The Global Threat Summary, week ending 31 October 2026

In one line: the largest crypto theft on record may have started on one engineer's laptop, the flaws that shook the web last week are now confirmed as used in attacks, and the suppliers that hold customer details were again the way to the customer.

The first is money. Binance, the world's largest crypto exchange, says a compromised engineer's laptop may have let an attacker submit withdrawals nobody approved. It puts the loss at around US$6.3 billion, most of it moved in about 20 minutes, and says user funds are safe. Two analytics firms name North Korea. Binance names nobody.

The second is speed. The PHP flaws behind last week's government website outages, and a flaw in Google's Brotli compression code built into browsers and servers, are both now on the US government's list of flaws exploited in real attacks. So are flaws in Ivanti and Cisco remote access equipment and in GitLab. One attack chain took PHP access all the way to full control of the server.

The third is suppliers. Guests of Australian holiday parks were sent scam payment messages quoting their real bookings, after unauthorised access at the booking software supplier. Japan Airlines lost passenger details through a supplier too. On ASD's new figures, a small Australian business that reported cybercrime last financial year put the average cost at $55,400.

Three questions for the executive team.

1. Which payments, and which changes to a supplier's bank details, can one person on one device still make in our business today?
2. Has our IT provider confirmed in writing that this fortnight's exploited flaws are fixed in everything we run, including software that carries its own copy of the code?
3. Which suppliers hold our customers' details, and if one of them had an incident tomorrow, who would tell our customers, in what words, and how fast?

Cross sectoral, the items that reach every industry

Flaws that moved from possible to used

PHP2Shell: now catalogued as exploited, chained to full control, aimed at firewalls. Cross sectoral. Since last week. [Reported]

• What moved. Last week's Summary said CISA had not listed the two flaws, CVE-2026-109618 and CVE-2026-109619. It added both on 26 October US time, with a federal deadline of 29 October (CISA KEV feed; Cyber Daily).
• Successful attacks, now reported. GreyNoise says it has seen at least six successful exploits (The Record). Perplexity's Adel Karimi confirmed exploitation against an Apache mod_php server on PHP 8.4.26 (BleepingComputer).
• The chain to root. Dream Security reports an attacker it calls Chinese chaining PHP2Shell with Fragnesia, a Linux kernel flaw, CVE-2026-46300, against firewall management panels, then going after three servers in a US government affiliated environment. CISA catalogued Fragnesia on 28 October and says it "can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root" (same BleepingComputer report).
• Whose firewalls. Dream later named the firewalls as Palo Alto Networks'; The Record says Unit 42 verified the findings and fixed its PAN-OS management web server (Palo Alto advisory, not read). Fixing PHP on a server does not reach PHP inside an appliance.
• Divergence on the count. BleepingComputer reports Dream rooting 25 servers across the US, Japan, Taiwan and South Korea; The Record reports 24 compromised firewalls, 22 with webshells only. CISA declined to comment on Dream's report.

Attribution: CISA, read directly; GreyNoise, Dream and Unit 42 as reported by The Record and BleepingComputer. Dream's attribution to a Chinese actor is Dream's own and is not confirmed by CISA.

Brotli, CVE-2026-111497: catalogued as exploited within days of the fixes. Cross sectoral. [Confirmed]

• Brotli is Google's free code for compressing web traffic, built into browsers, desktop apps, runtimes such as Node.js and .NET, and web servers. The flaw sits in the part that unpacks it. Node.js says crafted data can lead to "a crash, disclosure of process memory, or remote code execution" (Node.js).
• CISA added it to its exploited list on 27 October US time, deadline 10 November (BleepingComputer; CISA KEV feed). CISA has not described the attacks, and no actor is named.
• Fixes are out from Google, Node.js, the Python Brotli packages and Microsoft, whose unscheduled .NET updates note that the affected decompression is not on by default (Microsoft .NET advisory). PHP, Cloudflare and Linux distributions followed (iTnews).
• The catch. Updating a server's own Brotli does not fix software that carries its own copy. After patching, affected processes must be restarted and container images rebuilt (BleepingComputer).
• Going round as Node2Shell, HTTP2Shell and Broccoli2Shell. The CVE number is the one to ask suppliers about.

