Cyber Security News

Hacking Editorial Brief — October 21, 2026

SafePay Ransomware Campaign Destroys Backup Systems Across 600+ Organizations

CISA issued a warning that SafePay ransomware actors have compromised at least 600 organizations across multiple critical infrastructure sectors since August 2024. The campaign's distinguishing characteristic is the deliberate destruction of backup systems, reducing victim recovery options and increasing pressure for ransom payment. The advisory follows established patterns of ransomware operators targeting backup infrastructure, though the scale of confirmed victims and cross-sector impact mark this as a significant active threat. CISA's public warning indicates ongoing exploitation activity against critical infrastructure targets.

Active Exploitation of Plex Media Server and SiteGuard WAF Vulnerabilities

Attackers are actively exploiting unpatched Plex Media Server installations to deploy Plex2Shell malware for cryptocurrency mining. The campaign targets devices running versions prior to the August 2024 security update. Separately, threat actors are exploiting CVE-2026-106931, an OS command injection flaw in SiteGuard Server Edition web application firewall, allowing command execution with root or SYSTEM privileges on affected servers. Both campaigns demonstrate opportunistic exploitation of known vulnerabilities in widely deployed software, with the SiteGuard vulnerability representing a particularly high-impact flaw given the privileged execution context.

Certificate Authority Compromise and State Police Agency Breach

Researchers disclosed that eMudhra Certificate Authority issued eight intermediate certificates with weak private keys that could be extracted from public certificate data, fundamentally compromising the trust chain for any certificates signed by those intermediates. The incident represents a significant cryptographic failure affecting certificate validation across potentially thousands of downstream certificates. Separately, South Korea's National Police Agency confirmed its spam-filtering server was infected with malware on May 28, 2026, part of a broader trend showing hacking attempts against police servers quadrupled year-over-year. A hacker group operating as "Siriusim" claims access to 380,000 State Bank of India customer records, though the claim remains unconfirmed.

Sources: GBHackers · Bleeping Computer · PCWorld · GBHackers · Asia E · Times of India