BLOG 2026 OCTOBER 2026 2025 2024 2023
AI blog APT blog Attack blog BigBrother blog BotNet blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blog
2026 January(89) February(123) March(106) April(119) May(126) June(97) July(101) August(348) September(454) October(524) November(0) December(0)
DATE |
NAME |
Info |
CATEG. |
WEB |
|
24.10.26 |
How practical is 100k requests per second? Introducing h3fuzz | There was some research that the PortSwigger team released in late September that revealed that they were able to reach 100k requests per second over WiFi using HTTP/3. This caught my attention as a hacker that has always tried to find speed with fuzzing attempts. The context of the blog post stuck to how this worked with Turbo intruder inside Burp Suite, and how it could be used to perform time of check time of use (TOCTOU) attacks. | Security blog | SEARCH LABS |
|
24.10.26 |
High Fidelity Detection Mechanism for php2shell (CVE-2026-109618 and CVE-2026-109619) | Whenever a new earth shattering vulnerability like php2shell is released on the internet, our research teams are always rushing to determine the best way we can notify our customers about their exposure to it. We’ve had experience with this, both in vulnerabilities discovered by us (wp2shell), but also novel issues such as react2shell, late last year. | Vulnerebility blog | SEARCH LABS |
|
24.10.26 |
Defining a Zero Day Vulnerability | In cybersecurity, “zero day” is frequently diluted and used as a catch-all for any unpatched vulnerability. This article breaks down the three mandatory elements of a true zero day, illustrating why the distinction between a zero day and a known, but unpatched, flaw is critical for effective defense. | Vulnerebility blog | BeyondTrust |
|
24.10.26 |
AOMEI Backupper supply chain attack - METAL by ManageEngine | Detection: On 28 May 2026, ManageEngine EDR recorded AOMEI Backupper installing Radmin, a commercial remote-administration tool. The same execution chain appeared on a second, unrelated customer endpoint in another country within the same window. | Hacking blog | MANAGEENGINE |
|
24.10.26 |
Investigation: Unauthorized Access Through the ConnectWise Cloud Backup Microsoft 365 App | In Todyl-monitored tenants, an unauthorized party authenticated to Microsoft Graph as the ConnectWise Cloud Backup application. | Hacking blog | Todyl |
|
24.10.26 |
October 2026 Oracle Critical Patch Update Analysis | Oracle has released its October 2026 Critical Patch Update, delivering 1,295 new security patches across the affected Oracle product families. | Vulnerebility blog | Fortra Blog |
|
24.10.26 |
Krybit Ransomware: What You Need to Know | Krybit is the name of a ransomware-as-a-service (RaaS) operation that first surfaced in early 2026. The group rents out the ransomware it has developed to affiliates who carry out attacks on its behalf, splitting ransoms extorted from victims 80:20 (80% to affiliates, 20% to the Krybit operators) in exchange for access to the malware, a dashboard, and round-the-clock technical support. | Ransom blog | Fortra Blog |
|
24.10.26 |
The Art of Security Podcast: Episodes 13–17 Recap | You know the line: defenders have to be right every time, but attackers only have to get lucky once. Tyler and Josh wonder if that gives attackers too much credit. They explore how layered security, deception, active defense, preparation, and threat intelligence can tip the scales toward defenders, and whether the cat-and-mouse idea works the same for an enterprise as it does for you at home. | Cyber blog | Fortra Blog |
|
24.10.26 |
Inside Help TDS: Hotejka and Cloudflare Abuse | Threat research is always a bit of a cat-and-mouse game, and it’s often made more so when an actor survives years in the face of scrutiny. The actors behind the so-called Help Traffic Distribution System (TDS) are one such case. They’ve been active since at least April 2017 and have been largely unaffected by the cybersecurity world around them. | Hacking blog | INFOBLOX |
|
24.10.26 |
FlowerStorm detection and 70+ YARA rules: September 2026 | The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape. | Malware blog | VMRAY |
|
24.10.26 |
vulnerability-discovery-to-active-attacks-ai-in-cyber-operations | Recent PHP disclosures and published investigations into ARTEX indicate that AI is being used across vulnerability research and offensive operations. Darktrace telemetry identified failed authentication activity involving infrastructure that Microsoft later publicly associated with the ARTEX campaign. | Hacking blog | darktrace.com |
|
24.10.26 |
Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor - Real-time Open Source Software | The LiteLLM 1.107.0 release on PyPI carries a credential stealer and a remote code execution backdoor. All seven wheels (Linux, macOS, Windows) install them as three files in site-packages. Both run when any Python process starts on the host, even one that never imports litellm. The upstream GitHub source does not contain them. | AI blog | Supply Chain Security |
|
24.10.26 |
testmetest npm Packages Carry a Miasma-Family Worm - Real-time Open Source Software Supply Chain Security | An operator is testing a Miasma-family npm worm in public. Between 19 and 22 October 2026, npm received 15 packages with names that end in testmetest. The accounts alexjoipamiba and testnewtestme published four of them. The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the home directory when the victim revokes the stolen GitHub token. | Malware blog | Supply Chain Security |
|
24.10.26 |
PHP2Noise - Two PHP Critical RCEs Patched As Users Scramble for Fix Amid Misinformation - | A critical PHP exploit leaked ahead of its incoming fix, after PHP alerted users such a fix was incoming. Prior to this fix being released with two critical vulnerabilities being fixed, the internet at large responded quickly by creating alleged PoCs within hours of publication, along with fake recommendations for mitigation. | Vulnerebility blog | Checkmarx |
|
24.10.26 |
Eight Compromised Certificate Authority Keys Have Put The Internet At Risk - Checkmarx | What happens when your random function returns just one byte? It depends: if you’re issuing intermediate CA certificates, you create a global security failure, as the Go language maintainers discovered. Learn about the issue, how it impacts your organization, and what to do next. | Security blog | Checkmarx |
|
24.10.26 |
Mini Shai-Hulud in Tensorlake: A Token Monitor That Can Wipe Your Home Directory - Checkmarx | A malware campaign based on the npm Shai-Hulud tactics hit the Tensorlake AI sandboxing ecosystem. Learn about how it worked, how to detect it, and what to do if you’re impacted. | Hacking blog | Checkmarx |
|
24.10.26 |
Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core | This blog post is about an unauthenticated stored XSS vulnerability in WordPress core, tracked as CVE-2026-93485. If you use WordPress, please update to at least version 7.1.1, or to the latest release in your branch. The fix was backported to every supported branch down to 4.7.36. | Vulnerebility blog | IDNSEC |
|
24.10.26 |
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth | On 25 July 2026, researchers from HacktronAI achieved remote code execution (RCE) and administrative access on the Discourse web application deployed at community.openai.com. The attack used the image upload feature, where HEIF/AVIF files were processed by ImageMagick and libheif, which contained a previously unknown memory corruption vulnerability. | Vulnerebility blog | IDNSEC |
|
24.10.26 |
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail | In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. | Vulnerebility blog | IDNSEC |
|
24.10.26 |
ValleyRAT sideloads through a signed Microsoft profiler | Tax-themed ISOs sideload ValleyRAT through a signed Visual Studio tool. Five months of builds share one transport key and a text file that hands out new servers. | Malware blog | ADAMNET |
|
24.10.26 |
KeyStealth: A $10,000 PhaaS Kit caught in the wild | A construction quote lure led to device code phishing, three rogue Entra devices named iAuthFlow-Device, and seven weeks of mail access before a thread hijack. | Phishing blog | ADAMNET |
|
24.10.26 |
PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619) | Two unauthenticated RCE flaws in PHP, with exploitation attempts reported. Who is affected, how to check, and the fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35. | Vulnerebility blog | Hacktron AI |
|
24.10.26 |
Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web | Forever caught live malware on a customer's machine attempting a new kind of attack: a file planted in the Downloads folder that turns your own AI coding agent against you. Here's how it works on Codex and Claude Code, and why the vector stays open. | Hacking blog | OpenSource Malware |
|
24.10.26 |
Two Hawks in a Pod: one Android RAT behind a flock of fake Japanese brands | Over the past month we collected and analysed 64 Android samples (first seen 2026-09-15 to 2026-10-16) that are all the same thing: a thin dropper that installs a packed second-stage WebSocket RAT. | Malware blog | Forever Security |
|
24.10.26 |
Rokarolla Android Banking Trojan: Analysis & Detection | The Rokarolla Android banking trojan combines fake login screens, message collection, and remote device interaction. With the required permissions, it can steal credentials and manipulate legitimate app interfaces. | Malware blog | STAR Labs |
|
24.10.26 |
PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619) | PHP fixed two remote code execution bugs on October 21. They affect PHP 5.4 and later. An attack needs specific knowledge of the target server and specific conditions on it, so mass exploitation is less likely than we first expected. Update PHP anyway. | Vulnerebility blog | Sansec |
|
24.10.26 |
skynox7: Proxyjacking Edge Devices Into Residential Proxies | Adversaries have a wide range of mechanisms they can use to obfuscate their public internet protocol (IP) addresses to avoid attribution and reduce their detectable signature. | Hacking blog | GREYNOISE |
|
24.10.26 |
PHP2Shell: Critical PHP RCE CVE-2026-109618 & CVE-2026-109619 - Blackpoint Cyber | APG SitRep: Critical PHP Remote Code Execution Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Vulnerebility blog | Blackpoint Cyber |
|
24.10.26 |
php2shell by Calif Research | This story outlines the details of two PHP remote vulnerabilities (CVE-2026-109618, CVE-2026-109619) discovered by Calif, OpenAI and Wiz, and addressed in PHP October 2026 Security Release. To understand the bugs, first join us on a journey through time... | Vulnerebility blog | CALIF |
|
24.10.26 |
Beyond Day Zero: Akamai's Rapid Response and AI Threat Intelligence | When critical vulnerabilities emerge, protecting applications requires more than a fast response. It demands early intelligence, precision, continuous adaptation, and customer trust. | AI blog | Akamai |
|
24.10.26 |
Understanding PHP2Shell: Everything You Need to Know | On October 20, 2026, PHP announced that they would release a patch on October 21 at 14:00 UTC for two critical vulnerabilities. | Vulnerebility blog | Akamai |
|
24.10.26 |
When DNS Trust Breaks: What the Counterfeit Google Certificates Reveal | Between September 22 and 27, 2026, attackers hijacked the .gh, .sl, and .as country-code TLD registries and obtained 12 publicly trusted TLS certificates for Google and YouTube domains without compromising Google or the issuing certificate authorities. | Cyber blog | Akamai |
|
24.10.26 |
Comply with PCI 6.4.3 & 11.6.1 Through Client-Side Security Tools | The PCI DSS v4 is a critical defense against growing web skimming attacks (also known as e-skimming and digital skimming) and data leakage risks. | Security blog | JSCRAMBLE |
|
24.10.26 |
Why is Preemptive Cyber Defense Important in 2026? | Preemptive cyber defense is a prevention-first security strategy that stops threats before they execute, rather than detecting and responding to them after they have already run. Instead of recognizing an attack in progress, it removes the conditions an attack needs to succeed, blocking malicious code deterministically at the moment of execution. | Cyber blog | Morphisec Blog |
|
24.10.26 |
Same Vulkan Host, Different Payload: Inside VulcanRAT207.B | Our previous investigation traced a WhatsApp-delivered lure through Statement.exe to VulcanRAT207.A, a port 8888 WebSocket RAT running with SYSTEM privileges. Continued analysis of the recovered workspace identified a related Vulkan package that uses the same signed host but follows a different loader, installation, command-and-control (C2), and kernel-driver path. | Malware blog | Morphisec Blog |
|
24.10.26 |
Plug me if you can: Exploiting USB Printer Drivers in Windows | Windows loads the appropriate kernel driver by interpreting USB Descriptor when a USB device is connected. If the data sent by the device is not properly validated, this can lead to kernel-level vulnerabilities. | Exploit blog | Ethiack |
|
24.10.26 |
Vulnerability Analysis of PHP2Shell (CVE-2026-109618 & CVE-2026-109619) | PHP is one of the most widely deployed server-side scripting languages, powering everything from small websites to large commercial applications. Because it typically runs tightly integrated with the web server, a vulnerability in the PHP runtime can affect a broad range of services regardless of the application framework or business logic built on top of it. | Vulnerebility blog | Enki White Hat |
|
24.10.26 |
Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts | LevelBlue SpiderLabs has been tracking multiple waves of Wazza, a newly observed multi-stage phishing kit that deploys device code phishing targeting Microsoft 365 accounts. In addition to recent reporting by The Hacker News, our analysis examines the kit's evolving techniques and infrastructure, highlighting key changes observed across analyzed variants. | Phishing blog | LEVELBLUE |
|
24.10.26 |
PHP2Shell: Critical RCE Vulnerabilities Affect a Large Majority of Web Servers | On October 21st, two critical memory manipulation vulnerabilities were disclosed in a joint announcement by Wiz Research, Calif, OpenAI, and the PHP team. The two vulnerabilities, combined, are being called PHP2Shell. The vulnerabilities are in PHP Core, which means any web application running on top of PHP is likely vulnerable. Estimates suggest that this is over two-thirds (2/3) of the web. | Vulnerebility blog | LEVELBLUE |
|
24.10.26 |
Now Detecting: CVE-2026-109618/CVE-2026-109619 (php2shell)k | CVE-2026-109618 and CVE-2026-109619 are two remote code execution vulnerabilities in PHP core. The PHP security team rates both CVSS v4.0 9.2 (php.net). The figure of 10.0 that circulated earlier came from the leak, not from PHP. | Vulnerebility blog | Ethiack |
|
24.10.26 |
LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials | A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys. | AI blog | Socket |
|
24.10.26 |
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline | PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline. | Vulnerebility blog | Socket |
|
24.10.26 |
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches | The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release. | Vulnerebility blog | Socket |
|
24.10.26 |
PHP2Shell Shows the Shrinking Time to Patch | PHP2Shell, the two critical unauthenticated remote code execution vulnerabilities disclosed Wednesday in PHP, had been hiding in one of the Internet’s most widely used software components for more than a decade. Researchers at Calif and Wiz used frontier AI models during the research that led to their discovery and exploitation. | Vulnerebility blog | GAMBIT |
|
24.10.26 |
Cloudflare deploys protections against php2shell vulnerability | Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic. | Vulnerebility blog | Cloudflare Blog |
|
24.10.26 |
8 eMudhra certificates are compromised. Here's what you need to know | On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised. These certificates were widely trusted by browsers, operating systems, and also within Cloudflare. Because the keys themselves are weak, an attacker can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic. | Incident blog | Cloudflare Blog |
|
24.10.26 |
Introducing tsrs: a Port of TypeScript to Rust | Cloudflare and VoidZero are now working with Max Schwenk of Owner.com on tsrs, a Rust port of the TypeScript compiler. We are doing this work in close collaboration with the TypeScript team, and incubating tsrs as part of the Oxc JavaScript compiler toolchain. | Cyber blog | Cloudflare Blog |
|
24.10.26 |
Introducing Clairic, a new System One class of extraction models | Today, we're announcing a preview of a new class of System One-style models: extraction models. Our first one, Clairic, is available hosted on Workers AI as @cf/cloudflare/clairic.We intend to release the model open-weights soon. Clairic is an extraction model that is able to extract, compute, estimate, and forecast values from unstructured inputs — all at a significantly higher accuracy, faster latency, and cheaper cost than traditional LLMs. | AI blog | Cloudflare Blog |
|
24.10.26 |
There's always a patient zero: Defending the NetScaler front door before the patch | The recent disclosure of a major vulnerability in Citrix NetScaler pointed to a widespread weak point: a login page is an attack surface that can be used to compromise and access an application server. | Vulnerebility blog | Cloudflare Blog |
|
24.10.26 |
Localizing compliance at scale: Achieving South Korea’s ISMS certification | For ten days, auditors appointed by the Korea Internet & Security Agency (KISA) sat together with us and worked through 80 controls. That is what it took for a company headquartered in the United States, operating a global network serving Korean users, to be certified in South Korea. Cloudflare has now obtained South Korea's Information Security Management System (ISMS) certification under the ISMS-P framework. | Cyber blog | Cloudflare Blog |
|
24.10.26 |
Athena StealthRoute: A Phishing Marketplace with Cloaking and AI Tools | Athena StealthRoute is a previously unreported modular phishing-as-a-service platform offering a marketplace, link cloaking, and AI tools for lures and decoys. | Phishing blog | Abnormal AI |
|
24.10.26 |
The Prompt Is the New Attachment: Sensitive Data in AI | Nearly 40% of employee AI interactions involve sensitive data, which makes the prompt the riskiest thing most employees do with company data, and the email attachment era has lessons for handling it. | AI blog | Abnormal AI |
|
24.10.26 |
Beyond Regex: Governing Sensitive Data in AI Chat | Traditional DLP hunts for patterns like card numbers, but the riskiest content in AI chat has no pattern at all, and some of it is instructions hidden in the data the AI reads. | AI blog | Abnormal AI |
|
24.10.26 |
Major security alert: PHP vulnerable to critical RCE, attacks ongoing | PHP has released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers the risk highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs. | Vulnerebility blog | Patchstack |
|
24.10.26 |
Improving navigation experience in v0 with Next.js 16.4 | Previously, we shared how a coding agent used the instant() Playwright test helper to make navigations instant in v0, Vercel's AI app builder. That work focused on the core /chat experience. | Vulnerebility blog | Next.js |
|
24.10.26 |
Php2Shell: Two critical PHP flaws disclosed | Php2Shell is the name for two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, patched October 21, 2026. Both memory-safety flaws let unauthenticated attackers run code on any PHP installation serving web requests, including PHP-FPM, Apache mod_php, and php-cgi. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. | Vulnerebility blog | Expel |
|
24.10.26 |
Storm-0940 ARTEX attacks: ConnectWise app abuse and Okta sign-ups | ARTEX uses LLM agents to run attacks with little human involvement. According to Microsoft, Storm-0940 has used it against hundreds of organizations across many industries since September 2026. In multiple cases, the time from initial targeting to privileged cloud access was under three hours. ARTEX isn’t a vulnerability, so there’s nothing to patch. It speeds up familiar techniques like password spraying and OAuth app abuse. | APT blog | Expel |
|
24.10.26 |
PHP2Shell (CVE-2026-109618, CVE-2026-109619): Patch Now | PHP2Shell is a family of memory-safety bugs in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and rated CVSS 9.2. The PHP Foundation shipped an emergency fix on October 21, 2026. The flaws allow an unauthenticated attacker to execute code as the PHP web worker or read its process memory, including passwords, tokens, and API keys from other users' requests. | Vulnerebility blog | CYMULATE |
|
24.10.26 |
CVE-2026-85267: Google Cloud Shell OAuth Token Theft | How one-click and zero-click WebSocket attack vectors turned Google Cloud Shell into a tunnel for OAuth token theft. | Vulnerebility blog | CYMULATE |
|
24.10.26 |
eMudhra CA Compromise: Weak Keys and Forged Certificates | Eight eMudhra intermediate CA keys were compromised, some as weak as 3 bits. Learn the code-signing risk and the steps to hunt for misuse and close the gap from TrendAI™. | Incident blog | TrendAI (US) |
|
24.10.26 |
What a Week for CISOs: PHP, eMudhra, and the Questions Your Board Will Ask | Two critical PHP flaws leaked before patches shipped, and the same day Mozilla disclosed weak eMudhra certificate authority keys. In this post, TrendAI™ Global CISO Sundari Parekh gives security leaders a practical playbook. | Vulnerebility blog | TrendAI (US) |
|
24.10.26 |
Two Critical PHP Flaws Leaked Before the Patch: What Organizations Should Do Now | On 20 October at 15:20 UTC, a Hacker News post leaked details of two critical PHP vulnerabilities that could allow remote code execution. The post was removed, but screenshots circulated on X and Mastodon. | Vulnerebility blog | TrendAI (US) |
|
24.10.26 |
ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors | Wiz Research is tracking an ARTEX-using actor, overlapping with Storm-0940, across multiple targeted software vendors. Learn how the AI agent attacks Okta, Entra, and Cognito, and what it left behind in the logs. | APT blog | Wiz Blog |
|
24.10.26 |
QR Codes and Fake AI Tools Expand Mobile Attack Opportunities | A recent threat report highlights how attackers are using QR codes and fraudulent AI tools to evade traditional security controls and reach users across devices. Researchers observed campaigns embedding malicious links in QR codes, requiring users to scan them with smartphones and shifting attacks from protected computers to mobile environments. | AI blog | ZIMPERIUM |
|
24.10.26 |
From Mobile Threat Detection to Autonomous Investigation: Connecting Zimperium with Sekoia | Mobile devices have become essential to how organizations work. Employees use smartphones and tablets to access business applications, authenticate to corporate services, exchange sensitive information, and stay connected from almost anywhere. | Cyber blog | ZIMPERIUM |
|
24.10.26 |
Fake Rewards Messages Use Smishing to Target Mobile Users | A recent phishing campaign uses fraudulent text messages claiming that T-Mobile reward points are about to expire, creating urgency to lure recipients into clicking malicious links. | Malware blog | ZIMPERIUM |
|
24.10.26 |
