Gmail in the Ad Machine, PHP Crisis, and a Hacker Ring Unravels
Saturday, October 24, 2026 · 5-minute read
A coordinated law enforcement operation across Africa has disrupted close to 11,000 cybercrime networks. The sweep targeted groups involved in fraud, phishing, and online scams. It's one of the largest single cybercrime crackdowns the continent has seen.
↗ BleepingComputerThe FBI is closing in on the ShinyHunters hacking group, which has extorted more than $70 million from victims this year alone. Investigators arrested a Canadian cybersecurity executive, Edward Dubrovsky, who allegedly knew about a breach of FBI servers before the bureau itself did. Dutch authorities also arrested a key suspect, Pepijn van der Stap, and his Signal messages reportedly cracked open a web of ransomware negotiators working suspiciously close to the hackers.
↗ Krebs on SecurityCapcom, the Japanese company behind Resident Evil and Street Fighter, confirmed that hackers broke into its CAPCOM ID membership service and exposed the email addresses and personal details of over 11.7 million customers. If you have a CAPCOM ID account, treat your email address as compromised and watch for targeted phishing attempts.
↗ BleepingComputerHackers found a master key that was accidentally posted to a public code repository back in May — and nobody cancelled it. In October they used that key to break into LiteLLM's systems, steal a GitHub OAuth token, and push a poisoned version of the LiteLLM Python package to the public. That poisoned package was designed to quietly steal credentials, secrets, and environment variables from any developer who installed it. If you use LiteLLM or any AI tooling that depends on it, your build pipeline may have received the malicious version.
The Lazarus Group, linked to North Korea, is now using post-quantum cryptography to wrap their malware deliveries. This makes the malicious traffic much harder for security tools to inspect and flag. It's a sign that nation-state hackers are already preparing for a future where quantum computers could break conventional security measures — and using those techniques now to stay ahead of defenses.
A flaw in Google's Brotli decompression code lets a specially crafted compressed file overwrite parts of a program's memory it shouldn't touch. In the worst case, an attacker can use this to run their own code on your server — researchers have already demonstrated this on an unpatched version of Node.js. The same attack hasn't been proven on Python, Bun, or Envoy yet, but they all contain the same flawed code. No real-world attacks have been reported so far.
Status: Patches available for Node.js and Google's Brotli library (released October 21). Other affected software — including Python's Brotli packages and Bun — are rolling out fixes individually. Update each tool separately.
This is an SQL injection flaw in Arista's VeloCloud network management software. A remote attacker with no special access can send a crafted request and gain control over privileged internal functions — essentially getting admin-level access from the outside. CISA confirmed this is being actively exploited right now in real attacks.
Status: Patches available. Update to versions 5.2.3.18, 6.1.3.10, or 6.4.2.12 depending on your deployment. This is a CISA Known Exploited Vulnerability — patching should be treated as urgent.
If you run Nextcloud with the Collabora Online document editor, this vulnerability lets an outside attacker inject operating system commands through a web address called proxy.php. In plain terms: someone on the internet could run commands directly on your server. CISA has flagged this as actively exploited in the wild.
Status: Fixed in September 2026 in version 26.4.303 of the richdocumentscode app. If you haven't updated your Nextcloud + Collabora setup since then, do it now.
PHP shipped emergency patches this week for two critical bugs that let attackers run any code they want on a vulnerable web server. About 70% of websites depend on PHP, so the impact is enormous. Government websites in Europe reportedly went offline after the flaws were disclosed, and Cloudflare says it's already seeing active exploitation attempts. OpenAI, which helped with the research, called it "one of the most impactful security issues in recent memory."
Status: Emergency patch available now. If your website runs on WordPress, Drupal, Joomla, or Magento — or any PHP-based system — contact your host or developer immediately to confirm the update has been applied.
Microsoft is adding an AI layer to Teams that will scan messages for phishing attempts in real time — not just links, but the context of the conversation too. It's rolling out in early November 2026. This matters because attackers increasingly target Teams directly, knowing that people trust messages from what looks like a colleague far more than a cold email. The AI is designed to catch deceptive messages even when they come from a compromised internal account, not just an obvious outsider.
Dutch firm Eye Security discovered that the abandoned Time4Popcorn app — a piracy app from around 2014 — had left a silent background updater running on millions of computers. The updater was phoning home to a web address that had expired. Eye Security registered that address themselves, watched 50 connection requests per second pour in, and then used that control to push a harmless update that turned the updater off. They effectively patched millions of strangers' computers without anyone's permission — a legally murky but arguably life-saving move that closed a hole attackers could have weaponized as a botnet.
Google quietly updated its privacy policy this month, and buried in the legal language is something worth paying attention to: if you use Google's AI features in Search or Gemini, the company can now use data from your Gmail, Google Photos, and Google Drive to serve you targeted ads. This is a significant shift — Google previously said it wouldn't show personalized ads based on the content of those services.
Here's how it works in practice. When you ask Google's AI to help you plan a trip and it pulls in your Gmail to check your upcoming flights, that interaction — and the data it touched — can now feed into the advertising system. Google says this only applies if you "choose" to connect those services to AI features, and that you can turn it off. But the default experience for many users will move in this direction as AI becomes more embedded in Google's products.
For regular people, this means the trade-off for a more helpful AI assistant is a more surveilled inbox. Your emails discussing a medical appointment, a job search, or a financial decision could indirectly shape the ads you see — even if no human at Google ever reads them. The automated processing is invisible, but the targeting it enables is very real.
What to watch for: Google is careful to say this is opt-in, but "opt-in" often means accepting a prompt most users will click through without reading. Check your Google account's "Data & Privacy" settings, look under "Data from apps and services you use," and review which Google services you've allowed to share data with each other. If you'd rather keep your Gmail out of the ad equation, disconnecting those services from AI features is currently the only way to do it.