A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. TeamUpdraft detected unauthorized access to its infrastructure over the weekend and believes that the hacker accessed the customer database. The developer offers several WordPress tools for backup, storage, and site management: "Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website," TeamUpdraft said in an advisory yesterday. "Our team responded straight away and worked through the night to contain it – we closed the access route, signed out every account and replaced the keys and credentials that could have been affected." The vendor says it believes the threat actor accessed its customer database, which included details about the customer and billing, order history, as well as more sensitive information:
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. PHP powers many websites and web applications, including content management systems, e-commerce platforms, and custom web services. In an advisory published Tuesday, the PHP development team announced that it plans to release security updates on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern), to address two vulnerabilities, each rated 9.2 under CVSS v4.0. The PHP security team also sent a notice to its ANNOUNCE mailing list, urging administrators to prepare to install the security updates as soon as they become available. "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild," the PHP security team warned.
OpenAI confirmed that its newer models are much better at writing and migrating software in older programming languages. The company lists programming languages such as COBOL, Fortran, and Visual Basic as a few examples where it has seen significant improvements. OpenAI says COBOL supports more than 40% of online banking systems, 80% of in-person credit card transactions, and 95% of ATM transactions, while Fortran is still used in areas such as weather forecasting and nuclear reactor safety analysis. "These languages have less code and documentation available for models to learn from than languages like Python and JavaScript, yet support critical infrastructure and essential services around the world," OpenAI explained in a blog post. To measure progress, OpenAI created MultiLangBench, which asks models to build a SQLite-compatible database engine from scratch across 20 programming languages.
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept. A researcher reported the
Google Cloud’s London outage disrupted Revolut payments and ATM withdrawals, while ING Germany reported online banking issues. Multiple Google Cloud services went offline in the London region this morning, according to Google’s status page, and the disruption didn’t stay contained to infrastructure dashboards. BREAKING: Revolut's app and cards have stopped working across Europe. Google Cloud's London region is affected by network failures. Revolut, and many other services, runs on Google Cloud. Revolut says money and data are safe but has not named a cause. pic.twitter.com/kyxOMlVaak — International Cyber Digest (@IntCyberDigest) October 20, 2026 British digital bank Revolut reported a widespread service outage at roughly the same time, and a person familiar with the matter told Reuters the two events were directly connected. “Multiple Google Cloud services experienced disruptions in the company’s London region on Tuesday, according to its service status page, while British digital bank Revolut also reported a service outage.” Reuters states, “A person familiar with the matter told Reuters that Revolut’s service outage was related to the Google Cloud service disruption.” The outage affected Google’s europe-west2 data center, its main facility in London. Google’s engineering team said they were investigating the problem. Alphabet did not immediately respond to Reuters’ request for more information. This is common during an ongoing incident, but it leaves customers unsure when their cards will work again. Revolut’s own status page showed most services as unavailable or partially unavailable, including card payments and ATM withdrawals. For a bank that exists entirely as an app with no physical branches to fall back on, that’s not a minor inconvenience. “We are currently experiencing a service disruption affecting multiple services. We can confirm that all our customers’ money and data are safe. We’ve been working to fix the issue since it was identified this morning and apologise to anyone affected and for any inconvenience.” the financial company wrote on X. We are currently experiencing a service disruption affecting multiple services. We can confirm that all our customers’ money and data are safe. We’ve been working to fix the issue since it was identified this morning and apologise to anyone affected and for any inconvenience… — Revolut (@Revolut) October 20, 2026 That last sentence is the right thing to say, and it’s also exactly what every bank says during an outage regardless of whether the underlying cause is confirmed. Money and data being safe is a different question from whether you can pay for your coffee. ING Germany also reported problems on Tuesday. Customers had trouble logging into online banking and the mobile app because of a technical issue. Reuters did not link these problems to the Google Cloud outage, and ING has not explained the cause. Two major financial services companies experiencing problems on the same morning could be a coincidence. However, it also raises questions about how much European banks depend on a small number of cloud providers. Google Cloud’s europe-west2 region in London supports many UK and European fintech services. Revolut alone serves tens of millions of customers across Europe. When a major data center goes down, the impact can quickly reach customers, preventing them from paying or accessing banking services before the cause is fully understood. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Revolut)
The U.S. Department of Homeland Security (DHS) is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems. The order also covers products from the Chinese AI company's affiliates and third-party products and services built using DeepSeek technology. DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd) develops large language models and offers a chatbot, API services, and models suitable for coding and reasoning tasks. Its AI tools became extremely popular early on, but were but were soon followed by reports of security risks [1, 2, 3, 4] and concerns about the potential for Chinese authorities to access users’ conversations. The DHS is now taking regulatory action to limit the use of DeepSeek and derivatives on critical systems in the United States, and has issued a notice of order for agencies to:
CJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance. Specops outlines five practical priorities covering MFA, account management, passwords, logging, and audit readiness.
A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. 40-year-old Chukwuemeka Victor Amachukwu (also known as Chukwuemeka Victor Eletuo and So Kwan Leung) has pleaded guilty to conspiracy to commit computer intrusions and wire fraud after being extradited from France to the United States in August 2025. "Chukwuemeka Amachukwu believed he was operating safely offshore when he targeted his victims, but he has now been held to account and now faces a serious sentence for his crimes," said US Attorney Jamie McDonald in a Monday press release. "Amachukwu took part in sophisticated schemes to hack into US businesses, steal and use stolen identity information of victims, and commit fraud. These crimes imposed significant harm on the victims and the public, and so it is only appropriate that the crimes also come with a significant sentence for the defendant."