Attribution: CISA, Node.js and Microsoft, read directly; BleepingComputer and iTnews. GreenCyber carried this as a flash on 27 October, before CISA listed it.

Ivanti Connect Secure: the remaining two flaws in the October attacks catalogued and fixed. Cross sectoral. Since last week. [Confirmed]

• What moved. Last week's Summary found no fix for the third flaw. CISA has now catalogued CVE-2026-111357, missing authentication, due 2 November, and CVE-2026-118527, predictable identifiers, due 13 November, both added 30 October US time (CISA KEV feed).
• Ivanti's update of 29 October ties both to CVE-2026-104935, the authentication bypass exploited since 3 October, says the attacks "affected a limited number of customers", and names 25.1.1.3 and 22.8R2.6 as the fixed versions, as GBHackers reports it. Ivanti's advisory would not render.
• Why patching is not enough. Volexity, which tracks the attacker as UTA0576, says it used no web shell, ran its commands over ordinary web requests and "selectively removed evidence from Ivanti debug logs and Linux audit logs" (Volexity, as quoted by GBHackers). A clean log is weak evidence of a clean box.

Attribution: CISA, read directly. Ivanti's and Volexity's words through GBHackers, one outlet, so lighter on everything beyond the catalogue.

Cisco ASA and FTD firewalls: an exploited flaw that forces the VPN to restart. Cross sectoral. [Confirmed]

• Cisco: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." CVE-2026-76418 lets an unauthenticated attacker make the device reload, cutting remote access (BleepingComputer; Cisco advisory, not read).
• Affected: devices with SSL VPN enabled and secondary authentication configured on a tunnel group. A restart, not a break in, on what has been read.
• Cisco offers no workaround and recommends upgrading. Shadowserver tracks more than 51,000 exposed ASA SSL VPN devices, per BleepingComputer.
• CISA catalogued it on 29 October US time with a deadline of 1 November.

Attribution: Cisco, as quoted by BleepingComputer; CISA KEV, read directly.

Oracle E-Business Suite, CVE-2026-101767: attempts within a week of the patch. Cross sectoral. [Reported]

• A critical unauthenticated SQL injection, CVSS 9.8, in versions 12.2.3 to 12.2.15, fixed in Oracle's October Critical Patch Update. Oracle says it "continues to periodically receive reports" of attempted exploitation (Cyber Daily).
• ProCircular's Jim Sherlock says attackers were firing exploits at decoy servers within seven days of the patch. Scanning was also reported by BleepingComputer.
• Cyber Daily reports no confirmed victim, and it is not in CISA's catalogue at version 2026.10.30.

Attribution: Oracle and ProCircular as reported by Cyber Daily; BleepingComputer's headline, not read.

State actors at the management layer

Volt Typhoon's Silent Train, and a new implant on Cisco SD-WAN controllers. Cross sectoral. [Reported]

• Lumen's Black Lotus Labs describes Silent Train as a relay network of hacked routers and enterprise systems, built on demand and cleaned up after each operation, which it attributes to China's Volt Typhoon. It links at least four zero days to the activity, including VeloCloud Orchestrator CVE-2026-16812 and Cisco Catalyst SD-WAN CVE-2026-20127 (BleepingComputer; Lumen).
• Targets named include telecommunications, government, defence contractors, utilities, satellite providers, IT firms, managed service providers, transport and aviation. No Australian target is named.
• Separately, Cisco Talos reports a new cluster, UAT-11473, using CVE-2026-20127 to plant KeyDrift, malware that steals keying material from SD-WAN controllers, against space and satellite, defence and aerospace, and policy research organisations (BleepingComputer; Talos).
• Divergence on the link. Talos says UAT-11473 "appears to overlap" with Silent Train and makes no definitive link. Black Lotus Labs gives no formal confidence level.
• The Cisco flaw was patched in February, and the VeloCloud flaw in July, as dated context. The consoles that run a network are the target.

