{"id":3607,"date":"2026-10-19T15:32:13","date_gmt":"2026-10-19T15:32:13","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3607"},"modified":"2026-10-19T15:32:13","modified_gmt":"2026-10-19T15:32:13","slug":"98-zero-days-rogue-ai-agents-100m-crypto-theft-700-supermarkets-hit-and-more","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3607","title":{"rendered":"98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhTvDNJzlrpPvCifQ9zNcdkc0vjmmRwGCap_kODFlX5W_IimpUgTyObjSefO7gHjXKUMhEkIlmgnH1GbbbWna6eZWa8xcRDLXeRmYX0oSrhAgS8YXth6_T2CPXMMnZvgsf1Psq_DUB9JkjeELLHjnB2xFl9-8bM5BW19fJ1aHcOruzwKErZJkjwRBSRedBq\/s1700-nu-rw-lo-l85-e365\/recap-1.jpg\" style=\"clear: left; display: block; float: left;  text-align: center;\"><\/a><\/div>\n<p>The worst problems don&#8217;t always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done.<\/p>\n<p>This week had plenty of that. Trusted connections became a problem. Hardware wasn&#8217;t as safe as it looked. Old bugs found new victims, and some systems were left so exposed that breaking in barely required any effort. Even AI agents crossed lines they weren&#8217;t supposed to.<\/p>\n<p>Some attacks were clever. Others were painfully simple. The full recap shows just how much can go wrong, and how little it sometimes takes.<\/p>\n<h2 style=\"text-align: left;\"><strong>\u26a1 Threat of the Week<\/strong><\/h2>\n<p><strong>ConnectWise Suspends Cloud Backup Following Unauthorized Access <\/strong>\u2014 ConnectWise disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The IT management software provider said it took the action on October 17, 2026, at 07:00 UTC, adding it has also suspended Cloud Backup service by revoking certificates used for affected application connections across all users.<\/p>\n<h2 style=\"text-align: left;\"><strong>\ud83d\udd14 Top News<\/strong><\/h2>\n<ul>\n<li><strong><a href=\"https:\/\/thehackernews.com\/2026\/10\/china-linked-hackers-exploited.html\" target=\"_blank\">BeyondTrust Remote Support Flaw Exploited as 0-Day <\/strong>\u2014 The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a remote attacker to perform file operations on an affected appliance. According to Google-owned Mandiant, the attack involved the deployment of a lightweight PHP web shell codenamed SAWFLY for interactive remote access and a tunneling program called BARECLAW to route traffic through the device. Only a small number of organizations are assessed to be impacted.<\/li>\n<li><strong>Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages <\/strong>\u2014 Microsoft says it has dismantled a criminal marketplace that sold three phishing kits, namely CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System, that were responsible for sending over 1 billion malicious messages to more than 75,000 organizations worldwide. Redmond said it took down Yam Store (aka Storm-3119), a coordinated underground network that offered commercial phishing-as-a-service (PhaaS) toolkits that allowed other threat actors to readily purchase and deploy phishing pages and steal data and credentials. The kits were also capable of advanced evasion, such as geofencing, fake CAPTCHA gates, IP address blocklists and allowlists, and anti-detection configurations. Yam Store functioned as an initial access broker, peddling not just phishing kits but also infrastructure built on compromised or fraudulently obtained Microsoft and Google cloud environments.