> InfoSec News Nuggets – 10/23/2026

The internet is having a very bad cybersecurity day Security teams faced a pile-up of serious problems this week as AI-discovered critical vulnerabilities in PHP knocked government websites offline around the world and prompted the NSA to urge organizations to patch immediately or take affected systems offline. At the same time, Node.js patched four high-severity flaws including a remote code execution bug and TLS validation bypasses, the popular open source LLM proxy LiteLLM was compromised with malicious releases carrying an infostealer and remote access trojan, and Indian certificate authority eMudhra had its private keys compromised, raising the risk of fraudulent certificates being used to impersonate legitimate websites. The back-to-back incidents highlight how AI could make it easier for attackers to exploit vulnerabilities once they are discovered.   Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants Microsoft has attributed the compromise of ConnectWise’s Microsoft 365 tenants to a China-aligned threat actor tracked as Storm-0940, which used the agentic AI penetration testing framework ARTEX to target hundreds of organizations globally beginning in September 2026, often gaining privileged cloud access in under three hours. After taking control of ConnectWise cloud application identities, the group attempted sign-ins to more than 2,250 downstream customer tenants at roughly 2,900 attempts per minute, with follow-on activity including reconnaissance, application credential changes for persistence, and modifications to identities and privileged roles. ConnectWise’s Cloud Backup, SaaS Security and Cloud Management services remain offline, though the company has begun a phased restoration of Cloud Backup and is urging customers to review their Microsoft 365 tenants for unauthorized changes.   Qilin and INC Exploit Palo Alto VPN Flaw in Ransomware Attacks Palo Alto Networks’ Unit 42 has identified the Qilin and INC ransomware operations among the threat actors exploiting CVE-2026-0257, an authentication bypass in the PAN-OS GlobalProtect portal and gateway that lets attackers establish VPN sessions even when multi-factor authentication is enabled. Once inside, attackers used remote monitoring and management tools for reconnaissance, moved laterally over RDP and SMB, and in one case reached VMware vCenter, disabled an ESXi security control, and extracted domain credentials offline from a domain controller’s virtual disk to sidestep endpoint detection. Investigators also observed attacks on Veeam backup infrastructure and misconfigured GlobalProtect profiles exposing management interfaces to the internet, and administrators are urged to restrict access to those interfaces.   CISA Warns SafePay Ransomware Has Hit 600+ Organizations and Destroyed Backup Systems A joint advisory from CISA, the FBI, the Secret Service, and German and British law enforcement warns that SafePay ransomware actors have compromised at least 600 organizations across critical infrastructure sectors in North America, South America, Europe, and Australia since August 2024. The group gains access through exposed credentials, phishing, brute-force attacks, and five known vulnerabilities affecting Cisco, Veeam, and SonicWall products, then relies on legitimate tools such as PsExec, Windows Remote Management, and RDP to move laterally before exfiltrating data with WinSCP and RClone and encrypting files. Operators also sabotage recovery by stopping the Volume Shadow Copy Service and factory resetting network attached storage that holds backups, leading CISA to stress offline, immutable backups, multifactor authentication, and prompt patching of exposed systems.   Authorities disrupt nearly 11,000 cybercrime networks in Africa Interpol’s Operation Serengeti III, carried out with authorities from 21 countries and private partners including Team Cymru, Kaspersky, Group-IB, and Fortinet, has resulted in the arrest of 1,462 suspected cybercriminals and the dismantling of 10,909 malicious networks across Africa. The operation ran from June 29 to August 31, targeted business email compromise, ransomware, and online scams, identified 65,929 victims with estimated losses of more than $385 million, and recovered over $105 million in illicit funds. Highlights include the takedown of two transnational fraud rings in Uganda with 365 arrests, the seizure of more than 2,000 illegal cryptocurrency mining devices in Angola, and the arrest of a suspected large-scale phishing and business email compromise operator in Nigeria. The post InfoSec News Nuggets – 10/23/2026 appeared first on AboutDFIR - The Definitive Compendium Project.