Cybercrime, Fraud Management & Cybercrime, Incident & Breach Response

Hackers Scan for Newly Patched Oracle Flaw and Chinese Cameras Spy Ukraine

Anviksha More • October 29, 2026

ISMG regularly compiles a summary of cybersecurity incidents and breaches occurring globally each week. This recent roundup reveals that Chinese hackers have seemingly targeted the PHP2Shell vulnerability, prompting numerous discussions about its implications. Concurrently, the FBI has taken significant actions against the Virtualline bulletproof hosting domain. Security experts are also alerting organizations about hackers scanning for vulnerabilities in Oracle’s software.

Firewalls running PHP technology have become the target for attackers utilizing PHP2Shell exploits. The cybersecurity firm Palo Alto Networks recently issued a security bulletin reflecting this reality. The warning disclosed that attackers are actively exploiting two newly patched vulnerabilities in PHP, specifically within all up-to-date versions of the PAN-OS operating system, regardless of deployment method—from physical hardware to cloud environments.

All PAN-OS versions prior to last Wednesday are susceptible to these attacks. Palo Alto Networks has been distributing patches for the supported versions, with only one version, 11.1.7-h12, pending release. To mitigate risks while users rollout these patches, Palo Alto recommended restricting access to a management interface exclusively via a designated jump box.

The warning was inspired by research from Israeli cybersecurity firm Dream, which observed attacks conducting AI-assisted campaigns targeting firewalls with exposed management interfaces. Dream highlighted that the attackers had seemingly infiltrated numerous servers, including systems linked to a U.S. government-affiliated entity.

Dream’s findings revealed the attackers’ methodical approach using the Chinese IoT search engine FOFA, effectively identifying thousands of vulnerable firewalls. This alarming episode underlines the importance of timely updates and vigilance against such sophisticated threats.

The Federal Bureau of Investigation (FBI) has acted decisively against a domain-hosting service known as Virtualine, notorious for its involvement in cybercriminal activities ranging from phishing schemes to hosting illicit content, including child pornography. This service’s website, virtualine.net, was seized under a federal court warrant.

Virtualine, recognized on cybercrime forums as a facilitator for illegal activities, had been operational for several years, publicly advertising its services while allegedly allowing customers to bypass law enforcement inquiries by moving illicit infrastructures to unnamed shell companies.

Despite claims of not hosting child-related content, the FBI discovered that Virtualine knowingly hosted platforms facilitating child pornography and hack-for-hire services. A detailed analysis revealed a range of services, with prices varying dramatically depending on the functional needs of criminal enterprises.

Cybercriminals are rapidly scanning for systems vulnerable to a critical flaw discovered in Oracle’s E-Business Suite (EBS). Identified as CVE-2026-101767, this vulnerability exists in a vital component of the EBS Application Object Library, allowing unauthorized attackers to compromise susceptible systems with relatively low complexity.

Oracle addressed this flaw in its October security patches, although it notably did not label the vulnerability as being exploited in the wild. Nonetheless, intelligence firms have reported that scanning activities aimed at exploiting this critical flaw have increased significantly in recent days.

This situation comes as organizations struggle to keep pace with the numerous vulnerabilities that need addressing, particularly in light of Oracle EBS’s history of being a target for various cybercriminal groups. Such developments highlight a critical need for organizations to maintain diligence and apply patches promptly.

In a notable legal proceeding, a Ukrainian national, Artem Stryzhak, recently received a 70-month prison sentence for his role as an affiliate of the notorious Hive and Nefilim ransomware groups. His criminal activities resulted in substantial losses exceeding $100 million, affecting numerous hospitals, governmental bodies, and corporations globally.

Stryzhak, 36, collaborated with various ransomware groups since at least June 2021, boasting extensive experience in deploying devastating attacks against several high-profile victims, including during the COVID-19 pandemic. Following his arrest and extradition to the U.S., he confessed to multiple counts of conspiracy related to computer fraud and extortion.

In an alarming breach, hackers compromised approximately 345,000 email addresses and extensive internal communications of the German far-right Alternative für Deutschland (AfD) party. The breach came into public consciousness in October, revealing that massive amounts of sensitive data were made accessible online, raising serious questions regarding data security and political integrity.

Initial analyses determined that the breach occurred in September, with two separate infiltration attempts detected. Although the AfD has attempted to downplay the scale of the leak, the very existence of such breaches demands a deep reconsideration of cybersecurity protocols within political organizations.

Ukraine’s Computer Emergency Response Team (CERT-UA) has issued alerts regarding the potential compromise of surveillance cameras manufactured by Chinese firm Dahua. Reports indicate that cybercriminals have unlawfully accessed the video streams and device settings of these cameras, raising severe security concerns.

The entry methods chiefly included exploiting the Dahua cloud service, which has made it relatively easy for attackers to gain control over devices by using simple methods such as guessing device serial numbers. As a result, a comprehensive review of cloud-based security measures has become increasingly essential.

In another grim facet of cyber operations, John Allen Kurrle Jr., a former U.S. defense contractor, pleaded guilty to contributing to a conspiracy that enabled North Korean IT workers to obtain fraudulent employment in the U.S. Kurrle, who had access to sensitive governmental information due to his clearance, facilitated this scheme over several months in 2025, reflecting the persistent threat cybercriminal activities pose to national security.

A Brazilian cybercrime group, identified as part of the Magecart network, has executed a supply chain attack on the Convertr e-commerce platform, compromising customer payment information across multiple online retail sites. The incident highlights the increasing vulnerability of commercial entities to sophisticated attacks and the importance of enhancing security protocols in online transactions.

An extensive international operation resulted in the arrest of 1,462 individuals linked to cybercrime activities across Africa and the United States, demonstrating robust international cooperation in tackling this pervasive issue. The operation led to the disruption of over 10,900 malicious networks, underscoring the importance of collaborative efforts in combating cybercrime.

A newly discovered malware named Aokigahara has been identified as targeting artificial intelligence applications. Researchers have observed its capacity to steal sensitive information, raising alarms concerning the implications for business security and the integrity of AI technologies. Organizations are encouraged to adopt stringent security measures to protect critical AI-related data.

Conclusion

The continuously varying landscape of cyber threats necessitates a more concerted approach toward cybersecurity. Organizations, individuals, and governments must remain proactive in safeguarding their digital assets against evolving threats while swiftly responding to any breaches that may occur.