A data breach exposed AfD emails, while an anonymous site published AI summaries of 421,000 messages, raising questions about authenticity and privacy. Germany’s Alternative für Deutschland (AfD) confirmed on October 19 that its hosting provider was hacked in September and that mailboxes were copied. By the time the confirmation reached Bild, a website called hexane.cc had already been online for hours offering an index of what it claims are 421,179 internal party emails. “In September 2026 there was a hacking attack on a hosting provider used by our party.” By then the website hexane.cc had been online for several hours with an index of what it says are 421,179 of the party’s emails. In place of the emails, the site shows summaries written by software, sorted into categories that include racism and antisemitism and graded from Low to Critical. International Cyber Digest (ICD), a cybersecurity news account on X, examined it on 19 October and reported that the index includes Gauland’s mailbox and that the newest message is dated 12 September 2026. According to the summaries ICD relayed, Gauland, the party’s 85-year-old honorary chairman and former co-leader, forwarded a 2018 email about a “Hitler pilgrimage” by a former judge on the party’s internal court in Thuringia.” AfD told told Bild. “A district board member sent a Christmas card with a swastika and the words “Heil Hitler”. Staff at the party’s Berlin headquarters discussed luring a photographer to an event and throwing him out by force, in a thread signed off “hail and victory”. The AfD’s statement gave a limited account of the incident. The party said the attackers copied parts of a few mailboxes, most of which had not been used for years, and did not access the leadership’s current accounts. However, the online index includes messages dated as recently as September 12, 2026, raising questions about the party’s account. The website hexane.cc does not publish the emails themselves. Instead, it provides AI-generated summaries grouped into categories such as racism and antisemitism, with severity ratings from Low to Critical. The site operators have not identified the AI software used to create them. When users try to open a record, the site displays the message “source text not published for this record.” So far, none of the summaries has been linked to an original email that can be verified. That’s an important detail that’s getting lost in the coverage. The summaries describe swastikas, Nazi greetings, Christmas cards bearing Heil Hitler, and a thread at the federal party headquarters signed off with “hail and victory.” If authenticated, some of this material would matter significantly in ongoing court proceedings about whether the party can be banned. But right now all of it is filtered through an anonymous operator’s software, and the original texts remain unpublished. Bild is the only German news outlet confirmed to have examined files from the archive directly, although it reviewed only a very small sample. The files appeared to be genuine party records, including identity documents, invoices, bank statements, membership applications, and regional member lists. They also included the identity card of Markus Frohnmaier, deputy leader of the AfD’s parliamentary group in the Bundestag. Berlin-based security researcher Lilith Wittmann, who exposed a flaw in the CDU’s campaign app in 2021, wrote on X that she believed the leak was genuine and the reported attack method was plausible. The hacker reportedly told the International Cyber Digest account on X that they gained access through “a single unpatched party website” and then reached the mail servers. The AfD has confirmed that its hosting provider was targeted, but the reported entry method has not been independently verified. The archive’s own file names offer another clue: one server is labeled “afd_exfil.” The term “exfil” is commonly used for a system that stages stolen data before attackers transfer it out of a network. The AfD is currently contesting in court its classification as a confirmed right-wing extremist organization by Germany’s domestic intelligence agency. Lawmakers in the Bundestag and Thuringia are separately debating whether to seek a formal party ban, which under German law can only come from the Federal Constitutional Court. The leak appeared on October 19, while the Cologne Administrative Court is actively weighing whether the intelligence agency may publicly apply the extremist designation, and two months before the AfD plans to seek the election of one of its leaders as state premier in Saxony-Anhalt. Within two hours of the first posts about the archive on X, some accounts were using it to argue that the AfD should be banned. If authenticated, the most legally relevant emails would be those showing how the party’s national headquarters operates and handles internal disciplinary cases. This is because a ban case focuses on the party as an organization, not on individual members. So far, none of the summaries has been linked to an original email. The website describes itself as an independent archive published in the public interest and claims to have minimized personal data. However, Bild found that the files it reviewed included membership applications and member lists containing full names and home addresses of people whose only apparent connection to the story was their party membership. By the afternoon of October 19, the site’s About, Method, and Support pages were returning server errors, leaving visitors unable to access its own explanations of how the archive was created and managed. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AfD)
Fintech company Revolut is working to resolve a massive outage that disrupted most of its services worldwide earlier today. Since the incident began, thousands of users on the Downdetector outage tracking platform have reported issues with the Revolut app, mobile banking services, and transferring funds between accounts. In a statement today, the company said the outage has affected its services since Tuesday morning and added that customers' data and funds are safe. "We are currently experiencing a service disruption affecting multiple services. We can confirm that all our customers' money and data are safe," Revolut said. "We've been working to fix the issue since it was identified this morning and apologise to anyone affected and for any inconvenience caused." On its official status page, the company says the outage affects 28 services, including sign-ins, card payments, transfers, currency exchange, stock trading, and live support chat, which are now flagged as partially unavailable.
Confirm this action.
Leaving now will discard your changes.