Overview of incoming advisories.
2018 results found
This weekly cybersecurity recap covers a broad range of high-impact incidents and vulnerabilities. Key highlights include 98 zero-day vulnerabilities, rogue AI agents being weaponized, a $100 million cryptocurrency theft, and a supply chain attack affecting 700 supermarkets. The article emphasizes that threats often arrive through trusted services, hardware, and overlooked systems. Old vulnerabilities are finding new victims, and hardware security is increasingly a concern. The recap underscores the pervasive and stealthy nature of modern cyber threats across multiple sectors.
View original advisory →The GhostAction threat actor has expanded its supply chain attack campaign beyond injecting malicious GitHub Actions workflows. The group is now targeting open-source developers by phishing them and delivering credential-stealing malware disguised as a fake font file. The campaign has been observed across 94 GitHub repositories. Research from OpenSourceMalware indicates the attackers are actively evolving their tactics in response to detection and mitigation efforts. The shift from workflow injection to font-disguised stealers represents a notable refinement in their operational approach. This campaign poses a significant risk to open-source developers and the broader software supply chain.
View original advisory →Wiz's Cloud Incident Response Team (CIRT) investigated real-world AI-driven attacks targeting cloud environments, Kubernetes clusters, CI/CD pipelines, and identity systems. The attacks were characterized as loud, fast, and widespread, leveraging AI to accelerate and broaden attack scope. The article provides an anatomical breakdown of how these attacks behave across multiple infrastructure layers. Key focus areas include detection strategies for AI-assisted threat actors operating in cloud-native environments. The incidents highlight the growing risk of AI being weaponized to conduct sophisticated, multi-vector cloud intrusions. Organizations are advised to strengthen detection capabilities across cloud, container, and identity planes to counter these emerging threats.
View original advisory →A fake Web3 accelerator campaign has been discovered distributing information-stealing malware and backdoors targeting both Windows and macOS systems. The attackers used malicious npm packages as the delivery mechanism, luring victims with promises of free AI credits for Anthropic Claude and Google Gemini, coding tools, and security audits. The malware delivered included information stealers and backdoors capable of hijacking AI agent traffic. The campaign was identified and reported by Elastic security researchers. This represents a supply chain attack leveraging the npm ecosystem combined with social engineering around AI and Web3 themes to increase credibility. The use of legitimate AI brand names (Claude, Gemini) as bait indicates sophisticated targeting of developers and tech-savvy users. Both major desktop operating systems are affected, broadening the potential victim pool significantly.
View original advisory →A critical unpatched vulnerability in Broadcom's Wi-Fi setup software allows an attacker within radio range to execute arbitrary code as root on affected routers. No network password or pairing step is required to exploit the flaw. Security researcher Quentin Kaiser disclosed the vulnerability on October 16, demonstrating successful attacks against home gateways from three Belgian internet providers. In at least one case, the attacker was able to read the Wi-Fi password directly off the device. The vulnerability poses a significant risk to home and small office users relying on Broadcom-based routers. No patch has been released at the time of disclosure, leaving affected devices exposed. The attack is proximity-based, requiring the attacker to be within Wi-Fi radio range of the target device.
View original advisory →On the night of October 16, an intruder accessed a legacy system at OpenCode, potentially exposing third-party AI provider API keys stored by users in OpenCode Console. OpenCode Console is an optional hosted service that allows workspaces to store their OpenAI, Anthropic, or Google API keys, enabling team members to access AI models through a shared interface. The breach may have compromised sensitive credentials that users had saved within the platform. The incident raises concerns about the security of API key storage in third-party hosted services. Affected users may face risks of unauthorized usage of their AI provider accounts, potential cost exposure, and data privacy implications if the keys are misused.