Attribution: Black Lotus Labs and Cisco Talos as reported by BleepingComputer. Neither primary report was read.

Supply chain and trusted connections

ConnectWise Cloud Backup: restored in phases, cause still under investigation. Cross sectoral. Since last week. [Confirmed]

• What moved. ConnectWise began phased restoration on 28 October, Microsoft 365 backups and restores first, through "a new, hardened application". By 30 October, 21:00 UTC: "Phases 1 and 2 are complete, Phase 3 is now in progress", with reporting, export and billing next and notifications after (ConnectWise advisory).
• Partners must reset passwords, set up multifactor authentication again and reauthorise each tenant. ConnectWise warns that reauthorising a tenant does not confirm backups have resumed: check that new snapshots complete.
• No update in the window states a root cause. Microsoft's attribution to Storm-0940, in last week's Summary, stands.

Attribution: ConnectWise, read directly.

Supplier scripts turned on the checkout: Polymarket and Convertr. Cross sectoral. [Reported]

• Polymarket. The prediction market halted trading on 29 October US time after a script from DebugBear, a website performance monitoring service, was used to serve code that drained crypto from logged in users. Polymarket: "One of our third party providers was compromised." DebugBear: "We're impacted by an ongoing security incident." About US$2.5 million was traced to an attacker wallet (BleepingComputer; The Record).
• Convertr. Sansec found a card skimmer appended to the analytics tracker of Convertr, a Brazilian ecommerce platform, from 24 October, loaded on every checkout and taking card numbers, expiry dates and CVVs. Convertr removed it on 27 October (Sansec).
• Sansec attributes Convertr to a Brazilian Magecart group and suspects an unpatched Plausible flaw as the way in, unconfirmed. No Australian site is named.
• The common thread: a third party's script runs with the same reach as the site's own code.

Attribution: Polymarket and DebugBear as quoted by BleepingComputer; The Record's headline; Sansec, read directly.

eMudhra: Microsoft removes trust in seven certificates. Cross sectoral. Since last week. [Confirmed]

• What moved. On 26 October Microsoft shipped unscheduled Windows updates, KB5134133 for Windows 11 and KB5134125 for Windows 10, that "removes seven certificates associated with the affected hierarchies" from the Windows trust list, for machines that do not take automatic trust list updates (BleepingComputer).
• Edge followed on 27 October. Microsoft says it is still reviewing the remaining eMudhra roots.
• Administrators should install it on disconnected systems and find certificates that chain to the removed roots, which may need replacing. eMudhra has exited the website certificate business (iTnews, 23 October, dated context).

Attribution: Microsoft as reported by BleepingComputer; iTnews.

AI

Developer platforms report attackers using AI agents, and stolen AI keys put to use. Cross sectoral. [Reported]

• Warp, the AI coding terminal. Its chief executive says "roughly 1% of Warp users may have been impacted" after an attack on a third party vendor, with agent decision logs and telemetry exposed. The analysis suggests "an agent swarm" did the work (BleepingComputer, 27 October).
• Chainalysis, the blockchain analytics firm. It says an outside actor used "offensive agentic techniques" to reach internal systems earlier in October, accessing customer names, emails and role labels, and that it is "unrelated to the recent Binance theft" (BleepingComputer, 31 October).
• Northflank, a cloud platform for developers, told customers on 30 October to "Assume all environment variables have been decrypted" and rotate every key, and later said "Users have reported unauthorised use of AI API keys supplied to the Northflank platform" (BleepingComputer).
• Wiz counts at least nine October incidents at AI development platforms and has not confirmed a common attacker, as BleepingComputer reports it; Wiz's report was not found.
• Divergence. ESET says "we have not noticed AI substantially reshaping the APT landscape over the past six months" (ESET). The companies above describe criminal intrusions, not state ones, and none has published how the agents were used.

