← All threat briefs

Daily Cybersecurity Brief — 2026-10-18

SECURITY // 2026-10-18

Daily Cybersecurity Brief — 2026-10-18

High-Signal Security Journalism

  • Biomemory Launches DNA Shield, First Commercial Product Built on Its Molecular IT Platform — The launch follows the acquisition of catalog's assets and the appointment of Laurent Guengant as CEO earlier this year. (Source: Dark Reading)
  • Varonis is joining Proofpoint — Today, we announced a definitive agreement under which Varonis will be acquired by Proofpoint, a global leader in human and agent security. This is a testament to the incredible work of the Varonis team over two decades, and the start of a new chapter that will redefine how the industry protects people, data, and AI. More than two decades ago, we started Varonis with a simple belief: it’s all about the data. You can’t protect your organization unless you can protect your most critical informatio... (Source: Varonis Blog)
  • India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1 — The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with their numbers for incoming calls starting November 1, 2026, in an effort to help people identify calls from unknown numbers and tackle spam or fraudulent calls. To that end, the Department of Telecommunications has issued a circular urging service (Source: The Hacker News)

Threat Intelligence & Malware Analysis

  • ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants — ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise (Source: The Hacker News)
  • MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon — Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of (Source: The Hacker News)
  • Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants — Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs (Source: The Hacker News)
  • How SentinelOne Blocked APT29's CaptiveCrunch Campaign — Once the corporate network stopped being defensible, the control had to move to the device, as SentinelOne® has long argued.That move carried one assumption with it. Wherever the laptop sits, name resolution tells it the truth and the agent can reach its own cloud. Almost nothing in the stack checks either half.In July 2026, Microsoft disclosed a campaign that breaks both and named it CaptiveCrunch. A captive portal is the sign-in page a public Wi-Fi network pushes in front of you before it lets... (Source: SentinelOne Blog)
  • The Good, the Bad and the Ugly in Cybersecurity - Week 42 (2026) — The Good | Authorities Arrest Cyber Exec for Extortion & Dismantle DPRK Laptop FarmsThe FBI arrested Edward Dubrovsky, a Canadian former cybersecurity executive at incident response and ransomware negotiation firm CYPFER, on charges of conspiracy and extortion. Various reports have linked the arrest to the FBI’s continued crackdown on the ShinyHunters extortion group and their alleged compromise of the FBI’s job portal back in September. While Dubrovsky has not been officially named a ShinyHunte... (Source: SentinelOne Blog)
  • Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor — Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis (Source: The Hacker News)
  • UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing — Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The activity is being tracked by (Source: The Hacker News)
  • When Your Ransomware Negotiator Works for the Other Side — The shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight. (Source: Dark Reading)
  • DDoS attacks can knock services offline before links reach capacity — More than 9.1 million DDoS attacks were recorded globally between January and June 2026, an increase of nearly a quarter year over year, according to Netscout’s DDoS Threat Intelligence Report. Large attacks and distributed targeting strain defenses Attacks exceeding 1 Tbps or 1 Gpps increased 1,286% year over year. Much of that growth came from botnet operators associated with Aisuru, Kimwolf, Jackskid, and their successors. That means attackers need fewer devices to launch large attacks. … Mor... (Source: Help Net Security)
  • AI-Powered Espionage Campaign Targets Government Linux Infrastructure — Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft. The post AI-Powered Espionage Campaign Targets Government Linux Infrastructure appeared first on Unit 42. (Source: Unit 42)

