrives

Oracle E-Business Suite systems are facing exploitation attempts shortly after an October security fix became available. The affected component can allow an unauthenticated attacker to run database queries and execute commands on the application host. Depending on the deployment, exposed records may include financial, payroll, human resources and procurement data.

Key context: Successful exploitation could expose or change core business records and provide control of the application server.

Additional detail: Patch affected systems and investigate any instance that was internet-facing while unpatched.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, firewall, Oracle, business, systems, face, attacks, critical.

Daily Cyber News: BYOD cyberattack diverts ambulances and cancels classes at University of New Mexico health center

Patient care was disrupted after a cyberattack affected the University of New Mexico Health Sciences Center and the hospitals and clinics it operates. Ambulances were diverted for a time, outpatient surgeries and appointments were suspended, and medical classes were cancelled. A ransomware group claimed responsibility and alleged broad data theft, but the university hadn’t confirmed those claims.

Key context: Healthcare attacks can become safety and continuity events before anyone knows whether data was stolen.

Additional detail: Review downtime procedures and identity controls now, especially privileged accounts and clinical network segmentation.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, ransomware, phishing, New Mexico, BYOD, cyberattack, diverts, ambulances.

Daily Cyber News: Network controllers targeted for keys and long-term strategic access

Attackers exploited Cisco SD-WAN controllers to gain privileged access and install malware designed for persistence and key theft. The KeyDrift framework operated inside legitimate control-plane processes, intercepted decrypted traffic and collected material believed to protect data-plane communications. The campaign targeted organizations involved in space, satellites, defense, aerospace and policy research.

Key context: This matters because compromising a network controller can expose far more than one device.

Additional detail: Patch and harden SD-WAN controllers, then review them for rogue peers, altered startup scripts and unexplained key access.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, malware, cisco, Network, controllers, targeted, keys, long-term.

Daily Cyber News: Binance freezes withdrawals as potential multibillion-dollar theft unfolds

Binance temporarily suspended withdrawals on multiple networks after confirming a security incident and reports of funds leaving its wallets. The exchange says customer funds are safe and that it’s investigating. External estimates put the potential loss at between at least two dollars billion and as much as five point seven dollars billion, but Binance hasn’t confirmed that the transfers were unauthorized or provided a total loss figure.

Key context: For customers and counterparties, the immediate issue is uncertainty.

Additional detail: For now, verify your exposure through official channels, pause nonessential transfers and increase monitoring for impersonation scams.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, Binance, freezes, withdrawals, potential, multibillion-dollar, theft, unfolds.

Daily Cyber News: Firewall attacks turn edge access into internal credential theft

Attackers used exposed firewalls as a path toward internal credentials and administrative systems. A reported China-linked operation scanned nineteen thousand internet-facing devices, narrowed that list to 240 potential targets, and exploited 25 during October 23rd-24. Root webshells were reportedly placed on 24 devices, and activity advanced on two systems in a U.S. government-affiliated environment.

Key context: That shows how root access at the edge can become control over systems responsible for many other devices.

Additional detail: Leaders should treat firewall management planes as high-value identity and configuration assets.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, credential theft, firewall, linux, attacks, edge, access, internal.

Daily Cyber News: DHS personnel leak exposes identities and internal access clues

More than forty thousand Department of Homeland Security personnel records were published online, exposing names, job roles, work contact details, office locations, and information connected to internal access. The dataset includes large numbers of CBP and ICE personnel, cybersecurity staff, and senior officials. A hacker claimed the records came from a DHS Okta single sign-on environment.

Key context: This matters because work information becomes much more sensitive when roles, contact details, and group memberships are combined.

Additional detail: Leaders should treat identity records as sensitive operational information rather than a basic staff directory.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, phishing, personnel, leak, exposes, identities, internal, access.

Daily Cyber News: Volt Typhoon rebuilds covert attack paths in under two minutes

Critical infrastructure defenders are facing a covert access network that can change faster than traditional blocklists. Volt Typhoon has used rotating chains of compromised routers, connected devices, and enterprise systems to hide operations against high-value targets. Researchers observed chains assembled in under two minutes, sessions averaging roughly four hours, and cleanup after each use.

Key context: That constant rebuilding means removing an individual relay doesn’t remove the actor’s ability to return through a different path.

Additional detail: Leaders should govern internet-facing management platforms as critical assets, not routine appliances.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, Volt Typhoon, Volt, Typhoon, rebuilds, covert, attack, paths.

Daily Cyber News: Widely used Brotli decoder puts cloud and enterprise apps at risk

A critical issue in the widely used Brotli decoder now has to be traced across cloud runtimes, enterprise products, and developer stacks. Specially crafted compressed input can corrupt memory, expose process data, crash services, or allow code execution without authentication. The issue is listed as known exploited, and affected technologies include Node.js, dot net, PowerShell, Envoy Proxy, Istio, Bun, and Python packages.

Key context: The difficult part is finding every embedded copy.

Additional detail: Leaders should treat dependency ownership and redeployment capacity as remediation requirements.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, Widely, used, Brotli, decoder, cloud, enterprise, apps.

Daily Cyber News: Cyberattack diverts ambulances and cancels care at UNM Health

A cyberattack at UNM Health turned into an immediate patient-care problem on October 26th. Critical electronic systems went offline, ambulances were diverted for two hours, appointments and outpatient surgeries were canceled, and acceptance of new patients was temporarily limited. Hospitals remained open, and critical systems and normal ambulance traffic were restored by early October 27th.

Key context: The disruption affected New Mexico’s only level 1 trauma center, so the consequences extended beyond the technology team.

Additional detail: The practical priority is to rehearse clinical downtime and regional patient-diversion decisions before the next system outage.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, ransomware, UNM Health, Cyberattack, diverts, ambulances, cancels, care.

Daily Cyber News: PeopleSoft attack chain turns trusted internal access into full compromise

A chained attack against Oracle PeopleSoft can turn an externally reachable integration feature into code execution on the server. Technical analysis describes three weaknesses across the Integration Gateway and Environment Management Hub. One issue lets an attacker make a request appear to come from localhost, bypassing a check intended to limit management access to trusted clients.

Key context: The attack undermines a control designed to reserve sensitive management functions for trusted systems.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, PeopleSoft, attack, chain, trusted, internal, access, full.

Daily Cyber News: Shared compression bug exposes runtimes and cloud workloads to attack

A memory-corruption issue in the Brotli compression library reaches far beyond Node.js. Any application that decompresses attacker-controlled Brotli data with a vulnerable decoder may be exposed. That includes software built around dot net, Python clients, proxies and data platforms.

Key context: The challenge is that the same vulnerable component may be bundled into applications, containers and several runtime ecosystems.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, Shared, compression, exposes, runtimes, cloud, workloads, attack.