The attackers behind the breach of GMO Internet's cloud servers for automated FX trading demanded $50 million (about 8 billion yen) and said they would publish customer information at noon Tokyo time on Oct 27 and release more every day at noon after that; GMO maintained that it will not comply with the attackers' demands (Jiji). GMO told users to back up their data, turn off their computers and unplug them before noon (Investing.com via Yahoo Finance UK). At noon the group posted content on its site that it says is one customer's personal information; GMO said the material may be inaccurate, is verifying it, and asked people not to visit the site or spread the content (ITmedia). On Tuesday afternoon GMO said a ransomware attack had not been confirmed but that information apparently related to customers had been published (J-CAST). GMO has committed to pay every service user 5,000 yen, and said it is considering additional payments for customers whose data appears in the leak and new PCs of equivalent spec for anyone hit by ransomware, alongside compensation for realized losses and six months of a free alternative service (J-CAST, ITmedia). ITmedia said GMO staff are collecting customer PCs nationwide for analysis, with Trend Micro among the firms assisting.

• Indicators to watch · Whether new data appears at noon Tokyo time (11 p.m. ET) each day; GMO's finding on whether the posted data is genuine; any confirmed ransomware infections on customer PCs; whether Tokyo applies its active cyber defense powers; phishing that impersonates GMO or brokers

• B1Israel votes, with final polls showing neither bloc at a majorityPolls opened at 7 a.m. local time and exit polls are due at 10 p.m.; Channel 12's final survey had Netanyahu's bloc at 50 seats, the opposition at 56 and Arab parties at 16, short of a 61-seat majority either way (Jerusalem Post), and NBC said the three main Israeli broadcasters gave Gadi Eisenkot's camp a 2- to 6-seat lead.
• C3Iran's Bagheri Kani says Washington must meet seven conditions before talks proceedGulf News' live blog said Ali Bagheri Kani laid out seven conditions the U.S. must fulfill before negotiations move forward and warned against temporary deals followed by renewed military pressure; the list was not published.

• —No victim count yet from Mirae Asset LifeHELIOS found no statement during the window from Mirae Asset Life or South Korea's financial regulators giving the number of customers affected by the insurer's hacking-related leak. No notable change confirmed.

Watchlist next 12–48 hours and beyond

• Tue, Oct 27, 4 p.m. ET
  Israel's exit polls (10 p.m. local) and whether either bloc reaches 61 seats
• Tue, Oct 27, 11 p.m. ET
  Whether GMO Internet's attackers post more data at noon Tokyo time, as threatened, and GMO's verdict on what was released
• Wed, Oct 28, 2 p.m. ET
  FOMC decision, followed by Chair Kevin Warsh's press conference
• Thu, Oct 29
  Planned observer visit and aid delivery in Oleshky, and whether the first evacuations begin
• Fri, Oct 30
  Federal civilian agencies' PHP2Shell patch deadline (per BleepingComputer); German Chancellor Merz visits the DMZ
• Sat, Oct 31
  North Korea's self-imposed October deadline for border loudspeakers and whether the JCS confirms broadcasts