View original advisory →OpenCode reported a security breach targeting Console users who had linked AI providers to their accounts. The attack involved a distillation attack technique, which likely involved extracting or manipulating AI model outputs or credentials. The breach specifically affected developer environments where OpenCode was installed. StepSecurity published guidance on how to detect OpenCode installations on developer machines and how to respond to the incident. The article provides both vendor-reported information and practical remediation steps for security teams. This incident highlights supply chain and AI integration risks in developer tooling environments.
View original advisory →Attackers are actively exploiting an OS command injection vulnerability in SiteGuard Server Edition, a web application firewall product. The flaw allows threat actors to execute arbitrary commands with root or SYSTEM-level privileges on affected servers. This represents a critical security risk as the WAF product, designed to protect web servers, is itself being weaponized against the systems it defends. The vulnerability enables full system compromise due to the elevated privilege level of command execution. Organizations running SiteGuard Server Edition are urged to apply patches or mitigations immediately. The active exploitation in the wild increases the urgency of remediation efforts.
View original advisory →ConnectWise has suspended its Cloud Backup service after unknown threat actors gained unauthorized access to ConnectWise application identities. The attackers used these compromised identities to access and compromise Microsoft 365 tenants belonging to ConnectWise customers. ConnectWise responded by disabling seven application identities, including ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae). An investigation is ongoing to determine the full scope of the incident. The suspension of the cloud backup service impacts customers relying on ConnectWise for Microsoft 365 data protection. The incident highlights risks associated with third-party application identities having access to cloud tenants.
View original advisory →ConnectWise has shut down customer access to its Cloud Backup service, formerly known as SkyKick Cloud Backup, following a security incident in which hackers accessed application identities. The attackers leveraged this access to compromise Microsoft 365 tenants belonging to ConnectWise customers. The incident is classified as a supply-chain attack, as the breach originated through ConnectWise's own infrastructure and affected downstream customers. ConnectWise took the service offline as a containment measure. The attack highlights the risks of third-party cloud backup and management tools having broad access to enterprise Microsoft 365 environments. Organizations using ConnectWise Cloud Backup are advised to review their Microsoft 365 tenant for signs of unauthorized access and review delegated application permissions.
View original advisory →Drupal has released patches for two critical remote code execution (RCE) vulnerabilities affecting all supported versions of the popular content management system. The vulnerabilities could allow attackers to execute arbitrary code remotely on affected websites. Drupal has warned that exploits may emerge soon following the disclosure, urging administrators to apply patches immediately. The flaws affect any supported version of Drupal, making the scope of potential impact significant given Drupal's widespread use across enterprise and government websites. No specific CVE identifiers were mentioned in the article summary, but the critical severity rating and RCE nature of the flaws make them high-priority targets for threat actors. Website administrators running Drupal are strongly advised to update to the patched versions as soon as possible to mitigate the risk of exploitation.
View original advisory →Cybersecurity researchers have identified a malicious npm package named 'imgdecode' as part of the MALFEX software supply chain attack campaign. The package was uploaded to the npm registry on September 30, 2026, by a user named 'malfexteste8'. It has been downloaded approximately 979 times and remains available on npm. The package hides a shellcode loader within a Windows native addon, making it particularly dangerous as it can execute arbitrary code on victim machines. This discovery highlights the ongoing risks associated with software supply chain attacks targeting the npm ecosystem. The campaign name MALFEX suggests a coordinated effort to distribute malware through legitimate package registries.
View original advisory →An active campaign has been identified where unknown threat actors are leveraging a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customer M365 environments. At least 173 Microsoft 365 tenants have been affected. ConnectWise Cloud Backup is a cloud-based backup and recovery service designed for managed service providers (MSPs), making the breach particularly significant due to the downstream impact on MSP customers. The attack highlights risks associated with credential compromise in MSP tooling and cloud backup services. Cybersecurity researchers are actively raising alarms about this campaign. The incident underscores the supply-chain-like risk posed when a trusted MSP vendor's credentials are compromised. No specific CVEs have been mentioned in the available content.
