← All threat briefs

Daily Cybersecurity Brief — 2026-10-22

SECURITY // 2026-10-22

Daily Cybersecurity Brief — 2026-10-22

High-Signal Security Journalism

  • Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site — U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Source... (Source: Krebs on Security)

Threat Intelligence & Malware Analysis

  • LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release — LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hu... (Source: The Hacker News)
  • Africa cybercrime crackdown nets 1,462 arrests and over $105 million — Police in 21 countries arrested 1,462 suspects and took down 10,909 malicious networks in Operation Serengeti III, an INTERPOL-coordinated cybercrime sweep across Africa that ran from June 29 to August 31, 2026. Investigators recovered more than $105 million in illicit funds. Financial investigat... (Source: Help Net Security)
  • China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack — Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-sourc... (Source: The Hacker News)
  • LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor — The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Do... (Source: The Hacker News)
  • OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors — A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users. (Source: Dark Reading)
  • “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities — An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration. The post “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities appeared first on Un... (Source: Unit 42)
  • LiteLLM Compromised, Steals Credentials — In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a credential stealer targeting browser, cloud and AI secrets as well as a dormant C2 capability. (Source: Wiz Blog)
  • Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands — Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social engineering technique in which bad actors trick users into copying and pasting malicious code directly into ... (Source: The Hacker News)
  • Decades-Old Windows Utility Powers Modern ClickFix Attack — The attack uses malicious Google search results related to Amazon and leverages the "finger" utility to launch a CAPTCHA that installs malware, including the Lumma stealer. (Source: Dark Reading)
  • China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors — Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. "The most distinctive technical marker for Bronze Sandcastle is its consistent us... (Source: The Hacker News)
  • Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites — Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plu... (Source: The Hacker News)
  • Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion — A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Parti... (Source: The Hacker News)
  • Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20) — Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20) appeared first on Unit 42. (Source: Unit 42)
  • From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage — How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage (Source: Wiz Blog)
  • Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA — Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting  PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors ... (Source: The Hacker News)
  • Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree — A Chinese-speaking attacker has compromised hundreds of websites across the globe, looting from big fish like John Deere, SharkNinja, and engine manufacturer Cummins. (Source: Dark Reading)
  • The Risk of AI-Powered Antidetect Browsers in Online Fraud and Influence Operations — Key Findings Antidetect browsers obscure the digital identity of their users, enabling a single operator to silently manage thousands of isolated accounts across multiple platforms (including Facebook, TikTok, Instagram, and YouTube), while evading detection systems that look for scams and coordi... (Source: Check Point Research)
  • Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election — The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19. The finding came six days before Serbia's October 25 snap parliamen... (Source: The Hacker News)
  • Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader — The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO). The Symantec Threat Hunter Team, which is tracking the activity cluster und... (Source: The Hacker News)
  • Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware — An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it,... (Source: The Hacker News)
  • ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan — Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory th... (Source: The Hacker News)
  • Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware — Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus la... (Source: The Hacker News)
  • Researchers Infiltrate Microsoft Tech Support Scam Operation — A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links. (Source: Dark Reading)
  • 'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery — Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest. (Source: Dark Reading)
  • Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor — Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity invol... (Source: The Hacker News)
  • Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor — Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16.... (Source: The Hacker News)
  • GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories — The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalwa... (Source: The Hacker News)
  • Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic — A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The to... (Source: The Hacker News)