Sources 29

• C
  Cyprus Mail (Reuters)Russia, Ukraine begin Oleshky ceasefire but keep up strikes elsewhere
  B
• E
  EuronewsUS-brokered ceasefire begins in Russian-occupied Oleshky as strikes hit Kyiv
  B
• A
  Al JazeeraRussia halts strikes on Ukraine's Kherson as Oleshky ceasefire takes effect
  B
• T
  The Manila TimesUS-brokered truce begins in Ukraine city occupied by Russia
  C
• S
  SRN News (Reuters)Saudi-led coalition says it intercepted Houthi missiles, drones attacking kingdom
  B
• A
  Al JazeeraSaudi-led coalition says it downed Houthi missiles, drones aimed at kingdom
  B
• G
  Gulf NewsUS-Israel-Iran war: What UAE residents need to know today (Oct. 27, 2026)
  C
• G
  Gulf NewsLive updates: US military ready for major Iran operation within 96 hours, says CNN
  C
• J
  Jiji Press (via Yahoo! Japan)GMO hit with attack warning and 8 billion yen demand; threat to publish customer information at noon on the 27th (translated)
  B
• I
  ITmedia NEWSGMO to provide new PCs to ransomware-hit customers; criminal group appears to publish one customer's information (translated)
  C
• J
  J-CAST NewsGMO says attacker may have published customer-related information; extra payments considered, new PCs for ransomware victims (translated)
  C
• C
  CISACISA Adds Two Known Exploited Vulnerabilities to Catalog
  A
• B
  BleepingComputerCISA confirms PHP2Shell vulnerabilities now exploited in attacks
  C
• I
  Infosecurity MagazinePHP Publishes Mitigation Advice for New RCE Flaw
  C
• S
  Segye Ilbo (Yonhap)Kospi rebounds 3% to close at 5,638.34; Kosdaq also rises 2.3% (translated)
  B
• S
  Special TimesKospi closes with sharp 3% rebound; Samsung Electronics, SK Hynix up 4-5% (translated)
  C
• T
  TV SeoulKospi rebounds sharply by 3% to close at 5,638 (translated)
  C
• N
  News4JAX (AP)Asian stocks advance following a rally on Wall Street and oil prices fall
  B
• S
  Segye IlboJCS: North Korea exposed older self-propelled guns on the coast; intentions being closely watched (translated)
  B
• S
  Seoul ShinmunNorth Korean self-propelled guns with barrels in full view: 'a political purpose rather than effectiveness' (translated)
  B
• A
  Al JazeeraJordan strikes Syria after church attack, killing at least seven people
  B
• T
  The News-Gazette (AP)Jordan says it attacked militants in Syria tied to church assault. Syria says civilians killed
  B
• T
  The Jerusalem PostPolls open across Israel as voting begins in pivotal Knesset election
  B
• N
  NBC NewsIsrael election live updates: Netanyahu battles to stay in power as voters head to the polls
  B
• L
  Lloyd's ListRussian diesel tankers head for US after Washington issues sanctions waiver
  C
• F
  FreightWavesRussian diesel tanker heads for U.S. following Trump-Putin deal
  C
• S
  Seoul ShinmunKMMI to invest 300 billion won in Pohang to produce rare earth permanent magnets (translated)
  B
• A
  Asia TodayPohang and North Gyeongsang sign 300 billion won investment agreement with KMMI (translated)
  C
• G
  German Federal GovernmentChancellor Merz travels to Singapore, Japan and the Republic of Korea (translated)
  A

Russian forces stopped shelling toward Kherson at 4 a.m. Moscow time (0100 GMT) on Tuesday, Oct 27, and Dmytro Lubinets, Ukraine's parliamentary human rights commissioner and head of its negotiating team, said, 'I confirm that the Ukrainian side is honouring its commitments' (Reuters). Reuters said the deal was mediated with the involvement of U.S. first lady Melania Trump and Russia's human rights commissioner Yana Lantratova. Al Jazeera, citing negotiators, said doctors, medicines, food and water will be brought into Oleshky before evacuation corridors open; about 2,000 residents remain trapped by mines and drone attacks, according to the United Nations (Al Jazeera, Euronews). The Manila Times said Melania Trump described civilian officials from both countries visiting residents to assess the help they need, with evacuees offered transport to a destination of their choice. Overnight, strikes hit Kyiv's Southern Bridge and the metro infrastructure on it, halting traffic, and Reuters said Russian missile attacks since Monday evening killed at least one person and injured 15 in Kyiv, including students in a dormitory. 'The missiles hit very crowded areas, and there is not a single military facility nearby,' President Volodymyr Zelenskyy said; Euronews also reported two people killed in Kharkiv. Reuters reported one person killed by a drone in Russia's Bryansk and one killed and 30 injured when a drone hit a bus in Russian-controlled Zaporizhzhia, and said Ukrainian, Russian and U.S. negotiators have agreed to meet at the technical level in Abu Dhabi in the first half of November.