RemControl Expands Android Banking Fraud Capabilities | A recent investigation uncovered RemControl, an Android banking trojan designed to give attackers extensive control over compromised mobile devices. The malware combines remote access capabilities with techniques for stealing credentials, intercepting sensitive information, and manipulating device activity to support financial fraud. | OS Blog | ZIMPERIUM |
|
24.10.26 |
Beyond the Sandbox: Leveraging Android Intrusion Logs to Expose Advanced Threats | Some of the most important activity on a compromised Android device occurs when a threat attempts to move beyond the normal application sandbox: an unexpected process starts, a shell is opened, or a binary is staged outside the application’s lifecycle. | Cyber blog | ZIMPERIUM |
|
24.10.26 |
OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond | OpenCode reported a breach affecting Console users with linked AI providers. Here is what the vendor has said, and how to find OpenCode on your developer machines. | Incident blog | StepSecurity |
|
24.10.26 |
litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader | litellm 1.107.0 shipped a credential stealer and an hourly remote code loader in all seven PyPI wheels and in the official Docker images, including the latest tags. The release was built from a lookalike GitHub repository. Full analysis, IOCs, and recovery steps for pip and container users. | Malware blog | StepSecurity |
|
24.10.26 |
eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Update | On October 20, 2026, Python’s security team advised users to update Python packaging tools following the eMudhra / emSign certificate authority incident. The immediate concern is the certificate trust used when those tools connect to package indexes and other HTTPS services. Python security announcement | Security blog | StepSecurity |
|
24.10.26 |
PHP2Shell Makes PHP Inventory and Patch Ownership Urgent | PHP2Shell is the name being used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution. | Vulnerebility blog | SONATYPE |
|
24.10.26 |
The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation | The Gentlemen uses a double-extortion model. In addition to encrypting files, the ransomware can exfiltrate data from compromised systems. This puts additional pressure on victims to pay the ransom to restore access to their files and prevent the stolen data from being publicly leaked. | Ransom blog | ACRONIS |
|
24.10.26 |
Protecting Against AiTM Attacks: Is Your Microsoft Environment at Risk? | The identity threat landscape has shifted considerably over the past few years. Attackers have steadily moved toward more sophisticated techniques and Adversary-in-the-Middle (AiTM) phishing is near the top of that list. Microsoft observed a 146% rise in AiTM attacks in 2024 and the trend has continued into 2026. | Hacking blog | GuidePoint Security |
|
24.10.26 |
How to Patch PHP2Shell: CVE-2026-109618 & CVE-2026-109619 | The newly released ‘PHP2Shell’ vulnerabilities have become a hot topic hitting the desks, feeds and wires of every cybersecurity professional around the world. Starting October 20th, leaked details, disputed PoCs, conflicting exploitation reports and a patch that was scheduled but not yet released started circulating among security professionals online. | Vulnerebility blog | GuidePoint Security |
|
24.10.26 |
Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days | Three days is the average time between a high-severity vulnerability becoming public and its exploitation, according to the latest Quarterly Threat Landscape Report from Rapid7. And 71% of the exploitation tracked in Q3 occurred within the first seven days. | Vulnerebility blog | RAPID7 |
|
24.10.26 |
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP | On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's privileges. | Vulnerebility blog | RAPID7 |
|
24.10.26 |
Operation Serengeti III: Three Years of Collaboration Against Cybercrime | Participating authorities reportedly recovered an additional $105 million during Operation Serengeti III, targeting cybercrime networks across Africa. In earlier Serengeti operations, INTERPOL recognized Fortinet and the World Economic Forum’s Cybercrime Atlas as operational partners; Fortinet is a founding grantor of the initiative. This collaboration highlights the ongoing importance of public-private collaboration in supporting law enforcement operations that disrupt criminal infrastructure and impose consequences on cybercriminal networks. | CyberCrime blog | Fortinet Blog |
|
24.10.26 |
CodeAIAssistant: The VS Code MCP Install Prompt That Hides Its Payload | The marketplace listing for CodeAIAssistant reads like a hundred others. “AI-powered coding assistant for Visual Studio Code. Provides natural language code understanding, refactoring suggestions, and contextual documentation lookup.” The publisher calls itself Luxiel Security. The README has a Privacy section. It states that the extension “does not collect or transmit code” and that “all analysis runs locally.” | AI blog | Yeeth Security |
|
24.10.26 |
SleepyDuck Registry-Hops: The Fake Solidity Extension Hits the VS Code Marketplace | Pull up the listing and it clears review. The name reads solidity. The description matches the canonical extension word for word, the README is the canonical README with its install badges intact, and the version history holds a single 2.4 KB build that registers a hello-world command. There is nothing on that page to flag. | Hacking blog | Yeeth Security |
|
24.10.26 |
StealC Is Back, and This Time It's a RAT | Four months after Operation Endgame took it down, StealC's seller returns with Stadia, a remote access trojan that shares StealC's code byte for byte. | Malware blog | VARONIS |
|
24.10.26 |
Frozen Privilege: Remote Code Execution in Snowflake-Managed PostgreSQL | We uncovered a critical remote code execution vulnerability in Snowflake-managed PostgreSQL, highlighting hidden risks in cloud services. | Vulnerebility blog | VARONIS |
|
24.10.26 |
PHP2Shell: One Upload, Full Server | Varonis Threat Labs' deep dive on the critical PHP2Shell vulnerabilities that allowed remote code execution, affecting millions of websites. | Vulnerebility blog | VARONIS |
|
24.10.26 |
GoodPerson campaign aimed at users bypassing China’s Great Firewall | ThreatLocker Threat Intelligence has identified additional samples in-the-wild that contribute to a family of MSI-based trojans. As a follow up to GoodPersonRAT, these samples share common infrastructure, loader tactics, and final payloads that support attribution to the same operators and broader campaign. | Malware blog | THREATLOCKER |
|
24.10.26 |
ThreatLocker MDR team intercepts Chimera C2 ClickFix attack | On September 28, 2026, ThreatLocker MDR identified and intercepted the implementation of an active C2 framework in a monitored environment. A ClickFix attack persuaded the victim to execute malicious PowerShell commands, leading to machine compromise and the subscription to a Command-and-Control platform titled ChimeraC2. | Hacking blog | THREATLOCKER |
|
24.10.26 |
TRUST#GRAFT: WordPress Admin Attack Deploys PHP Backdoor | The chain should be assessed as a browser-mediated deployment mechanism rather than a traditional server-side exploit. The decisive condition is an already authenticated WordPress administrator browser; that context lets the loader reuse legitimate site-management workflows and turn a successful interaction into persistent server-side access. | Malware blog | SECURONIX |
|
24.10.26 |
eMudhra CA Key Compromise: Weak Keys, Risks and Fixes | The eMudhra CA key compromise is a certificate authority (CA) security incident in which eight intermediate certificates issued by eMudhra, an Indian digital trust provider, carried private keys that anyone can recover from the public certificate. An independent researcher reported the weakness on October 17, 2026, and Chrome and Firefox blocked the intermediates within hours. | Security blog | SOCRADAR |
|
24.10.26 |
AI Pentesting Tool: 30 Questions to Ask Before You Buy | “AI pentesting” now covers very different products. Some platforms plan and run attack chains on their own and return exploitation evidence for every finding. Others are vulnerability scanners with a language model summarizing the output. On a datasheet, or in a scripted demo against a vendor-prepared target, the two can look almost identical. | AI blog | SOCRADAR |
|
24.10.26 |
Japan Data Breaches 2026: Inside the October Surge | Japan is facing a dense wave of breach disclosures. Since late September, at least 20 major Japanese companies have reported breaches, including Times Car, Lawson, Yakiniku King, Sourcenext and Burger King Japan, and a ransomware attack on SoftBank’s IDC Frontier cloud took 495 customer organizations offline. | Incident blog | SOCRADAR |
|
24.10.26 |
Drupal Patches Critical RCEs: CVE-2026-108097 & 108099 | Drupal has patched two critical remote code execution (RCE) vulnerabilities affecting Drupal core and the contributed Entity List module. | Vulnerebility blog | SOCRADAR |
|
24.10.26 |
ConnectWise Cloud Backup Breach | ConnectWise is investigating unauthorized access to application identities associated with Cloud Backup, formerly SkyKick, after researchers detected the applications authenticating into customer Microsoft 365 environments. | Incident blog | SOCRADAR |
|
24.10.26 |
ZoomInfo Sale, TryCircle, Vicente López, HDB, and X Leaks | SOCRadar Dark Web Team identified several underground posts, including an alleged ZoomInfo database sale involving 185 million records, an alleged TryCircle customer data leak, and an alleged Vicente López municipal database exposure. Other posts advertised a previously compromised HDB Financial Services dataset and an unverified X (Twitter) user database leak claim. | Incident blog | SOCRADAR |
|
24.10.26 |
CVE-2026-102764: BeyondTrust Zero-Day Exploited | BeyondTrust has disclosed CVE-2026-102764, a critical Remote Support vulnerability exploited as a zero-day weeks before customers received a patch. | Vulnerebility blog | SOCRADAR |
|
24.10.26 |
Cisco Secure Email & PAN-OS Zero-Days Exploited | Cisco and Palo Alto Networks have patched two actively exploited zero-day vulnerabilities that can lead to root-level code execution on security appliances. CISA has flagged both vulnerabilities as known exploited flaws, adding them to its Known Exploited Vulnerabilities (KEV) catalog. | Exploit blog | SOCRADAR |
|
24.10.26 |
SOCRadar Splunk Integration: New MSSP and Vulnerability Apps | Your analysts live in Splunk. Your external risk does not: SOCRadar alarms for dozens of managed companies, and vulnerability findings across an attack surface that changes every day. Why should seeing either one still mean another console, another input per customer, or another spreadsheet of CVEs? | Vulnerebility blog | SOCRADAR |
|
24.10.26 |
CVE-2026-105445: Docker Hub PAT Reassignment Flaw | Docker has disclosed CVE-2026-105445, a critical privilege assignment flaw in Docker Hub that could allow an attacker to reuse a personal access token (PAT) after it was reassigned to another user during account-to-organization conversion. | Vulnerebility blog | SOCRADAR |
|
24.10.26 |
CVE-2026-114625: VeloCloud Orchestrator Flaw Exploited | Arista has disclosed CVE-2026-114625, a critical SQL injection vulnerability in on-premises VeloCloud Orchestrator deployments. The flaw is being exploited in the wild and allows any authenticated portal user, including an Enterprise Read Only account, to gain local superuser operator privileges. | Vulnerebility blog | SOCRADAR |
|
24.10.26 |
How to find, manage shadow AI: 3 steps to mitigate risk | Shadow AI used to be confined to a few simple scenarios, such as AI chatbots and AI browser extensions. Today, it spans a broad spectrum of complex vectors, making it harder to detect and control. | AI blog | Tenable® |
|
24.10.26 |
Tenable: Single multilingual model, native detection in 10 languages | AI security tools that can only detect threats in English offer limited protection. Here’s how Tenable trained our threat detectors to process nine additional languages and understand thousands more, without the need for a translation model, which increases costs and slows down processing. | AI blog | Tenable® |
|
24.10.26 |
Oracle October 2026 Critical Patch Update 1209 CVEs |
Oracle addresses 1209 CVEs in its final quarterly update
of 2026 with 1295 patches, including 112 critical updates. |
Vulnerebility blog | Tenable® |
|
24.10.26 |
The Adversary Economy: Threat Actors React to PHP2Shell | Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure management challenges as the organizations they target. | Vulnerebility blog | Tenable® |
|
24.10.26 |
PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 | News of two impending critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP prompted a huge, global overnight effort on Tuesday, October 20 when word of the vulnerabilities' existence leaked ahead of the planned patch release. The PHP team confirmed an upcoming security release shortly after the leak occurred. Naturally, upon seeing the leaked info, a thousand LLMs were immediately pointed at PHP source code. | Vulnerebility blog | VulnCheck |
|
24.10.26 |
SPIP odt2spip Plugin: Authenticated Command Injection via Uploaded Document Filename | VulnCheck is disclosing CVE-2026-104085, an OS command injection in odt2spip, a document-import plugin for the SPIP CMS. The plugin lets an author import an office document (.odt, .doc, .docx, .html) into an article. It moves the uploaded file to a path built from the raw client-supplied filename, then hands that path to LibreOffice through a shell command. The filename is concatenated into that command with almost no escaping, so a filename carrying shell metacharacters runs arbitrary commands as the web server user (CWE-78). | Vulnerebility blog | VulnCheck |
|
24.10.26 |
Exploring the Risks and Impacts of AI on Vulnerability Discovery and Exploitation | As we hear a lot of noise about AI’s impact on vulnerability discovery and exploitation, I found the need to compartmentalize the risks. So, I took it upon myself to build categories that provide a mental framework for the risks, impact, and evidence AI poses for vulnerabilities and exploitation. Most of these risks aren't new. AI makes the capabilities behind each one more accessible and accelerates how quickly attackers can use them. | Vulnerebility blog | VulnCheck |
|
24.10.26 |
PHP2Shell: Critical PHP RCE Flaws & Runtime Protection | PHP shipped emergency fixes today for two critical flaws in its core engine that let an unauthenticated attacker run code on a web server. If you run PHP anywhere, the move is the same: upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. | Vulnerebility blog | OLIGO SECURITY |
|
24.10.26 |
Node.js Brotli Vulnerability (CVE-2026-111497): Detection & Mitigation | Patching is a business process that takes time. OLIGO catches exploitation of this flaw as it happens, inside the workload under attack. | Vulnerebility blog | OLIGO SECURITY |
|
24.10.26 |
Three Critical Pillow CVEs: RCE and Heap Overflows in Python’s Imaging Library - CVE-2026-112900 CVE-2026-112393 CVE-2026-112403 | Three CVSS 9.2 vulnerabilities in the Python imaging library, allow remote code execution and heap corruption via a single malicious image upload | Vulnerebility blog | OX Security |
|
24.10.26 |
LiteLLM 1.107.0 Compromised With A RAT InfoStealer | LiteLLM got hijacked again: the AI gateway used to route traffic to dozens of LLM providers shipped a credential stealer with remote access built in | Malware blog | OX Security |
|
24.10.26 |
Node.js Brotli Decoder Out-of-Bounds Write (RCE) - CVE-2026-111497 | On October 21, 2026, Node.js shipped security releases across all supported lines fixing a high-severity out-of-bounds write in the bundled Brotli decoder. A Node.js process that decompresses attacker-controlled Brotli data — including Brotli-encoded HTTP responses it fetches — can be driven to write past the end of its buffer, leaking memory or executing code with the process’s privileges. | Vulnerebility blog | OX Security |
|
24.10.26 |
Industrial Remote Access Credential Exposure in Stealer Logs | A stolen password often leaves work for the person holding it. He or she may still need to identify the service, locate its login page, and establish what the account can reach. For some industrial remote access platforms, however, the stolen browser record already contains much of that context and removes most of that work. In these cases, the stolen record is not just a password but a labeled route to a specific machine. | Malware blog | Flare |
|
24.10.26 |
The Com: How Fear & Bad Attribution Distorted It | Part 1: The Ecosystem and the Actors By Jon DiMaggio, Cybersecurity Researcher The most dangerous thing about The Com isn’t any single group inside of it, but that the ecosystem replaces them faster than law enforcement can arrest the ones already operating. In 2025 and 2026, law enforcement handed down real sentences to real people… | Cyber blog | Flare |
|
24.10.26 |
PHP2Shell Exposure: 73% of 2.2 Million Version-Disclosing PHP Services Run Unsupported Branches | Two critical vulnerabilities in PHP have put renewed attention on a familiar operational question: how many internet-facing PHP services are running versions that no longer receive upstream security fixes?? We examined existing internet-scan records to measure the PHP versions that services disclose to the public internet. The result was 2,220,231 service records across 224 countries. Nearly three quarters advertised a PHP branch no longer supported by the PHP project. | Vulnerebility blog | Flare |
|
24.10.26 |
Does It Stop When Someone Is Watching? The Suspicious Behavior of a New Type of Infostealer | It is already well known that illegal software and cracked programs can be exploited for malware distribution. Recently, AhnLab identified a new type of information theft malware (Infostealer) disguised as an illegal program. | Vulnerebility blog | ASEC |
|
24.10.26 |
PHP2Shell: Responding to Critical PHP Vulnerabilities | PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP web servers. PHP released fixes on October 21, 2026. | Vulnerebility blog | Threat Spotlight |
|
24.10.26 |
Node2Shell: From Brotli Data to Remote Code Execution | Node2Shell is Imperva Red Team’s name for our analysis of CVE-2026-111497, a High severity flaw in Node.js’s bundled Brotli decoder. Node.js says the out-of-bounds write can permit remote code execution and has released fixes for the 22.x, 24.x, and 26.x lines. | Vulnerebility blog | Imperva |
|
24.10.26 |
PHP2Shell: Early Attack Activity Through Imperva’s Lens | Following the public disclosure of PHP2Shell (CVE-2026-109618 and CVE-2026-109619), Imperva Threat Research observed a sharp increase in scanning and exploitation attempts across protected environments. What had been a small number of unsuccessful probes before disclosure quickly grew into widespread automated activity targeting sites across industries and regions. | Vulnerebility blog | Imperva |
|
24.10.26 |
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware | Huntress investigated multiple incidents stemming from an Amazon-themed ClickFix campaign tied to a sponsored Google search result for the keywords "amazon business." The sponsored result leads to a spoofed Amazon login page with an embedded ClickFix (fake CAPTCHA) that downloads a malicious payload from attacker-controlled infrastructure. | Malware blog | Huntress |
|
24.10.26 |
M365 Token Spray and Replay Campaign Compromises Business Email Accounts | Over a ten-week stretch, Huntress tracked a Microsoft 365 campaign that captured sign-in sessions through adversary-in-the-middle (AiTM) relays and replayed the stolen tokens from an IP address block owned by German hosting provider 1337 Services GmbH. We responded to related incidents at 79 organizations, observing at least 497 successful sign-in events against more than 200,000 failed login attempts across our customer environments. | Phishing blog | Huntress |
|
24.10.26 |
Unboxing Phishing Kits: Huntress Examines 3 Real Kits | Teach a noob to phish and they'll be scamming for a lifetime. It has never been easier to steal credentials, thanks to a growing number of phishing kits that give aspiring attackers everything they need in one convenient interface. | Phishing blog | Huntress |
|
24.10.26 |
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks | A Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup (formerly SkyKick) has been compromised, and Huntress has confirmed it is being used to gain unauthorized access to customers' M365 environments. | Hacking blog | Huntress |
|
24.10.26 |
Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | On October 20, details of two critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online before their coordinated disclosure and before patches were released. | Vulnerebility blog | Huntress |
|
24.10.26 |
Russia Is Tightening Internet Controls, Leading to Operational Risks | Since mid-2025, the Kremlin has intensified restrictions on digital communications and infrastructure, very likely to suppress the organization of domestic political dissent and conduct digital surveillance within Russia. Increasingly strict measures targeting virtual private networks (VPNs), state-managed internet shutdowns, limitations on civilian communications platforms, and monitoring of domestic and foreign entities very likely represent an escalation from the approaches to censorship and surveillance pursued prior to 2024. | Cyber blog | Elastic Security Labs |
|
24.10.26 |
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619 | CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is verified, why exploitation converges on a web server spawning a shell, and the Elastic detections developed to catch this behavior. | Vulnerebility blog | Elastic Security Labs |
|
24.10.26 |
Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619) | Two critical PHP remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2, leaked before their scheduled patch on October 21, 2026 at 14:00 UTC. | Vulnerebility blog | HUNT.IO |
|
24.10.26 |
Ukraine’s State Data-Exchange System Targeted by Russian-Speaking Operator via Graylog Log4Shell | Disclosure note: Before publishing this research, we shared our findings and the victim data we recovered with the national CERTs of the affected countries. The CERTs are handling notification of the affected organizations in their jurisdictions. | BigBrother blog | HUNT.IO |
|
24.10.26 |
Sekoia Honeypot Captures an Attack on GenAI Infrastructure | Sekoia's TDR team ran a decoy Flowise server to study attacks on GenAI platforms. One threat actor stole its credentials and tried to misuse its AI agent. | AI blog | SEKOIA |
|
24.10.26 |
Sekoia + Zimperium: Investigate Mobile Threats In Your SOC | Zimperium Mobile Threat Defense now sends its mobile threat telemetry to the Sekoia SOC platform. Sekoia Elevate AI agents investigate each mobile alert alongside identity, cloud and network evidence, so analysts can see what it means for the whole organization. | Cyber blog | SEKOIA |
|
24.10.26 |
SEO Poisoning Campaign Delivers Armorsteal Malware | In September 2026, Zscaler Threat Hunting identified an SEO poisoning campaign that used fake websites impersonating the Chocolatey package manager and the Microsoft Activation Scripts (MAS) tool to distribute a Python-based malware family we track as Armorsteal. | Malware blog | ThreatLabz |
|
24.10.26 |
CVE-2026-109618 and CVE-2026-109619: PHP2Shell | On October 21, 2026, two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell,” were publicly disclosed. Both vulnerabilities carry a CVSS v4.0 score of 9.2 out of 10. The PHP security team has released emergency patches and strongly encouraged all PHP users to update immediately. | Vulnerebility blog | ThreatLabz |
