Summary
A ransomware attack forced the Oneonta City School District to close schools for two days, disrupting operations for families and staff while the district investigates the full scope of the breach. The incident comes as New York state institutions face mounting cyber pressure, with a 53 percent increase in attacks and ransomware incidents reported between 2016 and 2022, according to the state comptroller.
Ransomware operators are actively exploiting CVE-2026-0257, a critical authentication-bypass flaw in Palo Alto Networks PAN-OS GlobalProtect portals and gateways. Attackers are using this vulnerability to establish VPN sessions, bypass multi-factor authentication, and move laterally within networks across sectors including education, healthcare, and government.
An unnamed attacker compromised 79 Microsoft 365 organizations between July 14 and September 22, 2026, by replaying stolen session tokens instead of cracking passwords. The campaign involved registering at least 48 rogue devices and manipulating inbox rules, allowing the attacker to maintain access and monitor sensitive communications despite multi-factor authentication protections.
Top Malware Reported in the Last 24 Hours
Oneonta schools shut after ransomware hit
Oneonta City School District confirmed a ransomware attack that forced schools to close on Friday and Monday as the district worked to understand what was affected. It is still assessing the full scope and impact of the incident, including whether student records or other personal information was compromised. The district said it is following its established incident response protocols and collaborating with relevant professionals as the response continues. For families and staff, the immediate consequence is disruption to school operations and uncertainty about what data may have been exposed. The incident lands amid a wider rise in pressure on public institutions: a 2023 New York state comptroller’s report found cyberattacks and ransomware incidents in the state increased 53 percent from 2016 to 2022.
Time4Popcorn flaw exposes millions to RCE
CVE-2026-30612 exposed users of the Time4Popcorn app to remote code execution by turning the app’s software updater into an opening for attackers. It could allow code to run with elevated privileges, meaning a successful hit can hand an attacker deep control of a Windows or macOS system rather than just a single user account. Researchers at Eye Security observed the scale of exposure through client connections—about 3 million on Windows and 350,000 on macOS—and warned the risk is amplified because many people install the app and then forget it exists. For affected users, the real-world outcome can be a silently compromised device that attackers can use to steal data or plant additional malware without obvious warning. Eye Security registered the update domain to deliver a remediation payload disabling the updater, and domain ownership was later transferred to The Shadowserver Foundation; users were urged to remove the app and monitor for signs of exploitation.
LiteLLM package tampering triggers credential theft
LiteLLM suffered a supply-chain attack on October 21, 2026, when a malicious Python package (litellm==1.107.0) and related Docker images were published to widely used distribution platforms. The compromise enabled credential theft and remote code execution, a combination that can turn a routine dependency update into a direct path into developer and production environments. The malicious package was available on PyPI from 11:39 to 13:23 UTC, and the Docker images remained on Docker Hub until 14:20 UTC, widening the window for accidental pulls. The attacker used GitHub CLI OAuth tokens to publish the malicious artifacts, highlighting how a single stolen publishing credential can ripple across many downstream users. The company said LiteLLM Enterprise users were not affected, and it recommended rebuilding environments from verified clean artifacts, rotating potentially exposed credentials, and maintaining historical logs for investigation.
Top Vulnerabilities Reported in Last 24 hours
Attackers backdoor Nextcloud via Collabora bug
Attackers are exploiting a critical command-injection flaw in Collabora Online Built-in CODE Server (CVE-2026-110447, CVSS 9.2) to achieve remote code execution and plant backdoors on exposed systems, including Nextcloud servers. In practical terms, that can turn a collaboration or file-sharing environment into an entry point for reconnaissance and data theft across an organization. Attackers are already exploiting this in the wild. The activity was highlighted in reporting that says CISA has flagged the issue as actively exploited. A patch is available.
Ransomware gangs bypass PAN-OS VPN logins
A critical authentication-bypass bug in Palo Alto Networks PAN-OS GlobalProtect portals and gateways (CVE-2026-0257) is being used by ransomware operators to break into networks without valid credentials. Once inside, attackers can establish VPN sessions, bypass MFA, and move through internal systems—setting up data theft and eventual ransomware deployment that can halt day-to-day business operations. Attackers are already exploiting this in the wild, with activity first observed in June 2026 and updated again in October 2026. Unit 42 linked exploitation to ransomware operators including Spikey Scorpius, Tarnished Scorpius, and Settra, affecting sectors spanning education, financial services, healthcare, government, utilities and energy, and transportation and logistics. A patch is available.
Web and app stacks scramble over PHP and Brotli RCEs
Two critical PHP zero-days—an out-of-memory execution flaw (CVE-2026-109618) and a stale global state vulnerability (CVE-2026-109619)—were reported as a fast-moving risk to PHP-based websites, with potential for server compromise, credential theft, and administrative session hijacking. The blast radius is amplified by PHP’s ubiquity, with the source noting it powers about 70% of websites and underpins platforms like WordPress. Separately, the Brotli compression library flaw dubbed “Node2Shell/HTTP2Shell” (CVE-2026-111497) can be triggered by crafted Brotli-compressed streams to cause memory corruption and potentially remote code execution in environments that decode Brotli traffic. The PHP report describes exploitation pressure driven by proof-of-concept leaks and says emergency patches were released by PHP maintainers, while Brotli fixes are available by upgrading to 1.2.1 or later. Both cases carry a real-world risk of compromised public-facing services, from knocked-offline sites to stolen user and business data.