• Indicators to watch · Thursday's planned observer visit and aid delivery; demining of the access route; evacuation announcements from Ukraine's ombudsman or the Kremlin; any extension of the truce; further strikes on Kyiv's bridges, metro and power; a firm date for the Abu Dhabi technical talks

At the Defense Ministry's regular briefing on Oct 27, Joint Chiefs of Staff spokesman Navy Capt. Chang Do-young said the 122-mm self-propelled guns North Korea exposed on the coast of Kaepung county are existing older-model artillery, not the new weapons system referred to in North Korea's recent statements (Segye Ilbo, Seoul Shinmun). He said North Korean work near the Military Demarcation Line is still under way and that loudspeaker activity reflects routine maintenance seen even before Kim Yo Jong's statement (Segye Ilbo). Segye Ilbo said the guns, which carry propaganda slogans, are visible from the observatory at Aegibong Peace Ecology Park in Gimpo, and that the military is investigating how a civilian crossed the civilian control line in Cheorwon. Seoul Shinmun cited a military official who could not recall barrels ever being exposed this openly, since artillery normally sits in rear mountain positions to avoid reconnaissance and preemptive strikes, and a researcher who called the exposure a threatening act meant to raise military tension; the paper judged the move more political than tactical and noted that similar displays in 2016 and 2020 kept up the appearance of training. Kim Yo Jong's deadline for loudspeakers 'within October' falls on Oct 31, and HELIOS found no North Korean state media response to Seoul's Oct 23 offer of military talks by the end of the collection window.

• Indicators to watch · JCS confirmation of loudspeaker broadcasts around Oct 31; MDL crossings or warning shots during North Korean border work; further exposed artillery deployments; any KCNA response to the talks offer; German Chancellor Friedrich Merz's DMZ visit on Oct 30

• B2South Korean military probes a civilian's crossing of the Cheorwon control lineSegye Ilbo said the military is investigating how a civilian got through the civilian control line in Cheorwon and reviewing guard and surveillance procedures.
• —No North Korean response to Seoul's military talks offerHELIOS found no KCNA or Rodong Sinmun response during the window to the Defense Ministry's Oct 23 offer of inter-Korean military talks. No notable change confirmed.

U.S. Impact Assessment

• Web infrastructure exposureWith PHP2Shell now on the KEV list and attackers probing it since Oct 17, any PHP server left unpatched past Oct 21 should be treated as possibly compromised, not just patched. U.S. agencies, contractors and hosting providers should hunt for web shells and unusual outbound traffic, and apply PHP's session.upload_progress workaround wherever applications match the CVE-2026-115560 conditions.
• Energy and Gulf supplyHouthi missiles aimed at the Eastern Province hours after the Tehran talks, on top of unverified claims against Saudi pumping stations, show that regional diplomacy has not slowed attacks on the kingdom. Brent is at $111.05 (+0.28%) in collected quotes; U.S. refiners and fuel-intensive operators should keep contingency plans for Saudi supply disruptions in place rather than price in a de-escalation.
• Financial-sector cyberThe GMO case has moved from unauthorized trades to staged, daily data dumps after a refused ransom. U.S. broker-dealers, FX dealers and fintechs whose customers trade through hosted VPS or remote-desktop setups should review those access paths, prepare customer notices about impersonation scams and rehearse a response to extortion aimed at their customers rather than their own systems.
• Ukraine diplomacyStrikes on Kyiv's bridge and a dormitory on the first night of the Oleshky truce show the pause is strictly local. U.S. companies with staff, contracts or logistics in Ukraine should not read it as a broader de-escalation and should watch whether the Abu Dhabi technical talks get a firm date.