Attribution: each company's statement as reported by BleepingComputer, one outlet each, so lighter; ESET, read directly.

National assessments

ASD's Annual Cyber Threat Report: what cybercrime cost Australian business. Cross sectoral. [Reported]

• The Australian Signals Directorate's seventh yearly report, for the year to 30 June 2026, puts the average self-reported cost of a business cybercrime report at $93,500, up 16 per cent (SOCRadar; Australian Cyber Security Magazine).
• By size: small businesses $55,400, medium $141,300, up 45 per cent, large $148,100. On those averages a medium business now reports nearly what a large one does. That reading is ours, and averages of self-reported costs move with who reports.
• More than 82,000 cybercrime reports, about one every six minutes, and more than 1,500 incidents ASD responded to, up more than 20 per cent (Cyber Daily).
• Among its recommendations, as SOCRadar summarises them: plan for disruption, and reduce supplier and software risk.

Attribution: ASD's figures as reported by three outlets that agree. ASD's report timed out on every attempt this week, so no line of ASD's own is quoted. GreenCyber carried the small business figure as a flash on 28 October.

Norway raises its national cyber risk level to High, for the first time. Cross sectoral. [Confirmed]

• Norway's National Security Authority, NSM, on 27 October: the first time it has shared the national cyber risk level openly and unclassified, raised from the normal Moderate to High (NSM).
• Its reasons, in our translation: successful cyber operations against Norwegian organisations have roughly tripled in the last half year, and a high level "requires Norwegian organisations to implement preventive measures immediately".
• Named at high risk: defence and the defence industry, space, critical infrastructure, and providers to nationally important businesses.
• On AI, NSM says language models and agentic systems pose a serious risk, while noting their offensive use is not yet documented in Norway. It publishes 21 measures, from phishing resistant multifactor authentication to tested backups.

Attribution: NSM, read directly in Norwegian; the translation is ours.

The catalogue

Ten additions to the exploited catalogue in the window. Cross sectoral. [Confirmed]

• 26 October: PHP CVE-2026-109618 and CVE-2026-109619. 27 October: Google Brotli CVE-2026-111497; Adobe Commerce and Magento CVE-2026-48356, a dangerous file upload. 28 October: Linux kernel CVE-2026-46300, Fragnesia; VMware ESX CVE-2026-41709, insufficient logging (KEV feed, version 2026.10.30, 1,766 entries).
• 29 October: GitLab CVE-2026-97229; Cisco ASA and FTD CVE-2026-76418. 30 October: Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527. Dates are CISA's, US time.
• Ransomware use "Unknown" for all ten. Six carried federal deadlines of three days: both PHP flaws, Fragnesia, GitLab, Cisco and Ivanti's CVE-2026-111357.
• Since last week. PHP2Shell, which last week's Summary said was not listed, now is.

Attribution: CISA KEV, read directly.

Absences, counted rather than assumed

What was looked for and not found. Cross sectoral. [Confirmed]

• SEC EDGAR full text search for "Item 1.05", 26 October to 1 November: four hits, two 8-K exhibits, a fund prospectus and a merger registration, none on its face a cyber incident disclosure, and none read (SEC EDGAR).
• No Fortinet addition to the catalogue. Fortinet's advisories for last week's hardening batch are due on 10 November, as it said.
• cyber.gov.au timed out on every attempt in the window, so any new ACSC alert is unknown rather than absent. GreyNoise was read only through The Record, and Shadowserver only through BleepingComputer.

Attribution: SEC EDGAR; CISA KEV; the sources in each item above.

The week for a security leader

Energy and utilities

No in window incident at an energy or water operator met the bar. Black Lotus Labs lists utilities among Silent Train's targets and NSM names critical infrastructure among Norway's highest risks, both in the cross sectoral section, with the Ivanti, Cisco and PHP2Shell items as this sector's remote access exposure.

