← All threat briefs

Daily Cybersecurity Brief — 2026-10-19

SECURITY // 2026-10-19

Daily Cybersecurity Brief — 2026-10-19

High-Signal Security Journalism

  • Biomemory Launches DNA Shield, First Commercial Product Built on Its Molecular IT Platform — The launch follows the acquisition of catalog's assets and the appointment of Laurent Guengant as CEO earlier this year. (Source: Dark Reading)

Threat Intelligence & Malware Analysis

  • Ransomware pressure now reaches employees’ homes and families — Ransomware attackers threatened employees’ family members or friends at 37% of organizations surveyed for Semperis’ 2026 Ransomware Risk Report. The survey covered 1,200 IT and security professionals at organizations that had experienced at least one successful ransomware attack. “Ransomware has proven to be a great cash-generating activity for criminal syndicates, which have no hesitation about inflicting both cyber and physical harm,” said Mickey Bresman, Semperis CEO. Threats reach beyond the... (Source: Help Net Security)
  • ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants — ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise (Source: The Hacker News)
  • MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon — Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of (Source: The Hacker News)
  • Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants — Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs (Source: The Hacker News)
  • How SentinelOne Blocked APT29's CaptiveCrunch Campaign — Once the corporate network stopped being defensible, the control had to move to the device, as SentinelOne® has long argued.That move carried one assumption with it. Wherever the laptop sits, name resolution tells it the truth and the agent can reach its own cloud. Almost nothing in the stack checks either half.In July 2026, Microsoft disclosed a campaign that breaks both and named it CaptiveCrunch. A captive portal is the sign-in page a public Wi-Fi network pushes in front of you before it lets... (Source: SentinelOne Blog)
  • The Good, the Bad and the Ugly in Cybersecurity - Week 42 (2026) — The Good | Authorities Arrest Cyber Exec for Extortion & Dismantle DPRK Laptop FarmsThe FBI arrested Edward Dubrovsky, a Canadian former cybersecurity executive at incident response and ransomware negotiation firm CYPFER, on charges of conspiracy and extortion. Various reports have linked the arrest to the FBI’s continued crackdown on the ShinyHunters extortion group and their alleged compromise of the FBI’s job portal back in September. While Dubrovsky has not been officially named a ShinyHunte... (Source: SentinelOne Blog)
  • Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor — Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis (Source: The Hacker News)
  • UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing — Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The activity is being tracked by (Source: The Hacker News)
  • When Your Ransomware Negotiator Works for the Other Side — The shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight. (Source: Dark Reading)

Vulnerabilities & Exploits

  • Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers — A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device (Source: The Hacker News)
  • Bearer CLI: Free, source-available code security scanning tool (SAST) — Bearer CLI is a free static application security testing (SAST) tool that scans source code for vulnerabilities and prioritizes them by the sensitive data they touch. SAST means the tool reads code without running it. Organizations can use it freely, with a license restriction covered below. Bearer’s complaint is that SAST tools can hand developers hundreds of findings with no sense of which to fix first. Its fix is to follow sensitive data through the … More → The post Bearer CLI: Free, source-... (Source: Help Net Security)
  • Frozen Privilege: Remote Code Execution in Snowflake-Managed PostgreSQL — Varonis Threat Labs uncovered a remote code execution (RCE) vulnerability in Snowflake-managed PostgreSQL that turns an ordinary database privilege into control of the underlying server by chaining together legitimate features. The security risk extends beyond a single database bug. Our research shows how trusted, managed cloud services can still contain hidden privilege chains that bypass customer-visible logging, undermine data integrity, and create attack paths beneath the layer security team... (Source: Varonis Blog)
  • BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs — Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group. (Source: Dark Reading)
  • Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug — A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections.Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped (Source: The Hacker News)
  • Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 — Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42. (Source: Unit 42)
  • Scammers clone candidates’ voices to steal cash and voter data ahead of 2026 midterms, FBI warns — Three weeks before Americans vote in the 2026 midterm election, fraudsters are borrowing candidate names, logos and slogans to collect fake donations and harvest personal data, the FBI warned. “The FBI warns the public that scammers could exploit the 2026 US Midterm Election to perpetrate financial fraud schemes,” reads the public service announcement, which adds that these schemes target victims throughout the country and “have previously exploited state and local elections.” The alert updates ... (Source: Help Net Security)
  • Fake Arch Linux AUR packages exploit typos to run malware with root privileges — Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR is a popular community package source for Arch Linux and related distributions, hosting user-submitted build scripts for proprietary programs, beta builds and older software versions that the official repositories do not carry. Yay and paru, known as AUR helpers, search the AUR for software and … More → The post Fake Arch L... (Source: Help Net Security)

