About this episode
This week connects compromised administrative access, exposed perimeter systems, poisoned software pipelines, ransomware and espionage operations, and the controls organizations need as AI gains access to sensitive systems.
This episode brings together the week’s most relevant cybersecurity stories and their operational context for defenders.
Play the episode, then review the stories and chapter list for the reporting and topics covered.
Stories covered this week
Critical BlockStrap Flaw Allows Code Execution on Magento Servers
A maximum-severity vulnerability (CVE-2026-103849) in BlockStrap affects Magento and Adobe Commerce, enabling potential arbitrary PHP code execution on e-commerce servers. Researchers warn hackers could soon actively exploit this flaw to compromise online stores.
Source: BleepingComputer
Critical FortiSIEM Flaw with Public Exploit Enables Remote Code Execution
A critical Fortinet FortiSIEM vulnerability (CVE-2026-106173) with a CVSS score of 9.4 allows unauthenticated remote code execution via a path traversal flaw. A public proof-of-concept exploit for this recently patched issue has now been released.
Source: The Hacker News
Qilin and INC Ransomware Groups Exploit Palo Alto Networks MFA Bypass Flaw
Palo Alto Networks disclosed ongoing exploitation of CVE-2026-0257, a patched authentication bypass vulnerability affecting PAN-OS and Prisma Access. Ransomware groups Qilin and INC leveraged this flaw to establish unauthorized VPN connections.
Source: The Hacker News
Critical PHP Vulnerabilities Demand Immediate Patching
CISA urges urgent patching for critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 allowing unauthenticated remote code execution. Update PHP to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 without delay to mitigate risk.
Source: CISA
Critical GitLab Flaw (CVSS 10.0) Allows Unauthenticated RCE Since 2014
GitLab patched a critical vulnerability on October 21 that enables unauthenticated remote code execution on self-managed servers, affecting versions from 7.0 released in 2014 through recent releases. Earlier October fixes only covered versions 19.2 and later, making the latest patches essential for full mitigation.
Source: The Hacker News
Multiple High-Severity Vulnerabilities Found in Siemens APOGEE, TALON, and Desigo Products
Siemens announced critical vulnerabilities in APOGEE, TALON, and Desigo PXC/PXM products that could lead to denial-of-service and memory access issues. Patches are available for some products, while others have mitigations recommended due to no planned fixes.
Source: CISA
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited
Arista disclosed a critical zero-day SQL injection vulnerability in its VeloCloud Orchestrator, exploited by attackers to escalate privileges even with read-only accounts. This flaw affects the central management system for VeloCloud SD-WAN networks.
Source: The Hacker News
Nation-State Leveraging AI for Large-Scale Supply Chain Attack
Storm-0940 used ARTEX agentic AI to accelerate a supply chain attack on ConnectWise, enabling misuse of Microsoft 365 credentials. This AI-driven campaign shows significant advancements in automation by state-sponsored threat actors.
Source: Microsoft
China-Aligned Bronze Sandcastle Uses Sandboxie DLL Sideloading for Backdoors
Researchers reveal a China-aligned threat group called Bronze Sandcastle has been exploiting Sandboxie DLL sideloading to deploy backdoors in organizations across Asia and Africa since mid-2025. This technique allows the attackers to bypass traditional security controls and maintain stealthy access.
Source: The Hacker News
INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks
INTERPOL coordinated a global crackdown, disrupting over 10,900 cybercrime networks and arresting 1,462 suspects across 21 countries, recovering $105 million in illicit funds. The operation, called Serengeti III, ran from June to August 2026.
Source: The Hacker News
Russia-Linked Hackers Deploy New Mesh Network Backdoor in Ukraine Attack
Russian state-sponsored group Sandworm and a partner launched a destructive wiping attack against a Ukrainian logistics firm last year using a novel mesh network backdoor. Initial access was gained via spear-phishing with malware-laden attachments in July 2025.
Source: The Hacker News
DHS bans DeepSeek products across US federal civilian agencies
The U.S. Department of Homeland Security has ordered all federal civilian agencies to stop using DeepSeek products and remove them from their systems due to security concerns. This directive affects multiple government agencies and highlights escalating scrutiny on cybersecurity risks posed by third-party software.
Source: BleepingComputer
Hackers Exploit Plex2Shell Flaws to Deploy Crypto Miners and Proxy Backdoor
A chain of four vulnerabilities in Plex Media Server, called Plex2Shell, is being exploited to install cryptocurrency miners and reverse proxy backdoors. This follows the public release of a proof-of-concept exploit.
Source: The Hacker News
Rank Math PRO WordPress Plugin Compromised in Supply-Chain Attack
The Rank Math PRO SEO WordPress plugin was compromised last week through the vendor's official site, distributing malware that installed hidden backdoors on affected websites. This supply-chain attack potentially impacts numerous sites relying on this popular plugin.
