US election websites show improved security, but weak email protection, non-.gov domains and third-party tracking still expose voters to risks. Millions of Americans will use websites to check their registration, find polling places or track ballots before the November 3 election. However, a new study finds that many county election websites still have security weaknesses involving domain names, email authentication, encrypted connections and third-party tracking. Mysterium VPN’s 2026 County Election Website Security Census examines 2,081 county election websites across the United States. “42% of county election websites aren’t on .gov (869 of 2,081 identified). That’s down from 57% in 2024.” states the report. “Weighted by population, it’s 28% because the big counties moved first.” That’s an improvement from 57% in the company’s 2024 census. However, the findings reveal persistent weaknesses that could expose voters to impersonation, misleading websites and unnecessary data collection. These findings concern public information websites and their contact domains. They do not establish that voting machines, ballot-counting systems or election results have been compromised. The researchers started with 3,144 US counties and county equivalents but identified county-run election information pages for 2,081. Of these, 869 used domains outside .gov. Only verified US government organizations can register a .gov domain, making it a useful way for voters to identify official government websites. The study found that larger counties had made more progress: when weighted by population, 28% of residents lived in counties whose election pages used non-.gov domains. Texas accounted for 169 non-.gov sites, including 134 using the older co.<county>.tx.us structure. Arizona and Nebraska had no identified non-.gov county election sites. The FBI and CISA previously warned that criminals were using fake election websites to spread false information and collect personal data. Moving to .gov and redirecting older addresses can reduce confusion, although the domain alone cannot guarantee that every aspect of a website is secure. Election offices communicate with voters about registration, identification requirements and missing ballots. Weak email authentication can make it easier for attackers to impersonate these offices. Of 1,977 readable election pages, 965 displayed a contact address. After excluding consumer email services, researchers examined 942 county-controlled domains. “Of the 1,977 election pages whose content we could read, 965 display a contact address. Twenty-three of those are at consumer providers like Gmail. As in 2024, we set them aside, because Gmail’s security policy is Gmail’s, not the county’s.” states the report. “That leaves 942 county-controlled election email domains.” The study reported that 23% had no DMARC record, while 28% used p=none, a monitoring-only policy that does not request quarantine or rejection of unauthenticated messages. Another 30% requested quarantine and 19% rejection. Together, the first two groups account for roughly 51% of domains without an enforced DMARC policy. The report’s underlying counts total 941 rather than the stated 942, a discrepancy that requires clarification. The share of domains without DMARC fell from 41% in 2024 to 23% in 2026. SPF, another email authentication mechanism, was present on 98% of checked domains. Smaller counties performed worse. Among the third of counties with the fewest residents, 34% of election contact domains lacked DMARC, compared with 12% among the largest counties. Non-.gov domains also showed weaker protection: 32% lacked DMARC, compared with 16% of .gov domains. These findings indicate an association, not proof that adopting .gov automatically improves email security. DMARC enforcement can reduce certain forms of domain spoofing, but it cannot prevent every impersonation attempt, lookalike domain or attack involving compromised accounts. The researchers found 28 websites with consistent HTTPS failures among the 2,081 tested. Fifteen lacked a working HTTPS service, seven presented certificates for the wrong domain, and others had expired or untrusted certificates or failed to establish a secure connection. Another 178 websites would serve election pages over unencrypted HTTP if visitors requested them that way. Only 34% sent an HSTS header, which instructs compatible browsers to insist on encrypted connections. Sixty-three certificates were due to expire within 30 days of Election Day. A separate test examined third-party connections when election pages loaded in a clean browser, without clicks or scrolling. Of 1,930 measured pages, 84% contacted at least one company identified as a tracker by Disconnect or DuckDuckGo. The median page contacted six third-party domains. Google Analytics or Tag Manager appeared on 60% of websites, while Meta Pixel appeared on 3%. Mysterium suggests that some tracking results from default settings in website platforms rather than deliberate decisions by election officials. The presence of third-party code does not, by itself, establish unlawful tracking or prove exactly what information was collected. Still, counties should review whether these connections are necessary on pages designed to provide basic voting information. The study examined recognizable election-related domain names across several extensions, including .gov, .com, .org, .net, .us and .vote. Researchers identified 2,074 matching names that resolved to an address. Of these, 121 were registered outside government control. Thirty-eight hosted unrelated websites, eight were offered for sale, 73 displayed basic server or hosting pages, and two served gambling or spam content. The researchers also found 73 counties with