<\/li>\n<li><strong>Ledger Finds Unauthorized Hardware Implants <\/strong>\u2014 Cryptocurrency hardware maker Ledger temporarily paused sales of its products via CryptoBilis and other third-party resellers in Southeast Asia and Germany after a backdoor embedded into a handful of wallets led to the theft of an <a href=\"https:\/\/www.zetter-zeroday.com\/who-is-planting-backdoors-in-ledger-crypto-wallets\/\" target=\"_blank\">estimated $100 million in cryptocurrency<\/a>. The implants are said to be an advanced version of a backdoor that hardware hacker Joe Grand found earlier this year and notified Ledger in March 2026. It&#8217;s not clear how this occurred, but signs point to a compromise of Ledger&#8217;s supply chain. One of the victims of the incident is a fraudster who engaged in a task scam and lost more than $4.8 million. \u00abIn this task scam, people were paid to fake sales and reviews of real items,\u00bb Chainalysis <a href=\"https:\/\/x.com\/chainalysis\/status\/2110748973971468382\" target=\"_blank\">said<\/a>. \u00abThen a &#8216;negative balance&#8217; appeared, and they were told to add their own money in order to get paid. On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses. On Oct 9, thieves emptied all three. One transfer each, into the same wallet.\u00bb According to cybersecurity journalist Kim Zetter, Trezor wallet devices sold by third-party non-authorized sellers have also been found to <a href=\"https:\/\/www.zetter-zeroday.com\/trezor-wallets-also-compromised-with-implants\/\" target=\"_blank\">contain implants<\/a> that generated pre-determined seed phrases so as to allow the attackers to guess them easily and gain access to the accounts.<\/li>\n<li><strong>Pwn2Own Ireland Demos 98 0-Days <\/strong>\u2014 The <a href=\"https:\/\/www.zerodayinitiative.com\/blog\/2026\/10\/8\/pwn2own-ireland-2026-day-three-results-amp-master-of-pwn\" target=\"_blank\">Pwn2Own Ireland 2026 hacking contest<\/a> saw white-hat hackers exploiting 98 zero-day flaws, earning them a collective $1,262,000 in rewards. Ikotas Labs came first with 42.5 Master of Pwn points and $361,000 in cash after discovering 12 unique bugs. Xint and Team ZyGoat secured second and third spots. Ikotas Labs, Xint, and Mobile Hacking Lab broke into Google&#8217;s Pixel 10, earning them $150,000, $300,000, and $112,500, respectively. Vendors are expected to patch the zero-days disclosed during the competition within 90 days before the details are publicly disclosed.<\/li>\n<li><strong>OpenAI Disclosed New Misalignment Cases <\/strong>\u2014 OpenAI said internal models hacked more websites, bypassed browsing restrictions, and used cryptocurrency from a wallet it couldn&#8217;t otherwise access, in the latest set of disclosures where its agents carried out unethical and likely illegal acts. In all, the company reported seven new incidents. The development came as the Indian Computer Emergency Response Team (CERT-In) said it received \u00abmultiple voluntary disclosures from AI model providers\u00bb whose models, during research and evaluation runs on the open internet, accessed personal data from Indian organizations. The agents found their way in through credentials and connection settings left exposed in app configurations, public code repositories, and overly permissive cloud roles. CERT-In did not name the providers or affected organizations.<\/li>\n<li><strong>OpenAI Engineer Charged <\/strong>\u2014 The U.S. Department of Justice charged an OpenAI engineer, Abdulrahman Alfozan, with attempting to intercept oral communications after allegedly planting a recording device in an executive conference room. Prosecutors claimed company security staff found a second device in his bag. CCTV footage placed the defendant near the conference room on several dates. Alfozan allegedly had no authority to access or participate in meetings held in the room, which is often reserved for the highest-level discussions. In a subsequent filing, federal prosecutors revealed that Alfozan had booked a one-way ticket from San Francisco to Saudi Arabia with his wife and a third family member before his arrest on October 9, 2026.