|
24.10.26 |
Inside a Global AI-Assisted Hacking Campaign | In October 2026, Zscaler ThreatLabz investigated AI-assisted cyberattacks that combined the ARTEX penetration testing framework with AI coding assistants and custom automation scripts. | AI blog | ThreatLabz |
|
24.10.26 |
CVE-2026-88771: NetScaler RCE Exploitation | On September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution (RCE) vulnerability affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. | Vulnerebility blog | ThreatLabz |
|
24.10.26 |
Inside SiriusQT: A Seriously Skilled RAT | SiriusQT is advertised as a Windows RAT, but the analyzed sample in this article shows something more complex than a remote administration tool. Under the name, it offers several capabilities in a single implant: remote access, HVNC, browser automation, credential theft, cryptocurrency wallet collection, clipboard monitoring, keylogging, process injection, persistence, anti-analysis checks, and custom encrypted command-and-control traffic. | Malware blog | Group-IB Blog |
|
24.10.26 |
CrowdStrike Uncovers New Agentic AI Campaigns | CrowdStrike Counter Adversary Operations details research into four previously unreported threat actors conducting campaigns in which AI agents make decisions and execute commands. | AI blog | CrowdStrike |
|
24.10.26 |
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell | Two critical memory-corruption RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 have been disclosed in core PHP. | Vulnerebility blog | CrowdStrike |
|
24.10.26 |
BRONZE SANDCASTLE deploys modified Meterpreter shells | Counter Threat Unit™ (CTU) and SophosLabs researchers investigated a cluster of incidents attributed to the BRONZE SANDCASTLE threat group. The most distinctive technical marker for BRONZE SANDCASTLE is its consistent use of Sandboxie DLL sideloading. | APT blog | SOPHOS |
|
24.10.26 |
ConnectWise Cloud Backup application abused in cross-tenant token sweep | On October 15, 2026, Sophos X-Ops researchers identified a series of service principal sign-ins in which a threat actor authenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customer Microsoft 365 tenants. The malicious scanning activity originated from a single virtual private server (VPS) and continued for about 96 minutes | CyberCrime blog | SOPHOS |
|
24.10.26 |
Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion | Traditional business email compromise (BEC) is often thought of as a mailbox problem: a stolen account, unauthorized access to email, forwarding rules, and (sometimes) outgoing mail impersonating the compromised user. But more recent incidents show how far beyond “email only” these intrusions can extend once an attacker gains control of a cloud identity. | Spam blog | SOPHOS |
|
24.10.26 |
Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) | SOPHOS | The previous update (October 22 16:18 UTC) reported that Sophos observed successful exploitation of PHP2Shell in customer environments. Upon further analysis, we are correcting that assessment as Sophos customer telemetry shows scanning and a small number of failed exploitation attempts. As of this update, there is no evidence of a successful compromise due to these vulnerabilities. | Exploit blog | SOPHOS |
|
24.10.26 |
Linux Malware Hiding as Kernel Threads: How to Spot It | On September 5, 2026, Sansec, a security firm that investigates attacks on online stores, reported that attackers were exploiting a zero-day in Magento and Adobe Commerce to install a backdoor written in Rust. The vulnerability is tracked as CVE-2026-75650 and is rated Critical, with a CVSS score of 10.0. Early versions of the backdoor ran under the name [kworker/u:8:0], which is meant to look like one of the Linux kernel’s own worker threads. | Malware blog | Eclypsium |
|
24.10.26 |
NVIDIA and Eclypsium Partner for Trusted AI Infrastructure | AI agents are moving from answering questions to taking action. They can read sensitive data, call APIs, write and execute code, use external tools, and coordinate with other agents. In some environments, their decisions may affect physical systems. | AI blog | Eclypsium |
|
24.10.26 |
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why. | If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349. On August 11, 2026, Cisco published an advisory, scoring the vulnerability as “high” with a CVSS 3.1 score of 8.6. The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices. | Vulnerebility blog | Eclypsium |
|
24.10.26 |
Keys Are In The Browser: Exposure Across AI-Built Websites | Cyble scanned 1.3M+ newly registered domains and found AI-built sites leaking live secrets to the browser: OpenAI keys, Stripe keys, and database tokens. | AI blog | CYBLE |
|
24.10.26 |
PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution | Patch now: CVE-2026-109618 and CVE-2026-109619 let unauthenticated attackers run code on web servers running PHP, and details were public before fixes shipped. | Vulnerebility blog | SECURITY.COM |
|
24.10.26 |
Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks | Offensive agent is using unprotected AI models to scan the web, exploit frameworks, steal credentials and mine cryptocurrency for up to 100,000 steps without human input. The model's owner pays for every step. | AI blog | SECURITY.COM |
|
24.10.26 |
Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries | Russian group stole credentials and tunneled into the network during a two-month intrusion at a naval shipbuilder. | APT blog | SECURITY.COM |
|
24.10.26 |
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise | As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. | AI blog | Microsoft Security Blog |
|
24.10.26 |
The Current Landscape of OAuth Attacks | As enterprises continue to roll out multi-factor authentication (MFA), attackers have adapted. Rather than only stealing credentials, attackers have shifted to stealing Open Authorization (OAuth) tokens, the keys that govern what applications can do on your behalf. Adversaries are already accelerating these attacks by using dynamic evasion code, phishing-as-a-service (PhaaS) templates and LLM-generated brand impersonations. | Hacking blog | Palo Alto |
|
24.10.26 |
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 | Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0). We encourage reviewing the PHP Group’s security advisory and patching guidance. | Vulnerebility blog | Palo Alto |
|
24.10.26 |
EMudhra Intermediate CA Certificates Compromised | Eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to a critical cryptographic defect during the certificate generation process. The private keys in this incident were generated with insufficient randomness, allowing potential attackers to derive the private keys from the public certificates. | Cyber blog | Palo Alto |
|
24.10.26 |
The Risk of AI-Powered Antidetect Browsers in Online Fraud and Influence Operations - Check Point Research | Antidetect browsers obscure the digital identity of their users, enabling a single operator to silently manage thousands of isolated accounts across multiple platforms (including Facebook, TikTok, Instagram, and YouTube), while evading detection systems that look for scams and coordinated inauthentic behavior. | AI blog | Check Point Research |
|
24.10.26 |
I had plans for that second | Here for the latest on the PHP vulnerabilities? Head on down to ‘The One Big Thing’. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset. | Cyber blog | CISCO TALOS |
|
24.10.26 |
Compromised eMudhra intermediate certificates | Cisco Talos is aware of eight compromised intermediate certificates belonging to the intermediate certificate authority, eMudhra. Rather than possessing the mandatory 384 bits of pseudo-random security, several private keys evaluated single-digit and double-digit integers. This misconfiguration allows an attacker with the private key of any of the compromised intermediate CAs to impersonate any website or service. | Cyber blog | CISCO TALOS |
|
24.10.26 |
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers | Legitimate infrastructure has become a powerful delivery mechanism for attackers, carrying the inherent trust they once had to build. As Cisco Talos explored in our previous research on weaponizing software-as-a-service (SaaS) notification pipelines, these platforms are increasingly repurposed as proxies for malicious intent. | CyberCrime blog | CISCO TALOS |
|
24.10.26 |
Two critical RCEs in PHP core | Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial intelligence and associated technologies played a key role in the discovery of these vulnerabilities | Vulnerebility blog | CISCO TALOS |
|
24.10.26 |
Is the ad a scam? How to tell before you click | You can trust a social media platform and still get scammed by an ad running on it | Spam blog | Eset |
|
24.10.26 |
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC‑0099-Sandworm collaboration | ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm | Malware blog | Eset |
|
24.10.26 |
PHP2Shell: What defenders need to know about CVE-2026-109618 and CVE-2026-109619 | On October 21, 2026, the PHP project released emergency fixes for two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, together known as PHP2Shell. Both carry a CVSS v4.0 score of 9.2. They let an unauthenticated attacker run code on a web server, and because the flaws sit in PHP itself rather than in any application or plugin, a site can be exposed even when its own code is secure. | Vulnerebility blog | TRELLIX |
|
24.10.26 |
Dark Web Roast - September 2026 Edition | September delivered another bumper crop of underground incompetence, proving once again that the cybercrime economy runs less on sophistication and more on vibes, typos, and secondhand embarrassment. | CyberCrime blog | TRELLIX |
|
17.10.26 |
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) | Vercel announced a $1 million challenge inviting researchers to break the isolation boundary of its Sandbox product (total prize pool). The announcement came just weeks after OpenAI had disclosed a remarkable security incident: AI agents running inside restricted evaluation environments had found ways around their network isolation, compromised internal infrastructure, and eventually breached systems at Hugging Face. | Vulnerebility blog | PWN.AI Security Research |
|
17.10.26 |
XWorm Reborn: From infostealer to surveillance platform | In September 2024, Netskope Threat Labs first reported on XWorm and its infection chain. The following year, in July 2025, we reported version 6.0 and its more advanced features. As we continued tracking the malware over the past year, we identified four distinct XWorm versions operating concurrently in the wild. | Malware blog | Netskope Threat Labs |
|
17.10.26 |
Leaking the Keys to the Kingdom: How a Single Slip Handed Over a Darknet Empire | A flaw in GoBalance, a load-balancing tool used by many darknet sites, allows anyone to recover a site's master signing scalar from its publicly available data. With that key, an attacker can take over the site and redirect its visitors. | Cyber blog | SEARCHLIGHT |
|
17.10.26 |
A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline | During a security audit of Discourse, a popular open-source forum platform powering over 22,000 communities including OpenAI, Atlassian, and Cloudflare, we discovered two vulnerabilities affecting default configurations. | Security blog | SEARCHLIGHT |
|
17.10.26 |
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE | It has been a little while since we last looked at Adobe Experience Manager (AEM). We had some excellent findings last time but were just shy of full remote code execution. This time we were able to achieve full unauthenticated remote code execution on AEM Cloud. | Vulnerebility blog | SEARCHLIGHT |
|
17.10.26 |
Session Cookie Authentication Bypass: Predictable Signing Secret Enableds Account Impersonations | During a security review of a yard management system (YMS) used to optimize supply chain operations, Resecurity identified an authentication bypass caused by two independent weaknesses in the application's session-cookie design. | Security blog | Resecurity |
|
17.10.26 |
Iron Man & YamStore: Powering a Global Phishing-as-a-Service Ecosystem | Resecurity identified and mapped the infrastructure supporting a commercial phishing-kit-as-a-service (PhaaS) operation marketed under the name “Iron Man System.” The kit is sold to criminal buyers as a self-hosted package that deploys pre-built lure pages impersonating postal and courier services, toll and traffic-fine authorities, tax agencies, banks, telecoms and loyalty programmes, then captures the data victims submit. | Phishing blog | Resecurity |
|
17.10.26 |
October 2026 Patch Tuesday Analysi | Today’s Patch Tuesday Alert addresses Microsoft’s October 2026 Security Updates. The FIRE team is actively working on coverage for these vulnerabilities and expect to ship that coverage as soon as it is completed. | OS Blog | Fortra |
|
17.10.26 |
Best KnowBe4 Alternatives & Competitors | Adaptive Security is backed by OpenAI as its first and only cybersecurity investment, and is used by companies including Figma, Ramp, Lennar, and Plaid. | Security blog | Adaptive Security |
|
17.10.26 |
Email Security Statistics 2026: Phishing, BEC & AI | Email security statistics consistently show the human layer rather than the technical stack as the decisive variable in most confirmed breaches, which is why human-layer defense deserves proportionate investment. | Spam blog | Adaptive Security |
|
17.10.26 |
DNS as C2 in Noir, An AI-Developed Crypto Wallet Drainer | We found a cryptocurrency wallet-drainer kit, self-branded as Noir, that uses DNS TXT records to locate its hosted pool; currently these run on Cloudflare Pages. The loader races three public DNS-over-HTTPS (DoH) services and uses the first valid answer. | Cyber blog | Adaptive Security |
|
17.10.26 |
Inside Help TDS: Hotejka and Cloudflare Abuse | Threat research is always a bit of a cat-and-mouse game, and it’s often made more so when an actor survives years in the face of scrutiny. The actors behind the so-called Help Traffic Distribution System (TDS) are one such case. They’ve been active since at least April 2017 and have been largely unaffected by the cybersecurity world around them. | Security blog | Adaptive Security |
|
17.10.26 |
Run multi-container agent evals on Tensorlake with Harbor | Harbor 0.23.0 can run Docker Compose tasks on Tensorlake. Each task boots as one MicroVM with a Docker daemon inside, so an agent’s MCP server, database, browser, or game server runs next to it as its own container. | BotNet blog | Tensorlake |
|
17.10.26 |
GhostAction Returns: 772 Repos Hit, 30k More in Oct | The GhostAction supply chain campaign hit 772 public GitHub repositories between Aug. 31 and Sept. 30, 2026, targeting 2,577 secrets. Between Oct 8-9 a new burst hit 30k more, and this time the workflows ran. | Hacking blog | GITGUARDEN |
|
17.10.26 |
AI Agent Security: Six Controls From Nine Real Incidents | An AI agent runs with your credentials and acts before you can stop it. Nine incidents show what that costs. Six controls limit the damage: sandbox the agent, scope its credentials, lock its configuration, log every call, scan the workspace first, and deny by default. | AI blog | GITGUARDEN |
|
17.10.26 |
FlowerStorm detection and 70+ YARA rules: September 2026 | The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape. | Malware blog | VMRAY |
|
17.10.26 |
6 Malware Analysis Tasks You Can Automate with AI Agents | A reverse engineer’s week can quickly fill up with work that has already been solved once, whether that means decrypting a familiar string routine or peeling back another dropper stage. Once the underlying scheme is understood, much of this work no longer requires much judgment. | AI blog | VMRAY |
|
17.10.26 |
ontinue.com/1h2026threatintelligencereport/ | 1H 2026 findings reveal growing abuse of trusted identities, AI-assisted tooling, SaaS platforms, and business workflows as attackers achieve greater impact with less effort. | Cyber blog | ONTINUE |
|
17.10.26 |
2026_10_1h2026-TI-Report-Executive-Summary-en.pdf | The first half of 2026 reinforced a significant shift in the threat landscape: the most effective attacks increasingly do not look like attacks at all. They look like a Microsoft Teams message from someone claiming to be in IT, a login prompt from a trusted brand, a software package from a familiar repository, or a routine request that appears legitimate on the surface | Cyber blog | ONTINUE |
|
17.10.26 |
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) | Before we begin, yes - it's confusing. There are more vulnerabilities with watchTowr IDs in this blog post than there are CVE IDs (assigned by PaperCut), due to PaperCut bundling vulnerabilities and then patch bypasses for those same vulnerabilities into singular CVE IDs. | Vulnerebility blog | labs.watchtow |
|
17.10.26 |
Q3 2026 DDoS, bad bots, and BGP incidents: statistics and overview | As we predicted, botnet sizes returned to growth after a sharp decline in the previous quarter. The largest botnet observed in Q3 2026 comprised 3.56 million devices, up from 2.09 million in Q2. | Cyber blog | QRATORLABS |
|
17.10.26 |
Behind Closed Doors: How Physical Penetration Testing | Protecting confidential conversations takes more than closing a conference room door. Physical penetration testing reveals whether unauthorized people can reach sensitive spaces, interfere with equipment, or leave a device unnoticed. Define the test around the spaces and information you need to protect, then use the results to improve access checks, reporting, and response. | Security blog | Bishop Fox |
|
17.10.26 |
Submit and Execute: Weaponizing Reflected XSS in Siemens | Siemens Teamcenter is one of the most widely deployed product lifecycle management (PLM) platforms in the world, the system of record for the engineering designs, bills of materials, and approval workflows behind aircraft, vehicles, and industrial hardware. We found that a crafted link could execute JavaScript in the browser of a logged-in Teamcenter user. During an authorized assessment, we used it to silently grant one account the ability to act on behalf of another. | Vulnerebility blog | Bishop Fox |
|
17.10.26 |
AI Security Scoping: Define What To Test In Yo | Integrating artificial intelligence into enterprise workflows demands a system view: models are only one component in a chain that includes APIs, orchestration layers, data pipelines, identity, storage, and observability. | AI blog | Bishop Fox |
|
17.10.26 |
The October 2026 Security Update Review | Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland, because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I can represent the bugs at this level of volume, so let me know if you have ideas. (Seriously – I’m out of ideas). | OS Blog | Zero Day Initiative |
|
17.10.26 |
cikabika-bot-inside-a-discord-rat | Darktrace researchers investigate CikaBika Bot, a Rust-based remote access trojan delivered through a document-themed lure. The malware uses a Nim loader, PowerShell UAC bypass and DLL search-order hijacking before leveraging Discord for C2, reconnaissance, remote execution, and data exfiltration through ngrok in observed malicious activity. | BotNet blog | darktrace.com |
|
17.10.26 |
Underground AI-as-a-Service: How Cybercriminals are Buying and Selling AI | In under six months, the criminal supply of and demand for AI-powered tools grew into a sophisticated underground economy on hacker forums and platforms, maturing and scaling faster than any market these forums have seen. | AI blog | HALCYON |
|
17.10.26 |
ASOS App Hack: Attackers Used Push Notifications to Send a Ransom Note - Real-time Open Source Software Supply Chain Security | On October 6, 2026, people with the ASOS app got a push notification that said the company had been hacked. Attackers sent it. They had gotten into the third-party tools ASOS uses to message its customers, and they used that access to send an extortion note straight to people’s phones. ASOS has confirmed that names and contact details may have been accessed. The bigger claim, that the attackers “fully compromised” ASOS’s Snowflake data warehouse, is still unproven, and Snowflake says its platform was not breached. | Ransom blog | SAFEDEP |
|
17.10.26 |
tensorlake 0.5.144 npm Compromise Ships Mini Shai-Hulud - Real-time Open Source Software Supply Chain Security | We found a credential-stealing worm in tensorlake@0.5.144. It runs on install, and npm was serving it as latest for a package with about 106,000 monthly downloads. | Hacking blog | SAFEDEP |
|
17.10.26 |
MALFEX Moves Its npm Loader into a Native Windows DLL - Real-time Open Source Software Supply Chain Security | The npm package imgdecode hides a malicious loader in a compiled Node.js addon. Its nine-line JavaScript file loads a Windows dynamic-link library (DLL). When a Node.js program calls require('imgdecode') from a Windows console, the DLL attempts to download encrypted shellcode from GitHub. It decrypts the response and injects the result into a new dllhost.exe process. This code does not need an install script. On 2026-10-13, the package was still available on npm. | Malware blog | SAFEDEP |
|
17.10.26 |
TLD Launch Milestones 2026-2027: What Brand Protection Teams Need to Know | New top-level domain (TLD) launches follow public schedules, giving brand protection teams time to prepare defensive registrations, monitoring, and response plans before new namespaces become broadly available. | Vulnerebility blog | NETCRAFT |
|
17.10.26 |
TRM Labs Supports Microsoft's Disruption of YAM Store, CoGUI, and Iron Man, Three Services Behind Global Scam Operations | | On October 14, 2026, Microsoft's Digital Crimes Unit and Health-ISAC announced that they are dismantling three components of a Chinese-language cybercrime marketplace: YAM Store, CoGUI, and Iron Man. | Cyber blog | TRM Labs |
|
17.10.26 |
MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work - | The MALFEX campaign is a long-running npm supply-chain attack that delivers Remote Access Trojans (RAT), information stealers, or open Node.js processes as payloads. Learn about how the attack works, how to find out if you’re impacted, and what response actions to take. | Malware blog | Checkmarx |
|
17.10.26 |
Malware vs malware: a ClickFix kit at war for your screen | Two ClickFix kits fought over the same screen on hacked WordPress sites. One wrote the fight into its code, in Russian, down to the moment the browser broke. | Malware blog | ADAMNET |
|
17.10.26 |
OFAC Sanctions Tren de Aragua Crypto-Laundering Network | OFAC designated 10 targets in a Tren de Aragua ATM jackpotting scheme that stole at least $40.73 million from U.S. financial institutions. The network used cryptocurrency to launder the proceeds. | Cryptocurrency blog | CHAINALYSIS |
|
17.10.26 |
How Chainalysis Used AI to Trace the $387M Bitget Theft | Since $387 million was stolen from Bitget on September 24, Chainalysis investigators have been working with the exchange and law enforcement partners to trace the stolen funds across multiple blockchains and protocols. | AI blog | CHAINALYSIS |
|
17.10.26 |
Hacking OpenAI | On July 25, 2026, we chained two critical vulnerabilities to compromise multiple OpenAI employees’ ChatGPT accounts. With these accounts, we could then access internal OpenAI repositories, and potentially many other connectors. | AI blog | Hacktron AI |