Source: BleepingComputer
StopRansomware Advisory: SafePay Ransomware Targets Global Infrastructure
SafePay ransomware has actively targeted over 600 victims globally, exploiting multiple CVEs and using sophisticated tactics to evade detection and demand ransom payments in cryptocurrency. The advisory highlights key mitigations for organizations to defend against SafePay's evolving techniques.
Source: CISA
LiteLLM release pipeline hacked to distribute info-stealer malware
The LiteLLM project’s PyPI package and Docker images were compromised to distribute malware that steals credentials and secrets. This attack targets software supply chains affecting AI-related tooling.
Source: BleepingComputer
Hackers Abuse Compromised ConnectWise Credential to Access 173 M365 Tenants
Unknown threat actors are using compromised ConnectWise Cloud Backup credentials to infiltrate 173 Microsoft 365 tenants, gaining unauthorized access to customer environments. This active campaign targets MSPs leveraging ConnectWise’s cloud backup service.
Source: The Hacker News
OpenCode Console Breach May Have Exposed AI Provider API Keys
On October 16, an intruder accessed a legacy OpenCode system, potentially exposing OpenAI, Anthropic, and Google API keys stored in the OpenCode Console. This breach puts multiple AI service integrations at risk for affected users.
Source: The Hacker News
Zeabur Shuts Down After Second Security Breach in Two Months
Zeabur, a development platform, revealed a security breach involving leaked internal plaintext credentials that led to the theft of over 3.2 million environment variables and data from 321,810 accounts. This marks its second breach within two months, prompting the company to shut down.
Source: BleepingComputer
Japan's Onamae Desktop Cloud hacked, nearly 27,000 servers compromised
Hackers breached Onamae Desktop Cloud, a major Japanese VPS provider, infecting up to 26,739 servers with malware. This incident risks widespread disruption to hosted customer infrastructure.
Source: BleepingComputer
Capcom Confirms Data Breach Affecting 11.7 Million Accounts
Capcom has confirmed a breach in its CAPCOM ID membership service, impacting over 11.7 million customer accounts with exposed email addresses and associated data. The attack highlights ongoing risks to gaming companies' user data security.
Source: BleepingComputer
Hackers Breach Enterprise Firewalls and VPNs Exposing 70,000+ Credentials
Researchers revealed a widespread campaign targeting Fortinet FortiGate and Palo Alto GlobalProtect firewalls, compromising over 70,000 credentials. Attackers gained access to numerous organizations worldwide and are attempting further compromises.
Source: The Hacker News
AI Agents at Risk: Managing Who Commands Your AI Access
AI agents can be exploited through malicious inputs to execute unauthorized actions with granted permissions. Gen Digital's Agent Trust Hub introduces skill verification, secure connectivity, and runtime controls to mitigate these risks.
Source: BleepingComputer
Chapters
- Opening
- Hackers Abuse Compromised ConnectWise Credential to Access 173 M365 Tenants
- Nation-State Leveraging AI for Large-Scale Supply Chain Attack
- Hackers Breach Enterprise Firewalls and VPNs Exposing 70,000+ Credentials
- Qilin and INC Ransomware Groups Exploit Palo Alto Networks MFA Bypass Flaw
- Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited
- Critical FortiSIEM Flaw with Public Exploit Enables Remote Code Execution
- Rank Math PRO WordPress Plugin Compromised in Supply-Chain Attack
- LiteLLM release pipeline hacked to distribute info-stealer malware
- OpenCode Console Breach May Have Exposed AI Provider API Keys
- Zeabur Shuts Down After Second Security Breach in Two Months
- Critical GitLab Flaw (CVSS 10.0) Allows Unauthenticated RCE Since 2014
- Critical PHP Vulnerabilities Demand Immediate Patching
- Critical BlockStrap Flaw Allows Code Execution on Magento Servers
- Hackers Exploit Plex2Shell Flaws to Deploy Crypto Miners and Proxy Backdoor
- StopRansomware Advisory: SafePay Ransomware Targets Global Infrastructure
- China-Aligned Bronze Sandcastle Uses Sandboxie DLL Sideloading for Backdoors
- Russia-Linked Hackers Deploy New Mesh Network Backdoor in Ukraine Attack
- INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks
- Japan's Onamae Desktop Cloud hacked, nearly 27,000 servers compromised
- Capcom Confirms Data Breach Affecting 11.7 Million Accounts
- Multiple High-Severity Vulnerabilities Found in Siemens APOGEE, TALON, and Desigo Products
- DHS bans DeepSeek products across US federal civilian agencies
- AI Agents at Risk: Managing Who Commands Your AI Access
- Closing