About this episode
This week connects actively exploited perimeter systems, compromised software and hardware trust chains, identity attacks, and the expanding role of AI on both sides of security operations—along with the evidence defenders need to patch, contain, and verify each risk.
This episode brings together the week’s most relevant cybersecurity stories and their operational context for defenders.
Play the episode, then review the stories and chapter list for the reporting and topics covered.
Stories covered this week
Unpatched AhsayCBS Flaws Exploited to Deploy Webshells and Crypto Miners
Threat actors are actively exploiting a critical and a medium-severity vulnerability in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. These vulnerabilities remain unpatched and pose a significant risk to affected environments.
Source: BleepingComputer
Critical Bricksforge WordPress Flaw Enables Unauthenticated RCE Exploited
A critical CVSS 10.0 vulnerability in the Bricksforge WordPress plugin allows unauthenticated attackers to execute arbitrary PHP code, leading to remote code execution. This flaw is actively exploited in the wild, impacting vulnerable WordPress sites.
Source: The Hacker News
Critical Docker Hub Flaw Allowed User Impersonation and Image Tampering
Docker disclosed a critical vulnerability in Docker Hub (CVE-2026-105445) where attackers could use personal access tokens to access and tamper with other users' container repositories. This flaw allowed serious risks including impersonation and potential malware injection into trusted images.
Source: BleepingComputer
Microsoft Patch Tuesday October 2026: Key Vulnerabilities & Snort Rules
October 2026 Patch Tuesday reveals multiple vulnerabilities across Microsoft products with updated Snort rules. This update is crucial for SOC teams to quickly detect and mitigate emerging threats.
Source: Talos Intelligence
Ivanti Warns of Actively Exploited Connect Secure Zero-Day
Ivanti has issued an urgent alert for a critical zero-day vulnerability in its Connect Secure remote access gateway that is currently being exploited in the wild. Customers are strongly advised to patch immediately to prevent potential breaches.
Source: BleepingComputer
Critical CVSS 10 Flaw in SAP Cloud SDK for Python Exposes OAuth2 Credentials
SAP disclosed a critical vulnerability in its Cloud SDK for Python that allows attackers to steal OAuth2 client credentials from multi-tenant applications on the SAP Business Technology Platform. The flaw requires control of the tenant subdomain to exploit.
Source: The Hacker News
Palo Alto Networks alerts on critical PAN-OS RCE zero-day exploited in the wild
Palo Alto Networks has issued security patches for a high-severity remote code execution vulnerability, CVE-2026-0322, actively exploited against their PAN-OS firewalls. The flaw allows attackers to execute arbitrary code and poses significant risk to enterprise networks.
Source: BleepingComputer
Critical PwnEscape Linux Kernel Flaw Allows Guest VMs to Leak Host Memory
A critical Linux kernel vulnerability, CVE-2026-99999 (PwnEscape), enables code inside guest virtual machines to read the host's memory. This flaw affects Linux networking code, impacting cloud environments including Vercel's live sandboxes.
Source: The Hacker News
Hackers Exploit Critical RCE Flaw in Collabora to Backdoor Nextcloud
Threat actors are actively exploiting a critical remote code execution vulnerability, CVE-2026-110447, in the Collabora Online CODE Server app used by Nextcloud servers. This flaw allows attackers to backdoor affected systems and gain unauthorized access.
Source: BleepingComputer
BeyondTrust patches zero-day exploited since August
BeyondTrust has released a critical patch for a zero-day vulnerability in its Remote Support software that has been actively exploited in attacks since late August. Customers are urged to update immediately to prevent potential breaches.
Source: BleepingComputer
Flax Typhoon Exploits Five Flaws Ahead of CISA October 11 Deadline
CISA has added five security flaws exploited by the China-linked threat actor Flax Typhoon to its Known Exploited Vulnerabilities catalog, with a compliance deadline of October 11 for federal agencies. Among the flaws is a critical ProFTPD vulnerability rated CVSS 10.0.
Source: The Hacker News
UAT-11985 Targets Taiwan Research with Google AitM Phishing via Fake Invites
An APT group named UAT-11985 is conducting spear-phishing attacks against individuals linked to Taiwan research organizations using fake event invites to deploy an adversary-in-the-middle phishing framework. The campaign aims to steal Google credentials and MFA codes to bypass authentication.
Source: The Hacker News
Inside AvisLoader: New Windows Malware Loader Designed to Resist Disruption
AvisLoader is a novel Windows malware loader utilizing encrypted peer-to-peer communications to protect its command-and-control infrastructure. Researchers detail its ClickFix delivery, shortcut persistence, and remote command execution features.
Source: BleepingComputer
Microsoft Disrupts 3 Phishing Kits Behind Over 1 Billion Scam Messages
Microsoft, Health-ISAC, JC3, and several private sector partners disrupted three major phishing kits: CoGUI, Haozi, and Iron Man System, which have been flooding victims with scam messages since January 2026. These coordinated takedowns target threat actors responsible for a significant volume of global phishing attacks.
Source: The Hacker News
Citizen Lab Links Zero-Click Candiru Spyware to Al Jazeera via Ads
Researchers at Citizen Lab revealed that Candiru spyware infected Al Jazeera devices through zero-click attacks embedded in online ads, some running invisibly in the background. This highlights a sophisticated spyware campaign using ordinary ads to bypass user interaction.