|
17.10.26 |
Shadow AI Detection for MSPs | Employees have always found and used technology outside the approved IT stack, from unauthorized endpoint applications and browser extensions to personal cloud services. It left a trail: an install, a device on the network, something a scan or an agent could eventually catch. From there, an analyst had to investigate the finding and assess the risk before deciding how to respond. | AI blog | WatchGuard Blog |
|
17.10.26 |
GhostAction Is Now Phishing Open Source Maintainers | GhostAction operators used a targeted GitHub phishing proxy to steal developer credentials and one-time codes using a sophisticated GitHub phishing kit | Hacking blog | OpenSourceMalware |
|
17.10.26 |
GhostAction Attack Escalates By Targeting GitHub Users OpenSourceMalware | OSM has identified a new evolution of the GhostAction attack, which targets GitHub users via malicious CI workflow files and worm-like behaviour | Hacking blog | OpenSourceMalware |
|
17.10.26 |
Threat intel blog | GitHub security improvements, GhostAction phishes OSS maintainers, and DoJ shuts down DPRK laptop farms | Cyber blog | OpenSourceMalware |
|
17.10.26 |
YuanKong RAT: the Android remote-control service that stamps its operators' names into every build | Most Android RATs try hard to hide their server. This one barely hides anything and that turns out to be the interesting part. The dropper leaves the key under the mat: a vault-config.json sitting in assets/ right next to the ciphertext it unlocks, holding the key and IV in cleartext. | Malware blog | STAR Labs |
|
17.10.26 |
Qilin Ransomware: Inside a Rust Encryptor and Its Affiliate Ecosystem | Qilin ransomware combines file encryption with an affiliate operation that manages victims, ransom negotiations, and stolen-data publication. Different intrusion teams deploy its payloads, so identifying Qilin does not automatically identify the attacker or the method used to enter a network. | Ransom blog | Darkatlas |
|
17.10.26 |
Rokarolla Android Banking Trojan: Analysis & Detection | The Rokarolla Android banking trojan combines fake login screens, message collection, and remote device interaction. With the required permissions, it can steal credentials and manipulate legitimate app interfaces. | Malware blog | DARKATLAS |
|
17.10.26 |
BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849) | BlockStrap (CVE-2026-103849) is a CVSS 10.0 Magento and Adobe Commerce flaw that gives unauthenticated attackers remote code execution. Adobe fixed it on October 13 in APSB26-153 but requires a manual patch, while new installs remain vulnerable. | Vulnerebility blog | Sansec |
|
17.10.26 |
Spike in attacks targeting digital video recorders in Ukraine | GreyNoise identified an increase in scanning and exploitation attempts targeting Digital Video Recorders (DVR) in Ukraine between 21 September and 1 October 2026. The activity coincides with an escalation in Russian strikes across the country. There are a myriad of malicious use cases for compromising DVRs; one involves gaining the ability to physically survey an area to gain battlespace awareness before, during, and after kinetic strikes. | BigBrother blog | GRAYNOISE |
|
17.10.26 |
skynox7: Proxyjacking Edge Devices Into Residential Proxies | Adversaries have a wide range of mechanisms they can use to obfuscate their public internet protocol (IP) addresses to avoid attribution and reduce their detectable signature. Adversaries have used various types of nodes and services to proxy their traffic including commercial virtual private networks (VPN), virtual private servers (VPS), co-opted victim infrastructure, and more. | Hacking blog | GRAYNOISE |
|
17.10.26 |
Variola: From ClickFix to a Modular Implant | Blackpoint’s Adversary Pursuit Group (APG) traced a ClickFix intrusion to a previously unclassified modular Windows implant, which APG is tracking as Variola. | Security blog | Blackpoint Cyber |
|
17.10.26 |
Pay Day Piracy: How Attackers Talk Their Way Into Your Payroll System | Using behavioral AI to chain anomalies from the help desk to HR payroll systems. | AI blog | Abnormal AI |
|
17.10.26 |
Detecting AI Attackers in the Cloud: 4 Signals That Work | AI-driven cloud attacks pass posture checks and detection rules because every step looks legitimate, and four signals still catch them when they're read together instead of one at a time. | AI blog | Abnormal AI |
|
17.10.26 |
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin | This blog post covers a Critical unauthenticated arbitrary file upload vulnerability in the Bricksforge(opens in new tab)↗ plugin for WordPress. Patchstack has deployed a mitigation rule to protect against exploitation of this vulnerability. If you are a Bricksforge user, update to at least version 3.1.8.10. | Vulnerebility blog | Patchstack |
|
17.10.26 |
Next.js Security Update for Upstream Vulnerabilities | Last week we announced an upcoming out-of-band security update for Next.js, including two fixes postponed from the September security release due to upstream dependency delays. | Vulnerebility blog | Next.js |
|
17.10.26 |
Patch Tuesday: October 2026 (Expel’s version) | Microsoft’s October release is the largest in its history: 1,414 CVEs, 78 rated critical and 1329 rated important. | OS Blog | Expel |
|
17.10.26 |
QuartzLine: A working PDF viewer with a backdoor inside | QuartzLine is a working PDF viewer with a backdoor hidden inside. In public analysis so far, the attacker never sent a command in any traffic researchers could decrypt. | Malware blog | Expel |
|
17.10.26 |
Emsisoft Anti-Malware for macOS stable release | After months of testing, feedback, and refinement, Emsisoft Anti-Malware for macOS is now officially available in a stable release. This release brings several performance improvements and tweaks. | Malware blog | Expel |
|
17.10.26 |
LG webOS sync-demo Preauth RCE - | First, the attacker replays the LG-signed manifest embedded in com.webos.app.sync-demo. SSG trusts the signature and follows the STB_INTERNAL_CONNECTION prompt-skip path, issuing a SECURE-tier client-key without a PIN prompt. Then cmp-client navigates to an attacker-controlled interactiveUrl. The loaded page keeps the app instance bridge and calls Luna services as cmp-client. | Vulnerebility blog | SSD Secure Disclosure |
|
17.10.26 |
Mobile Device Management Alone Cannot Address Every Mobile Security Threat | In an article published by HackRead, the limitations of Mobile Device Management (MDM) are examined as organizations face increasingly sophisticated threats targeting employee smartphones and corporate data. While MDM helps enforce device policies and manage access, it does not eliminate risks from mobile phishing, malicious applications, and compromised devices. | Security blog | ZIMPERIUM |
|
17.10.26 |
Crypters and the Mobile Malware Blind Spot: What a New Australian Government Advisory Means for Mobile Security | A joint advisory from the Australian Signals Directorate (ASD), Australian Federal Police (AFP), New Zealand Police, Google, and the UK's National Crime Agency (NCA) warns that "crypters," commercial obfuscation-as-a-service tools priced from as little as $25 a file, let attackers scramble malware so it evades antivirus and endpoint detection. | Cryptocurrency blog | ZIMPERIUM |
|
17.10.26 |
Banking Scams Now Primarily Target Mobile Devices | A recent report reveals that 90% of banking scam attempts now occur on mobile devices, highlighting the growing role of smartphones in financial fraud. Researchers found that scammers are increasingly exploiting mobile banking interactions through social engineering, impersonation, and deceptive communications to manipulate victims into authorizing fraudulent transactions. | Spam blog | ZIMPERIUM |
|
17.10.26 |
GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories - | On October 8, 2026, attackers operating the GhostAction GitHub Actions credential-theft campaign compromised two high-profile open-source maintainer accounts and swept 345 repositories in two automated windows lasting minutes. Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC. | Cyber blog | StepSecurity |
|
17.10.26 |
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD | Calif frequently publishes our offensive research and work, but we otherwise don't draw much attention to the defensive work we do — assisting open source projects with remediation, patch generation, cryptographic improvements, and internal engineering projects we carry out for our clients. | Exploit blog | Calif |
|
17.10.26 |
Akamai Named a Leader in IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment | Akamai has been named a Leader in the IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment. This is the second time that Akamai has been recognized as a Leader in this assessment. | Security blog | Akamai |
|
17.10.26 |
Comply with PCI 6.4.3 & 11.6.1 Through Client-Side Security Tools | As the payment landscape evolves, compliance with PCI DSS v4 (v4.0.1 is the latest) is now a reality, with the deadline to adopt the future-dated requirements behind us. It is a critical defense against growing web skimming attacks (also known as e-skimming and digital skimming) and data leakage risks. | Security blog | Akamai |
|
17.10.26 |
From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain | A WhatsApp-delivered financial document lure carried Statement.exe into a multistage Windows intrusion. After unpacking, the loader screened the host, attempted elevation, and injected a downloader into the LocalSystem Task Scheduler process. | Social blog | Morphisec Blog |
|
17.10.26 |
Why is Preemptive Cyber Defense Important in 2026 | Preemptive cyber defense is a prevention-first security strategy that stops threats before they execute, rather than detecting and responding to them after they have already run. Instead of recognizing an attack in progress, it removes the conditions an attack needs to succeed, blocking malicious code deterministically at the moment of execution. | Security blog | Morphisec Blog |
|
17.10.26 |
2026 Financial Sector Cyberattack Chain Analysis & Defense | Between September 30 and October 3, 2026, consecutive customer data leaks were confirmed at several major commercial banks in Korea. In particular, most of the leaks were found to have exploited APIs by targeting authentication and authorization flaws, and there are even concerns about potential automated attacks using AI agents. | BigBrother blog | Enki White Hat |
|
17.10.26 |
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign | The campaign uses PhantomPolia, a JavaScript loader that retrieves an encrypted configuration from an Ethereum Sepolia smart contract through public Remote Procedure Call (RPC) endpoints. The loader then decrypts the configuration locally using PBKDF2 and AES-GCM, revealing the next-stage command-and-control (C2) domain without exposing it directly on the compromised site. | Cryptocurrency blog | LEVELBLUE |
|
17.10.26 |
Now Detecting: CVE-2026-85706 - Unauthenticated Arbitrary File Read in GitLab | A maximum severity flaw in GitLab's repository commits API allows anonymous attackers to read arbitrary files from self-managed servers. We are already detecting it. | Vulnerebility blog | Ethiack |
|
17.10.26 |
Mythos AI Security Implications: The Complete Guide (2026) | Claude Mythos did not create the AI-security asymmetry between attackers and defenders. Mythos made it undeniable. Anthropic's own Frontier Red Team used the model to autonomously discover thousands of high- and critical-severity zero-day vulnerabilities across every major operating system and every major web browser, and it did so at costs that break the historical economics of vulnerability research. | AI blog | Ethiack |
|
17.10.26 |
Front Lines Podcast: What Founders Get Wrong When Pitching CISOs | On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust. | Cyber blog | Socket |
|
17.10.26 |
Socket for Origin Now Available | Socket for Origin scans dependency changes in pull requests and flags security risks based on your team’s policies. Now available in Cursor’s App Marketplace. | Cyber blog | Socket |
|
17.10.26 |
Anthropic Gives Open Source Maintainers a Fast Track to Mythos Vulnerability Findings | Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes. | AI blog | Socket |
|
17.10.26 |
Suspected Chinese spies hit BeyondTrust via zero-day | A suspected Chinese espionage crew broke into BeyondTrust Remote Support appliances through a flaw nobody knew about, weeks before the vendor disclosed it. Google Threat Intelligence Group (GTIG) and Mandiant say the actor they now call ARMORY CASTLE, previously tracked as UNC5221, exploited CVE-2026-102764 as a zero-day in late August 2026, then used the hijacked appliances to steal credentials and reach the machines those appliances are trusted to manage. | Vulnerebility blog | IntelFusions |
|
17.10.26 |
Deploy with Void | VoidZero's tools such as Vite, Vitest, Oxc, and Rolldown — bundled in one toolchain as Vite+ — have made frontend development faster, but building full-stack applications requires more than just a tooling stack. These applications need server routes, databases, local development environments, and a fast and easy way to deploy ideas to production. | Cyber blog | Cloudflare Blog |
|
17.10.26 |
Cloudflare and OpenAI: making AI discovery better for everyone | Optimizing your site for AI is of little use if AI can't find it. The answer to someone's question may already be on your website: the installation guide you spent a week writing, or a first-hand account of using a product, with the details that make the difference for whether they buy it. As more people turn to AI for help, you want those systems to find your work, represent it accurately, and send interested people your way. You also want control over how they access your site. | AI blog | Cloudflare Blog |
|
17.10.26 |
Yandex outage: data shows that instead of going dark, malicious bots went on the move | Following reported strikes on Yandex data centers, claims circulated on the Internet that Russian bot farms and influence operations had been knocked offline. HTTP traffic charts showed steep drops, fueling speculation that the infrastructure damage had stopped these malicious actors. However, aggregate traffic metrics can easily mislead. There are two autonomous system numbers (ASNs) associated with Yandex: AS13238 is used by Yandex’s search engine, while AS200350 runs its cloud services. | BigBrother blog | Cloudflare Blog |
|
17.10.26 |
Inside Hyperdrive: How we solved a rare Hyperdrive MySQL caching bug | Hyperdrive support for MySQL is now generally available (GA). Hyperdrive, Cloudflare’s database connection pooler for Workers, initially only supported Postgres. Since we announced the beta for MySQL protocol support last year, we have been working on making our MySQL handling as reliable as our Postgres support. | Vulnerebility blog | Cloudflare Blog |
|
17.10.26 |
A fully programmable secure web gateway | Every secure web gateway on the market works the same way: traffic matches a condition. A terminal action fires. Allow, Block, Isolate, Log. This model has been the foundation of network security for nearly 30 years, and it handles the common case well. But it has a ceiling, and customers with complex environments hit that ceiling regularly. | Vulnerebility blog | Cloudflare Blog |
|
17.10.26 |
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) | On August 18, 2026, Vercel announced a $1 million challenge inviting researchers to break the isolation boundary of its Sandbox product (total prize pool). The announcement came just weeks after OpenAI had disclosed a remarkable security incident: | Vulnerebility blog | PWN.AI Security Research |
|
17.10.26 |
Acronis Cyberthreats Update, October 2026 | The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in September 2026 and reflect threats that Acronis detected, as well as news stories from the industry. This report represents a global outlook and is based on more than one million unique endpoints distributed around the world. | Cyber blog | ACRONIS |
|
17.10.26 |
Acronis AI Copilot: Adoption is high and growing among MSPs | Acronis Cyber Platform has a built-in AI assistant. Type a plain-language question into the console, and it generates an answer or completes a supporting task within the console. | AI blog | ACRONIS |
|
17.10.26 |
NEBULA - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL | CloudSEK uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. Disguised as legitimate developer tools, these packages deploy a modified KNTRAT Windows trojan capable of stealthy remote access, camera and microphone surveillance, and persistence. The investigation reveals advanced syscall-based evasion techniques, active threats, and actionable indicators for security teams. | Malware blog | CloudSEK |
|
17.10.26 |
AI and the Shared Responsibility Model: What Changes | Whether you are deploying large language models (LLMs), training custom machine learning models, building agentic workflows or embedding AI into existing applications, the major cloud service providers (CSP) have rolled out dedicated platforms to make it easier than ever to get started. | AI blog | GIUDEPOINT |
|
17.10.26 |
Hiring in the Age of Deepfakes: Synthetic Applicants | It’s tough enough to hire the right person in today’s competitive talent market. Candidates ghost interviewers, skill sets don’t match job descriptions and the race for top technical talent is relentless. | Hacking blog | GIUDEPOINT |
|
17.10.26 |
Silent Ransom Group Leaked Chats: Key Findings by GRIT | The chats appear to be from Silent Ransom Group (SRG) and show an attempt at a deliberate rebrand (to Sleepless Threat) to evade law enforcement. The tradecraft analysis matches the FBI’s May 2025 notice on SRG. We assess with moderate-to-high confidence that the people in this chat operate under or alongside, the SRG name. | Ransom blog | GIUDEPOINT |
|
17.10.26 |
러시아 전쟁의 이면에서 우크라이나를 겨냥한 김수키의 Operation GitPower | Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War | APT blog | GENIANS |
|
17.10.26 |
금융분야 침해사고 이슈 분석 | 본 보고서는 2026년 9월 말부터 10월 초까지 국내 금융권에서 연쇄적으로 발생한 개인정보 침해사고를 대상으로, Genians Security Center(GSC)가 공개 보도, 금융당국 발표, 보안업계 분석을 종합하여 사고 경과, 공격 기법, AI 활용 정황 및 국내외 위협 동향을 정리한 것입니다. | APT blog | GENIANS |
|
17.10.26 |
The zod Near-Miss: Publish-Time Scanning at the npm Registry Boundary — | zod is the kind of dependency you add without thinking about it. The schema validation library sits in millions of TypeScript projects; commenters in GitHub’s incident thread put its weekly downloads above 280 million. On Sunday, September 21, 2026, a commit landed in the public colinhacks/zod repository with the message Fix bugs and improve performance. | Hacking blog | Yeeth Security |
|
17.10.26 |
CVE-2026-89111: Critical SAP Cloud SDK SSRF | SAP has disclosed CVE-2026-89111, a maximum-severity server-side request forgery (SSRF) vulnerability in SAP Cloud SDK for Python that can expose OAuth2 client credentials. | Vulnerebility blog | SOCRADAR |
|
17.10.26 |
Top RCE Vulnerabilities: 10 Critical CVEs and Exploits | A remote code execution (RCE) vulnerability is a software flaw that lets an attacker run their own code on a target system from a remote location. Exploiting vulnerabilities like this is now the most common way attackers get in: it was the initial access vector in 31% of breaches in Verizon’s 2026 Data Breach Investigations Report (DBIR), up from 20% the year before, and the median time to fully patch rose from 32 to 43 days. | Vulnerebility blog | SOCRADAR |
|
17.10.26 |
October 2026 Patch Tuesday: 1,413 Flaws, 3 Zero-Days | Microsoft’s October 2026 Patch Tuesday, released on October 13, 2026, fixes 1,413 vulnerabilities across Windows, Office, Exchange Server, SharePoint, .NET, Azure services, and developer tools. The total surpasses September’s Patch Tuesday (974 flaws) and sets a new monthly record for the second month in a row, a rise Microsoft has tied to AI-assisted vulnerability discovery. | OS Blog | SOCRADAR |
|
17.10.26 |
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks | Ivanti released fixes on October 13, 2026, for CVE-2026-104935, an Ivanti Connect Secure zero-day that attackers exploited before a patch existed. Volexity, which uncovered the activity during an incident investigation, tracks the attacker as UTA0576. According to the published analysis, the actor chained three vulnerabilities to move from an unauthenticated web request to root-level code execution on an ICS VPN appliance running version 22.8R2.4, which was fully patched at the time. | Exploit blog | SOCRADAR |
|
17.10.26 |
n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site | A month after its first leak site postings, the n0n extortion group has turned its attention to global shipping. On October 12, 2026, the group added 38 organizations to its Dark Web leak site in one batch: container terminals in Brazil, Spain, Morocco, India and Vietnam, shipping lines in Singapore, China and Taiwan, port IT providers in Kuwait, Indonesia and Germany, and a dense cluster of South Korean operators. | APT blog | SOCRADAR |
|
17.10.26 |
French Supermarket Cyberattack: Exposed OT Behind France’s Food Supply | Supermarkets across France opened on Monday, October 12, to warm freezers and spoiled stock. Overnight, attackers had taken control of refrigeration controllers in hundreds of stores and forced them into defrost, heating equipment to as high as 50°C. Prosecutors confirmed fires, retailers estimated losses in the tens of millions of euros, and Coopérative U’s chief executive called the attack unprecedented. | BigBrother blog | SOCRADAR |
|
17.10.26 |
Iran War Cyber Threat Outlook: Conflict Phases and What Comes Next | Since the Iran War began on February 28, 2026, the conflict has moved through phases that most threat frameworks were not built to track. In cyberspace, SOCRadar tracked 1,357 incidents prominent in the first month that spanned 25+ countries, 15+ sectors, and 40+ distinct attack groups. That data does more than record what happened. It reveals a pattern | BigBrother blog | SOCRADAR |
|
17.10.26 |
Behind the scenes of a vishing operation | Okta Threat Intelligence recently obtained material from a sensitive source that provides an inside view of Work Panel, an operator console used by threat actors running vishing campaigns that target customers of multiple identity providers, including Okta. | Phishing blog | Okta Threat Intelligence |
|
17.10.26 |
October 2026 Microsoft Patch Tuesday | Microsoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. This month’s updates include patches for two zero days, including one that was exploited in the wild. | Vulnerebility blog | Tenable® |
|
17.10.26 |
Xorbits Xoscar: Unauthenticated RCE via Cloudpickle Deserialization in the Actor Pool | VulnCheck is disclosing CVE-2026-49950, a deserialization vulnerability in Xorbits Xoscar that allows for unauthenticated remote code execution. The bug is not in an application endpoint; it is in the transport layer of the actor framework itself. An actor pool is Xoscar's unit of concurrency: a process that hosts actors and exchanges messages with other pools over TCP. | Vulnerebility blog | VulnCheck |
|
17.10.26 |
Expanding Visibility Into Chinese Government-linked Cyber Threat Actors | Some of the joint advisory's IOCs are still live and repurposed. Three IPs were hitting VulnCheck Canaries as recently as May 2026, years after their advisory last-seen dates, but against entirely different vulnerabilities than the advisory lists. | APT blog | VulnCheck |
|