Financial services

Binance: around US$6.3 billion taken, traced to a compromised engineer's laptop. [Confirmed]

• Binance's update: its initial investigation suggests the incident "may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." Total impact around US$6.3 billion; no evidence of a wallet private key leak; "User funds are safe" (Binance).
• TRM Labs says most of it moved in about 20 minutes from 20:05 UTC on 29 October, 6.05am on 30 October in Brisbane, across ten blockchains, and calls it the largest crypto theft on record (BleepingComputer). The Record says preparations began 36 hours earlier (The Record).
• Co-chief executive Richard Teng: "the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action." Binance says it has "uncovered additional points of breach" (BleepingComputer).
• Divergence on the frozen figure. Binance and The Record give about US$3 billion frozen; TRM gives about US$2.7 billion, with about US$2.4 billion beyond any issuer's reach. Binance says it will cover all losses from its SAFU fund and company funds (iTnews, from Reuters).
• Attribution divergence. TRM attributes it to TraderTraitor, a North Korean state backed unit also tracked as Lazarus Group and APT38; Chainalysis concurs "with a high degree of confidence". Binance says its "investigation has not attributed responsibility to any individual."

Attribution: Binance, read directly; BleepingComputer, The Record and Reuters through iTnews. The North Korea attribution is TRM's and Chainalysis's, not Binance's. GreenCyber carried this as a flash on 31 October; the facts above are as last corrected there.

The supplier script item in the cross sectoral section is the other money story of the week: Polymarket's users lost funds through a monitoring service's script. GMO's foreign exchange customers in Japan are under technology and software.

Healthcare

UNM Health diverts ambulances and suspends surgeries after a cyberattack. [Reported]

• The University of New Mexico's health system limited admissions, diverted ambulances, and suspended outpatient surgeries and appointments; classes were cancelled (BleepingComputer, 27 October; UNM, not read).
• UNM says the event "did not penetrate core systems or servers" and "affected some end-user devices", and that critical systems are back and hospitals fully open.
• UNM has not said what kind of attack it was and has not used the word ransomware.
• Claimed. A new group calling itself Byod claims 36,000 systems and student, employee and patient data. Unverified.

Attribution: UNM as quoted by BleepingComputer, one outlet read, so lighter; the group's figures are claims.

The PHP2Shell, Brotli and Ivanti items in the cross sectoral section are this sector's priorities.

Manufacturing and OT

A Belarus aligned group deploys its first known wiper, against a Ukrainian manufacturer. [Reported]

• ESET says FrostyNeighbor "attacked a manufacturing company in Ukraine that plays an important role in the country's transportation sector" with destructive wiper malware (ESET, 28 October).
• ESET: "our telemetry more clearly points to Belarus-aligned groups acting as cyberproxies or force multipliers for Russia."
• ESET's researcher Alexis Rapin puts Belarus in "the small club of 4-5 states" publicly documented deploying wipers, per Risky Business. No date or wiper name is given.

Attribution: ESET, read directly; one vendor, so lighter.

No in window incident at a plant or in an OT environment outside Ukraine met the bar. The Silent Train item in the cross sectoral section names the network management consoles that plants rely on for remote sites.

Technology and software

GitLab CVE-2026-97229: a maximum severity flaw now exploited. [Confirmed]

• An integer overflow in GitLab's CI/CD regular expression compiler that GitLab says "could have allowed an unauthenticated user to execute arbitrary code" on the server (BleepingComputer, 30 October).
• Fixed in Community and Enterprise Editions 19.4.2, 19.3.5 and 19.2.8. GitLab released detections after seeing exploitation attempts. CISA catalogued it on 29 October US time with a deadline of 1 November.
• Alpine Linux reports an attempt on its own GitLab server that failed before code ran (Alpine Linux, not read).
• Shadowserver tracks nearly 2,800 internet exposed GitLab Community Edition instances, per BleepingComputer.

Attribution: GitLab as reported by BleepingComputer; CISA KEV, read directly.

