UNM Hospitals Hit, Copenhagen Breach Grows, CISA Flags Exploited Firewall Flaws

Cyberattack Disrupts University of New Mexico Hospitals, Extortion Group Claims Breach

A cyberattack on the University of New Mexico Health Sciences Center disrupted hospital operations on Monday, forcing ambulance diversions and canceled appointments at all clinics. The university's IT teams worked with external partners and law enforcement to contain the incident, and systems were brought back online in phases, with hospitals reopening and clinics resuming by Tuesday. A group calling itself BYOD claimed the attack on a leak site, alleging it compromised 36,000 machines and stole student and employee data including Social Security numbers, though UNM later said the event affected end-user devices but did not penetrate core systems. (Help Net Security)

University of Copenhagen Confirms 525,000 People's Data Exposed in Breach

The University of Copenhagen confirmed that a breach disclosed on 23 October exposed personal data for about 525,000 people, including names, national identity numbers, phone numbers and email addresses. The intrusion was detected on 20 October in a test environment. A Monday shutdown of administrative systems initially appeared to be a second attack, but the university determined it was activity tied to the original breach. The university also disclosed that PIN codes for 20,000 staff and student ID cards were compromised and have since been reissued. It reported the incident to the Danish Data Protection Agency. (Help Net Security)

Chinese Actors Exploit VMware ESX Zero-Day and Chain Flaws to Root Firewalls

CrowdStrike reported that Chinese espionage group Warp Panda exploited a VMware ESX logging flaw (CVE-2026-41709) as a zero-day to reduce audit trail visibility before Broadcom patched and disclosed it in July 2026. Separately, researchers at Dream found a China-nexus actor chaining a Linux kernel flaw (CVE-2026-46300) with PHP2Shell exploits to root 25 firewalls across four countries and target US government servers. Cisco also confirmed that a newly disclosed firewall vulnerability, CVE-2026-76418, is being actively exploited to crash devices, with no available workaround, and urged customers to upgrade immediately. (Help Net Security)

CISA Unveils 2030 Strategy to Push Adversaries Out of Critical Infrastructure

CISA released CISA 2030: Defend, Harden, Prevail, a strategy addressing intersecting cyber, physical and geopolitical threats to critical infrastructure. The plan rests on three pillars: defending national cyber systems, hardening infrastructure security through better intelligence-to-action translation, and mobilizing resilience via regional advisors and modernized planning. CISA will begin reviewing its core services within 60 days, submit an implementation plan within 180 days, and report on progress within a year. Acting Director Nick Andersen said the strategy aims to 'eliminate adversarial footholds' in US infrastructure. (Help Net Security)

FBI Seizes Virtualine, a Bulletproof Hosting Provider Shielding Criminal Customers

The FBI seized the domain of Virtualine, a bulletproof hosting provider that sold servers and domains to cybercrime forum customers while promising to shield them from law enforcement. Despite warnings from police agencies in Germany, Canada and Australia, and from the National Center for Missing and Exploited Children, the provider continued hosting a forum selling child sexual abuse material and helped it build a replacement site. The operation, dubbed Omegaline, involved Germany's Polizei Hessen, the Netherlands' Politie Midden-Nederland and the UK's National Crime Agency, alongside blockchain analysis firm Chainalysis. (Help Net Security)