17.10.26 |
SPIP odt2spip Plugin: Authenticated Command Injection via Uploaded Document Filename | VulnCheck is disclosing CVE-2026-104085, an OS command injection in odt2spip, a document-import plugin for the SPIP CMS. The plugin lets an author import an office document (.odt, .doc, .docx, .html) into an article. It moves the uploaded file to a path built from the raw client-supplied filename, then hands that path to LibreOffice through a shell command. | Hacking blog | VulnCheck |
|
17.10.26 |
5 Key Takeaways From Censys’ State of the Internet Report | New research from Censys’ 2026 State of the Internet Report challenges familiar assumptions about where Internet infrastructure lives, how it changes, and what’s exposed. | Cyber blog | Censys |
|
17.10.26 |
The Ultimate Guide to Brand Protection with Censys - Censys Brand Protection & Fraud Takedowns: A Censys Guide | On August 23, 2026, a PowerShell dropper reached out to hxxp://binance-idexchange[.]com/333.mp4 for its next stage. Binance, the world’s largest cryptocurrency exchange with hundreds of millions of users, had nothing to do with it — duh! | Cryptocurrency blog | Censys |
|
17.10.26 |
Frostbitten in France: A Danfoss StoreView Internet Exposure Report | Attackers targeted refrigeration units at hundreds of supermarkets across France over the weekend of October 10, resulting in spoiled food and, in some cases, fires. | Incident blog | Censys |
|
17.10.26 |
Navigating the Waves of AI-Powered Identity Attacks | It’s one of the most famous lines in movie history. Chief Brody, chumming the water off the back of the Orca, a battle-hardened fishing boat, gets his first full look at the nemesis in Jaws. He backs slowly into the cabin in shock and says… | Incident blog | Flare |
|
17.10.26 |
Analysis After the Refrigeration System Attack in France | Overnight between October 11-12, 2026, refrigeration systems at several hundred grocery stores in France were driven into forced defrost. Temperatures in some cases reached 50 degrees Celsius, stock was destroyed, and equipment overheated. | Incident blog | Flare |
|
17.10.26 |
September 2026 Threat Trend Report on APT Groups | APT cases disclosed in September 2026 demonstrate that attacks have evolved to exploit the developer ecosystem, cloud services, and network management infrastructure as trust layers. Legitimate software installers, GitHub repositories, Microsoft 365, OneDrive, Telegram, Nostr, routers, and authentication servers were all included in the attack chain. | APT blog | ASEC |
|
17.10.26 |
Analysis of the Infrastructure of ARTEX, a Chinese AI Penetration Testing Tool #4 – The Birth of Copy Cat | Since the original ARTEX GitHub repository disappeared, there has been an increase in independent distributions and customized instances based on the existing ARTEX codebase. These distributions are being redistributed with the product name, UI, filesystem structure, agent settings, and language modified, while retaining traces of ARTEX. | Cyber blog | ASEC |
|
17.10.26 |
ARTokens 5.1.2: Microsoft 365 Device Code Phishing | ARTokens (also reported as ARToken) is a Microsoft 365 device code phishing kit previously documented by Cisco Talos. It has re-emerged in recent campaigns with notable changes to its implementation and deployment options. | Phishing blog | ZeroBEC |
|
17.10.26 |
ARTEX Attacks on South Korean Financial Institutions | From September 27 to early October 2026, the internet-facing (peripheral) business systems of multiple South Korean financial institutions were attacked one after another. | Attack blog | THREATBOOK |
|
17.10.26 |
RedAgents.Ai: The World's First Multi-Agent AI Pentest Platform | Recent news of multiple South Korean banks having their networks breached has once again deepened the industry's alarm over AI attacks. Even when attackers are not technically skilled, they can use AI agents to cause a major security impact. | Malware blog | THREATBOOK |
|
17.10.26 |
MSSP Growth: How to Scale Investigations Without Adding More Work | But growth also brings more alerts, suspicious files and URLs, investigations, escalations, reports, and SLA commitments. And if too much of that work still depends on manual analyst effort, those 10 new clients can put pressure on the SOC faster than expected. | Security blog | ANYRUN BLOG |
|
17.10.26 |
Fake AI Tools Target US Companies: Claude, ChatGPT & Copilot | ANY.RUN researchers tracked fake AI tool campaigns that impersonate Claude, ChatGPT, GitHub Copilot, Gemini, and other AI brands to plant infostealers, take over browser sessions, and phish business accounts. Between April 15 and October 5, 2026, 1,258 public sandbox analyses were tied to these campaigns, and the USA was the second-largest source of submissions after India. | AI blog | ANYRUN BLOG |
|
17.10.26 |
What Can ANY.RUN Reveal About Your Threat Landscape? | Every day, thousands of SOC and IR teams worldwide analyze suspicious files, emails, and links with ANY.RUN. Beyond individual investigations, this activity generates valuable data on emerging threats, industry trends, and SOC operational performance. | Security blog | ANYRUN BLOG |
|
17.10.26 |
DORA TLPT Requirements: Where Threat Intelligence Fits | The DORA TLPT requirements push selected EU financial entities beyond standard penetration testing. TLPT must be based on realistic threat scenarios, relevant threat actors, and current intelligence about how attacks are actually carried out. | Security blog | ANYRUN BLOG |
|
17.10.26 |
Russia Is Tightening Internet Controls, Leading to Operational Risks | Since mid-2025, the Kremlin has intensified restrictions on digital communications and infrastructure, very likely to suppress the organization of domestic political dissent and conduct digital surveillance within Russia. | BigBrother blog | RECORDEDFUTURE |
|
17.10.26 |
Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure Beyond the Published IOCs | Disclosure note: Before publishing, we shared the new infrastructure identified in this research with the relevant national CERTs. This research did not recover victim data. | Cryptocurrency blog | HUNT.IO |
|
17.10.26 |
Inside a PaperCut Attacker’s AI Toolkit: Agent Instructions, Exploit Code, a Second RCE, and Victims Across 45+ Countries | Disclosure note: Before publishing this research, we shared our findings and the victim data we recovered with the national CERTs of the affected countries. The CERTs are handling notification of the affected organizations in their jurisdictions. | AI blog | HUNT.IO |
|
17.10.26 |
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint identified four espionage-motivated threat actors employing a new exploit kit that chains multiple Chrome browser and Microsoft Windows vulnerabilities. Proofpoint is tracking the exploit kit used in this activity as BlueMoon. | Exploit blog | Proofpoint US |
|
17.10.26 |
Threat Actors Abuse AI Pentesting Framework | Zscaler ThreatLabz analyzed a recently active exploitation campaign in which a threat actor abused ARTEX to target South Korean financial institutions. ARTEX is an open source agentic penetration testing framework developed in China that uses large language models (LLMs) to automate reconnaissance and exploitation tasks. | AI blog | ThreatLabz |
|
17.10.26 |
The patch tsunami: Microsoft addresses 1,415 CVEs in Patch Tuesday | For nearly 25 years, Patch Tuesday gave IT teams a predictable stream of patches to manage. In 2026, AI turned that stream into a tidal wave that threatens to overwhelm the organizations that can’t adapt. | OS Blog | ThreatDown |
|
17.10.26 |
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize | Group-IB researchers analyze KGB RAT, a Windows Remote Access Trojan advertised on underground forums as being fully undetectable, featuring a built-in crypter, HVNC, credential theft, ransomware, and an unusual set of psychological harassment capabilities. | Malware blog | Group-IB Blog |
|
17.10.26 |
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance | CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. Analysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files, and Claude memory files, providing direct insight into the threat actor's operational methodology and tooling. | AI blog | CrowdStrike |
|
17.10.26 |
How Attackers Can Bypass LLM Safety Classifiers | The CrowdStrike Cyber Superintelligence Lab evaluated the most advanced publicly deployed content safety classifier and found that it can be systematically circumvented. | AI blog | CrowdStrike |
|
17.10.26 |
CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage | CrowdStrike joins Anthropic’s Critical Infrastructure Defense Program, bringing deep cybersecurity expertise in protecting IT and OT environments to help advance AI-powered defense for critical infrastructure. | AI blog | CrowdStrike |
|
17.10.26 |
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation | On October 4, 2026, Citrix disclosed a high-severity (CVSS score of 8.7) memory overflow vulnerability (CVE-2026-88779) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway deployments that are configured as either a SAML Service Provider (SP) or SAML Identity Provider (IdP). Successful exploitation can cause a denial of service (DoS) condition, potentially disrupting authentication services and remote access functionality. | Vulnerebility blog | SOPHOS |
|
17.10.26 |
Intent-Based Access Control: AI, Risk and the Limits of Inference | In Minority Report, the Department of Precrime promised certainty. Three precognitives saw the future, the system picked the consensus, and police arrested people for murders they hadn't yet committed. The whole machine depended on one buried secret: sometimes the precogs disagreed, and the dissenting vision, the minority report, was quietly deleted. The system held together as long as the precogs agreed, but broke when it removed its own doubt. | AI blog | SOPHOS |
|
17.10.26 |
Vulnerability Discovery and Exploitation Trends in the AI Era | Google Threat Intelligence Group (GTIG) examines vulnerability disclosure and exploitation statistics to evaluate the impact of artificial intelligence (AI) on the vulnerability threat landscape. We found that AI is measurably changing not just the pace of vulnerability discovery and exploitation, but also the types and typical risk profiles of vulnerabilities that are being discovered. | Exploit blog | Google Cloud Blog |
|
17.10.26 |
ARMORY CASTLE Exploits BeyondTrust | On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances. BeyondTrust Remote Support is an enterprise secure remote access solution that enables IT teams to securely access and troubleshoot remote endpoints. The successful exploitation of this vulnerability results in the arbitrary upload of files. | Exploit blog | Google Cloud Blog |
|
17.10.26 |
AI/ML-Driven Malware Analysis Platforms: Key Features | Malware is becoming increasingly sophisticated, making it difficult for organizations to detect emerging threats using traditional signature-based security tools alone. Attackers use techniques such as code obfuscation, polymorphism, and sandbox evasion to bypass conventional security measures. | AI blog | SEQRITE |
|
17.10.26 |
CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive | CVE-2026-3854 exposed a critical trust-boundary failure in the GitHub Enterprise Server (GHES) push pipeline. A value supplied through a standard Git push option could be copied into internal, semicolon-delimited metadata and later interpreted as trusted configuration. | Vulnerebility blog | SEQRITE |
|
17.10.26 |
WP2Shell Exploit Chain: Anatomy of a Sophisticated WordPress Attack | WP2Shell is a critical WordPress Core exploit chain disclosed in July 2026 that can enables pre-authentication remote code execution (RCE) on vulnerable WordPress installations. The chain is particularly significant from a threat-intelligence perspective because it removes the requirement for an attacker to first obtain valid credentials or authenticate to the target application. | Exploit blog | SEQRITE |
|
17.10.26 |
Weekly Vulnerability Report: Langflow, N8n, And 54 ICS Flaws | This Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report covers two views of risk: what attackers tried against Cyble’s global honeypot sensors, and what the Cybersecurity and Infrastructure Security Agency (CISA) disclosed for industrial control systems (ICS). | Cyber blog | CYBLE |
|
17.10.26 |
Don’t Get Played: TOKEN2049 Security Event Faces Scam Claims | A crypto security event that promised to teach attendees how to avoid scams is now the subject of scam allegations. The gathering, branded “Don’t Get Played,” was held as a side event during TOKEN2049 week in Singapore and co-hosted by groups operating under the names “Apex Accelerator” and “Stone Venture.” | Spam blog | CYBLE |
|
17.10.26 |
The GhostX Ecosystem: Forged In Transit, Licensed To Deceive | Cyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025. Recent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX. | Malware blog | CYBLE |
|
17.10.26 |
Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data | Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in our user base. | Malware blog | Gen Blogs |
|
17.10.26 |
Aoki: Infostealer Targets AI Coding Assistant Credentials | Newer versions of a little-documented infostealer steal API keys and tokens from ever-growing number of AI coding assistants, including Claude, Codex, Cursor and Gemini. | Malware blog | SECURITY.COM |
|
17.10.26 |
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime | Over the past year, Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators, developers, and an illicit marketplace selling tools and infrastructure for large-scale phishing, enabling cybercriminal operations worldwide. | Phishing blog | Microsoft Security Blog |
|
17.10.26 |
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant | Unit 42 investigated a multi-stage network intrusion against a telecommunications organization that occurred in September 2024, which we are tracking as cluster CL-STA-0954 (aka UNC5820). The attackers behind CL-STA-0954 achieved an initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance. | APT blog | Palo Alto |
|
17.10.26 |
The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk | When unusual activity was detected on a European bank’s central IT system, its internal security team quickly recognized that the incident warranted immediate response. They discovered unauthorized VPN-based access attempts that spanned several months. They then engaged Unit 42 to determine the full scope of the intrusion, identify any persistent footholds and secure the environment. | Hacking blog | Palo Alto |
|
17.10.26 |
AI-Powered Espionage Campaign Targets Government Linux Infrastructure | Unit 42 identified a campaign targeting government entities and state-affiliated infrastructure, with observed activity spanning from October 2025–April 2026. We track this activity as CL-UNK-1211. | AI blog | Palo Alto |
|
17.10.26 |
When LLM Gateways Go Wrong: Findings from LiteLLM - Check Point Research | Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029, CVE-2026-59823) which have been resolved as of LiteLLM version 1.83.9. | AI blog | Check Point Research |
|
17.10.26 |
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation | I've been following a lot of (sometimes heated) threads and discussions lately about the current vulnerability landscape. I learned new words/phrases such as Summer of Hell (although I'm writing this with 1°C/34°F outside), Vulnpocalypse, Bugmageddon, Bugpocalypse, Breachpocalypse... | Vulnerebility blog | Check Point Research |
|
17.10.26 |
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing | Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility. | APT blog | CISCO TALOS |
|
17.10.26 |
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware | “AI-analysis evasion” encapsulates the real-world techniques malware authors are developing in attempt to obstruct or defeat any layers of automated AI analysis. | AI blog | CISCO TALOS |
|
17.10.26 |
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical." | OS Blog | CISCO TALOS |
|
17.10.26 |
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations | Cisco Talos identified UAT-6275 (TAG-193 by Recorded Future) activity targeting government organizations across the Commonwealth of Independent States (CIS). Recovered artifacts show additional interest in water resources and energy. This focus is consistent with intelligence collection and may reflect the regional effects of the Russia–Ukraine war. | APT blog | CISCO TALOS |
|
17.10.26 |
Inbox flooded with sign-up messages? How to handle email bombing | If you’re suddenly being overwhelmed with sign-up emails, it could very well be a sign of something more serious | Spam blog | Eset |
|
17.10.26 |
Medicare Open Enrollment season is here, and so are the scams | Open Enrollment is peak season for Medicare fraud – here’s how to tell real outreach from fakes and keep your details safe | Spam blog | Eset |
|
17.10.26 |
What to do when a data breach notice tells you almost nothing | Data breach notifications are telling victims less than ever. What the company leaves out can still shape what you do next. | Security blog | Eset |
|
17.10.26 |
The Unseen Credential Surface: How AI Agents Expose Secrets | There is a quiet assumption behind every AI agent: that when it "just runs a command for you," it handles your credentials as carefully as a good engineer would. It does not. This is not due to malicious intent. It is architectural. | AI blog | TRELLIX |
|
13.10.26 |
SOCRadar and Torq: Automate Threat Intelligence Response | Your Dark Web monitoring just flagged a set of employee credentials for sale. The alarm is accurate, it is timely, and it is now sitting in a queue. Someone has to read it, confirm the accounts are real, check whether the sessions are active, open a ticket and chase the identity team to rotate the password. | Security blog | SOCRADAR |
|
13.10.26 |
CVE-2026-102255: Critical SonicWall SMA1000 SSRF | SonicWall has patched CVE-2026-102255, a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability affecting the WorkPlace interface of SMA1000 appliances. | Vulnerebility blog | SOCRADAR |
|
13.10.26 |
Inside ICMacOS: From an Infostealer to a Persistent RAT | Over the past few years, Apple’s enterprise footprint has expanded significantly, with macOS capturing an important share of the global desktop operating system market. Modern enterprise adoption has surged, particularly in the United States, where roughly one in three software developers works on macOS. | Malware blog | SOCRADAR |
|
13.10.26 |
Angi, Tour Guy, Healthcare, KPN and CafeMom Leaks | SOCRadar Dark Web Team identified several new underground posts, including an alleged Angi customer database sale, an alleged The Tour Guy breach exposing 3.8 million records, and an alleged healthcare leads database covering Australia, South Korea, Japan, and China. | CyberCrime blog | SOCRADAR |
|
13.10.26 |
CVE-2026-85097: Bricksforge Flaw Exploited for Unauthenticated RCE | Threat actors are actively exploiting CVE-2026-85097, a maximum-severity (CVSS 10.0) vulnerability in the Bricksforge plugin for WordPress. The flaw lets unauthenticated attackers upload and execute arbitrary PHP code on vulnerable sites, resulting in remote code execution (RCE). | Vulnerebility blog | SOCRADAR |
|
13.10.26 |
ARTEX Attacks on South Korean Financial Institutions | From September 27 to early October 2026, the internet-facing (peripheral) business systems of multiple South Korean financial institutions were attacked one after another. | Attack blog | THREATBOOK |
|
13.10.26 |
Auditing the auditor: Unmasking Apex Accelerator | REF8801 exposes how Apex Accelerator combines convincing Web3 services with malicious npm packages, attacker-controlled AI infrastructure, and cross-platform malware delivery. | Security blog | Elastic Security Labs |
|
10.10.26 |
Dire Wolf Ransomware Attacks: How to Test and Strengthen Your Defenses | Dire Wolf Ransomware is a double-extortion ransomware first observed in April 2025. By August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services. | Ransom blog | PICUSSECURITY |
|
10.10.26 |
CISA AA26-281A: How Chinese Government-Linked Actors Steal Sensitive Data | CISA published a joint cybersecurity advisory on October 8, 2026, which describes how Chinese government-linked threat actors combine automated reconnaissance with hands-on intrusion to steal sensitive data. | BigBrother blog | PICUSSECURITY |
|
10.10.26 |
CrowdSec Bot Detection Uncovers a 75,000-IP Bot Network | On the 31st of August, we released CrowdSec 1.8.0 that included the bot detection feature. Despite the fact that the feature was (is) still tagged as alpha, some mad lads promptly slapped it on their production infrastructure. Thanks for the trust! | Malware blog | OpenSource Malware Blog |
|
10.10.26 |
Malicious Crypto Shell Packages Target RubyGems | A threat actor calling themselves "Ghost Dev" published 42 malicious typo squat packages to the RubyGems registry targeting crypto and web3 packages | Malware blog | OpenSource Malware Blog |
|
10.10.26 |
How to Investigate a GitHub Repo's Real History | Learn to reconstruct what actually happened to a compromised repo using timestamps and logs that the person doing the manipulation doesn't control. | Malware blog | OpenSource Malware Blog |
|
10.10.26 |
Novinarya: An Android stealer that hides its live C2 in a shop bio | Scan this sample for a command server and you find nothing: no URL, no IP, nothing to block. That is the whole idea. Behind a fake “Smart System Security” app, this Iranian banking and crypto stealer keeps its server out of the binary and reads it at run time from the bio of a seller’s profile on a legitimate marketplace, rotating it with a single edit no new sample needed. | Malware blog | STAR Labs |
|
10.10.26 |
Runtime AI Defense in a shared responsibility model | This last February, by their own account, an employee at Meta connected an open source agent to their inbox and told it to suggest which emails to archive or delete, and to confirm with them before acting. Despite the guardrails of the prompt, the agent started deleting. Their stop commands didn't work and they had to manually kill the process. | AI blog | Sysdig |
|
10.10.26 |
Spike in attacks targeting digital video recorders in Ukraine | GreyNoise identified an increase in scanning and exploitation attempts targeting Digital Video Recorders (DVR) in Ukraine between 21 September and 1 October 2026. The activity coincides with an escalation in Russian strikes across the country. | BigBrother blog | GREYNOISE |
|
10.10.26 |
Why API Security Belongs in ECB Cyber Action Plans | An undocumented partner endpoint or an outdated mobile-banking API can expose customer information even after newer services receive stronger protections. As AI accelerates vulnerability discovery and exploitation, banks need a clearer view of these gaps and a practical way to reduce them. | Vulnerebility blog | Akamai |
|
10.10.26 |
CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products | On October 5, 2026, Atlassian released a security advisory to address a critical arbitrary file read vulnerability across multiple Atlassian Data Center products, including Bitbucket, Confluence, Jira Software, and Bamboo. | Vulnerebility blog | Akamai |
|
10.10.26 |
How Akamai ExAR Contained a LATAM Supply Chain Attack | Akamai Guardicore Segmentation’s Exposure Analysis and Response (ExAR) detected and investigated a multistage intrusion affecting supply chain infrastructure in Latin America (LATAM). The complex intrusion was targeting Linux, OpenShift, and Windows DMZ workloads before significant operational disruption occurred. | Hacking blog | Akamai |