Sony's So-net: data on more than 2.1 million members taken. [Confirmed]

• Sony Network Communications says unauthorised access on 19 October exposed names, phone numbers, email addresses, user IDs, dates of birth and connection IDs for 2,141,986 So-net members and 443,495 plala customers, current and former (So-net notice, 27 October, updated 29 October).
• 54,401 email addresses with their passwords across four mail services were also taken, and reset on 27 October; bank account details in 16 cases.
• No card data; member account passwords not leaked. The groups may overlap, so the figures should not be added. Cause under investigation.

Attribution: Sony Network Communications, read directly in Japanese; also reported by BleepingComputer.

Japan's GMO: the attacker's ransom threat, and a government emergency package. Since last week. [Reported]

• What moved. Last week's Summary carried malicious programs on up to 26,739 Onamae Desktop Cloud servers. GMO has since said company and customer data was published, received a ¥8 billion demand it will not pay, and on 27 October asked customers to unplug their PCs ahead of a threatened ransomware trigger (BleepingComputer).
• GMO's foreign exchange trading service also suffered unauthorised access; customers will be compensated for losses plus ¥5,000 each. Chief executive Masatoshi Kumagai: "The internet itself is now starting to break down." (iTnews, from Reuters).
• Prime Minister Sanae Takaichi said the government will compile an emergency cybersecurity package. TrendAI counts 723 incidents in Japan in the year to 20 October, more than all of 2024 or 2025 (Reuters).
• BleepingComputer infers that no ransomware was triggered; GMO has not said so.

Attribution: GMO as reported by BleepingComputer and Reuters through iTnews.

Linux kernel CVE-2026-98432: a remote root flaw on servers with an MPTCP listener. [Reported]

• A use after free in the kernel's IPv4 TCP code, back to kernel 4.4, across Ubuntu, RHEL and Rocky Linux. The kernel CVE team scores it 9.8; Red Hat scores it 5.9 as a possible denial of service (BleepingComputer, 30 October).
• Anthropic researchers demonstrated root code execution on a server with an MPTCP listener, using an unreleased Claude model, in about 53 minutes. BleepingComputer reports no confirmed exploitation in the wild.
• Go 1.24 and later enable MPTCP by default where the kernel supports it, so some Go services expose it unknowingly. Disabling MPTCP alone is not enough.
• Debian, Oracle Linux, Amazon Linux and SUSE have fixes; Ubuntu's were in progress on 30 October.

Attribution: BleepingComputer, one outlet read, so lighter.

The PHP2Shell, Brotli and AI platform items in the cross sectoral section are this sector's priorities.

Government and defence

Moldova shuts 82 public services after data on 750,000 citizens is taken. [Confirmed]

• Moldova's e-government agency says attackers took sensitive details on 750,000 citizens, about a third of the population, including bank accounts, debt and payment history (e-government agency, not read).
• IT staff spotted data leaving the network on 23 October, as dated context. 82 digital services and 30 government networks were shut to contain it, and services are being restored after audits (e-government agency, not read).
• The way in, per Risky Business: a logging service exposed online without authentication. The attackers tried again on two later days and failed. No attribution.

Attribution: the agency's statements as reported by Risky Business; the agency's pages were not read. One outlet read, so lighter.

Florida: Social Security numbers of nearly 5 million aid applicants exposed. [Reported]

• The Florida Department of Education says an unauthorised party reached its Student Financial Aid site, exposing names, addresses, Social Security numbers and dates of birth of about 4.9 million applicants. It learned on 19 October and announced on 29 October (The Record).
• The site is down. "Financial aid for students is not at risk," the department says. It declined to describe the incident or the attacker.

Attribution: the department's statement as reported by The Record. One outlet read, so lighter.

The Silent Train and KeyDrift item, aimed at defence, aerospace and policy research, and Norway's risk level are in the cross sectoral section, with PHP2Shell's chain into a US government affiliated environment.