a working .gov version of the name used by their non-.gov election website, suggesting that some had secured the official address without completing the migration. A separate test generated 14,456 single-character misspellings of 77 state and large-county election domains. Researchers found 245 registered variants and identified 26 that served parked, placeholder or unrelated pages after excluding potentially coincidental matches. The study does not establish that these registrations were malicious or identify their owners. However, a voter who mistypes an address or guesses the wrong domain ending could reach a third-party website instead of an official source. Across the seven states that decided the 2024 presidential election, 43% of identified county election websites were outside .gov, down from 55% in 2024. In these states, 26% of election contact domains lacked DMARC, compared with 39% two years earlier. However, 55% still lacked an enforced policy. The nine states whose 2026 Senate races were rated toss-up or lean in mid-October showed similar concerns: 53% of identified county election sites were outside .gov, while 44% of election contact domains lacked enforced DMARC. These figures measure website and email configurations. They are not evidence that an election has been compromised. Mysterium recommends that eligible government organizations complete the move to .gov, redirect old addresses, enforce email authentication policies and configure HTTP-to-HTTPS redirects and HSTS. Counties should inventory legitimate email senders before tightening DMARC policies to avoid disrupting valid communications. They should also review advertising pixels and unnecessary third-party connections, monitor certificate expiration dates and consider registering defensive versions of their domains. For voters, the report recommends starting with the state election office listed on USA.gov and following its link to the relevant county website. Voters should avoid trusting unsolicited messages or plausible-looking search results without checking the destination. If an election-office email comes from an unexpected address, voters should verify it using an independently obtained official telephone number. An unusual address is a reason to check, not proof of fraud, since the study found that some legitimate offices still use consumer email services. The researchers combined Census Bureau county data with official websites recorded in Wikidata and checked them against CISA’s .gov registry. They tested displayed contact addresses, email authentication records, certificates, redirects, tracking requests and lookalike domains. The study identified 2,081 election pages, compared with 2,913 in the 2024 manual survey. Automated discovery favored larger counties with better-structured websites, leaving smaller counties underrepresented even though some had weaker protections. The comparisons indicate progress but are not a perfectly matched before-and-after assessment. Different tests also used different sample sizes, and the tracking analysis measured a single page load from one location. The observations reflect October 17, 2026, rather than continuous monitoring. The findings provide a useful snapshot of public-facing election website security, but individual results should be rechecked before drawing conclusions about a specific county. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Election Website)
Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28. Talos calls the attacks historical but does not specify when they
Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet," the network security company said in an update to its advisory. The vulnerabilities, tracked as
Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers’ personal information. A Sony Group Corporation subsidiary, the company provides telecommunications and technology services, acting as an internet service provider (ISP) in Japan. The breach occurred on October 19 and was detected four days later, when the company shut down the compromised servers and blocked external communication. In an announcement yesterday, the company said that its So-net member database, supporting its internet access service, was accessed by an unauthorized party. The investigation confirmed that a total of 2,585,481 customer records had been exposed, including the following types of information: No banking, payment card, or other account details were exposed.
Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. The findings come from Eclypsium's October InfraTrust Pulse, a monthly report tracking security advisories affecting network devices, servers, firmware, chips, and other infrastructure. Between September 18 and October 14, InfraTrust tracked 133 new security advisories across 18 vendors, covering 2,813 vulnerabilities. Of those advisories, 37 were rated critical, five had a maximum CVSS score of 10.0, and 58 could be exploited remotely without authentication. Sixteen newly published advisories included vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog (KEV) as they were actively exploited.
PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach.
Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability. Discovered in a core component of EBS's Application Object Library and tracked as CVE-2026-101767, this flaw lets unauthenticated threat actors with HTTP network access take over vulnerable systems in low-complexity attacks. Oracle released security updates to address the issue in its October 2026 Critical Security Patch Update on October 20 and urged customers to patch their systems immediately. "In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches," it said. "Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay."
