Cyber news on October 28, 2026

1. 0122:50 UTC

   Texas county GOP sues to force hand count of all state ballots

   4 outlets · first: Democracy Docket Security

   Machine summary The Potter County Republican Party and a party official filed a federal lawsuit on Oct. 27 asking a court to block certification of Texas' Nov. 3 election results unless every paper ballot statewide is hand counted. The 27-page complaint, filed against Potter County Elections Administrator Christy Benge, rests on claims about hacking, software errors, foreign-made voting machine components and artificial intelligence, though it does not allege any machine changed votes, Democracy Docket reports.

   1. The 27-page complaint asks the court to require a 100% hand count of every paper ballot in every Texas precinct before federal race results are certified, according to Democracy Docket.
   2. Democracy Docket reports that a complaint contends Texas' current election protections are constitutionally insufficient because hacking, software mistakes, and manipulation by ever more advanced AI could occur.
   3. Democracy Docket reports the case as having been filed within the Amarillo Division of the Northern District of Texas's U.S. District Court, with U.S. District Judge Matthew Kacsmaryk, a Trump appointee, assigned to it.
   4. The election is scheduled for Nov. 3, and the suit seeks to block certification of results until a statewide hand count of paper ballots is completed, the reports state.

   Reported by Democracy Docket, The Texas Tribune and NewsNation.

   • Artificial Intelligence
   • Potter County Republican Party

2. 0207:07 UTC

   Coinbase attributes customer contact data exposure to vendor Amplitude

   3 outlets · first: financefeeds.com Data breach

   Machine summary Coinbase said an analytics vendor, Amplitude, experienced a security incident that affected contact data of a small subset of Coinbase customers. The exchange stated that its own systems showed no signs of unauthorized access, that customer funds remained unaffected, and that it is alerting affected customers and regulators. Reports did not state how many customers were affected, which contact data fields were exposed, or when the incident occurred.

   1. Coinbase's support account said on Tuesday that "Coinbase has not had a data breach" and that an incident at analytics vendor Amplitude affected contact data of a "small subset" of Coinbase customers
   2. Coinbase said it had found no evidence that anyone had accessed its own infrastructure without authorization, and added that customer funds were "not impacted"
   3. Coinbase did not disclose how many customers were affected, what contact data was exposed, or when the incident occurred, according to Decrypt
   4. According to a submission to Maine's attorney general, the Coinbase breach in May 2025 impacted 69,461 customers, exposing names, addresses, masked Social Security numbers, and images of government IDs.
   5. Coinbase refused a $20 million ransom demand in the May 2025 incident and offered a $20 million bounty for information leading to attackers' arrest

   Reported by Decrypt, financefeeds.com and cointelegraph.com.

   • Coinbase
   • Trezor
   • Amplitude
   • ShipMonk

3. 0308:37 UTC

   CISA lists exploited Brotli decoder flaw Node2Shell in KEV catalog

   2 outlets · first: securityweek.com Vulnerability

   Machine summary CISA added CVE-2026-111497, an out-of-bounds write in the Brotli decoder affecting versions 1.0.3 through 1.2.0, to its Known Exploited Vulnerabilities catalog on October 27, 2026.

   1. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026, with no details on the attacks, SecurityWeek reports
   2. The out-of-bounds write in the Brotli decoder affects Brotli versions 1.0.3 through 1.2.0, and is also known as Node2Shell, HTTP2Shell and Broccoli2Shell
   3. Previdian recorded one exploitation attempt on October 27 from a US-based IP address and rated its confidence as 'confirmed', while stating this does not mean the attempt succeeded
   4. ELLIO says its sensors caught a malicious request on October 26 targeting Node.js 24.22.0 on x86-64 systems, a day after a public tool sent Brotli-compressed data to its sensors

   Reported by securityweek.com and bleepingcomputer.com.

   • CISA
   • Node.js
   • Brotli
   • CVE-2026-111497
   • Node2Shell
   • ELLIO

4. 0423:45 UTC

   Alpine Linux rebuilds GitLab after CVE-2026-97229 exploitation attempt

   2 outlets · first: alpinelinux.org Vulnerability

   Machine summary All passwords were reset and Alpine Linux warned of credential-stuffing attempts using passwords leaked from other breaches.

   1. CVE-2026-97229 carries a CVSS score of 10.0 and stems from insufficient regular expression validation in Onigmo, Ruby's built-in regex engine
   2. GitLab published patched releases on October 12, 2026; the attacker began targeting Alpine Linux's instance on October 20 and 21, approximately one week later
   3. Alpine Linux found no evidence of tampering in the aports repository, packages, or the October 21 releases, but rebuilt the GitLab instance from scratch because it could not rule out compromise
   4. Alpine Linux observed automated login attempts against its GitLab using passwords leaked from other sites and reset all account passwords before reopening on October 30

   Reported by alpinelinux.org and securityweek.com.

   • GitLab
   • Ruby
   • Onigmo
   • Alpine Linux
   • aports repository
   • CVE-2026-97229

Each summary and its key facts are a machine summary of the reports linked under it; the outlets, times and counts come from those reports' own records. How a rundown is built.