|
10.10.26 |
Open Enrollment Is Where Digital Strategy Gets Tested. Are You Ready? | Most retail purchases come with a return policy. If the sweater doesn't fit, you send it back. But health plan selections work differently. Once a member chooses a plan during open enrollment, they generally keep that plan for the year unless they qualify for a Special Enrollment Period or get coverage another way. | Cyber blog | Akamai |
|
10.10.26 |
Beyond Vendor Assessments: Managing Third-Party Risk | In recent years, organizations have made real progress here. SBOMs (Software Bill of Materials) are now a standard deliverable. Software Composition Analysis (SCA) tools run in CI/CD. Vendor security questionnaires are longer and more rigorous than ever. | Security blog | JSCRAMBLE |
|
10.10.26 |
From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain | A financial-document lure, reported to have arrived over WhatsApp, carried Statement.exe into a multi-stage Windows intrusion. After unpacking, the loader screened the host, attempted elevation, and injected a downloader into the LocalSystem Task Scheduler process. | Social blog | Morphisec Blog |
|
10.10.26 |
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign | The LevelBlue Operational Cyber Threat Intelligence (OpsCTI) Team recently observed a ClickFix campaign delivering Remus Stealer through compromised websites. | Malware blog | LEVELBLUE |
|
10.10.26 |
16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials | Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces. | Cryptocurrency blog | Socket |
|
10.10.26 |
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack | Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware. | Malware blog | Socket |
|
10.10.26 |
Building an evidence-grounded agentic security operations harness on Cloudflare | Security alerts rarely arrive one at a time. A single alert can cause a spike across the environment, requiring a human analyst to decide which alerts are related and what they mean. When multiple arrive at the same time, it can quickly overwhelm even a seasoned security analyst. Enter the alert paradox. Now, our built-in, multi-AI-agent security operations harness can handle more of this work at Cloudflare scale. | AI blog | Cloudflare Blog |
|
10.10.26 |
Bridging technical depth and usability: The story behind Radar’s redesign | Radar provides a real-time view into global Internet trends, powered by Cloudflare’s global network. We support Cloudflare’s mission to help build a better Internet by making web data visible, clear, and actionable for everyone. Since launching in 2020, Radar has found a natural audience amongst expert users with technical backgrounds, such as network operators and academic researchers who rely on Radar data to observe industry trends and global events. | Security blog | Cloudflare Blog |
|
10.10.26 |
Meet AI Detection Engineer, the Newest Member of Your SOC | AI Detection Engineer investigates, builds, tests, and deploys a tuned detection for confirmed misjudgments your team reports, then shows the verifiable impact. | AI blog | Abnormal AI |
|
10.10.26 |
Four ways back in: the WordPress XSS campaign that hides its own admin account | Two unrelated WordPress plugins, two separate stored Cross-Site Scripting vulnerabilities, one payload. Over the past several days our telemetry has recorded exploitation attempts against both, and every attempt pulls the same JavaScript from imgcdn1.com. Two is what we have confirmed, not what we expect the final count to be. | Vulnerebility blog | Patchstack |
|
10.10.26 |
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin | This blog post covers a Critical unauthenticated arbitrary file upload vulnerability in the Bricksforge(opens in new tab)↗ plugin for WordPress. Patchstack has deployed a mitigation rule to protect against exploitation of this vulnerability. If you are a Bricksforge user, update to at least version 3.1.8.10. | Vulnerebility blog | Patchstack |
|
10.10.26 |
Inferno Drainer Is Burning Out | Inferno Drainer and its many derivatives constitute arguably the most notorious cryptodrainer-as-a-service ecosystem ever developed. After months spent reverse-engineering its newest payloads and monitoring the ecosystem in real time, one thing seems clear: the operation is in serious decline, and has been for quite some time. | Cryptocurrency blog | Ransom-ISAC |
|
10.10.26 |
Upcoming Next.js Security Update for Upstream Vulnerabilities | Next Wednesday, October 14, 2026, we plan to publish an out-of-band Next.js security update. It will address three vulnerabilities in upstream dependencies: two Critical and one High. Two of these fixes were postponed from the September security release due to upstream coordination. | Vulnerebility blog | Next.js |
|
10.10.26 |
Oh Noes! is updated and free for Cybersecurity Awareness Month | October means Cybersecurity Awareness Month, which for a lot of security teams means the same routine: send a fake phishing email, see who clicks, remind everyone not to click links from strangers. Again. | Cyber blog | Expel |
|
10.10.26 |
Earth Sirrush: A Russia-Aligned Intrusion Set With 4 Years of Evolving Espionage Tooling | Earth Sirrush has repeatedly changed its tools and delivery methods, but TrendAI™ Research reveals how shared code, reused artifacts, and infrastructure patterns continue to expose the links between its campaigns. | APT blog | TrendAI (US) |
|
10.10.26 |
AI and the Evolving Threat Landscape: What Public Sector CISOs Need to Know Now | Public sector CISOs need to grapple with challenges brought about by AI threats: up to 3,600 AI CVEs in 2026, autonomous ransomware, and critical infrastructure risk. | AI blog | TrendAI (US) |
|
10.10.26 |
Crypters and the Mobile Malware Blind Spot: What a New Australian Government Advisory Means for Mobile Security | A joint advisory from the Australian Signals Directorate (ASD), Australian Federal Police (AFP), New Zealand Police, Google, and the UK's National Crime Agency (NCA) warns that "crypters," commercial obfuscation-as-a-service tools priced from as little as $25 a file, let attackers scramble malware so it evades antivirus and endpoint detection. | Malware blog | TrendAI (US) |
|
10.10.26 |
Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It | tensorlake@0.5.144 on npm steals credentials when you install it, then tries to spread to other packages and repos. It also sets a trap. If you revoke the GitHub token it stole, a background job on your machine deletes your home directory. | Malware blog | StepSecurity |
|
10.10.26 |
StepSecurity Now Inventories AI Agent Skills in Your GitHub Repositories and on Developer Machines | AI agent skills live in two places. Developers install them on their own machines, and teams commit them to repositories so everyone who works in the codebase gets them. A skill often travels between the two: a developer installs it, finds it useful, and commits it; everyone who clones the repository then has it. | AI blog | StepSecurity |
|
10.10.26 |
Hijacked TensorLake npm Turned Install Into Credential Risk | The affected npm release included a preinstall hook that starts an obfuscated JavaScript payload through Bun. The package can download Bun 1.3.13 if it is not already available. | Hacking blog | SONATYPE |
|
10.10.26 |
NEBULA - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL | CloudSEK uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. Disguised as legitimate developer tools, these packages deploy a modified KNTRAT Windows trojan capable of stealthy remote access, camera and microphone surveillance, and persistence. The investigation reveals advanced syscall-based evasion techniques, active threats, and actionable indicators for security teams. | Malware blog | CloudSEK |
|
10.10.26 |
aws-auth ConfigMap Deprecated: What EKS Teams Need Now | If you’ve been running Amazon Web Services (AWS) Elastic Kubernetes Service (EKS) clusters for any length of time, you’ve probably had that moment. Staring at an aws-auth ConfigMap YAML file at 2 AM, trying to figure out why a new team member can’t access the cluster. | Hacking blog | GUIDESECURITY |
|
10.10.26 |
GRIT Q3 2026 Ransomware Report: Top Takeaways | GuidePoint’s Research and Intelligence Team (GRIT) just unveiled the Q3 GRIT Ransomware and Cyber Threat Insights Report. This quarter, they look at the so-called “vulnpocalypse,” shine a spotlight on the Education industry and ShinyHunters group, analyze the Clop syndicate’s latest activity and assess payment trends in the ransomware space. | Ransom blog | GUIDESECURITY |
|
10.10.26 |
AgentCorruption: One Role to Rule Them Al | Exploring what the agent's default execution role and stolen credentials can actually do, and how they became an entry point to the entire region - discovering and invoking other agents, reading, deleting and hijacking private conversations through chat history tampering, and more. | Hacking blog | Zenity Labs |
|
10.10.26 |
AgentCorruption: Credential Theft from AWS's Secrets Manager and More | Up to now, we showed how far we could get once we had the over-privileged role in hand: we were able to pull container images, talk to other agents that we were never allowed to, read private conversations, plant short- and long-term memories to control agents’ behavior and delete user data. All of this stays within the AWS region boundary. | Hacking blog | Zenity Labs |
|
10.10.26 |
AgentCorruption: Weaponizing Agent Memory for Persistent Hijacking | How access to AgentCore Memory let us plant instructions that survived beyond the initial compromise, turning an agent's remembered context into a channel for persistent command and control. | Hacking blog | Zenity Labs |
|
10.10.26 |
AgentCorruption: Initial IMDS Access | How a single prompt to a public-facing AgentCore agent exposed the instance metadata endpoint, the agent's cloud identity, and its container image: the foothold for everything that follows in this series. | Hacking blog | Zenity Labs |
|
10.10.26 |
DarkSword/Coruna Open Directory Finding Report | Open directories on five hosts exposed the full DarkSword/Coruna iOS exploit-and-harvest platform, from the C2 delivery server to the per-wallet theft modules. The infrastructure was still in use at triage time. | Exploit blog | Censys |
|
10.10.26 |
New on the Map — September 2026: 22 Protocol and Endpoint Scanners | Most organizations do not have a complete picture of what is reachable from the Internet. A router, a camera system, a data warehouse, a building access controller — any one of these could be answering requests from anywhere in the world right now, and your security team might not know. Attackers scan for these services systematically, every day. | Security blog | Censys |
|
10.10.26 |
Harbor SSRF Vulnerability Exposes Cloud Credentials | OX Research disclosed an SSRF vulnerability in Harbor, the CNCF open-source container registry. Any registered user who can create a project can point a webhook at the cloud metadata endpoint and walk away with the server’s IAM credentials. | Hacking blog | OX SECURITY |
|
10.10.26 |
Leaked AI & MCP Credentials: What They Expose | One record in the corpus carries the argument before we even start counting. It’s a project configuration file for an AI coding assistant that wires several named tool servers behind a single agent. | AI blog | FLARE.IO |
|
10.10.26 |
Healthcare: Cybercrime's Highest-Value Target | Various healthcare and public health reports like the one of IC3 (2025) report that healthcare organizations are among the most targeted critical infrastructure sectors for cyber incidents, with hundreds of reports of ransomware attacks and data breaches reported in a single year. | CyberCrime blog | FLARE.IO |
|
10.10.26 |
Email Security That Reasons About the Request and the Response | ARTokens (also reported as ARToken) is a Microsoft 365 device code phishing kit previously documented by Cisco Talos. It has re-emerged in recent campaigns with notable changes to its implementation and deployment options. | Phishing blog | ZEROBEC BLOG |
|
10.10.26 |
DDoS Readiness: Is Your Protection Actually On? | Most security controls tell you when they’re broken. A bad firewall rule lets traffic through that shouldn’t be there. An expired certificate generates alerts. A misconfigured WAF starts blocking legitimate users and someone notices pretty quickly. | Attack blog | Imperva |
|
10.10.26 |
From Threat Intelligence to SOC Action | So, what actually makes threat intelligence useful in daily SOC work? During our discussion, we narrowed it to three things: | Security blog | ANY.RUN & Elastic |
|
10.10.26 |
Critical N-able N-central Vulnerability and Active Exploitation | UPDATE 9/6/26: N-able issued [Hotfix 4 (2026.3 HF4)] to address CVE-2026-86218, an actively exploited pre-auth RCE zero-day with a 10.0 CVSS score that supersedes all prior hotfixes. On-premises N-central users must apply HF4 immediately, as systems running HF3 remain vulnerable to this newly disclosed flaw. Hosted (NCOD) instances have already been patched by N-able. | Exploit blog | Huntress |
|
10.10.26 |
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer | On October 4, 2026, NVD disclosed two CVEs impacting the AhsayCBS backup utility: CVE-2026-105133 and CVE-2026-105134. Starting October 7 (23:20:15 UTC), Huntress began seeing threat actors exploiting the flaws to perform remote code execution on impacted hosts. | Vulnerebility blog | Huntress |
|
10.10.26 |
Japan Adopts Proactive Cyber Defense Strategy | Japan’s Active Cyber Defense (ACD) framework shifts the country from voluntary information sharing and post-incident investigation to mandatory reporting, preventive communications analysis, and limited disruption of attack infrastructure. | BigBrother blog | RECORDEDFUTURE |
|
10.10.26 |
AI SOC automation: Inbox zero for your alert queue | AlertZero brings AI SOC automation to Elastic Security with four agents, one job each, so the queue stops setting your priorities. Nothing changes in your environment without your approval. | AI blog | Elastic Security Labs |
|
10.10.26 |
Semantic Privilege Escalation: The AI Security Threat Your Access Controls Can't See | In 1988, Norm Hardy published a short paper about an incident at Tymshare roughly eleven years earlier. A Fortran compiler lived in a system directory called SYSX, and so it could record usage statistics there, administrators had granted it a "home files license" that let it write any file in that directory. | AI blog | Proofpoint US |
|
10.10.26 |
Trojanized Terraform Provider Campaign | In July 2026, Zscaler ThreatLabz uncovered a campaign linked to TraderTraitor (also tracked as Jade Sleet, UNC4899, Pressure Chollima, and Slow Pisces), an advanced persistent threat actor backed by the North Korean government that has targeted the cryptocurrency industry for years. | Malware blog | ThreatLabz |
|
10.10.26 |
Criminal AI, powered by OpenRouter | Kriminal, DadGPT, and WormGPT are three of the most recognizable tools in the criminal AI marketplace today. Kriminal and DadGPT sell themselves as unrestricted AI: no filters, no refusals, built specifically to say “yes” where a mainstream model would say “no.” WormGPT takes the opposite approach, marketing itself as an “Ethical Hacking AI” for “cybersecurity professionals” — camouflage that lets it hide in plain sight. | AI blog | THREATDOWN |
|
10.10.26 |
How Attackers Can Bypass LLM Safety Classifiers | The CrowdStrike Cyber Superintelligence Lab evaluated the most advanced publicly deployed content safety classifier and found that it can be systematically circumvented. | AI blog | CROWDSTRIKE |
|
10.10.26 |
CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage | CrowdStrike joins Anthropic’s Critical Infrastructure Defense Program, bringing deep cybersecurity expertise in protecting IT and OT environments to help advance AI-powered defense for critical infrastructure. | AI blog | CROWDSTRIKE |
|
10.10.26 |
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance | CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. Analysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files, and Claude memory files, providing direct insight into the threat actor's operational methodology and tooling. | AI blog | CROWDSTRIKE |
|
10.10.26 |
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation | On October 4, 2026, Citrix disclosed a high-severity (CVSS score of 8.7) memory overflow vulnerability (CVE-2026-88779) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway deployments that are configured as either a SAML Service Provider (SP) or SAML Identity Provider (IdP). | Vulnerebility blog | SOPHOS |
|
10.10.26 |
CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive | CVE-2026-3854 exposed a critical trust-boundary failure in the GitHub Enterprise Server (GHES) push pipeline. A value supplied through a standard Git push option could be copied into internal, semicolon-delimited metadata and later interpreted as trusted configuration. | Vulnerebility blog | Seqrite |
|
10.10.26 |
Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data | Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in our user base. | Malware blog | GENDIGITAL |
|
10.10.26 |
CVE-2025-7544: Attackers Weaponize Tenda AC1206 Router Vulnerability to Deploy Mirai-Related Malware | MLflow is one of the most widely deployed open-source platforms for managing the machine learning lifecycle, from experiment tracking and model versioning to deployment and registry management. | Vulnerebility blog | SonicWall |
|
10.10.26 |
IBM Langflow OSS Unauthenticated RCE - CVE-2026-9198 | The SonicWall Capture Labs threat research team became aware of an Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation in Langflow AI, assessed its impact and developed mitigation measures. Langflow AI is a Python-based web application that provides a visual interface to build AI-driven agents and workflows. | Vulnerebility blog | SonicWall |
|
10.10.26 |
Adobe Commerce and Magento StyleSmuggler RCE - CVE-2026-75650 | SonicWall Capture Labs threat research team became aware of the threat CVE-2026-75650, assessed its impact, and developed mitigation measures. The flaw, also known as StyleSmuggler, is a critical vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. It lets an unauthenticated attacker run arbitrary code on a store by smuggling a template directive through the styles parameters of the storefront API. | Vulnerebility blog | SonicWall |
|
10.10.26 |
Blinder Tunnel Campaign Targets Iraqi Infrastructure | We discovered that an Iranian state-aligned threat actor has been masquerading as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets. Unit 42 tracks the activity as CL-STA-1178. This activity includes a campaign we call “Blinder Tunnel,” that targeted Iraqi critical infrastructure in March 2026, following infrastructure staging that was observed as early as November 2025. | Cyber blog | Palo Alto |
|
10.10.26 |
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) | Unit 42 is aware of possible zero-day activity against NetScaler devices. In a Citrix report that details several CVEs, they noted that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. The threat actors exploited these vulnerabilities to deliver web shells and establish their initial access and persistence into organizations. Analysis is ongoing to determine any post-compromise activity. | Vulnerebility blog | Palo Alto |
|
10.10.26 |
Evolution of Web3 in Cloud Supply Chain Attacks | Threat actors have systematically upgraded their command-and-control (C2) infrastructure to use Web3, also known as Web 3.0 or decentralized blockchain web architectures. This advancement goes from using static C2 endpoints hard coded in malware binaries to using Web3-powered smart contracts. Threat actors are then enabled to dynamically update entire botnets and worm network infrastructures with a single smart contract transaction. | Hacking blog | Palo Alto |
|
10.10.26 |
Making sure the checks get printed | My name is Pierre Cadieux, and I’ll be helping contribute to these newsletters. A little about me: I’ve been working in the cybersecurity industry in many roles over the past 20+ years, first focusing on endpoint security, policies, and firewalls, then moving to risk management and compliance, disaster recovery, and investigations. | Cyber blog | CISCO TALOS |
|
10.10.26 |
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware | Just as attackers are adding new capabilities into their toolkits with AI, they are consciously trying to evade the novel AI capabilities levied on them by defenders. In Cisco Talos' findings with CAIRN, we classify this archetype of malware as “A3: AI-Analysis Evasion” — that is, malware that embeds natural-language instructions to influence automated analysis. In line with the CAIRN philosophy, we treat this embedded language as a signal and actively seek it out to track and measure the progression of adversary techniques on this front. | AI blog | CISCO TALOS |
|
10.10.26 |
One breach, please, and make no mistakes | For some time now, the cybersecurity community has seen examples of autonomous agents, built inside AI labs, attacking public infrastructure (to name a few, Hugging Face, DSEWiki, and RubyGems). Of course, frontier labs have built-in security to prevent these attacks from occurring, but every now and then, the training or prompting appears to be insufficient — especially when the agents themselves attempt to use logic to probe and bypass the restrictions placed on them. | Incident blog | CISCO TALOS |
|
10.10.26 |
Microsoft, Adobe, Apple, and Foxit vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. | Vulnerebility blog | CISCO TALOS |
|
10.10.26 |
Give yourself room to be human | Fall is officially here in Maryland, and I can’t be more relieved. I flourish in 50 degree weather, where it feels natural to burrow under blankets, knit sweaters, and listen to an audiobook. | Cyber blog | CISCO TALOS |
|
10.10.26 |
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing | Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility. | APT blog | CISCO TALOS |
|
10.10.26 |
MATCHBOIL: New tricks, same old evil intentions | ESET Research catalogs the changes of UAC-0099’s MATCHBOIL downloader from 2024 to 2026 | Malware blog | Eset |
|
10.10.26 |
Inside a brand deal scam targeting YouTube creators | A plausible-sounding sponsorship offer could mask an attempt to compromise your Google account | Phishing blog | Eset |
|
10.10.26 |
The quest for simplicity: Why SMBs want advanced protection without the complexity | The cybersecurity market is often making it tougher for SMBs to keep threats at bay | Cyber blog | Eset |
|
10.10.26 |
Windows Exploitation Techniques: Dangling COM Object Registrations | This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. | Vulnerebility blog | PROJECT ZERO |
|
8.10.26 |
Q3 2026 Open Source Malware Index: When Compromise Compounds | In the third quarter of 2026, Sonatype identified 149,329 malicious open source packages across ecosystems, bringing the total logged since tracking began in 2017 to 1,960,846. | Malware blog | SONETYPE |
|
8.10.26 |
CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD | NOTE: This is an analysis of the artifacts and samples found during the hunt of SLAPSHOT, WHIPSHOT which is a Python tunneler used to proxy traffic into internal networks. The analysis is done using various AI Models and if you find any irrelevancy, please do report directly. This article is intended for Network Defenders, Threat Analysts, SOC and IT Administrators. | Exploit blog | THE RAVEN FILE |