Retail and consumer

Australian holiday park guests sent scam payment messages quoting real bookings. [Confirmed]

• Guests of BIG4, Reflections Holidays, Summerstar and other parks received messages by WhatsApp, SMS and email saying a booking payment had failed, some carrying their real names and stay dates (ABC News; Cyber Daily).
• RMS Cloud, the booking software supplier, on 29 October: it "identified unauthorised access to a limited part of its environment" on 26 October; guest contact and booking details are involved, card and payment details are not (RMS status page).
• Since the flash. On 30 October RMS said it had notified the ACSC, the OAIC and the National Office of Cyber Security, and is assessing further notification. It has issued new credentials to integration partners.
• RMS: "These messages are not being sent by RMS." RMS names no attacker and has not said how the data was taken.

Attribution: RMS, read directly; ABC News and Cyber Daily. GreenCyber carried this as a flash on 29 October, naming no company on the card.

Online shop platforms: exploited flaws in Adobe Commerce and Drupal Commerce. [Confirmed]

• CISA catalogued Adobe Commerce and Magento CVE-2026-48356, an unrestricted upload of dangerous file types, on 27 October US time, deadline 10 November (CISA KEV feed).
• Drupal: "This vulnerability is being actively exploited in the wild." CVE-2026-118539, a highly critical access bypass in Commerce Core; fixed in 3.3.13 and 8.x-2.41, and Drupal advises auditing orders (BleepingComputer).

Attribution: CISA KEV, read directly; Drupal as quoted by BleepingComputer.

The supplier script item in the cross sectoral section, with Convertr's skimmer on Brazilian fashion checkouts, is this sector's other priority.

Transport and logistics

Japan Airlines: passenger data on about 92,000 people exposed through Amadeus. [Confirmed]

• JAL says unauthorised access to Amadeus's Passenger Service System, which it uses for reservations, ticketing and check in, exposed booking codes, names, flight dates, routes and classes for about 90,000 customers, and contact, passport and frequent flyer details for about 2,000 more (JAL, not read; BleepingComputer).
• The access ran from 10 August 2023 to 23 September 2026; Amadeus told JAL on 23 October. JAL says card numbers and passwords were not compromised and flights are unaffected.
• Amadeus serves airlines, airports, hotels and travel agencies, per BleepingComputer, and published its own statement on the vulnerability on 1 October, as dated context.

Attribution: JAL as reported by BleepingComputer and The Record.

Silent Train's targets include transport and aviation, and FrostyNeighbor's wiper hit a manufacturer serving Ukraine's transport sector; both are above.

Professional services

CrowdStrike: Australia among the most targeted countries for attacks on law firms. [Assessment]

• CrowdStrike's 2026 Legal Threat Landscape Report, for September 2025 to August 2026, puts Australia among eight countries most targeted and third for initial access broker advertisements against law firms, behind the US and Brazil (Cyber Daily, 29 October).
• Advertised access averaged US$1,573.89, median US$1,000. 455 legal entities were named on leak sites, up 39 per cent.
• Silent Ransom Group activity rose 129 per cent; its internal chats leaked this month (Ransom-ISAC, not read).

Attribution: a vendor report as summarised by Cyber Daily; no methodology seen, so Assessment.

The ConnectWise and AI platform items in the cross sectoral section are this sector's most relevant: firms rely on providers who connect into their systems.

Circulating but not carried

• Four Australian organisations claimed by Qilin in four days, an accounting firm, an events group, a defunct racing syndicate and a club. The club confirmed a contained incident; the rest are claims, from one outlet. Names held for Adam.
• A US fashion retailer's payment card breach. The Record's headline names it Resolve and its text Revolve, citing an 8-K the SEC search did not return. One outlet, the name unsettled.
• The US Federal Election Commission shutting its e-filing system after an intrusion. Reuters refused the read.
• South Korean police arresting seven people who used AI tools against more than 60 organisations. Yonhap refused the read.
• A data breach at the South Texas nuclear plant's operator. Seen only on an aggregator; no reputable outlet found.
• Wordfence's "still no confirmed WordPress compromises" from PHP2Shell. A headline only, not read.
• Wiz's count of nine October incidents at AI development platforms. Its report was not found.