← All threat briefs

Daily Cybersecurity Brief — 2026-10-20

SECURITY // 2026-10-20

Daily Cybersecurity Brief — 2026-10-20

High-Signal Security Journalism

  • Mastercard helps banks assess stablecoin risks before funds move — Mastercard has announced Stablecoin Security, a new risk intelligence solution, with Borderless.xyz and Keyrails as initial partners. As stablecoins play a growing role in cross-border and business-to-business payments, financial institutions need a clearer view of risk across increasingly complex payment flows. The solution builds on Mastercard’s existing capabilities and helps financial institutions identify fraud, scams, sanctions and other financial-crime risk indicators throughout the stabl... (Source: Help Net Security)
  • Cybersecurity jobs available right now: October 20, 2026 — Application Security Architect Riskified | Israel | Hybrid – View job details As an Application Security Architect, you will review architecture, design, and code to identify security gaps and vulnerabilities. You will work with developers, product managers, and security teams to resolve risks, improve application security tools and processes, and support incident response in Riskified’s environment. CISO United Utilities | United Kingdom | Hybrid – View job details As a CISO, you will lead Unit... (Source: Help Net Security)
  • Bring Your Own Vulnerable Driver: What Detection Teams Should Actually Hunt — Bring your own vulnerable driver (BYOVD) is having a moment in endpoint security. Some of the buzz is earned. Some of it is overblown. This series unpacks both and shows the evidence for each. This piece turns the noise into specific behavior a detection team can hunt."EDR killer," a tool built to shut down endpoint detection and response (EDR), is one phrase doing the work of four different attacks. Detection teams treat it as a single thing and write one rule that catches one technique and mis... (Source: SentinelOne Blog)

Threat Intelligence & Malware Analysis

  • Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware — Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users into running malicious commands and infecting their own (Source: The Hacker News)
  • Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor — Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the (Source: The Hacker News)
  • 19th October – Threat Intelligence Report — For the latest discoveries in cyber research for the week of 19th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES CenterPoint Energy, a US utility company serving Texas and several other states, has disclosed a data breach affecting more than 1 million Texas residents. Unauthorized access to an external system exposed names, addresses, Social Security information, and driver’s license numbers, according to regulatory notifications filed by the company. Burger ... (Source: Check Point Research)
  • MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon — Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of (Source: The Hacker News)

Vulnerabilities & Exploits

  • ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan — Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the (Source: The Hacker News)
  • Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19) — Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19) appeared first on Unit 42. (Source: Unit 42)
  • 'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery — Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest. (Source: Dark Reading)
  • Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor — Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell. The vulnerabilities (Source: The Hacker News)
  • Supply Chain Zero Days: Closing the Gap Between Publication and Detection — When trusted packages are compromised, malicious code can quickly spread throughout and beyond developer environments. See how Wiz’s supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply chain compromises in Wiz Defend before a CVE is published (Source: Wiz Blog)
  • OnlyFans Copyright Takedowns Expose Compromised Websites — Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's Greg Pollock explains what universities, government websites, and security teams need to think about next. (Source: Dark Reading)
  • The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience — An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience. (Source: Dark Reading)
  • Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site — U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom. Hackers aligned with ShinyHunters have ... (Source: Krebs on Security)
  • GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories — The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps (Source: The Hacker News)
  • Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities — The recent disclosure of a major vulnerability in Citrix NetScaler pointed to a widespread weak point: a login page is an attack surface that can be used to compromise and access an application server. Indeed, the disclosures included an actively exploited flaw that allowed attackers to execute commands on affected gateways without signing in. As with any emergency patch, admins had to weigh cutting off or disrupting their users’ access with the risk of delaying a critical security update.If you... (Source: Cloudflare Blog (security))
  • From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software — In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it is how airlines and hotels run support intake. Both are standard, documented, as-designed features. Chained together, (Source: The Hacker News)
  • Cybercriminals favor Microsoft over Apple and Google in brand phishing attacks — Microsoft accounted for 33% of brand impersonation attempts tracked by Check Point Research in the third quarter of 2026, up from 23% in the previous quarter and roughly four times the share of any other brand. Top 10 most impersonated brands in phishing attacks (Source: Check Point) Apple and Google followed with 8% each. Dropbox and YouTube recorded the biggest climbs in the rankings. “Attackers favor Microsoft because stolen Microsoft credentials can unlock an entire … More → The post Cybercr... (Source: Help Net Security)
  • Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers — A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device (Source: The Hacker News)
  • Frozen Privilege: Remote Code Execution in Snowflake-Managed PostgreSQL — Varonis Threat Labs uncovered a remote code execution (RCE) vulnerability in Snowflake-managed PostgreSQL that turns an ordinary database privilege into control of the underlying server by chaining together legitimate features. The security risk extends beyond a single database bug. Our research shows how trusted, managed cloud services can still contain hidden privilege chains that bypass customer-visible logging, undermine data integrity, and create attack paths beneath the layer security team... (Source: Varonis Blog)