Vulnerabilities & Exploits

  • Anthropic finds 94 cases where open-source projects drop security controls without warning — Software can expose complex functionality to unauthenticated users even when that functionality is disabled or unnecessary. Anthropic’s Frontier Red Team used Claude to examine 25 open-source projects and reported 493 issues involving unnecessary exposure, conflicting settings, and code running b... (Source: Help Net Security)
  • Signal flaw could expose audio and video even after users hang up — A flaw in Signal’s calling library could let the other person on a call keep receiving a user’s audio, and possibly video, after that user hangs up. Tracked as CVE-2026-113380, the vulnerability affects RingRTC versions before 2.72.0. RingRTC is the open source library that powers voice and video... (Source: Help Net Security)
  • Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions — Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could... (Source: The Hacker News)
  • AI-found bugs are expected to rise, and OpenAI has a five-stage response plan — OpenAI has proposed a five-stage process for handling critical vulnerabilities in widely used software. The process grew out of a two-month response to flaws in PHP, the open-source language that runs websites and web applications. Calif found one of the PHP flaws using OpenAI’s GPT-5.6 Sol model... (Source: Help Net Security)
  • New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification — A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code. By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force ... (Source: The Hacker News)
  • Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed — Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches. "The exploit a... (Source: The Hacker News)
  • AI coding boom exposes cracks in cloud development — Developers are encountering bugs, testing delays and disruptions in shared cloud environments as AI increases the volume of code they produce, according to LocalStack’s 2026 State of AI in Cloud Development report. More code adds to the testing workload Sixty-five percent of respondents say their... (Source: Help Net Security)
  • AI agent observability is struggling to keep up with hallucinations — Sixty-two percent of IT and engineering professionals now rely on AI agents frequently to work out why their systems broke, and more than half have no way to measure whether the agents get it right. Splunk surveyed 2,050 of them across ten countries. Source: Splunk Agents diagnose, people still s... (Source: Help Net Security)
  • Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack Technique — Executive SummaryOn October 21, 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. The two flaws are known together as PHP2Shell. They were disclosed by the security firms C... (Source: SentinelOne Blog)
  • 'PHP2Shell' Bugs Signal Red Alert for Security Industry — Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts. (Source: Dark Reading)
  • Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases — GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update... (Source: The Hacker News)
  • Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 — CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 appeared first on Unit 42. (Source: Unit 42)
  • Optiv Launches CyberBOT Cybersecurity Awareness Training Program — Hands-on sessions provide educators, nonprofits, and community leaders with an accessible resource to foster year-round cyber awareness and build more resilient communities. (Source: Dark Reading)
  • Widespread PHP Flaw May Cause Many Site Outages Today — Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these ... (Source: Krebs on Security)
  • Introducing full transaction detection for Cloudflare WAF — Today, we are expanding our web application firewall (WAF) by adding two new capabilities: full transaction detections and response rules. Full transaction detections evaluate each HTTP request alongside its response to identify evidence of exploitation. It helps answer both "Does this reque... (Source: Cloudflare Blog (security tag))
  • PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge — PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws, together called P... (Source: The Hacker News)
  • PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet — Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web. (Source: Wiz Blog)
  • Cloudflare deploys protections against php2shell vulnerability — Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execut... (Source: Cloudflare Blog (security tag))
  • Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports — Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templates now arrive fluent, personalized, and unique to each recipient, and the behavioral signals email filters have relied on for years are ... (Source: The Hacker News)
  • PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't — You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says. PHP will release the fix at 14:00 UTC on October 21 for two flaws it rat... (Source: The Hacker News)
  • Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections — Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login ... (Source: The Hacker News)
  • PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert — This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory. PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical v... (Source: The Hacker News)
  • CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities are listed below - CVE... (Source: The Hacker News)
  • CrowdStrike Protects Customers from Threats Delivered via PHP2Shell — (Source: CrowdStrike Blog)
  • 8 eMudhra certificates are compromised. Here's what you need to know — On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised. These certificates were widely trusted by browsers, operating systems, and also within Cloudflare. Because the keys themselves are w... (Source: Cloudflare Blog (security tag))
  • Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution — Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw tha... (Source: The Hacker News)
  • Supply Chain Zero Days: Closing the Gap Between Publication and Detection — When trusted packages are compromised, malicious code can quickly spread throughout and beyond developer environments. See how Wiz’s supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply chain compromises in Wiz Defend before a CVE is published (Source: Wiz Blog)
  • OnlyFans Copyright Takedowns Expose Compromised Websites — Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's Greg Pollock explains what universities, government websites, and security teams need to think ab... (Source: Dark Reading)
  • ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More — The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted connections became a... (Source: The Hacker News)
  • The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience — An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience. (Source: Dark Reading)
  • Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities — The recent disclosure of a major vulnerability in Citrix NetScaler pointed to a widespread weak point: a login page is an attack surface that can be used to compromise and access an application server. Indeed, the disclosures included an actively exploited flaw that allowed attackers to execute c... (Source: Cloudflare Blog (security tag))
  • From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software — In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it is how airlines an... (Source: The Hacker News)

AI/ML Security

  • Delinea gives AI assistants read-only access to governance data — Delinea has announced Delinea Fastpath MCP Server, a new capability that connects access governance data to the AI assistants teams already use. Using the Model Context Protocol (MCP), finance, IT, audit, and compliance teams can ask natural-language questions and get fine-grained, cross-applicat... (Source: Help Net Security)
  • AI agent permissions are outrunning security — Most organizations have handed AI agents work that used to need a person’s sign-off. In a survey of 1,100 IT and security decision-makers, 70% said they now let AI make decisions and take actions that would have required human approval a year ago. That new authority is already causing trouble. Th... (Source: Help Net Security)
  • Say a few words, and a rigged AI asks for $5,000 — Researchers at Imperial College London tampered with speech-to-text models so they transcribed most speakers accurately and misbehaved for one chosen person. When that person spoke, the models produced output the attacker had picked in advance. In one test, that output was a request to send $5,00... (Source: Help Net Security)
  • UAE Transitions 50% of Gov't Services to Agentic AI — The United Arab Emirates says it's creating a foundation of security and safety as it transforms its public service footprint. (Source: Dark Reading)
  • OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So — OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and GPT-6 Astra weakened misalignment monitoring while making requested software changes during two internal coding tasks. The AI company said the incident took place on October 3 and 6, 2026, for Sol and Astr... (Source: The Hacker News)
  • The Harness Is the Hard Part of Agentic Pentesting — An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production and worth acting on afterward lives in the harness around the model. The harnes... (Source: The Hacker News)
  • CrowdStrike Uncovers New Agentic AI Campaigns — (Source: CrowdStrike Blog)
  • Ex-OpenAI Engineer Detained After Planting Secret Recorder at HQ — The perp, who has Saudi ties, was arrested for allegedly bugging an OpenAI conference room, highlighting a preventable insider threat vector. (Source: Dark Reading)
  • Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites — A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet. The agents tried more than 1,200 sites and reached websites bel... (Source: The Hacker News)
  • What Security Teams Can Do To Tame Wild Code — A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team’s daily routine. Across the same organization, employ... (Source: The Hacker News)
  • Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge — A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco office to allegedly steal sensitive secrets. In a new court filing Sunday, prosecutors revealed tha... (Source: The Hacker News)
  • Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack — Wiz CIRT responded to AI-driven attacks spanning cloud, Kubernetes, CI/CD, and identity. Learn how these attacks behave and how to detect them. (Source: Wiz Blog)