<\/li>\n<li><strong>Attacks on French Refrigeration Systems <\/strong>\u2014 Cyber attacks on Danfoss- and Copeland-managed refrigeration systems pushed temperatures as high as 50\u00b0C (122\u00b0F) for roughly six hours, impacting over <a href=\"https:\/\/www.bloomberg.com\/news\/articles\/2026-10-12\/french-supermarket-refrigeration-sites-hit-by-cyberattacks\" target=\"_blank\">700 French supermarkets<\/a> and forcing them to discard food. French cybersecurity authorities advised supermarkets to disconnect them from the internet. The attacks targeted Intermarch\u00e9 and Netto, Coop\u00e9rative U, Carrefour, Monoprix, and E.Leclerc. The affected systems are said to be internet-facing and running outdated firmware. \u00abThe username is admin and the password changes every day automatically to.. the current date,\u00bb security researcher Kevin Beaumont <a href=\"https:\/\/cyberplace.social\/@GossiTheDog\/117429502412235079\" target=\"_blank\">said<\/a>. \u00abEvery single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.\u00bb To make matters worse, the affected stores likely also failed to put the devices behind a VPN and create an allowlist of trusted IP addresses permitted to log in. \u00abTwo things would have changed the outcome,\u00bb Pen Test Partners <a href=\"https:\/\/www.pentestpartners.com\/security-blog\/you-dont-need-a-nation-state-to-warm-up-a-fridge\/\" target=\"_blank\">said<\/a>. \u00abCyber hygiene would have prevented the access: take the controller off the public internet, put remote access behind a VPN and an IP allowlist, bring third-party kit onto the network in a controlled, owned and documented way rather than leaving it on a contractor&#8217;s own connection, change known and default credentials, and patch to a current release.\u00bb Multiple <a href=\"https:\/\/claroty.com\/team82\/research\/chilling-discoveries-unpacking-vulnerabilities-in-copeland-xweb-pro-controllers\" target=\"_blank\">vulnerabilities<\/a> have been <a href=\"https:\/\/claroty.com\/team82\/research\/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers\" target=\"_blank\">disclosed<\/a> in the <a href=\"https:\/\/www.cisa.gov\/news-events\/ics-advisories\/icsa-25-140-03\" target=\"_blank\">affected<\/a> <a href=\"https:\/\/www.cisa.gov\/news-events\/ics-advisories\/icsa-26-057-10\" target=\"_blank\">models<\/a>, with Claroty warning that the issues could be exploited to \u00abdefrost the food.\u00bb<\/li>\n<li><strong>Collabora RCE Flaw Exploited to Backdoor Nextcloud Servers <\/strong>\u2014 Threat actors are exploiting a critical command execution flaw, tracked as CVE-2026-110447 (CVSS score: 9.2), in the Collabora Online &#8211; Built-in CODE Server app for Nextcloud to backdoor servers. It has been patched in version 26.4.303. The attacks involve issuing a malicious request to the app&#8217;s \u00abproxy.php\u00bb endpoint to trigger command injection and plant a PHP web shell with the end goal of conducting reconnaissance and searching for password databases, password manager artifacts, and cryptocurrency wallets. <\/li>\n<\/ul>\n<h2 style=\"text-align: left;\"><strong>\u200e\ufe0f\u200d\ud83d\udd25 Trending CVEs<\/strong><\/h2>\n<p>Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.