|
8.10.26 |
AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage | An AI tool that produces only text carries roughly the risk of a badly worded email. A tool that can reach into systems and change things carries the risk of whatever those systems hold. The security question is not how clever the model is. It is which systems and data the model is authorized to access. | AI blog | ACRONIS |
|
8.10.26 |
Caught in 4K: The Gentlemen Files | A Russian-speaking Gentlemen ransomware affiliate called Azazel robbed two dozen victims across six countries, then double-crossed his own gang by publishing the loot on a private leak site and pocketing every dollar. | APT blog | CloudSEK |
|
8.10.26 |
How AI Is Changing the Roles Required in the Security Operations Center | As AI takes on more of the enrichment, correlation, and initial assessment inside the SOC, roles, skills, and KPIs still require deliberate redesign. Security leaders need to decide where automation is dependable, where human judgment should remain decisive, and how teams should be measured when alert handling is no longer the center of the operating model | AI blog | RAPID7 |
|
8.10.26 |
Rapid7 Named Among Notable Vendors in Forrester MDR Landscape: Why the Future is Exposure-informed, Preemptive MDR | The managed detection and response (MDR) market has reached a turning point. We’ve gone beyond the baseline of 24/7 monitoring focusing on the speed of detection and moved to a world with a convergence of exposure management and response to deliver measurable, outcome-based defenses of a larger, AI-driven attack surface. | Security blog | RAPID7 |
|
8.10.26 |
The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment | The surge in emerging threat actors directly correlates with the rapid escalation of victim counts and stolen financial resources. Simultaneously, this growth has spurred the proliferation of specialized supply storefronts across social media platforms, dark web channels, and various smaller niche marketplaces. | CyberCrime blog | RAPID7 |
|
8.10.26 |
SMTP is the key: BPFDoor and AVERAT hitting the network edge | Rapid7 tracked a set of Linux samples that blend into the software and device conventions of the telecom environments they target. The set spans a newly observed BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of a Linux implant we track as AVERAT, deployed against Taiwanese appliances. | Malware blog | RAPID7 |
|
8.10.26 |
Access Governance: Reducing Attacker Reach in the Age of AI-Accelerated Threats | AI is accelerating vulnerabilities and threats. Learn how to strengthen your organization's data security and access governance to reduce risks effectively with insights from Varonis and PwC. | AI blog | VARONIS |
|
8.10.26 |
Least Privilege for AI Agents: A Practical Guide for Security Leaders | Learn what it means to enforce least privilege for AI agents, and get practical with a six-step implementation plan. | AI blog | VARONIS |
|
8.10.26 |
Rogue AI Agents Abuse urlquery to extract Russian government data | We found additional activity and sandbox circumvention techniques used by rogue AI agent swarms. These include attempting to extract Russian government data, hijacking remote browser services and running Javascript in attempts to extend their capabilities, circumvent networking and sandbox restrictions, and complete their tasks. | AI blog | Zenity Labs |
|
8.10.26 |
How AI Agents Turned One Exposed Endpoint into a Server Takeover Threat Spotlight | ReliaQuest investigated an incident in which, for the first time, we identified an open-source AI agent orchestration platform running on the same IP address that launched the attack. We assess with high confidence that AI agents driven by large language models (LLMs) carried out substantial portions of it. | AI blog | RELIAQUEST |
|
8.10.26 |
5 SOC Pain Points Putting US Security Teams Under Pressure | US SOC teams are under pressure to detect and contain threats faster, but the real challenge is often not a lack of security solutions. It’s the growing amount of alerts, fragmented investigation data, evasive attack techniques, and the time analysts spend connecting the dots. | Security blog | ANYRUN BLOG |
|
8.10.26 |
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs | In September, Huntress observed a phishing campaign where threat actors abused legitimate Power BI domains to make their attack more convincing and evade security controls that trust the service. | Phishing blog | Huntress |
|
8.10.26 |
Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure Beyond the Published IOCs | On 31 August 2026 Group-IB described BraZetsu, a Python framework for Windows compiled with Nuitka, and attributed it with high confidence to the Brazilian actor Exilware. The same paper ties the binary to the Infected Marketplace (Banco de Infects), a shop that inventories compromised Windows hosts and sells the access after a deposit of about $5.80 (BRL 30), settled through NowPayments. | Malware blog | HUNT.IO |
|
7.10.26 |
Identity-aware AI data agents with AWS Lake Formation and Trusted Identity Propagation | You’re building a data agent that lets business users ask questions about lakehouse data in natural language. You’ve already built governance policies that control who can access which datasets. The challenge is making the agent respect those rules without rebuilding them in your application code. | AI blog | AWS Security Blog |
|
7.10.26 |
CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure | SOCRadar’s Threat Research Unit (STRU) has documented CyberXero, a Russian-speaking, financially motivated Initial Access Broker that pairs commodity offensive tooling with an AI orchestration layer running on its own infrastructure. | AI blog | SOCRADAR |
|
7.10.26 |
Investigate Threats Faster | Your SOC runs on Elastic. Detections, logs, cases and dashboards all live in Kibana, and your analysts have built their muscle memory around it. Then an impersonating domain, a leaked credential or a newly exposed asset shows up in a different console, and the investigation starts with a copy-paste. | Hacking blog | SOCRADAR |
|
7.10.26 |
How to mitigate shadow AI risks from employee citizen coders | AI tools let non-technical employees build workplace apps in minutes with natural language prompts. While these AI-generated apps boost productivity, they can create severe security and data risks. As Cybersecurity Awareness Month kicks off, we’re sharing how Tenable adopted a structured governance framework that allows our “citizen coders” to build secure and compliant apps with AI. | AI blog | Tenable® |
|
7.10.26 |
Claude Mythos: When Zero-Day Vulnerabilities Outpace Defenses | Advances in AI are reshaping the cybersecurity landscape in a fundamental way. Modern AI systems are no longer limited to detecting known threats. They are increasingly capable of uncovering previously unknown vulnerabilities buried deep within complex software and systems, including Zero Day vulnerabilities that can be found at lightning speed. | AI blog | FORESCOUT |
|
7.10.26 |
CrocoRat Adds a New Twist to ClickFix with DNS Payload Delivery | ClickFix campaigns have become one of the most effective ways to turn a browser session into code execution. The technique is simple: show the victim a fake verification page, place a command on the clipboard, and convince them to paste it into the Windows Run dialog. | Malware blog | Flare |
|
7.10.26 |
IronChain Ransomware Raises Business Data Loss Risk | During Cybersecurity Awareness Month, ransomware remains one of the clearest examples of how a cyber incident can become a business continuity issue. IronChain shows why. It puts business-critical data at risk of permanent loss and can bring operations to a halt. | Ransom blog | ANYRUN BLOG |
|
7.10.26 |
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack | In September, the Huntress agent was deployed on an organization that had been hit by an Akira ransomware attack. The post-compromise agent deployment limited Huntress visibility into critical pieces of evidence. | Ransom blog | Huntress |
|
7.10.26 |
Super Intelligence: The Rise of Super-Intelligent Threats | On September 29, 2026, the White House signed an executive order replacing the term "Artificial Intelligence" with "Super Intelligence" across the U.S. executive branch. The stated reasoning is that "Super Intelligence" better conveys "the true capabilities of the technologies being developed today", not merely imitating or automating human intelligence, but empowering citizens “to achieve what was previously impossible.” | AI blog | SEKOIA |
|
7.10.26 |
CVE-2026-88771: Citrix NetScaler Zero-Day Attack Clusters | As early as the beginning of September 2026, eSentire's Threat Response Unit (TRU) observed multiple threat actor clusters exploiting CVE-2026-88771, a zero-day vulnerability later disclosed in Citrix's September 27, 2026 security bulletin CTX697096. | Vulnerebility blog | eSentire |
|
6.10.26 |
47-Day TLS Certificates: 5 Steps to Prepare | Somewhere in your organization is a spreadsheet of certificate expiry dates, and someone who owns it. That is not a caricature. DigiCert’s 2026 research with Omdia surveyed more than 400 senior IT leaders and found that 47% still rely on manual tracking methods such as spreadsheets, and only 34% have a complete, current view of what they hold. | Security blog | Imperva |
|
6.10.26 |
Harvest Now, Decrypt Later: End-to-End PQC TLS | Somewhere, an attacker is recording your encrypted traffic. Not breaking it. Recording it. The bet is patient and simple: store ciphertext today, wait for quantum computers to mature, decrypt at leisure. The industry calls it harvest now, decrypt later (HNDL), and it is the rare security threat with a believable deadline attached: data with a ten-year shelf life, encrypted with algorithms on a countdown. | Security blog | Imperva |
|
6.10.26 |
New Remote DoS Attacks Against GraphQL Java | Imperva Threat Research identified a series of remote denial‑of‑service vulnerabilities in GraphQL Java, one of the most widely used libraries for GraphQL in the Java ecosystem. | Attack blog | Imperva |
|
6.10.26 |
The Hidden DoS Vector in SQL Parsers | SQL parsers are critical components of the modern data stack. They validate queries before they reach the database, transpile between dialects, and lint codebases for style violations. Increasingly, they also power AI-driven SQL generation in LLM-integrated data tools. | Attack blog | Imperva |
|
6.10.26 |
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage | This article explains how Elastic SIEM uses a monthly automated telemetry pipeline to score prebuilt detection rules across noise, performance, threat, and profile dimensions, helping security teams decide which rules to enable first. | Spam blog | Elastic Security Labs |
|
6.10.26 |
Machine-speed attacks require machine-speed prevention and detection | Artificial intelligence (AI) is transforming the way cyberattacks are handled. Reconnaissance has become faster, phishing is more convincing, and vulnerabilities are identified and exploited sooner, and after initial access, automation can accelerate privilege escalation, lateral movement, and data theft. | Hacking blog | Threatlocker |
|
6.10.26 |
IQUALIF Leak, IUT Breach, SMTP Dump and Struts Exploit | SOCRadar Dark Web Team identified several new underground posts, including an alleged IQUALIF-based French residential data leak, an alleged breach affecting IUT Paris Seine, and an alleged initial access auction for a U.S. manufacturing company. Other posts advertised an alleged 19 million SMTP credential dump and access to servers reportedly compromised through CVE-2017-5638. | Exploit blog | SOCRADAR |
|
6.10.26 |
FortiMail Zero-Day Under Active Exploitation | Fortinet has confirmed that CVE-2026-104286, a critical path traversal flaw in FortiMail, is being exploited in zero-day attacks, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on the same day the advisory went live. | Exploit blog | SOCRADAR |
|
6.10.26 |
CVE-2026-90970: GitLab AI Gateway RCE | GitLab has patched CVE-2026-90970, a critical vulnerability in the Self-Hosted AI Gateway that can allow an authenticated user with Duo Agent Platform access to execute arbitrary commands on the gateway. | Vulnerebility blog | SOCRADAR |
|
6.10.26 |
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure | How ClingSTUN combines vulnerability exploitation, persistence, and STUN-assisted connectivity on Linux devices | Malware blog | FortiGuard Labs |
|
3.10.26 |
AI-Enabled Cyber Attacks: What They Are and How to Defend Against Them | AI-enabled cyber attacks are malicious operations in which adversaries use AI, most often large language models (LLMs), to plan, carry out, or scale any part of an attack. That includes writing phishing lures and deepfake pretexts, developing and debugging malware, discovering and exploiting vulnerabilities, and running intrusions end to end. | AI blog | PICUSSECURITY |
|
3.10.26 |
CrowdSec Bot Detection Uncovers a 75,000-IP Bot Network | On the 31st of August, we released CrowdSec 1.8.0 that included the bot detection feature. Despite the fact that the feature was (is) still tagged as alpha, some mad lads promptly slapped it on their production infrastructure. Thanks for the trust! | BotNet blog | CROWDSEC |
|
3.10.26 |
AI-Agentic attacks Optimized Operations | AI is changing cyberattacks from isolated activities into connected operations that require a new level of speed, context, and understanding. | AI blog | WatchGuard Blog |
|
3.10.26 |
PolinRider is A/B Testing its Way Past Your Detections | We've seen fa-solid-400.woff2 become 500 and 900, change from .woff2 to .llf files, move folders, and drop its whitespace padding. | Malware blog | OpenSource Malware Blog |
|
3.10.26 |
Prompt Forcing: The Scarier Sibling of Prompt Injection | Breaking down a newly discovered prompt attack technique that isn't prompt injection. | AI blog | Forever Security |
|
3.10.26 |
Introducing the SysQL Skill: Ask your security graph anything | Dashboards answer the questions someone already decided to build a screen for. Every other question — the one a new CVE just made urgent, or the one no vendor anticipated — waits until someone writes a report or files a ticket. | Vulnerebility blog | Sysdig |
|
3.10.26 |
Swarming Against Citrix 0-Day Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | Exploit blog | GREYNOISE |
|
3.10.26 |
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | Exploit blog | GREYNOISE |
|
3.10.26 |
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | AI blog | GREYNOISE |
|
3.10.26 |
Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets | GreyNoise is observing automated scanners posing as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies. These forged automated scanners have been observed requesting files often exposed on misconfigured web servers and by other commonly leaked secret and credential methods. | AI blog | GREYNOISE |
|
3.10.26 |
Separating Signal from Slop: Triaging CVEs in the Age of… | Tools that can read a codebase, identify a vulnerability, and generate a working proof-of-concept have lowered the skill floor for vulnerability research. They also produce a wave of bugs that look terrifying on paper (remote code execution, popular software, no authentication,) yet they often depend on a configuration rarely enabled in real deployments. | Vulnerebility blog | Bishop Fox |
|
3.10.26 |
One Port to Root: Weaponizing Check Point Management… | The Check Point management server is the brain of a Check Point firewall estate: it holds the policy every gateway enforces, the administrator credentials, and the certificate authority the whole deployment trusts. A flaw already used in real attacks lets anyone who can reach that server take it over completely without logging in. | Vulnerebility blog | Bishop Fox |
|
3.10.26 |
AI-Assisted Attacks Still Leave a Behavioral Trace | AI is increasingly being used to accelerate cyber-attacks, but attackers still leave detectable behavioral traces. This blog explores how Darktrace identified suspicious file delivery, command-and-control communications, beaconing activity, and other anomalies linked to AI-assisted campaigns through behavioral analysis. | AI blog | DARKTRACE |
|
3.10.26 |
DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm - Real-time Open Source Software Supply Chain Security | Nine npm packages hide a self-spreading Linux worm. The npm account dirtyblanket published all nine on September 29, 2026, in 33 minutes. Eight of them copy the popular Express framework. One copies React. | Malware blog | SAFEDEP.IO |
|
3.10.26 |
PolinRider Switches to Ethereum C2 in 30+ Repositories - Real-time Open Source Software Supply Chain Security | The PolinRider loader family has a new way to find its command and control (C2) servers. It reads Ethereum mainnet and looks for small transactions from an operator wallet. The recipient address of each transaction holds the IP address of a C2 server. SafeDep found two operator wallets that use this method. One wallet has sent a transaction about every 51 minutes since 2026-06-23. | Cryptocurrency blog | NETCRAFT |
|
3.10.26 |
'Super Intelligence' Executive Order Fuels Nearly Hundredfold Increase in .si Domain Registrations | We previously reported that registrations of Slovenian .si domains overtook .ai in the 25 hours after President Trump told the UN General Assembly on September 22 that the U.S. would call AI “super intelligence” (SI). | AI blog | NETCRAFT |
|
3.10.26 |
FinCEN Moves to Cut the A7 Network's Sub-Agents Off From the US Financial System | FinCEN issued a finding and NPRM today identifying transactions involving any non-US company controlled by the A7 Network, which the agency calls "Sub-Agents," as a class of transactions of primary money laundering concern. The proposed rule would prohibit every covered US financial institution from sending or receiving funds or crypto involving a Sub-Agent. | AI blog | TRM Labs |
|
3.10.26 |
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail | In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. | OS Blog | IDNSEC |
|
3.10.26 |
CVE-2026-86950: The Great Glyph Grift | Apple recently released iOS 26.7.1 to fix a bug in CoreGraphics (CVE-2026-86950). The security advisory stated that the vulnerability was reported by Meta Product Security and "may have been exploited in an extremely sophisticated attack against specific targeted individuals." For those who are unfamiliar with Apple’s English dialect, it means that the bug was actually exploited in the wild. | Vulnerebility blog | Calif |
|
3.10.26 |
Crypto Scam Extensions Masquerade as High-Profile Investors | LayerX security researchers (now part of Akamai) uncovered a campaign of nearly 30 malicious browser extensions designed to scam cryptocurrency investors by masquerading as legitimate, high-profile financial and/or cryptocurrency investors such as Warren Buffett, Andy Kreiger, Thomas Bulkowski, and others. | Spam blog | Akamai |
|
3.10.26 |
When Productivity Extensions Become Attack Platforms | LayerX Research (now part of Akamai) discovered a coordinated campaign of 32 malicious browser extensions across the Chrome Web Store and Microsoft Edge Add-ons Store, affecting more than 6,150 users. | Security blog | Akamai |
|
3.10.26 |
Beyond Vendor Assessments: Managing Third-Party Risk | Software supply chain security has a well-defined starting line. It has no finish line, even though most programs are built as if it does. | Cyber blog | JSCRAMBLE |
|
3.10.26 |
Aligning AI Speed with AI Trust: AI Agent Security Insights for CISOs and Security Leaders | AI agent security is the practice of governing two separate things: what an autonomous AI system is allowed to reach, and what it is allowed to do. Most enterprises have built a program for the first one. Almost nobody has built one for the second, and that's where the losses are starting to show up. | AI blog | Morphisec Blog |
|
3.10.26 |
From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat | RATHat's Android malware remained largely static from late 2025 to September 2026, while its Command-and-Control (C2) panel was replaced entirely and went through three generations in six months, rebranded from BlackCat to Panda Workshop. | Malware blog | Cleafy |
|
3.10.26 |
TIKTOUK: Tracing a WordPress Credential Collection Toolkit | TIKTOUK brings together WordPress probing, collection of exposed configuration data, recovery of encrypted email credentials, and JavaScript secret scanning. Its two Python components and Go-based Linux crawler turn website responses into structured results for a central hub: an HTTP service that distributes target tasks and receives collected data and status reports. | Hacking blog | LEVELBLUE |
|
3.10.26 |
Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators | CVE-2026-88771 is a critical pre-authentication command-injection vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. Citrix and security researchers have already documented the vulnerability and its underlying exploitation mechanism. This analysis focuses instead on exploitation activity identified by LevelBlue's Threat Hunt Operations & Research (THOR) team while hunting across multiple customer environments. | Vulnerebility blog | LEVELBLUE |
|
3.10.26 |
Citrix NetScaler Zero-Day Exploited Globally | On Sept 27, Citrix released patches for two critical vulnerabilities being exploited in the wild. Based on current information, we confirm there has been no exposure or impact to LevelBlue or our clients. CISA has already added these vulnerabilities to the Known Exploited Vulnerabilities (KEV) list. | Vulnerebility blog | LEVELBLUE |
|
3.10.26 |
Hackers exploit FortiMail zero-day before a patch exists | Fortinet says attackers are already exploiting a critical flaw in FortiMail, its email security gateway, and the fixed software has not shipped yet. The bug, tracked as CVE-2026-104286 and rated 9.8 on CVSS v3, lets an attacker with no login write arbitrary files to the appliance using crafted HTTP or HTTPS requests. Fortinet rates its impact as executing unauthorized code or commands. | Vulnerebility blog | IntelFusions |
|
3.10.26 |
Introducing Cloudflare Basin: an open, serverless data platform, now generally available | During Birthday Week 2025, we announced the Cloudflare Data Platform, a suite of products that ingest, store, and query your analytical data. Today, we’re announcing that the platform is generally available, and we’re giving it a new name: Cloudflare Basin. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Introducing Clef: our open-source decision models, and new RL fine-tuning platform | Over the last few weeks, there has been lots of buzz around decision models such as Typesafe AI’s Jev System One model. While classifier models have been around for some time, Jev introduces a new decision model concept into the world of AI — a model that produces bounded structured outputs cheaply, quickly and consistently that can be added into a workflow when a decision is required. | AI blog | CLOUDFLARE |
|
3.10.26 |
One year later: Sovereign AI and the fight for choice | It's Birthday Week, when we traditionally ship presents to the Internet. This year, two of them come from Europe: EuroLLM, which covers all 24 official EU languages, and Apertus, Switzerland's fully open model, trained on more than 1,500 languages. Both were built by public universities and research institutions. Both are coming to Workers AI, and you can request access today. | AI blog | CLOUDFLARE |