Supply Chain & Software Security

  • Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software — The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could i... (Source: The Hacker News)
  • Close Identity Gaps in Software Development Before Unleashing AI — Artificial intelligence is complicating security in the software development life cycle, but a Dark Reading roundtable found collaboration, better identity visibility, and reduced testing costs offer CISOs a way ahead. (Source: Dark Reading)
  • Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns — Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys. Programs built on the new release will refuse connections to sites and services whose certificates were issu... (Source: The Hacker News)
  • ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident — ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associa... (Source: The Hacker News)
  • ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs — Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials; ConnectWise says customer impact remains unconfirmed. (Source: Dark Reading)

Cloud & Infrastructure Security

  • TiDB Breach Exposes Flawed Cloud Security Assumptions — Cloud providers may be storing sensitive customer data, without either party knowing it. But when a provider is breached, the data comes home to roost. (Source: Dark Reading)
  • Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security — The effort is aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure. (Source: Dark Reading)
  • Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens — Research finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization. (Source: Dark Reading)
  • Wiz Sensor on GKE. 1-Click Runtime Protection, Now Native. — Enable native runtime protection for GKE in just one click. The Wiz Runtime Sensor add-on now automates deployment and credential management while delivering predictable, kernel-level eBPF threat detection for your GKE Kubernetes fleets. (Source: Wiz Blog)

Policy & Regulation

  • Sovereignty vs. security: Microsoft’s Roger Halbheer says you’re asking the wrong question — In this interview with Help Net Security, Roger Halbheer, Customer Security Officer at Microsoft, argues that digital sovereignty is a security question first. He explains why organizations underestimate speed, the time it takes to detect and stop an attacker, and why the cost curve turns steep o... (Source: Help Net Security)
  • U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases — U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services "developed using DeepSeek implementations," under a Department of Homeland Security order. They may also no longer buy information technology pro... (Source: The Hacker News)
  • WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators — WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who could no longer delete their accounts, even though WhatsApp's own privacy policy for Europe tells users they can complain to one. The text ... (Source: The Hacker News)
  • CrowdStrike Achieves NCSC CIR Enhanced Level Assurance — (Source: CrowdStrike Blog)

Vendor Advisories & Patches

  • Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys — Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it's unclear how the keys were compromised. (Source: Dark Reading)
  • Varonis and Collibra: Improving Data Governance for Trusted AI — As organizations move faster to integrate AI, datasets are connected to models, agents, and analytics pipelines based on their metadata and lineage. But pressing questions often go unanswered: what’s sensitive, and who has access to it?   Successful AI initiatives depend on trusted data... (Source: Varonis Blog)

Reports & Analysis

  • Survey Finds High-Profile Executives Feel Untouchable as Digital Exposure Turns Into Physical Risk — 360 Privacy finds more than 8 in 10 security and wealth professionals say cybersecurity and physical security can no longer be separated. (Source: Dark Reading)
  • 19th October – Threat Intelligence Report — For the latest discoveries in cyber research for the week of 19th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES CenterPoint Energy, a US utility company serving Texas and several other states, has disclosed a data breach affecting more than 1 million Texas re... (Source: Check Point Research)
  • Bring Your Own Vulnerable Driver: What Detection Teams Should Actually Hunt — Bring your own vulnerable driver (BYOVD) is having a moment in endpoint security. Some of the buzz is earned. Some of it is overblown. This series unpacks both and shows the evidence for each. This piece turns the noise into specific behavior a detection team can hunt."EDR killer," a to... (Source: SentinelOne Blog)

IoT & OT Security

  • State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web — State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from. The state-owned bank, India's largest, said in a stock-exchange filing dated October ... (Source: The Hacker News)