Our Threat Research Unit published a breakdown of “The Gentlemen” - a Russian-speaking ransomware-as-a-service group that emerged in mid-2025, reportedly after affiliates split off from established groups like LockBit and Qilin. A few things that stood out from the research:
They’re offering affiliates up to 90% of ransom revenue - aggressive even by RaaS standards
Claimed 800+ victims across the US and Europe, making them one of the top RaaS groups this year
Cross-platform ransomware variants targeting Windows, Linux, NAS, and BSD
Active use of EDR-killing tooling - one recent incident involved a custom dropper abusing vulnerable Safetica ProcessMonitor and Lenovo BootRepair.sys drivers (BYOVD)
A breach of the group’s own infrastructure gave researchers rare visibility into their affiliate network, tooling, and ties to the broader ransomware ecosystem
Hackers stole about 8.3 million confidential tip records submitted to school safety and crime tip lines across the US and Canada, according to Nevada education officials citing media estimates. The exposed data may include names, addresses, dates of birth, and Social Security numbers. The tips were stored on P3 Global Intel, an anonymous reporting platform owned by safety software company Navigate360, which acknowledged the breach on Oct. 23, 2026, as reported by Reuters.
How the Navigate360 Breach Happened
An attacker accessed Navigate360’s P3 Global Intel system between November 2025 and March 2026 and copied confidential tips. P3 runs the anonymous reporting apps and websites behind many school safety and crime tip lines. According to an April 2026 letter from U.S. Sens. Maggie Hassan and Jim Banks, Navigate360’s products are used by more than 35,000 schools and 5,000 public safety agencies.
Here is what’s known so far:
March 2026: A hacktivist group claimed it stole 93GB of data, including millions of tips.
22, 2026: The Nevada Department of Education said about 10% of SafeVoice Nevada tips containing personally identifiable information were compromised between November 2025 and March 2026, in what it called a “criminal multistate cybersecurity incident.”
22, 2026: Toronto Crime Stoppers said it had frozen its operations after CBC reported that more than 1.5 million Canadian Crime Stoppers tips, some dating back 25 years, were exposed. The stolen data had been made available to journalists and researchers by the transparency group Distributed Denial of Secrets in March, according to The Record.
23, 2026: Navigate360 publicly acknowledged the breach and said sensitive personal data may have been exposed.
Tip records are different from most breached data. A single tip can include the tipster’s details, a student’s name, a description of another person, and sensitive details such as medical information. Nevada says it cannot notify everyone directly because SafeVoice tips are anonymous, so many affected people may never receive a letter.
Exposed personal data often fuels follow-up scams. Americans already receive an average of 14 scam messages a day across text, email, and social media, according to McAfee’s State of the Scamiverse report (January 2026). Breach news gives scammers a fresh, believable pretext to add to that volume.
Red Flags After the Navigate360 Breach
Watch for messages that use this breach as a hook:
A text or email about “your tip” or “your SafeVoice report” with a link: Scammers copy breach news to steer people to fake claim or login pages.
A caller who says they’re from Navigate360, a school, or police and asks for your SSN or bank details: Legitimate breach notifications don’t ask for payment, and you should never give your full SSN to an unsolicited caller.
A demand for payment to “remove” your tip or keep it private: No legitimate organization charges to protect leaked data. This is extortion or a scam.
Someone who knows details from a tip you submitted: This may mean your tip was exposed. Treat it as a possible safety issue, not just a scam.
New credit accounts, inquiries, or tax notices you don’t recognize: These are signs your SSN may be in use.
Mail or calls about credit in your child’s name: Children rarely have credit, so this activity is a warning sign.
How to Protect Yourself After the Navigate360 Breach
If you or your child ever submitted a tip through SafeVoice, a Crime Stoppers program, or another P3-powered tip line, take these steps now:
Use only the official notice line. Navigate360’s call center is 833-966-1754, open 6 a.m. to 6 p.m. Pacific Time, Monday through Friday, according to the Nevada Department of Education. If a message gives a different number or link, don’t use it.
Freeze your credit. A freeze with Equifax, Experian, and TransUnion blocks new accounts in your name. It’s free and does not affect your current accounts.