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. Tracked as CVE-2026-111497, this critical-severity flaw stems from an out-of-bounds write weakness in the Brotli decoder used to expand data compressed with Google's widely popular Brotli lossless compression algorithm. Unprivileged attackers can use a maliciously crafted Brotli-compressed stream to trigger crashes or memory leaks and, in some cases, gain remote code execution on devices with vulnerable Brotli libraries or binaries. The security issue was first identified in the Node.js JavaScript runtime environment, but it also affects HTTP servers and clients that rely on vulnerable Brotli implementations.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Brotli and Adobe Commerce and Magento vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-111497 (CVSS score: 9.2) – An unchecked return value vulnerability in Google Brotli that could allow a remote, unauthenticated attacker to corrupt decoder memory, expose sensitive information, cause a denial-of-service, or potentially execute arbitrary code by sending a specially crafted Brotli-compressed stream. CVE-2026-48356 (CVSS score: 9.3) – An unrestricted file upload vulnerability in Adobe Commerce and Magento that could allow an attacker to execute arbitrary code with the privileges of the current user, potentially gaining elevated access or taking control of the victim’s account or session. Brotli is a data-compression algorithm developed by Google.It reduces the size of web content, such as HTML, CSS, JavaScript, and other text-based resources. Security researchers have observed exploitation attempts targeting CVE-2026-111497 (aka Node2Shell), a critical flaw in Google’s Brotli library. Previdian recorded one attempt by October 27, while ELLIO researchers recently detected traffic carrying a public exploit that could execute code on vulnerable systems. The activity may indicate attempts to exploit the flaw on a larger scale, but its scope remains unclear. An attacker can trigger the vulnerability to cause crashes, expose sensitive memory or remote code execution when applications decompress attacker-controlled Brotli data. Because Brotli is widely used, multiple projects and vendors have released security updates, including Node.js, PHP, Bun, and Microsoft .NET. Cybersecurity firm Wiz warned that 91% of cloud environments contain resources vulnerable to the flaw, while 82% have publicly exposed Node.js instances. The second flaw added to the catalog is an unrestricted file upload vulnerability tracked as CVE-2026-48356, dubbed PolyShell. Recently WordPress security firm Sansec warned of attacks exploiting CVE-2026-48356 to infect at least 953 of online stores. The attackers reportedly used a Magento CMS block to insert a malicious loader capable of retrieving and executing a payload hosted under their control. So far, researchers have not recovered the subsequent payload, leaving the campaign’s ultimate objectives unclear. The activity is believed to have been underway since at least July 2025 and remains ongoing. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaws by October 29, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Three Japan-focused cyberattacks show how AI helps hackers scale operations, while exploiting old systems and weak security remains key. In autumn 2026, Japanese companies and other organizations reported a series of data leaks involving their web systems. On October 9, Japan’s National Cybersecurity Office issued a warning to businesses, while the head of the ruling party’s cybersecurity team described cyberspace as being in a “state of emergency.” Researchers at Trend Micro studied three attack infrastructures to understand how hackers use AI. Their findings show three different approaches, ranging from limited AI assistance to systems that use AI agents to manage almost an entire attack. The researchers looked at files that attackers left on servers anyone could reach. These included attack scripts, lists of targets, logs, and records of commands. The files showed attacks on organizations in Japan and other countries. But the researchers could not see the victims’ own logs or network records. So they could not confirm every break-in, measure the full damage, or say who was behind it. Attackers also like to claim more success than they really had. The researchers only counted a result as real when the evidence backed it up. The three cases show that AI does not play the same role in every cyberattack. “The cases differ along two dimensions: how much of the attack AI handled and how confidently we can establish its involvement.” reads the report. “Case A used AI to drive the entire workflow, which we confirmed. Case B was human-led, with confirmed AI assistance in planning and tool development. Case C showed high-confidence indications of AI use in a limited role, such as tool development. All three were active in 2026, and much of the activity preceded the previously published ARTEX reports.” Case A: AI agents managed the attack workflow. The researchers confirmed the use of CyberStrikeAI, an open-source penetration-testing platform built around AI agents. It handled reconnaissance, vulnerability checks, exploitation, data theft and reporting as part of a repeatable process. The platform split tasks among multiple AI agents. One record mentioned a credential-search agent in a system that used 44 agents. The platform could also generate Japanese content, including forms and fake login pages. Researchers identified at least 19 target organizations, including at least 16 in Japan. The system worked on several targets at once and kept traffic to each organization relatively low. This made the activity harder to detect by checking the logs of a single victim. Despite this automation, the platform rarely gained deep access to target systems. In many cases, it had no active session or web shell and showed no evidence of stolen data. The clearest intrusion started through an administration page that was publicly accessible on an old web system. The attackers did not need to exploit a newly discovered vulnerability. Case B: A human attacker used AI to plan and build tools. In this