> InfoSec News Nuggets – 10/28/2026

CISA warns of hackers now exploiting critical Node2Shell flaw CISA has confirmed that attackers are now actively exploiting CVE-2026-111497, a critical out-of-bounds write flaw in Google’s Brotli decoder that researchers have dubbed Node2Shell, Broccoli2Shell and HTTP2Shell. First identified in Node.js, the bug also affects HTTP servers, clients and other software that rely on vulnerable Brotli implementations, and a crafted compressed stream can trigger crashes, leak memory or in some cases lead to remote code execution. The agency added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by November 10, while urging all defenders to update, block or disable Brotli decoding where patches can’t be applied immediately, and to restart affected processes and rebuild container images afterward.   Data breach at Sony-owned internet provider compromises 2.6 million customer records Sony Network Communications has disclosed that attackers broke into the member database of its Japanese internet provider So-net on October 19, stealing personal information tied to more than 2.58 million current and former So-net and plala customers, including names, phone numbers, email addresses, user IDs, birth dates, gender and connection IDs. The intruders also obtained addresses and passwords for 54,401 email accounts, which were reset on October 27, along with 16 bank account records, though no credit card data was exposed. The company has reported the breach to Japan’s privacy regulator and warned customers to watch for scam messages that exploit the leaked data.   Apple patches older iPhones against ‘extremely sophisticated’ attacks leveraging CoreGraphics flaw Apple has backported its fix for CVE-2026-86950, an out-of-bounds write flaw in CoreGraphics that was exploited in what the company called an extremely sophisticated attack against specific individuals, to older iPhones and iPads that cannot run the latest operating system. The October 26 releases of iOS 18.7.11 and iPadOS 18.7.11 bring the patch to devices including the iPhone XS, XS Max and XR and the seventh-generation iPad, and also address two privacy-related bugs in audio and CoreMedia, one of which could let a malicious app access the camera without permission. Owners of older Apple devices are urged to install the latest compatible update immediately.   University of New Mexico hospital diverts ambulances after cyberattack The University of New Mexico Health System diverted ambulances to other Albuquerque and Santa Fe hospitals for about two hours on Monday and suspended outpatient surgeries and appointments for the rest of the day after a cyberattack that affected the entire UNM Health Sciences Center. Staff were told to unplug desktops and disconnect mobile devices from hospital Wi-Fi, and while appointments resumed Tuesday, health sciences classes and research units remained closed. A new ransomware gang called BYOD claimed responsibility, alleging it compromised 36,000 machines and stole student, patient and employee data, making this the second major attack on a large state hospital this year.   Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption Kaspersky has attributed a cyber espionage campaign dubbed Operation FlashHole to North Korea’s Lazarus Group, which has targeted at least three South Korean organizations in the construction, software and telecom equipment manufacturing sectors since at least July 2025. The attackers sent tailored spear-phishing links to fake résumé and portfolio sites, then abused INISAFE CrossWeb EX, mandatory financial security software in South Korea, to launch an in-memory infection chain that deploys tools including TechHub, ClientHub, LPEClient and the Cubridge framework. Notably, the latest LPEClient uses the post-quantum ML-KEM-1024 algorithm to encrypt its command-and-control traffic, a capability Kaspersky traces back to at least September 2024. The post InfoSec News Nuggets – 10/28/2026 appeared first on AboutDFIR - The Definitive Compendium Project.