Freeze your child’s credit, too. Parents and legal guardians can freeze credit files for children under 16 at no cost. You’ll typically need your child’s birth certificate and Social Security card, your ID, and proof of address. Our guide on how to protect your child from identity theft walks through the freeze and other steps.
Check your credit reports. Get free reports at AnnualCreditReport.com and look for accounts or inquiries you don’t recognize.
Treat unexpected breach messages as suspect. Don’t click links or call numbers in unsolicited texts or emails. Go directly to the official source instead.
Turn on multi-factor authentication. Add it to email, banking, and school accounts so a stolen password alone can’t unlock them.
What to Do If Your Information Was Exposed or Misused
Act quickly if you see signs your data is being used:
Report identity theft: Go to identitytheft.gov to get a recovery plan and an FTC Identity Theft Report.
Contact your bank or card issuer: Call right away if you see charges or accounts you didn’t open.
Stop contact and don’t send money: Don’t pay anyone who threatens to release your tip or demands payment.
Change passwords: Update any account that shares a password you used with a tip app or school portal.
Call the Navigate360 line: Dial 833-966-1754 to ask about the breach and available help.
Keep records: Save letters, messages, phone numbers, and any accounts or charges you dispute.
Contact police: File a report if anyone threatens or harasses you over a tip.
How to Report Navigate360 Breach Scams and Identity Theft
If you encounter suspicious activity, potential scam communications, or identity theft related to the breach, it is essential to report it promptly to the appropriate authorities. Reporting assists law enforcement in tracking fraudulent schemes and protects others from falling victim. Use these official channels:
Online fraud or extortion: FBI Internet Crime Complaint Center at ic3.gov
Threats to your safety: Your local police department
While learning about a potential breach can be unsettling, taking a few proactive steps can go a long way in securing your personal information. If you or your child have ever used SafeVoice, Crime Stoppers, or another P3-powered tip service, freezing your credit files is an effective measure to help keep your family protected. As always, stay vigilant and verify any unexpected messages referencing your tip through official channels.
FAQ
Is SafeVoice Nevada still safe to use?
Navigate360 told Nevada that SafeVoice “remains fully operational and available 24/7.” The state has also opened a request for information to evaluate other vendors, according to the Nevada Department of Education.
What information was exposed in the Navigate360 breach?
Navigate360 said names, addresses, dates of birth, Social Security numbers, and other sensitive information may have been exposed. What was exposed varies by tip.
Which states were affected by the Navigate360 breach?
As of Oct. 27, 2026, Nevada is the only US state that has publicly quantified its impact. Canadian Crime Stoppers programs were also affected. Navigate360 has not published a full list.
The University of New Mexico is canceling classes across the medicine, nursing, and pharmacy faculties for a second day amid continued efforts to recover from a "cybersecurity event." The attack targeted the Health Sciences Center on Monday, the Uni revealed, forcing it to shut down systems, cancel appointments and clinics at UNM Health hospitals, and divert ambulances to healthcare facilities in nearby Albuquerque and Santa Fe. Hospital appointments and clinics return to normal today, although nonessential UNM Health Sciences Center staff are being asked to remain at home. "The University of New Mexico Health Sciences Center (HSC), which includes the UNM Health clinical delivery system, experienced a cybersecurity event Monday, Oct. 26, 2026," the university said in a statement on Monday evening. "HSC information technology security teams immediately took steps to contain the event and protect the network. They also notified state and federal law enforcement and engaged external partners to assist with the investigation. "Leadership activated an Emergency Operations Center to coordinate the response and provide guidance to HSC employees, students, and UNM Health system frontline providers." The university announced the attack at 1430 local time, immediately cancelling all remaining clinics and classes, dismissing everyone other than critical and clinical staff, and urging patients not to attend HSC facilities. It has not commented on the nature of the cyberattack, although that hasn’t stopped researchers from speculating about ransomware’s involvement. Rumors were fuelled by the newly assembled BYOD ransomware group claiming responsibility for the attack on Monday afternoon. It's important to note that just because a purported ransomware group took credit for the attack, it does not mean they actually were responsible, nor does it mean they deployed a ransomware/locker payload as part of the attack. However, the group's take on the digital raid is that it compromised 36,000 