case, the operator made the main decisions but used a large language model to speed up planning and tool development. The researchers found an attack plan written by an LLM that targeted services providing AI and GPU resources. The attacker presented requests as authorized security testing to get around the model’s safety limits. The researchers say this was a false claim, although they did not publish the exact method. The attacker also targeted AI infrastructure, including platforms for AI workflows, data processing and model inference. The researchers believe the goal may have been to gain access to computing resources that could be used to run AI models cheaply. Some intrusions had serious consequences. In one case, the attacker gained control across several systems, including an FTP service, a database, an administrator account, a web shell and SSH access. The attacker also restored backdoors after they had been removed. In another case, a geographic information system server was exposed with default credentials. This provided access to hundreds of thousands of land and business records, as well as Windows credentials and email data. The evidence confirmed that information was downloaded. However, the researchers found no evidence that AI carried out these attacks independently. It helped the operator plan and build tools, while the actual work relied mainly on scripts, existing software and human decisions. Case C: AI played a limited role. Here, the operator appears to have used AI mainly to develop tools and scripts. The researchers found no evidence that it was involved in planning or managing the wider operation. They rated AI involvement as highly likely, but not confirmed, because they found no direct evidence such as prompts or API keys. The operator ran at least six campaigns in 2026, targeting exposed VPN devices and Oracle WebLogic servers. The targets included devices from Cisco, Citrix, F5 and Yamaha. In attacks against Yamaha RTX1210 routers, the operator did not exploit a product vulnerability. Instead, the attacker used credentials found in configuration files. These credentials provided direct access to internal corporate networks. The researchers also found signs that AI may have helped write some commands and scripts. These included unusually structured comments and emoji used as status markers. Such clues can support an assessment, but they cannot prove AI use on their own. Japan was the main target in all three operations, but attackers also targeted other countries and regions. All three used Simplified Chinese, but this does not prove they came from the same group or location. “Simplified Chinese was the working language in all three infrastructures. Japan was the largest target country, although the operators also pursued nearby countries and regions. Entry points were exposed legacy systems or weaknesses left in default configurations.” concludes the report. “Target selection was opportunistic across industries: the operators sought systems that were easy to attack from outside and acted on what they found.” The main difference was how AI was used. In one case, AI agents managed much of the attack and worked on many targets at once. In another, AI helped a human plan attacks and build tools. In the third, AI was mainly used to develop tools. AI helped make attacks faster and easier to scale, but attackers still exploited familiar weaknesses, such as outdated web systems, exposed admin pages, default passwords and poorly secured network devices. Researchers also found that AI tools sometimes reported planned actions as successful, making it essential to verify their results. AI can also help defenders discover vulnerabilities. However, researchers found no evidence that these three operations used AI-discovered zero-day flaws. Their attacks relied on known vulnerabilities and poor security settings. The report identifies six main priorities for defenders: Review public-facing systems. Identify old web applications and update them or isolate them if they cannot be secured. Protect administration pages. Check that management interfaces are not exposed to the internet without a clear need and strong access controls. Secure VPNs and network devices. Review configurations, remove default credentials and check for reused passwords. Protect internal AI services. Include AI workflows, inference services and GPU systems in asset inventories, and check whether they are exposed. Improve monitoring. Look for low-volume attacks spread across many targets, which may be difficult to spot in the logs of a single organization. Prepare for AI misuse. Organizations that use LLMs for work should train staff to recognize requests that falsely claim to be authorized security testing. These security weaknesses existed long before AI became widely available. AI simply helps attackers find and exploit them faster and across more systems. The time between discovering a vulnerability and using it in an attack may also become shorter. Organizations should install security updates quickly and apply temporary protections when patches are not available. Researchers still don’t know who was behind the three operations, whether they were connected or how much damage they caused. Further reports may provide more answers. “The attackers’ identities, whether the three cases share an operator, the full scale of the damage, and the AI models used remain unresolved. Our observations come from attacker-side files and still require confirmation from the affected organizations.” concludes the report. “We are considering further technical reporting on individual cases: AI-driven activity in Case A, AI assistance in Case B, and limited AI assistance in Case C. We will also continue working with the relevant organizations.” The main lesson is clear: AI can make cyberattacks faster and larger, but the basic security priorities remain the same. Organizations must identify systems exposed to the internet, strengthen access controls and detect suspicious activity before attackers turn a simple weakness into a serious breach. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Italy)
Confirm this action.
Leaving now will discard your changes.