Edition archiveRSS

• Saturday, Oct 31 · Morning Edition · 05:42 ETAttacks on ships around Hormuz hit a wartime monthly high as Trump says the Iran war will be “wrapped up soon,” Binance finds more entry points behind its $6.3 billion theft, and Seoul weighs stretching its Cheonghae naval unit toward Oman
• Friday, Oct 30 · Evening Edition · 17:44 ETTankers keep getting hit around the Strait of Hormuz as Qatari mediators carry a U.S. letter into Tehran, a tech rout hands the S&P 500 its worst day since June, and the Secret Service joins the hunt for Binance's stolen $6.3 billion
• Friday, Oct 30 · Morning Edition · 05:40 ETA small boat attached explosives to a tanker in the Strait of Hormuz, Binance was hit by a roughly $6.3 billion hack that blockchain analysts tie to North Korea, and AI-spending worries sent South Korea's KOSPI down 3.48%
• Thursday, Oct 29 · Evening Edition · 17:46 ETIran's Revolutionary Guards say three tankers hit mines on Hormuz's southern route and Houthi missiles are downed over Riyadh, as a Russian drone kills at least 14 at a Dnipro rail station and Florida discloses a student-aid breach that may affect 4.9 million people
• Thursday, Oct 29 · Morning Edition · 05:42 ETNorth Korea fires about 10 short-range ballistic missiles six days after Seoul offered military talks, as DHS says it is working to contain a leak of 40,000-plus employee records and Trump says Vance's Iran outreach was about medical aid, not peace talks
• Wednesday, Oct 28 · Evening Edition · 17:40 ETIran dismisses Qatar's draft deal as 'unacceptable ideas' amid reports that U.S. and Israeli officials expect a week of strikes after the midterms if talks fail, while a leak exposes more than 40,000 DHS employees and the Fed holds with two votes for a hike
• Wednesday, Oct 28 · Morning Edition · 05:36 ETThe U.S. has reportedly told Gulf allies to brace for a short, intense Iran campaign after the Nov 3 midterms as oil rebounds, while three South Korean financial firms, including crypto exchange Bithumb, disclose hacks
• Tuesday, Oct 27 · Evening Edition · 17:39 ETA cyberattack forces ambulance diversions at New Mexico's only Level 1 trauma center, the Houthis claim a missile hit on Saudi Arabia's largest refinery, and Iran threatens 'legal action' against every ship run by Sinokor, the biggest crude carrier through Hormuz
• Tuesday, Oct 27 · Morning Edition · 05:44 ET · CurrentA local truce takes hold in occupied Oleshky even as Russian missiles hit Kyiv's Southern Bridge and a student dorm, the Houthis fire ballistic missiles at Saudi Arabia's Eastern Province hours after the Tehran talks, and CISA confirms PHP2Shell is under attack
• Monday, Oct 26 · Evening Edition · 17:45 ETIran and three Mecca pact powers agree to keep talking after a first four-way meeting in Tehran and oil eases, but the Saudi-led coalition widens strikes on Houthi missile sites and North Korea parks self-propelled guns in plain view of the South
• Monday, Oct 26 · Morning Edition · 05:47 ETMediators converge on Tehran and oil eases, but a Houthi missile again targets Riyadh and South Korea reports its first hacking-related customer data leak at an insurer
• Sunday, Oct 25 · Evening Edition · 17:44 ETTrump says it's decision time on Iran, 'finish it off' or make a deal, but rules out a strike Sunday, as the Houthis claim a ballistic-missile barrage on Riyadh's newly reopened airport and CENTCOM's commander says Hormuz shipping lanes are clear of mines
• Sunday, Oct 25 · Morning Edition · 05:50 ETTrump says a U.S. strike on Iran could come 'maybe tomorrow' while floating a 'big, beautiful agreement,' as Houthi missiles and drones fly at Riyadh and Khamis Mushait and Musk says SpaceX throttled Ukraine over 'offensive' Starlink use
• Saturday, Oct 24 · Evening Edition · 17:43 ETA U.S. intelligence memo warns Iranian plots against Americans abroad have reached 'advanced stages' as the State Department thins out Gulf embassies, Houthi ballistic missiles fly at Riyadh, Taif and Yanbu, and Ukraine says its Starlink speed caps are gone