Vulnerabilities & Exploits

  • Frozen Privilege: Remote Code Execution in Snowflake-Managed PostgreSQL — Varonis Threat Labs uncovered a remote code execution (RCE) vulnerability in Snowflake-managed PostgreSQL that turns an ordinary database privilege into control of the underlying server by chaining together legitimate features. The security risk extends beyond a single database bug. Our research shows how trusted, managed cloud services can still contain hidden privilege chains that bypass customer-visible logging, undermine data integrity, and create attack paths beneath the layer security team... (Source: Varonis Blog)
  • BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs — Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group. (Source: Dark Reading)
  • Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug — A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections.Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped (Source: The Hacker News)
  • Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 — Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42. (Source: Unit 42)
  • Scammers clone candidates’ voices to steal cash and voter data ahead of 2026 midterms, FBI warns — Three weeks before Americans vote in the 2026 midterm election, fraudsters are borrowing candidate names, logos and slogans to collect fake donations and harvest personal data, the FBI warned. “The FBI warns the public that scammers could exploit the 2026 US Midterm Election to perpetrate financial fraud schemes,” reads the public service announcement, which adds that these schemes target victims throughout the country and “have previously exploited state and local elections.” The alert updates ... (Source: Help Net Security)
  • Fake Arch Linux AUR packages exploit typos to run malware with root privileges — Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR is a popular community package source for Arch Linux and related distributions, hosting user-submitted build scripts for proprietary programs, beta builds and older software versions that the official repositories do not carry. Yay and paru, known as AUR helpers, search the AUR for software and … More → The post Fake Arch L... (Source: Help Net Security)
  • Android adds AI-powered scam alerts, hangs up on bank impostors — Google’s new scam protections cover Google Messages and third-party messaging apps, with an enhanced protection mode, expanded scam alerts and safeguards against call-forwarding and screen-sharing scams. “With scams growing harder to spot, it’s nearly impossible for users to catch every red flag themselves. That’s why Android’s built-in defenses actively intercept these threats before they reach you,” Alberto Pastor Nieto, Senior Product Manager at Google Messages, and Shaifali Bhandari, Product... (Source: Help Net Security)
  • China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers — The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a (Source: The Hacker News)
  • The cyber talent shortage? Job postings just hit a four-year low — US employers posted 235,786 cybersecurity jobs from January through September 2026. That is the lowest total for those months in the four years that staffing and workforce intelligence firm CyberSN has tracked. They pulled the listings from job data provider JobSpikr, removed duplicates and sorted each one by the security work it described. The postings that remain have drifted toward governance, risk and compliance (GRC), the teams that track an organization’s risk and answer to … More → The po... (Source: Help Net Security)
  • PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions — A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a (Source: The Hacker News)
  • F-Secure Launches Victim-First Scam Encyclopedia Covering 50+ Types of Consumer Fraud — Built from decades of threat intelligence research, the new resource explains scams from the victims' perspective and tracks emerging forms of cyber crime. (Source: Dark Reading)
  • Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory — A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape, is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared (Source: The Hacker News)
  • ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More — Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and (Source: The Hacker News)
  • Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks — The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives (Source: The Hacker News)
  • Vulnerability Management Isn't About the Score — It's About How It Applies to You — Organizations need to move away from vendor-assigned, theoretical scores toward real exploit data specific to their environments. (Source: Dark Reading)
  • NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks — NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit. A fourth lets an attacker forge a TLS session that could (Source: The Hacker News)
  • Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing — Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images. The fixes are in (Source: The Hacker News)
  • Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules — Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login. (Source: The Hacker News)
  • Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation — Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an (Source: The Hacker News)