|
3.10.26 |
Introducing Workers KV Instant — powered by Quicksilver | Today, we’re introducing Workers KV Instant, a new mode for Workers KV that pushes your changes globally for instant availability without cold read penalties. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Cloudflare OS: your company’s agent workspace, managed for you | Cloudflare OS gives everyone in your organization an agent workspace that knows how your company works and connects to its data and systems. Today, we're opening the waitlist for fully managed Cloudflare OS deployments. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Announcing Cloudflare K2: serverless event streams | With traditional Remote Procedure Call (RPC) architectures, there exists a core challenge: producers and consumers must align in scale and in time. If your producers send too much data for your consumers to handle or if your consumers or downstream services become unavailable, events are dropped. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
We want you to build the next Git platform on Cloudflare | GitHub was built for a world where humans write code, organize it into repositories, and collaborate through branches, commits, issues, and pull requests. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
AI Search is now generally available | Cloudflare’s AI Search combines Workers AI, Vectorize, R2, and Browser Run into a fully managed index and retrieval pipeline. Since we launched AI Search over a year ago, we’ve seen developers use it to power a wide range of search use cases, from searching internal documentation to powering search for their websites. We use AI Search ourselves to power search on our own blog and developer docs. | AI blog | CLOUDFLARE |
|
3.10.26 |
Support for modern cryptographic algorithms in Workers | Today, Cloudflare Workers is adding support for post-quantum-resistant algorithms within Web Crypto. These are defined in Modern Algorithms in the Web Cryptography API draft community group report, and include: | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Cloudflare Impact reaches $100 million in donations | This week, Cloudflare's Impact programs will reach $100 million in donated services. It's a significant milestone, and one that we are proud of because it means that thousands of organizations, like journalism outlets, civil society, state and local governments, election management bodies, and public schools are being protected from cyberattacks. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Cut your AI spend with AI Gateway's Auto Router | From our conversations with companies at every stage of their AI adoption journey, we've seen some common patterns. First, there is an exploration period as you bring on every new tool, dole out API keys freely, and let the tokens flow. Then, you converge on the canonical tools for your organization for agentic coding, for non-technical workflows, for running and deploying agents. | AI blog | CLOUDFLARE |
|
3.10.26 |
Detect and send production issues straight to your agent | As agents help us build more complex applications, both humans and agents need a better way to stay on top of what goes wrong in production. Coding agents can already query observability data, navigate a repository, change code, write tests, and open a pull request. | AI blog | CLOUDFLARE |
|
3.10.26 |
Simplifying domains for people and agents | You just thought of your next great idea, and buying the right domain feels like the easiest way to make that first bit of progress. Naturally, you open a new tab in your browser, only to find yourself face-to-face with an experience that feels like a budget airline peppering you with add-ons at checkout: Want security? How about a website? Do you want email? You’re just a few minutes into building your next idea, and it doesn’t feel fun anymore. | AI blog | CLOUDFLARE |
|
3.10.26 |
Monetization Gateway beta: charge AI agents for consumption with HTTP 402 | Today, we’re making the Cloudflare Monetization Gateway available as part of a closed beta, and showcasing four customer use cases that are in production today. Since we announced the plan three months ago, we have been working closely with our customers to make the Gateway fast, flexible, and easy to use. | AI blog | CLOUDFLARE |
|
3.10.26 |
Pay Per Use: when AI uses your work, you should get paid | AI answer engines read a publisher’s page and hand the reader a summary, so the visit, and the revenue that would come with it, never happens. Most publishers will never sign a licensing deal with the companies that use their work in AI products, and no company can negotiate with millions of sites. The web needs a way to say “yes, if you pay.” Pay Per Use is one way to say it, and it's now in beta. | AI blog | CLOUDFLARE |
|
3.10.26 |
Spetsvuzavtomatika Leak Exposes an SVR Cyber Development Ecosystem | The Spetsvuzavtomatika leak found on the darknet exposes a broad Russian cyber research and development program, with seven named projects defining its work. Two of the projects, Felix-23 and HAD, focus on target discovery, scanning, enrichment, and active testing. Another project, Putnik, supports internal-network access and credential theft. | CyberCrime blog | DomainTools Investigations |
|
3.10.26 |
AI Security Strategy: 6 Steps for CISOs | Security teams are used to vetting technology before it arrives. With AI, it was already everywhere before anyone asked them. | AI blog | Abnormal AI |
|
3.10.26 |
Signatures Are the Floor, Not the Ceiling | See why signature-based detection struggles against AI-generated attacks and how behavioral AI uses embeddings to detect novel threats without relying on known indicators. | AI blog | Abnormal AI |
|
3.10.26 |
How Behavioral AI Detects Threats That Look Normal | Attackers are no longer breaking in but blending in, mimicking normal behavior to breach organizations. A founding Abnormal AI engineer explains why we bet on behavioral AI to stop attackers walking through the front door. | AI blog | Abnormal AI |
|
3.10.26 |
XCTDH Adopts Hash Hiding | A blockchain-based C2 technique discovered in the XCTDH campaign's September 2026 evolution, where C2 addresses are steganographically encoded in Ethereum transaction destination addresses. | Cryptocurrency blog | Ransom-ISAC |
|
3.10.26 |
September 2026 Security Release | An attacker-controlled, allow-listed remote URL can lead to Server-Side Request Forgery (for example to private IP ranges) during Image Optimization. If no images.remotePatterns are configured, your application is not affected. | Security blog | Next.js |
|
3.10.26 |
Beyond Model Alignment: Securing Every Layer of the AI Agent | Alignment makes a model well-intentioned, but it can’t secure the harness, tools, and data an agent touches in production. Real agent security means governing every layer with enforcement the agent itself can’t switch off. | AI blog | Trend Micro |
|
3.10.26 |
ShinyHunters Returns to PeopleSoft With a One-Character WAF Bypass | ShinyHunters is once again exploiting a previously patched vulnerability in PeopleSoft, which we analyzed in June 2026. | Incident blog | Trend Micro |
|
3.10.26 |
Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes | Compromised MemTensor npm releases turn an AI memory plugin into a credential-harvesting entry point, exposing prompts and creating a path to further package compromise. | Malware blog | StepSecurity |
|
3.10.26 |
Managing Agentic AI: Why the Control Plane Problem Is an AI Problem | On one hand, it’s somewhat befuddling how often people may need that reminder. In reality, it is not that they don’t know that happy mantra, it’s that they struggle to gain the requisite visibility into … everything in their IT and OT environments. | AI blog | GUIDESECURITY |
|
3.10.26 |
Cloud Security Assessments: Set the Right Cadence | While cloud practitioners are accustomed to their fast-moving environments, it’s still common practice to move on to the next priority after the cloud assessment report is delivered and the major findings get remediated. | Cyber blog | GUIDESECURITY |
|
3.10.26 |
New Report from Rapid7 Labs: Why Q2 2026 signals the end of traditional patch cycles | The latest Quarterly Threat Landscape Report from Rapid7 Labs shows vulnerability disclosures still surging while attackers use automation and AI-assisted tooling to compress the time between disclosure and exploitation. The gap that patch cycles were built to fill is closing. Speed and volume are overwhelming security teams that have relied on traditional patch cycles and reactive programs. | Cyber blog | RAPID7 |
|
3.10.26 |
Why One-Time Approval Fails for AI Agent Skills | A review answers one question, once: is this skill, MCP server or plugin allowed in? It never asks again, whether it took six weeks in a ticket queue or six minutes in a governance tool. | AI blog | Manifold |
|
3.10.26 |
Spanish Carding Tutorial: How Fraudsters Think | A 2,200-word tutorial titled “Complete Guide to Carding in Spain (2026)” appeared on the Carder Market forum in April 2026. It is exactly what it sounds like: a beginner’s playbook for credit card fraud targeting the Spanish market, complete with entry fees, expected returns, and step-by-step operational workflows (we are holding back specific names and techniques to execute attacks to prevent these from falling into those with malicious intentions). | CyberCrime blog | FLARE.IO |
|
3.10.26 |
Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504) | On Wednesday, September 30, Cisco dropped an out-of-band security advisory highlighting CVE-2026-76504, a brand new critical authentication bypass in the SD-WAN vManage line of products that was disclosed as an exploited zero-day vulnerability. | Vulnerebility blog | VULNCHECK |
|
3.10.26 |
JCTables for Joomla: When "Already Escaped" Means Injectable | Today VulnCheck is disclosing CVE-2026-76570, an unauthenticated arbitrary SQL read and write in JCTables, the Joomla data-table component published by JoomCode, that chains to remote code execution as the web user. It is being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy. | Vulnerebility blog | VULNCHECK |
|
3.10.26 |
CVE-2026-86950: Apple CoreGraphics Zero-Day | Apple has issued an urgent security patch for CVE-2026-86950, a critical zero-day out-of-bounds write vulnerability in CoreGraphics that enables arbitrary code execution via malicious files. Exploited in targeted, highly sophisticated attacks against specific individuals, this flaw presents an immediate threat across affected Apple platforms. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
CVE-2026-76504: Cisco SD-WAN Flaw Exploited | Cisco has disclosed CVE-2026-76504, a critical authentication bypass vulnerability in Catalyst SD-WAN Manager, formerly known as vManage. The flaw allows an unauthenticated remote attacker to access the management API with administrator privileges. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
TeamViewer Fixes Five Remote Access Flaws | TeamViewer has patched five high-severity vulnerabilities in its Full Client and Host applications for Windows, Linux, and macOS. The flaws include local privilege escalation, potential code execution, and remote session access control bypass. The company strongly recommends that all users update to the latest available version as soon as possible. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
Gotta Breach 'Em All! The Journey Of ShinyHunters | ShinyHunters has outlasted forum takedowns, multiple arrests, and its own founders' convictions. This report traces six years of activity and tactical evolution. From stolen S3 buckets to zero-day exploits, we attempted to explain why the brand keeps surviving what should have ended it. | Cyber blog | SEKOIA |
|
3.10.26 |
The New Rules of Patching: When a Fix Becomes a Blueprint for Attackers | TL;DR: Frontier AI has collapsed the vulnerability exploit window from weeks to mere hours. Attackers now use advanced AI models to reverse-engineer published fixes and generate working exploits faster than human security teams can deploy updates. In the AI era, publishing a patch creates a blueprint for attackers. Surviving this threat requires vendors to tier sensitive disclosures and customers to treat patch application speed as a critical security metric. | AI blog | JFROG |
|
3.10.26 |
ANY.RUN's Threat Coverage Digest: September 2026 | September saw an expansion of detection coverage across network, file, and behavioral activity, providing analysts with additional visibility into suspicious activity. ANY.RUN added 76 behavior signatures, 16 YARA detections, and 1,098 Suricata rules, strengthening coverage across malware activity, suspicious files, and network communications. | Cyber blog | ANYRUN BLOG |
|
3.10.26 |
Copilot has the largest AI attack surface of any tool we tracked | Microsoft Copilot accounts for a disproportionate share of the AI footprint we track, and it’s barely being used. It’s a massive attack surface featuring a minuscule rate of activity. | AI blog | ThreatDown |
|
3.10.26 |
Milk Dragon: Huge Discounts on Social Media? Think Twice Before You Buy | Milk Dragon, also known as NaiLong is an Adversary-in-the-Middle (AiTM) phishing kit active since October 2025. Unlike conventional phishing tactics that rely on fear and urgency, Milk Dragon lures victims with big discounts on consumer goods distributed via Facebook and TikTok marketplace advertisements. | Phishing blog | GROUP-IB |
|
3.10.26 |
Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino | Group-IB descubre BraZetsu, un nuevo malware para Windows basado en Python que funciona como un toolkit maestro para Initial Access Brokers y potencia un marketplace clandestino único, mejorado con IA, para comercializar objetivos comprometidos en Iberoamérica y Latinoamérica. | Malware blog | GROUP-IB |
|
3.10.26 |
Your State’s Scam Reality: What New Research Reveals Across All 50 States | A package notification arrives, and we stop to check whether we actually ordered something. A recruiter reaches out about a job, but before replying, we research the person and the company. A bank alert appears, and instead of tapping the link, we open the banking app ourselves. | Spam blog | McAfee Blog |
|
3.10.26 |
ClickFix Attacks: How They Work and How CrowdStrike Stops Them | Consider this hypothetical scenario: An employee tries to join what looks like a routine video meeting. The page loads, but instead of the meeting, they see an error message along with a helpful fix: Copy the provided command, open the Windows Run dialog, paste it, and press Enter. | Hacking blog | CROWDSTRIKE |
|
3.10.26 |
CrowdStrike Expands Federal SOC Modernization via CISA-Funded SIEMaaS | Falcon Next-Gen SIEM is now part of CISA’s SIEMaaS technology stack, which gives eligible agencies a funded path to modernize security through the CDM DEFEND F shared service. | Cyber blog | CROWDSTRIKE |
|
3.10.26 |
CrowdStrike and NVIDIA Extend Security Across the AI Stack | CrowdStrike and NVIDIA are collaborating on the NVIDIA Open Agent Safety Platform, an open reference design to extend security deeper into the agentic stack and establish stronger boundaries for autonomous AI. | AI blog | CROWDSTRIKE |
|
3.10.26 |
Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation | On September 27, 2026, Citrix disclosed eight vulnerabilities affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. Two of these vulnerabilities are critical (CVSS score of 9.5) and can allow an unauthenticated remote attacker to execute code: | Vulnerebility blog | SOPHOS |
|
3.10.26 |
TerminalFix and Lorem Ipsum Loader enable covert tunneling | The activity is linked to a broader campaign that previously used a different delivery mechanism | CyberCrime blog | SOPHOS |
|
3.10.26 |
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI | Since the release of our May 2026 report detailing adversarial misuse of artificial intelligence (AI), Google Threat Intelligence Group (GTIG) has observed forward leaning adversaries transition from basic prompting to agentic AI workflows and AI-enabled automation. In these operations, human-in-the-loop latency is dramatically reduced, compressing the traditional window for defenders to respond. | AI blog | Google Cloud Blog |
|
3.10.26 |
NVIDIA and Eclypsium Partner for Trusted AI Infrastructure | AI agents are moving from answering questions to taking action. They can read sensitive data, call APIs, write and execute code, use external tools, and coordinate with other agents. In some environments, their decisions may affect physical systems. | AI blog | Trend Micro |
|
3.10.26 |
Inside DragonForce: How a Ransomware Cartel's Payload Actually Runs | DragonForce is a Ransomware-as-a-Service (RaaS) operation that first surfaced in mid-to-late 2023. It initially presented itself as a hacktivist collective before shifting to a profit-driven model. Early payloads were built on leaked LockBit 3.0 source code and later supplemented with code derived from the leaked Conti builder. | Ransom blog | Seqrite |
|
3.10.26 |
Telecom Attack Surface: SS7, BGP & Nation-State Intrusions | SS7 and BGP were built on trust. Here's how nation-state actors exploit that trust, and telecom routers, to stay inside carrier networks for years. | Hacking blog | Cyble |
|
3.10.26 |
Attack Surface Management 2026: Why Point-in-Time Scans Fail | Quarterly scans leave cloud exposures hidden for months. Learn why CISA and FBI data now make continuous attack surface management essential in 2026. | Cyber blog | Cyble |
|
3.10.26 |
Your IP, Their Traffic | You install an app that offers a reward, a premium feature or perhaps a little money in exchange for sharing some of your unused internet bandwidth. It sounds harmless enough. Your connection is idle most of the time anyway. | Cyber blog | GENDIGITAL |
|
3.10.26 |
Warlock Ransomware Attackers Hit Water and Telecom Operators | China-nexus group behind Warlock is still exploiting SharePoint vulnerabilities, attacking organizations in Portuguese and Spanish-speaking countries, hitting critical infrastructure, government, and education organizations. | Ransom blog | SECURITY.COM |
|
3.10.26 |
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 | Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path. Exploitation can be triggered by a specially crafted email against internet-facing Zimbra servers when the optional zimbra-snmp package is installed and SNMP notifications are enabled, without requiring authentication or user interaction. | Vulnerebility blog | Microsoft blog |
|
3.10.26 |
Phishing Abuses RMM Tools for Persistent Access | In July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed a masqueraded MSP360 Remote Monitoring and Management (RMM) installer through meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. | Phishing blog | Microsoft blog |
|
3.10.26 |
Safely Securing AI Agents | Learn of the benefits of safely securing AI agents. | AI blog | Trend Micro |
|
3.10.26 |
IBM Langflow OSS Unauthenticated RCE - CVE-2026-9198 | The SonicWall Capture Labs threat research team became aware of an Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation in Langflow AI, assessed its impact and developed mitigation measures. Langflow AI is a Python-based web application that provides a visual interface to build AI-driven agents and workflows. | Vulnerebility blog | SonicWall |
|
3.10.26 |
SmokeLoader Malware: A Modular Threat with Advanced Evasion and Persistence | This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of SmokeLoader malware. This is a modular program used by a variety of criminal and APT groups to gain a foothold on a system. It has vigorous anti-VM, anti-AV, and anti-analysis checks and capabilities. SmokeLoader can be used with RATs, ransomware, backdoors or botnets and uses both file and fileless methods of persistence. | Malware blog | SonicWall |
|
3.10.26 |
VioletRAT v6.5: From .NET Loader to In-Memory RAT — A Deep Dive into the Infection Chain | Recently, the SonicWall Capture Labs Threat Research Team discovered a sophisticated multi-stage .NET malware campaign that delivers VioletRAT v6.5 through a heavily obfuscated infection chain. The malware uses multiple .NET loader stages, an obfuscated batch script, in-memory assembly loading, and process injection into Msbuild.exe before executing the final VioletRAT payload. | Malware blog | SonicWall |
|
3.10.26 |
OperTraitors: How Kubernetes Operators Betray Your Security Posture | Kubernetes operators are coded to drastically reduce operational toil by acting as automated site reliability engineers. However, their reliance on highly privileged service accounts introduces a severe, often overlooked security weak spot. | Hacking blog | Palo Alto |
|
3.10.26 |
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) | Unit 42 is aware of possible zero-day activity against NetScaler devices. In a Citrix report that details several CVEs, they noted that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. The threat actors exploited these vulnerabilities to deliver web shells and establish their initial access and persistence into organizations. Analysis is ongoing to determine any post-compromise activity. | Vulnerebility blog | Palo Alto |
|
3.10.26 |
The Fine Art of Frustrating the Adversary | For Cybersecurity Awareness Month, eight Cisco Talos researchers share practical ways defenders can frustrate adversaries at different stages of an operation. | Cyber blog | CISCO TALOS |
|
3.10.26 |
Give yourself room to be human | Fall is officially here in Maryland, and I can’t be more relieved. I flourish in 50 degree weather, where it feels natural to burrow under blankets, knit sweaters, and listen to an audiobook. | Cyber blog | CISCO TALOS |
|
3.10.26 |
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor | Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as “Antino” in developer artifacts. | APT blog | CISCO TALOS |
|
3.10.26 |
Securing the keys to the kingdom: Announcing Executive Threat Detection | Attackers are using greater sophistication to gain access to high-yield targets like executives, and company-wide security measures can easily miss these subtle, personal attacks. | Cyber blog | CISCO TALOS |
|
3.10.26 |
Trust and the enticing consultancy offer | In the cybersecurity industry, trust is the invisible currency. Every practitioner carries the implicit trust not to abuse privileged access or knowledge of vulnerabilities in each employment or engagement. This trust is valued by those who require our services, but also by threat actors. | Vulnerebility blog | CISCO TALOS |
|
3.10.26 |
The Closed Quorum: Inside the first reported autonomous AI C2 implant | CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025. | AI blog | CISCO TALOS |
|
3.10.26 |
This month in security with Tony Anscombe – September 2026 edition | Autonomous AI agents go on a hacking spree, and Microsoft ships what used to be a year's worth of security patches in one go – here's how to keep pace | Cyber blog | Eset |
|
3.10.26 |
Timeshare exit scams: From fake buyers to recovery scams | Con artists are targeting timeshare owners who want out – and some victims are hit twice | Spam blog | Eset |
|
3.10.26 |
The devil is still in the email – but wearing a new mask | When phishing can increasingly pass familiar checks, avoiding or limiting the damage depends on how quickly your company can detect and contain the attack | Spam blog | Eset |
|
3.10.26 |
Is that new (vibe coded) app safe? 5 questions to ask first | As AI lets anyone build software, here’s how to vet that shiny new app before it exposes your data | Cyber blog | Eset |