AI/ML Security

  • OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys — An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without (Source: The Hacker News)
  • Half the AI bot traffic hammering your website comes from Meta — AI agent traffic across DataDome’s network grew 41.5% quarter over quarter to nearly 25 billion requests in Q3 2026, according to the company’s AI Traffic Report Q3 2026. Meta’s Muse generated 29.1 million requests between September 22 and October 3, its first 12 days of full availability. In a sample of Muse traffic, 99.3% of requests came from cloud and CDN infrastructure. Nearly half of the AI agent traffic recorded in 2026 through September occurred … More → The post Half the AI bot traffic ... (Source: Help Net Security)
  • Week in review: Hidden implant in Ledger wallets linked to $93M theft, 1,500+ npm packages exposed — Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Strands Box: Open-source sandbox for AI agents AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it act again. Box is in developer preview and runs on Macs with Apple silicon, with Linux support planned. Geopolitics and the cyber resilience gap … More → The post Week in review: ... (Source: Help Net Security)
  • Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk — Campaigns that impersonate popular AI brands are on the rise, and they typically use ClickFix-like tactics to target unsuspecting enterprise employees. (Source: Dark Reading)
  • Enterprise AI Enters Risk Management Phase as Security Concerns Rise — Companies are increasingly discovering that the challenge with AI is no longer adoption, but execution. (Source: Dark Reading)
  • AI Takes Control of Robotic Arm in 16 Minutes Flat — Most OT devices at utilities, factories, and elsewhere have been deployed for a decade or more, but operators need to get agile and deploy new cyber defenses. (Source: Dark Reading)
  • OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract — OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test cryptocurrency from a third-party's wallet without authorization to complete a coding task. The incident, the AI company said, involved an internal research model part (Source: The Hacker News)
  • When AI Agents Commit Breaches, Humans May Not Be Held Liable — As agents escape containment and access external systems, responsibility remains human. Accountability, however, is much less settled. (Source: Dark Reading)
  • AI Decision Models and Their Impact on AI SOC Platforms — In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally. Others, like Laya, are (Source: The Hacker News)

Reports & Analysis

  • Hackers disguise phishing as promising business opportunities — Attackers are breaking into business email accounts with short messages asking whether a company can quote on an upcoming project, the kind of request sales and procurement staff answer every week. Cadence Riddle, a cybersecurity researcher at Fortra, tracked a 12-fold increase in malicious emails mentioning “RFQ” (request for quotation) between October 2025 and September 2026. In nearly 73% of cases, the lure led to a page built to steal login credentials. “RFQ communication is … More → The pos... (Source: Help Net Security)

IoT & OT Security

  • RPO and RTO explained with a real disaster recovery example — In this Help Net Security video, Matthew Burden, CEO of BlackBox Hosting, explains RPO and RTO and how they differ in practice. RPO, the recovery point objective, is the most data you can lose, measured in time. RTO, the recovery time objective, is the longest your business can stay down. A backup does not guarantee quick recovery, and quick recovery does not help if the data is days old. Burden says every application needs its … More → The post RPO and RTO explained with a real disaster recover... (Source: Help Net Security)
  • Continuous accountability for Verified bots — A driver’s license tells you who someone is and that they passed a driving test, not whether they’ll drive responsibly in the future. The same is true for bots: verifying who operates it creates accountability, but trust depends on what it does next. A known bot can still ignore website preferences, overwhelm origins, or evade controls. It’s not always malicious — often it’s just a misconfiguration or a bug.As we described in a previous blog post on bot behavior, we strive to verify two question... (Source: Cloudflare Blog (security))