CISA said on Oct 26 that it added CVE-2026-109618, a PHP memory corruption vulnerability, and CVE-2026-109619, a PHP stale internal request-state vulnerability, to its Known Exploited Vulnerabilities catalog, citing Binding Operational Directive 26-04 (CISA). The pair, tracked as PHP2Shell, can let unprivileged attackers achieve remote code execution on unpatched systems in high-complexity attacks; the PHP security team shipped emergency fixes on Oct 21, and Amazon has said attackers began targeting the flaws four days before the patches (BleepingComputer). BleepingComputer said federal civilian agencies must secure their systems by Oct 30 and quoted CISA as saying these types of vulnerabilities 'are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.' Separately, PHP on Oct 23 disclosed CVE-2026-115560, a remote code execution risk that arises only under an unusual combination of configuration and application code involving session serialization handlers and session upload progress. It will not be fixed until the next regular release; PHP recommends setting session.upload_progress.enabled=0 in the meantime, and no exploitation has been reported (Infosecurity Magazine).

• Indicators to watch · The federal patch deadline under BOD 26-04; advisories from hosting-panel and CMS vendors that bundle PHP; any proof-of-concept or exploitation reports for CVE-2026-115560; PHP's next regular release; web shells or other post-exploitation signs on PHP servers that were exposed between Oct 17 and patching

Saudi-led coalition spokesman Maj. Gen. Turki al-Maliki said on Tuesday, Oct 27, that the coalition intercepted three Houthi ballistic missiles aimed at the kingdom's Eastern Province and four drones headed for its southern regions, with no casualties (Reuters, Al Jazeera). Saudi Civil Defense issued early warnings for the Eastern Region and Kharj governorate before announcing the danger had passed (Reuters). Gulf News said the wave came hours after Saudi, Turkish, Pakistani and Iranian officials wrapped up talks in Tehran with an agreement to keep talking. The coalition also destroyed three drones over Riyadh and the south on Monday evening, and on Monday the Houthis claimed attacks on Riyadh's airport and on crude oil pumping stations in western and eastern Saudi Arabia, which have not been verified (Al Jazeera). Al Jazeera said an attack on King Khalid International Airport earlier this month killed at least 13 people and wounded more than 300, and that Egypt's parliament on Monday authorized the military to help defend the kingdom. Reuters said the Houthis captured strategic areas along Yemen's Red Sea coast last month and are advancing toward the Bab el-Mandeb Strait, fighting that has shattered the 2022 U.N.-brokered truce. Etihad has suspended Abu Dhabi–Riyadh and Abu Dhabi–Dammam flights through Nov 5, and Emirates its Dubai–Riyadh and Dubai–Dammam flights until Nov 8 (Gulf News). Collected quotes show Brent at $111.05 (+0.28%) and WTI at $101.97 (+0.21%).

• Indicators to watch · Claims, or any halt announcement, from Houthi military spokesman Yahya Saree; any confirmed hit on the East-West pipeline or the Yanbu export terminal; Egyptian forces actually deploying; a date for the next four-way session; Gulf carriers' timetable for returning to Riyadh and Dammam

• B2Chipmakers lead Asia higher; Hong Kong and Shanghai slipAP said Asian markets mostly followed Wall Street's AI-led gains, with chip-related shares leading in Tokyo while Hong Kong's Hang Seng and the Shanghai Composite fell.
• B2Fed expected to stand pat when its meeting ends WednesdayAP said the Fed is not expected to change rates at the meeting that concludes Wednesday; collected quotes show the 10-year Treasury yield at 4.986% and the VIX at 18.32 (-0.38%).