machines, "both [Active Directory] forests," two Oracle databases, the personal data belonging to every student and employee, as well as internal emails and data from other systems. As Reg readers know, a cybercriminal's word is never one to be trusted. Yet BYOD's claims about breaching Trump Mobile's customer database appear to have held up It was a bold debut, even for a ransomware crew: BYOD’s first named victim was the US president's smartphone biz, with data allegedly leaked for all 3,615 customers. A rival group, EndZone, claimed a similar breach a week earlier, and some experts suggested the two could be one and the same. In May, the Trump Mobile was found leaking thousands of people's data via a poorly secured website. The Trump Organization did not respond to our requests for more information in either of these cases. A UNM spokesperson declined to answer our additional questions, directing us back to its public statement. ®
You can overwrite the prepareStackTrace property of the Error object by String prototype's functions and invoke them without parentheses. Then by overwriting the Error and Array prototype it is possible to control the arguments. Combining this behavior, together with some JSFuck-inspired tricks, it is possible to generate arbitrary JavaScript strings and run arbitrary JavaScript with only letters + - = and ,
The US government's cybersecurity watchdog has confirmed attackers are exploiting both critical PHP2Shell vulnerabilities, giving federal agencies three days to patch the bugs that have wreaked havoc across the web over the past week. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on Monday, setting an October 29 deadline for federal civilian agencies to address the flaws. The move marks a shift from last week, when the agency warned of the danger posed by PHP2Shell but said it had not yet observed successful exploitation in the wild. Both bugs are rated 9.2 on the CVSS scale and can be exploited without authentication to run code on vulnerable PHP servers. That's bad news given how much of the web still relies on PHP, and just how many sites could be left exposed. Patches landed on October 21, but attackers had already beaten the maintainers to it. AWS spotted attempts to exploit the flaws as early as October 17, four days before the bugs were publicly disclosed. CISA's confirmation comes amid growing evidence that attackers are doing more than simply knocking on the door. On October 24, Perplexity security researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php. The attacks came from two IP addresses and used memory exhaustion and disclosure to achieve remote code execution. The attackers then tried to contact external servers using PHP, curl, and wget, although no additional malware was successfully downloaded. Karimi's findings were consistent with exploitation of CVE-2026-109618, but he found no evidence that the second PHP2Shell flaw was involved. He also warned that the honeypots used a favorable single-worker configuration, so the results don't necessarily reflect how reliably the exploit works against production servers. Still, attackers appear to be giving it a good go. Delft University's Threat Intelligence Lab has tracked more than 50,000 PHP2Shell exploitation requests from over 600 IP addresses across 70 countries. Of those, 171 addresses went beyond probing for vulnerable servers and started sending exploit code or malware droppers. CISA's confirmation also comes after some of the earlier reports of successful PHP2Shell attacks turned out to be rather premature. Sophos walked back its initial assessment after determining that the activity it observed amounted to scanning and failed attempts, while Palo Alto Networks withdrew claims linking the vulnerabilities to an intrusion at a European government agency. CISA has not disclosed which organizations have been compromised or provided details of the attacks behind its decision to add the flaws to KEV. The listing confirms that the agency considers both vulnerabilities actively exploited, but it does not confirm how many production systems have been successfully breached. For federal agencies, the clock is now ticking. CISA is also urging organizations outside the federal government to prioritize the fixes, although the deadline does not apply to them. Admins should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch. Those running older, unsupported versions face the added headache of upgrading or obtaining vendor-supported fixes, while systems that cannot be secured should be taken offline until the risk is addressed. And with CISA now officially acknowledging exploitation, anyone still waiting for more proof before patching may be waiting a little too long. ®
The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups.
The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices.
The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file.
Patches for the flaw were released last month by Apple in
Jess Asato’s public campaigning for victims of online abuse put her in the crosshairs of Grok’s deepfake scandal. Then the UK member of parliament became a victim of the abuse herself.