AI/ML Security

  • Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge — A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco office to allegedly steal sensitive secrets. In a new court filing Sunday, prosecutors revealed that Abdulrahman Alfozan, a 35-year-old Saudi national, was "in frequent communications via WhatsApp (Source: The Hacker News)
  • Cloudflare bets you’re overpaying an LLM to read your invoices — Cloudflare released a preview of Clairic, an extraction model that pulls typed values out of messy text and images in one pass without generating tokens. In Cloudflare’s test on a damaged-product support claim, a pipeline built around Clairic finished in 19.3 seconds, against 61.7 seconds for a version that used an LLM at every step, and cost 49% less. Clairic goes after a job developers routinely hand to large language models: read this invoice and … More → The post Cloudflare bets you’re overp... (Source: Help Net Security)
  • ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More — The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were (Source: The Hacker News)
  • Axonius AI Workforce pairs asset intelligence with automated action — Axonius has announced Axonius AI Workforce, the latest expansion of Axonius AI. It enables organizations to deploy teams of Virtual Workers that monitor their environments, identify high-risk exposures and assets that deviate from their expected state, remediate issues, and report progress toward assigned goals. Actions requiring human-in-the-loop (HITL) approval pass through a structured checkpoint for review before execution. Security and IT teams have more data than ever, but it is scattered ... (Source: Help Net Security)
  • Sweet Security adds one-click protection for vulnerable cloud workloads — Sweet Security has announced the release of Virtual Patching, a new capability that protects running cloud and AI applications from specific vulnerabilities the moment they are identified. Security teams can enforce protection in one click while engineering develops, tests, and deploys a permanent fix. Vulnerability remediation can take days or weeks as engineering teams develop fixes, test changes, obtain approvals, and deploy updated applications. During that window, the running application re... (Source: Help Net Security)
  • With open-weight AI, more of the security burden falls on enterprises — Organizations that run open-weight AI models on their own infrastructure may have to supply safety and security controls that an AI provider would otherwise handle for them, Microsoft and NVIDIA warn in a joint paper on managing the risks of these models. Open-weight models are AI models whose weights, the values a model learns during training, are published so that anyone can download, inspect, modify and run them. Closed-weight models stay with the company that … More → The post With open-weig... (Source: Help Net Security)
  • Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic — A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic (Source: The Hacker News)
  • OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys — An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without (Source: The Hacker News)

Cloud & Infrastructure Security

  • EasyDMARC and GMO GlobalSign connect email authentication with verified branding — EasyDMARC has partnered with GMO GlobalSign to help organizations establish trusted email identities through DNS security, sender authentication, and verified branding in recipients’ inboxes. As organizations rely on an increasing number of cloud applications, marketing platforms, CRMs, helpdesk systems, and third-party services to communicate with customers, managing the email ecosystem has become significantly more complex. Every sender introduces new DNS records, authentication requirements, ... (Source: Help Net Security)
  • Researchers Infiltrate Microsoft Tech Support Scam Operation — A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links. (Source: Dark Reading)
  • ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs — Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials; ConnectWise says customer impact remains unconfirmed. (Source: Dark Reading)
  • ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access — American software company ConnectWise is contending with a security incident that has allowed unknown attackers to use its application identities to break into organizations’ Microsoft 365 accounts. The intruders used a compromised credential belonging to the ConnectWise Cloud Backup application, formerly known as SkyKick. This spurred the company to temporarily suspend the backup service, as well as its SaaS Security (monitoring and alerting) and Cloud Management (user and license management) s... (Source: The Hacker News, Help Net Security)
  • Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack — Wiz CIRT responded to AI-driven attacks spanning cloud, Kubernetes, CI/CD, and identity. Learn how these attacks behave and how to detect them. (Source: Wiz Blog)

Reports & Analysis

  • Your frontline workers have a workaround for that MFA prompt — Frontline workers in healthcare and manufacturing are getting around slow, unreliable logins by staying signed in, sharing credentials and trying to bypass multifactor authentication. Sapio Research surveyed 700 IT and security decision-makers in August, and 95% said they had seen frontline workers use workarounds like these in the past 12 months. Each of those habits breaks the link between an account and the person using it. A session left open on a shared workstation lets … More → The post Yo... (Source: Help Net Security)