• C2Gulf carriers keep Riyadh and Dammam flights suspended into NovemberGulf News said Etihad has suspended Abu Dhabi–Riyadh and Abu Dhabi–Dammam flights through Nov 5 and Emirates its Dubai–Riyadh and Dubai–Dammam flights until Nov 8.
• C3UKMTO flags a vessel fire about 63 nautical miles southeast of Iraq's Al-FawGulf News said UKMTO reported a ship on fire on Oct 26 about 63 nautical miles southeast of Al-Faw; the crew's status and the extent of damage were unknown.
• B1U.S.-funded rare earth magnet plant expansion planned in South KoreaPohang city and North Gyeongsang province signed an investment MOU on Oct 27 with magnet maker KMMI, which plans to add 6,000 tons a year of rare earth and non-rare earth magnet capacity on a 118,118-square-meter site in Pohang from 2026 to 2030, funded with about 300 billion won of foreign investment from Nasdaq-listed Evolution Metals & Technologies (Seoul Shinmun, Asia Today).

Intelligence gaps · unconfirmed

• Kyiv casualties: Reuters reported at least one killed and 15 injured in Kyiv since Monday evening, while Euronews reported one killed and 10 injured at the university plus a 20-year-old woman hurt near the dormitory. Estimates of residents left in Oleshky also differ: about 2,000 according to the U.N. (Al Jazeera, Euronews) versus more than 6,000 in last edition's Hromadske report.
• Oleshky: Only Al Jazeera said the truce runs through Saturday or longer; HELIOS found no official statement from both sides on its duration, and no confirmed aid delivery or evacuation during the window.
• Houthis: No Houthi claim was found for Tuesday's ballistic missiles, and Monday's claims about Riyadh's airport and pumping stations remain unverified.
• Price conflicts: Gulf News put Brent at $114.66 (-0.99%) on Tuesday morning, and AP had Brent at $110.21 (-0.5%) and U.S. crude at $100.66 (-1.1%) in Asian trading, versus collected quotes of $111.05 (+0.28%) and $101.97 (+0.21%), likely a contract-month or timing difference. Only collected quotes are used in the text.
• GMO: GMO itself is still verifying whether the posted data is genuine and whether it covers only one customer. A republished GMO notice in search results (publication confirmed at 12:30, no ransomware as of 13:44) could not be opened, so only J-CAST's 'Tuesday afternoon' wording is used.
• PHP2Shell: BleepingComputer's article gives Oct 30 as the federal patch deadline, while another summary said Thursday (Oct 29); CISA's alert does not state a date. Estimates of exposed PHP hosts were not used because the measuring source could not be identified.
• Russian diesel: Lloyd's List named the U.S.-bound tankers as Agioi Fanendes, PVT Azura and Iblea, while other reports named Talisman and Leruo; the Agioi Fanendes is described as Malta-flagged by FreightWaves and Greek-flagged elsewhere. The Financial Times report that one tanker is under sanctions could not be opened.
• Iran: Bagheri Kani's seven conditions come from a single Gulf News live blog, and his current title and the full list could not be confirmed. CNN's report that U.S. forces could launch major operations against Iran within 96 hours of an order, and Iranian armed forces chief Ali Abdollahi's claim of complete control of Hormuz, predate the window and were not opened, so they are not used.
• UKMTO: The vessel, crew status and cause of the fire southeast of Al-Faw are unknown, and only Gulf News carried the alert.
• Kospi flows: One search summary put foreign net buying at 5.91 trillion won, but two articles (Special Times, TV Seoul) give 591 billion won, which is used. Anthropic's offering size and valuation came from a single outlet and were not used; individual stock moves are not collected quotes and were left out.
• Israel: Turnout and exit polls arrive after the window closes (10 p.m. local). Final poll figures vary by broadcaster.
• Pending grades: 'cisa-kev-php2shell-nov5' appears to have been met by CISA's Oct 26 KEV addition of both CVEs. For 'riyadh-airport-reopens-oct31', travel site AirHelp reported the airport reopened Oct 18, but HELIOS did not confirm this with GACA or SPA this edition.