Cyber Security News

Hacking Editorial Brief — October 26, 2026

AI-Assisted Intrusion Campaign Targets Government and Healthcare Infrastructure Across 19 Countries

Threat actors are using AI coding assistants and agentic AI platforms to conduct intrusions against government agencies, healthcare organizations, and commercial enterprises across 19 countries and territories, according to research from Zscaler. Investigators observed the campaign targeting financial and personal data, with particular focus on organizations in Malaysia and other regional markets. The operation demonstrates operational use of AI tools for both initial compromise and post-exploitation activity, marking a notable evolution in attacker tradecraft. Attribution, specific victim counts, and the full scope of data exfiltration have not been independently verified. Separately, researchers report that threat actors exploited PHP2Shell vulnerabilities in attacks against government and healthcare systems, with suspected North Korean-linked scanning activity detected globally. The relationship between the AI-assisted campaign and PHP2Shell exploitation activity remains unclear.

South Korean Authorities Arrest Seven in AI-Driven Data Theft Operation Affecting 90 Organizations

South Korean law enforcement has arrested seven individuals allegedly responsible for breaching approximately 90 companies and stealing 8.2 million records using AI-assisted techniques, according to reports from multiple Korean news outlets. The ringleader reportedly had no formal IT background but learned hacking skills while employed at a security company conducting penetration testing. Investigators report the group used generative AI tools to conduct large-scale intrusions and subsequently attempted extortion, threatening to leak stolen data unless victims paid. The specific AI platforms used and technical details of the compromise methodology have not been publicly disclosed. In a separate development, security researchers are raising concerns about newly disclosed Node.js vulnerabilities that could enable website compromise, following recent PHP-related exploitation activity. Separately, researchers report that Russia-linked threat group APT28 breached a naval shipbuilder in a NATO member country and targeted military aircraft infrastructure, though the timing and operational impact of the intrusions have not been confirmed.

Sources: CRN Asia · The Hacker News · Yonhap News Agency · Chosun Biz · Asia Economy · SOFX · SBS News