Daily Summary of Cybersecurity · Final editionWednesday 28 October 2026 · UTC
Cybersecurity News: 28 October 2026
DHS staff data leaked, Microsoft distrusts eMudhra keys, PHP2Shell flaws exploited
The leak site Distributed Denial of Secrets published personal and job details on more than 40,000 US Homeland Security employees, and Okta denied that its systems were the source. Microsoft pushed emergency Windows trust updates after eight eMudhra certificate authority keys were found to be recoverable.
Attacks on newly patched PHP and Oracle E-Business Suite flaws grew, and Japan's GMO offered a $1 million bounty after refusing a ransom demand.
Leak exposes personal details of more than 40,000 DHS employees
On October 28, Distributed Denial of Secrets announced it had published data on more than 40,000 US Department of Homeland Security employees and attributed it to a group calling itself the Department of Peace. The records include names, phone numbers, email addresses, job titles and internal email groups across ICE, CBP, Homeland Security Investigations and CISA. Some entries name surveillance, forensics and undercover roles.
The group's co-founder said the data came from the Okta single sign-on service DHS uses, but Okta said it had no evidence its systems were compromised, and Reuters was able to verify only some individual records.
Microsoft issues emergency Windows updates to distrust compromised eMudhra keys
Microsoft released out-of-band Windows trust updates after eight private keys for eMudhra intermediate certificate authorities were found to be recoverable. An October 26 update removed seven certificates from the Windows trust list, and on October 27 Microsoft confirmed it had removed the same certificates from Microsoft Edge.
Six of the keys are for TLS and two are for code signing, so attackers could in theory use them to impersonate websites or make malware look like it came from a trusted publisher. Microsoft said the problem lies in eMudhra's certificate hierarchy, not in Microsoft systems, and no such attacks have been confirmed.
PHP2Shell exploitation grows as federal patch deadline nears
CISA added the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on October 26. It gave federal civilian agencies until October 29 to patch, under a three-day rule for the highest-risk bugs. Researchers have recorded more than 50,000 exploit attempts and 35 successful shell executions on honeypots.
The PHP security team has also published a mitigation for CVE-2026-115560, a separate remote code execution flaw that it says can be exploited only with an unusual combination of configuration and application code.
Attackers probe critical Oracle E-Business Suite flaw days after patch
Threat intelligence firm Defused Cyber said its Oracle E-Business Suite decoys recorded exploratory attacks on October 27 against CVE-2026-101767. The flaw has a CVSS score of 9.8 and was patched in Oracle's October Critical Patch Update.
Horizon3.ai, which reported it to Oracle on July 24, describes it as an unauthenticated SQL injection in the Thin Client Framework servlet that can be chained to run operating system commands as the EBS application account.
Japan's GMO offers $1 million bounty after refusing $50 million extortion demand
On October 28, GMO Internet Group opened a reward program paying up to $1 million in total for tips that lead to an arrest or an international wanted notice for the people who breached its Onamae.com Desktop Cloud service. The service hosts Windows desktops used for FX trading, and a broker has linked unauthorized trades on some customer accounts to logins leaked from it. GMO refused a demand for about $50 million received on October 21.
The attackers' leak site, which posted material on October 27, was taken offline early on October 28 Japan time.
Illustration 