View original advisory →A critical maximum-severity vulnerability tracked as CVE-2026-103849 has been discovered in BlockStrap, affecting Magento and Adobe Commerce platforms. The flaw could allow attackers to execute arbitrary PHP code on store servers. Researchers are warning that exploitation could be imminent. The vulnerability poses a significant risk to e-commerce stores running Magento and Adobe Commerce. No additional details about patches or mitigations are provided in the article excerpt, but the severity rating suggests urgent remediation is required. The issue highlights ongoing risks to widely-used e-commerce infrastructure.
View original advisory →Researchers from security firm Calif have published a local privilege escalation exploit targeting OpenBSD 7.9 that achieves root access by chaining a roughly 37-year-old integer overflow in shared memory with a separate kernel flaw. The exploit successfully bypasses OpenBSD's KARL (kernel address randomization layout) as well as hardware protections SMAP and SMEP. A full proof-of-concept code was released after OpenBSD shipped a patch. The vulnerability chain demonstrates that legacy bugs in foundational OS code can remain exploitable for decades. This is particularly notable given OpenBSD's reputation as one of the most security-focused operating systems. The attack is local, requiring existing access to the system, but escalates privileges to root. The disclosure follows responsible reporting by Calif to the OpenBSD team prior to public release.
View original advisory →Unit 42 researchers detail the top five initial access vectors used by adversaries to breach organizations in September 2026. The report highlights edge device exploits, credential abuse, and phishing as leading methods. These findings are based on incident response and threat intelligence observations by Palo Alto Networks' Unit 42 team. The article serves as a periodic threat landscape summary to help organizations prioritize defensive measures. Understanding these vectors is critical for improving detection and prevention strategies against current threat actor tactics.
View original advisory →Between May and July 2026, attackers repeatedly tampered with AOMEI Backupper's official update servers in short windows of five to ten minutes at a time. Any instance of the Windows backup software that checked for updates during these windows would download and execute a backdoor. The attack represents a classic supply chain compromise targeting the software update mechanism of a trusted vendor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team were involved in investigating the incident. The brevity of the attack windows suggests the attackers were attempting to minimize detection while still achieving broad distribution through legitimate update channels.
View original advisory →A threat actor tracked as UAT-11985 has been conducting a spear-phishing campaign targeting individuals affiliated with Taiwan research organizations. The campaign uses fake event invitations to lure victims to an adversary-in-the-middle (AitM) phishing framework. The goal is to harvest Google account credentials and multi-factor authentication (MFA) codes. The AitM technique allows attackers to bypass MFA protections by intercepting authentication tokens in real time. This represents a sophisticated APT-level operation targeting academic and research communities in Taiwan, likely for espionage purposes.
View original advisory →CISA has issued an alert regarding CVE-2026-102764, a critical authentication bypass vulnerability in BeyondTrust Remote Support (formerly Bomgar) affecting versions 26.2.3 and earlier. The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog as threat actors are actively exploiting it to gain initial access, establish persistence, escalate privileges, and move laterally. Organizations using self-hosted appliances must apply the BT26-05-RS patch; those on versions older than 24.3.1 must upgrade first. BeyondTrust-hosted SaaS deployments have already been patched. CISA recommends isolating potentially compromised appliances, conducting forensic investigations, hunting for indicators of compromise such as unrecognized privileged sessions or unauthorized account changes, and rebuilding from a known-good state. After remediation, organizations should rotate all credentials stored or injected by the appliance and revoke active support sessions. Mandiant has published additional guidance under the campaign name ARMORY CASTLE.
View original advisory →BeyondTrust has patched a critical vulnerability in BeyondTrust Remote Support, identified as CVE-2026-102764 with a CVSS score of 9.3. The vulnerability involves insufficient validation of message origins within internal product components. An unauthenticated remote attacker can exploit this flaw to place or modify files on an affected appliance. All Remote Support versions up to and including 26.2.3 are affected. BeyondTrust has confirmed that CVE-2026-102764 was actively exploited as a zero-day vulnerability in the wild.
View original advisory →