Source: The Hacker News
Hackers Hijack D-Link and Ubiquiti Devices to Resell Bandwidth
A proxyjacking campaign has compromised D-Link and Ubiquiti devices across 34 countries, selling stolen bandwidth through a commercial residential proxy network. The attack monetizes victims' internet connections without their knowledge.
Source: BleepingComputer
Attackers Delivered Backdoor via AOMEI Backupper Update Server Tampering
Between May and July 2026, attackers intermittently altered files on AOMEI Backupper's update servers to deliver a backdoor to any Windows systems updating during brief windows. This supply-chain compromise risked widespread infection through a trusted backup software.
Source: The Hacker News
Nippon Columbia Malware Incident Exposes 8.7 Million Records
A malware infection at Nippon Columbia, a contractor of Japanese entertainment system maker Daiichi Kosho, exposed over 8.7 million customer and employee records. The breach highlights significant data security risks in third-party vendors.
Source: BleepingComputer
Ledger Confirms Spy Chip Implant Behind Crypto Wallet Thefts
Ledger has verified that several hardware wallets sold through a Southeast Asian reseller, CryptoBilis, were compromised with spy chip implants that enabled thefts of users' cryptocurrencies. This highlights significant supply chain risks for crypto hardware devices.
Source: BleepingComputer
Chinese Hacker Uses ARTEX AI and Claude Agents in South Korean Bank Attacks
A Chinese hacker deployed the ARTEX AI penetration testing suite and Claude agents in cyberattacks targeting South Korean banks earlier this month. This represents a sophisticated use of AI tools in active cyber threat campaigns.
Source: BleepingComputer
CyberXero Uses AI-Powered Attack to Steal Over 628,000 Ukrainian Records
Researchers uncovered a sophisticated AI-augmented campaign leveraging Claude Code and Cobalt Strike to target Ukrainian WordPress sites and critical infrastructure. The operation exfiltrated more than 628,000 records, highlighting AI’s growing role in offensive cyber operations.
Source: The Hacker News
Anthropic Warns AI Could Enable Self-Propagating IoT Botnets
Anthropic warns small AI models may soon self-replicate across IoT devices, forming autonomous botnets that are difficult to control. These worm-like botnets would lack a centralized shutdown point, complicating mitigation efforts.
Source: The Hacker News
NIST, NSA, and CISA Release Incident Readiness Practices for Super Intelligence
NIST, NSA's Super Intelligence Security Center, and CISA published voluntary core practices for incident readiness and response in training and evaluating highly capable super intelligence agents. These guidelines cover controlling agent access, monitoring activities, preserving evidence, containment validation, and reporting incidents.
Source: CISA
How to Keep AI Agents Operating Within Their Permissions
AI agents can misuse valid credentials to exceed their permissions, posing security risks that traditional controls may miss. Token Security offers strategies to enforce agent-specific policies while maintaining operational autonomy.
Source: BleepingComputer
How to Run a Deepfake Readiness Drill Before a Cloned Voice Hits Your Team
Cloned voices and synthetic videos are now being used in payment fraud and access requests. Running a structured drill helps security teams identify verification weaknesses without risk.
Source: The Hacker News
Chapters
- Opening
- Ivanti Warns of Actively Exploited Connect Secure Zero-Day
- Palo Alto Networks alerts on critical PAN-OS RCE zero-day exploited in the wild
- BeyondTrust patches zero-day exploited since August
- Flax Typhoon Exploits Five Flaws Ahead of CISA October 11 Deadline
- Microsoft Patch Tuesday October 2026: Key Vulnerabilities & Snort Rules
- Unpatched AhsayCBS Flaws Exploited to Deploy Webshells and Crypto Miners
- Critical Bricksforge WordPress Flaw Enables Unauthenticated RCE Exploited
- Hackers Exploit Critical RCE Flaw in Collabora to Backdoor Nextcloud
- Inside AvisLoader: New Windows Malware Loader Designed to Resist Disruption
- Attackers Delivered Backdoor via AOMEI Backupper Update Server Tampering
- Critical Docker Hub Flaw Allowed User Impersonation and Image Tampering
- Ledger Confirms Spy Chip Implant Behind Crypto Wallet Thefts
- Microsoft Disrupts 3 Phishing Kits Behind Over 1 Billion Scam Messages
- UAT-11985 Targets Taiwan Research with Google AitM Phishing via Fake Invites
- How to Run a Deepfake Readiness Drill Before a Cloned Voice Hits Your Team
- Critical CVSS 10 Flaw in SAP Cloud SDK for Python Exposes OAuth2 Credentials
- How to Keep AI Agents Operating Within Their Permissions
- Chinese Hacker Uses ARTEX AI and Claude Agents in South Korean Bank Attacks
- CyberXero Uses AI-Powered Attack to Steal Over 628,000 Ukrainian Records
- Anthropic Warns AI Could Enable Self-Propagating IoT Botnets
- NIST, NSA, and CISA Release Incident Readiness Practices for Super Intelligence
- Critical PwnEscape Linux Kernel Flaw Allows Guest VMs to Leak Host Memory
- Hackers Hijack D-Link and Ubiquiti Devices to Resell Bandwidth
- Citizen Lab Links Zero-Click Candiru Spyware to Al Jazeera via Ads
- Nippon Columbia Malware Incident Exposes 8.7 Million Records
- Closing