AI/ML Security

  • Week in review: Hidden implant in Ledger wallets linked to $93M theft, 1,500+ npm packages exposed — Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Strands Box: Open-source sandbox for AI agents AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it act again. Box is in developer preview and runs on Macs with Apple silicon, with Linux support planned. Geopolitics and the cyber resilience gap … More → The post Week in review: ... (Source: Help Net Security)
  • Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk — Campaigns that impersonate popular AI brands are on the rise, and they typically use ClickFix-like tactics to target unsuspecting enterprise employees. (Source: Dark Reading)
  • Enterprise AI Enters Risk Management Phase as Security Concerns Rise — Companies are increasingly discovering that the challenge with AI is no longer adoption, but execution. (Source: Dark Reading)
  • AI Takes Control of Robotic Arm in 16 Minutes Flat — Most OT devices at utilities, factories, and elsewhere have been deployed for a decade or more, but operators need to get agile and deploy new cyber defenses. (Source: Dark Reading)
  • OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract — OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test cryptocurrency from a third-party's wallet without authorization to complete a coding task. The incident, the AI company said, involved an internal research model part (Source: The Hacker News)
  • When AI Agents Commit Breaches, Humans May Not Be Held Liable — As agents escape containment and access external systems, responsibility remains human. Accountability, however, is much less settled. (Source: Dark Reading)
  • AI Decision Models and Their Impact on AI SOC Platforms — In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally. Others, like Laya, are (Source: The Hacker News)
  • CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing — AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an advisory on October 15. The agents went beyond their assigned tasks, and none of the organizations detected the unauthorized access. After internal reviews, the AI companies whose models were being tested (Source: The Hacker News)
  • Stolen AI API keys are paying for hackers’ autonomous scans — A seller on a restricted criminal forum is marketing an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google API keys, so the key’s owner pays for the scans. Bitsight’s threat intelligence team tracked the shift across thousands of posts on 16 underground forums from February through August 2026. Over that window, mentions of AI agents, indirect prompt injection and the Model Context Protocol (MCP) rose 67 percent. Two groups are exposed. A … More → The post Stolen AI API key... (Source: Help Net Security)
  • New infosec products of the week: October 16, 2026 — Here’s a look at the most interesting products from the past week, featuring releases from NinjaOne, Qualys, Scytale, and SolarWinds. NinjaOne combines Katana AI and MCP server to accelerate IT problem resolution NinjaOne has announced Katana AI, an agentic AI technician that supports and elevates IT workers, and the NinjaOne MCP server, an agentic orchestration connector that extends the platform’s governed access to the AI tools teams already use. Katana AI analyzes device telemetry, history, ... (Source: Help Net Security)
  • AI Slop Isn't Just for Social Media; It's Ruining Cyberattacks, Too — Don't buy the hype! AI has been dumbing down cyberattacks, and serious threat actors are barely touching it. (Source: Dark Reading)
  • Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early — Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026. The campaigns also increase operational pressure on MSSPs serving US businesses, which accounted for 16% of country-attributed targets. Similar attacks (Source: The Hacker News)
  • Why AI Confidence Is Not Validation — AI is already part of digital forensics and incident response work, with or without a policy in place to govern it. The issue is that these tools are growing more confident in their own output faster than practitioners are developing reliable ways to verify it. Without governance models and validation standards in place, that gap compounds and rarely stays contained to a workstation: an (Source: The Hacker News)

Cloud & Infrastructure Security

  • Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams — A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active since at least 2017, offering PHP code templates to partners and affiliates that are installed into compromised websites with an aim to direct unsuspecting (Source: The Hacker News)

Policy & Regulation

  • Why Active Directory weaknesses stay open for years in teams with one or two admins — David Fuhr, CTO at intcube, talks about a security cohort for public administration, where 27 municipalities hardened Windows Server and Active Directory together over 12 weeks. This Help Net Security interview covers how a cohort works, with weekly sessions, homework and measurements at the start and end. He explains how the group handled settings that can break systems, such as SMB signing, LDAP signing and Kerberos hardening, how changes were tested in a lab, and … More → The post Why Active ... (Source: Help Net Security)

Reports & Analysis

  • Hackers disguise phishing as promising business opportunities — Attackers are breaking into business email accounts with short messages asking whether a company can quote on an upcoming project, the kind of request sales and procurement staff answer every week. Cadence Riddle, a cybersecurity researcher at Fortra, tracked a 12-fold increase in malicious emails mentioning “RFQ” (request for quotation) between October 2025 and September 2026. In nearly 73% of cases, the lure led to a page built to steal login credentials. “RFQ communication is … More → The pos... (Source: Help Net Security)
  • SecTor 2026 Reveals a Rapidly Shifting Cybersecurity Landscape — The event closed in Toronto last week, with experts sharing critical perspectives on emerging risks, drawing record attendance and marking 22% growth. (Source: Dark Reading)
  • Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads — Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday. The hidden attack code ran the moment an ad loaded on the screen, and in some cases the ad loaded out of sight, in the background. The Citizen (Source: The Hacker News)

IoT & OT Security

  • Continuous accountability for Verified bots — A driver’s license tells you who someone is and that they passed a driving test, not whether they’ll drive responsibly in the future. The same is true for bots: verifying who operates it creates accountability, but trust depends on what it does next. A known bot can still ignore website preferences, overwhelm origins, or evade controls. It’s not always malicious — often it’s just a misconfiguration or a bug.As we described in a previous blog post on bot behavior, we strive to verify two question... (Source: Cloudflare Blog)