Microsoft has released another out-of-band update for Windows, but this one isn't an emergency fix for the latest breakages. This time, it's all about certificates. The non-security out-of-band release applies to supported OSes ranging from Windows 11 and Windows Server 2025, to Windows 10. It's all about updating the current certificate trust list (CTL) of devices that cannot access Microsoft's certificate-update service, or where automatic CTL updates are disabled. It also contains everything in the October 13 update, including the ongoing VPN issues and the change that could break on-premises Exchange Servers. There might also be oddities with Smart App Control, audio, and Remote Desktop connections for non-admin users, all of which are known issues in the October 13 update. These problems are not resolved in this patch, so be aware of this when installing it. It is also worth remembering that many devices will not need this version since the current certificate list updates usually come down through the update service. However, if that service isn't available or being used, it might be a good idea to get this out-of-band fix (while keeping the known issues in mind), since problems can occur when verifying certificates used by applications or websites. The OOB update came after Microsoft laid out its response to the compromised eMudhra certificate keys. The Indian certification authority's private keys were compromised earlier this month, requiring a massive cleanup effort. According to Microsoft, "they could potentially be used to create certificates or sign content that appeared to come from a trusted CA [certificate authority]." Like many other organizations, Microsoft moved swiftly to block the affected certificate authorities. It did so by updating its Windows Disallowed Certificate Trust List to block the affected certificates. There was also a separate CRLSet release for Edge and WebView2. According to the Windows behemoth, "On October 26, Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies: six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list." Microsoft's out-of-band patches are usually released after the company breaks a product and needs to issue an emergency fix. This time, the revision is due to Somebody Else's Problem and a need to get a CTL update out to devices that are disconnected from CTL updates. ®
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account.
Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update.
In the researchers' tests,
The cyberattack on Alternative for Germany (AfD), the country’s most prominent far-right political party, exposed hundreds of thousands of confidential emails and attachments, as well as more than 345,000 unique email addresses. Have I Been Pwned confirmed the scale of the breach for the first time today, after AfD officially disclosed the September attack on its hosting provider last week. AfD said in its statement that “only a few email accounts were illegally copied,” but admitted a large amount of the data was taken from them, resulting in an extensive data breach. The emails were added to what the party described as “an activist website,” which summarised the email chains into searchable topics and has led to the publication of various revelations, such as a party co-leader’s opinions on colleagues’ “deeply problematic” racial discourse. Per a report from investigative journalist Lilith Wittmann, citing conversations with the cybercriminals responsible for the hack-and-leak job and party sources, the attack was first spotted on September 9 and started with a compromise of a poorly protected WordPress site. The same report claimed the criminals gained persistent access to the servers operated by the hosting provider, identified as AfD-owned Alternita Dienstleistungs GmbH, and exfiltrated more than a terabyte of data. No official sources have verified the hackers’ claims about how the attack unfolded. The Register contacted Alternita Dienstleistungs for its take. AfD said the owners of the affected email accounts have been notified, and that it reported the attack to security authorities. “We are deeply concerned by what has happened,” the party said in an October 20 statement. “Such a digital attack is illegal and a criminal offense. Furthermore, it is an attack on the German party system and thus on democracy. “We are extremely worried that, apparently, the content of the stolen documents was analyzed using a very rudimentary AI. This analysis focused on keywords, not the context. The alleged scandals published so far do not stand up to scrutiny – a fact that, thankfully, is being confirmed by a growing number of commentators on social media.” Among the AI-generated summaries compiled by the “activist site” are chains supposedly expressing views related to Holocaust denial, racist and antisemitic rants, the 9/11 disaster, forged documents, and more. Der Spiegel sifted through the raw files and reported that party leader Alice Weidel seemingly knew about illegal donations related to the 2017 federal elections weeks before she previously said she did. The AfD's position is that the AI summaries of the emails are not to be trusted, but it has not specifically commented on the veracity of the raw email files available for download via torrent. It did not immediately respond to our request for input, but has told reporters previously that it will not comment on whether the emails, or the stories that have been written based on them, are to be trusted. ®
An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26.
Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve
Login