Top Threat Actors Reported in Last 24 hours
Spikey Scorpius exploits PAN-OS auth bypass
Spikey Scorpius, a ransomware operator, is among the groups actively exploiting CVE-2026-0257—a critical PAN-OS authentication bypass that opens the door to GlobalProtect portals and gateways without valid login. After getting in, they establish VPN access and use it as a launchpad for reconnaissance and lateral movement that can end in data theft and ransomware deployment. The campaign spans a wide set of victim types, including education, financial services, healthcare, government, and professional and legal services, raising the odds that routine remote-access infrastructure becomes an unexpected point of failure for everyday operations. Unit 42 reported that one standout tactic is pivoting into the virtualization layer to disable security controls and perform credential dumping, helping the adversary deepen persistence. Initial exploitation was observed in June 2026, with updates reported in October 2026.
Tarnished Scorpius joins PAN-OS ransomware rush
Tarnished Scorpius, a ransomware operator, has also been linked to active exploitation of CVE-2026-0257, a PAN-OS flaw that allows authentication bypass in GlobalProtect. By turning remote-access gateways into an initial access channel, they can bypass MFA, establish VPN sessions, and move toward ransomware deployment and potential data exfiltration. The breadth of affected sectors—ranging from utilities and energy to manufacturing, hospitality, transportation and logistics, and retail—means the fallout can extend beyond IT teams into service delivery and business continuity. Reporting tied the activity to post-compromise steps that include broad internal discovery and lateral movement, with some intrusions escalating to disabling security controls and dumping credentials via the virtualization layer. Unit 42 tracked the exploitation activity beginning in June 2026 and later updated its findings in October 2026.
Token replay hits 79 Microsoft 365 tenants
An as-yet unnamed attacker ran a passwordless compromise spree against Microsoft 365 by replaying stolen session tokens, breaking into 79 organizations between July 14 and September 22, 2026. Rather than cracking credentials, they relied on tokens gathered via adversary-in-the-middle (AiTM) phishing and device-code phishing to access accounts and then reshape email behavior by manipulating inbox rules. For affected organizations, the practical impact is that sensitive messages and business workflows can be silently redirected or monitored, even when users believe MFA is protecting them. To keep access, the attacker registered at least 48 rogue devices in victims’ Microsoft Entra directories and swapped MFA methods to lock in persistence. The campaign included 497 successful sign-ins alongside over 200,000 failed login attempts.
Frequently Asked Questions
What is CVE-2026-30612? CVE-2026-30612 exposed users of the Time4Popcorn app to remote code execution by turning the app’s software updater into an opening for attackers. It could allow code to run with elevated privileges, meaning a successful hit can hand an attacker deep control of a Windows or macOS system rather than just a single user account.
What is LiteLLM? LiteLLM suffered a supply-chain attack on October 21, 2026, when a malicious Python package (litellm==1.107.0) and related Docker images were published to widely used distribution platforms. The compromise enabled credential theft and remote code execution, a combination that can turn a routine dependency update into a direct path into developer and production environments.
What is CVE-2026-110447? Attackers are exploiting a critical command-injection flaw in Collabora Online Built-in CODE Server (CVE-2026-110447, CVSS 9.2) to achieve remote code execution and plant backdoors on exposed systems, including Nextcloud servers. In practical terms, that can turn a collaboration or file-sharing environment into an entry point for reconnaissance and data theft across an organization.
What is CVE-2026-0257? A critical authentication-bypass bug in Palo Alto Networks PAN-OS GlobalProtect portals and gateways (CVE-2026-0257) is being used by ransomware operators to break into networks without valid credentials. Once inside, attackers can establish VPN sessions, bypass MFA, and move through internal systems—setting up data theft and eventual ransomware deployment that can halt day-to-day business operations.
What is CVE-2026-109618? Two critical PHP zero-days—an out-of-memory execution flaw (CVE-2026-109618) and a stale global state vulnerability (CVE-2026-109619)—were reported as a fast-moving risk to PHP-based websites, with potential for server compromise, credential theft, and administrative session hijacking. The blast radius is amplified by PHP’s ubiquity, with the source noting it powers about 70% of websites and underpins platforms like WordPress.
What is Spikey Scorpius? Spikey Scorpius, a ransomware operator, is among the groups actively exploiting CVE-2026-0257—a critical PAN-OS authentication bypass that opens the door to GlobalProtect portals and gateways without valid login. After getting in, they establish VPN access and use it as a launchpad for reconnaissance and lateral movement that can end in data theft and ransomware deployment.
What is Tarnished Scorpius? Tarnished Scorpius, a ransomware operator, has also been linked to active exploitation of CVE-2026-0257, a PAN-OS flaw that allows authentication bypass in GlobalProtect. By turning remote-access gateways into an initial access channel, they can bypass MFA, establish VPN sessions, and move toward ransomware deployment and potential data exfiltration.