<\/p>\n<p>Check the list, patch what you have, and hit the ones marked urgent first \u2014 <a href=\"https:\/\/docs.progress.com\/bundle\/marklogic-server-whats-new-11\/page\/topics\/release-notes.html\" target=\"_blank\">CVE-2026-9192, CVE-2026-85947, CVE-2026-85948, CVE-2026-85955, CVE-2026-85956, CVE-2026-9191<\/a> (Progress Software MarkLogic Server), <a href=\"https:\/\/docs.gitlab.com\/releases\/patches\/patch-release-gitlab-19-4-2-released\/\" target=\"_blank\">CVE-2026-97229, CVE-2026-92883, CVE-2026-16301, CVE-2026-14814<\/a> (GitLab), <a href=\"https:\/\/kb.cert.org\/vuls\/id\/162329\" target=\"_blank\">CVE-2026-103521, CVE-2026-103522, CVE-2026-103523, CVE-2026-103524, CVE-2026-103526, CVE-2026-103527, CVE-2026-103528, CVE-2026-103529, CVE-2026-103535, CVE-2026-103537, CVE-2026-107248<\/a> (Thelia), <a href=\"https:\/\/www.docker.com\/blog\/docker-hub-security-advisory-cve-2026-105445\/\" target=\"_blank\">CVE-2026-105445<\/a> (Docker), <a href=\"https:\/\/support.sap.com\/en\/my-support\/knowledge-base\/security-notes-news\/october-2026.html\" target=\"_blank\">CVE-2026-89111, CVE-2026-89110, CVE-2026-89107, CVE-2026-89108, CVE-2026-89113<\/a> (<a href=\"https:\/\/onapsis.com\/blog\/sap-security-patch-day-october-2026\/\" target=\"_blank\">SAP<\/a>), <a href=\"https:\/\/www.wordfence.com\/blog\/2026\/10\/wordfence-argus-discovers-critical-vulnerability-in-ghostscript-the-program-that-turns-uploaded-pdfs-into-thumbnails-on-your-server\/\" target=\"_blank\">CVE-2026-39919<\/a> (Ghostscript), <a href=\"https:\/\/www.adobe.com\/trust\/security\/bulletins-and-advisories.html\" target=\"_blank\">CVE-2026-103849<\/a> aka <a href=\"https:\/\/sansec.io\/research\/blockstrap-magento-rce\" target=\"_blank\">BlockStrap<\/a>, <a href=\"https:\/\/www.adobe.com\/trust\/security\/bulletins-and-advisories.html\" target=\"_blank\">CVE-2026-92909, CVE-2026-91013, CVE-2026-100133, CVE-2026-92464, CVE-2026-105899, CVE-2026-106622, CVE-2026-105903, CVE-2026-106612, CVE-2026-106624, CVE-2026-75994, CVE-2026-106620, CVE-2026-90530, CVE-2026-106621, CVE-2026-106619, CVE-2026-90532, CVE-2026-48383, CVE-2026-48382, CVE-2026-105895, CVE-2026-103848, CVE-2026-75732, CVE-2026-90531, CVE-2026-83662, CVE-2026-106630, CVE-2026-106629, CVE-2026-106626<\/a> (Adobe), <a href=\"https:\/\/kb.cert.org\/vuls\/id\/456950\" target=\"_blank\">CVE-2026-110005<\/a> (Komodo Periphery Agent), <a href=\"https:\/\/kb.cert.org\/vuls\/id\/382143\" target=\"_blank\">CVE-2026-16753<\/a> (Lowcoder), <a href=\"https:\/\/kb.cert.org\/vuls\/id\/157374\" target=\"_blank\">CVE-2026-104937<\/a> (Shopware), <a href=\"https:\/\/www.fortiguard.com\/psirt\/FG-IR-26-185\" target=\"_blank\">CVE-2026-107656<\/a> (Fortinet FortiSandbox), <a href=\"https:\/\/www.fortiguard.com\/psirt\/FG-IR-26-180\" target=\"_blank\">CVE-2026-106173<\/a> (Fortinet FortiSIEM), <a href=\"https:\/\/www.zoom.com\/en\/trust\/security-bulletin\/\" target=\"_blank\">CVE-2026-108184, CVE-2026-108185, CVE-2026-53420, CVE-2026-53418<\/a> (Zoom), <a href=\"https:\/\/github.com\/MariaDB\/server\/security\/advisories\" target=\"_blank\">CVE-2026-107815, CVE-2026-107821, CVE-2026-102523, CVE-2026-107819, CVE-2026-107814<\/a> (MariaDB), <a href=\"https:\/\/www.ibm.com\/support\/pages\/node\/7291628\" target=\"_blank\">CVE-2026-78401, CVE-2026-78406, CVE-2026-16916, CVE-2026-16823, CVE-2026-19491<\/a> (IBM Verify Identity Access and Security Verify Access), <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/releaseNote\/2026-Oct\" target=\"_blank\">CVE-2026-96951, CVE-2026-108398, CVE-2026-92707, CVE-2026-70242, CVE-2026-102866, CVE-2026-105016, CVE-2026-65674<\/a>, <a href=\"https:\/\/blog.doyensec.com\/2026\/10\/13\/Sfape.html\" target=\"_blank\">CVE-2026-83498<\/a> (Microsoft Windows), <a href=\"https:\/\/github.com\/zhangutah\/security-research\/tree\/main\/pocs\/linux\/cve-2026-74580\" target=\"_blank\">CVE-2026-74580<\/a> aka Vghost, <a href=\"https:\/\/vercel.com\/blog\/findings-from-the-1-million-dollar-vercel-sandbox-challenge\" target=\"_blank\">CVE-2026-99999<\/a> aka PwnEscape (<a href=\"https:\/\/allelesecurity.com\/intro-linux-kernel-exploitation-part-4\/\" target=\"_blank\">Linux kernel<\/a>), <a href=\"https:\/\/chromereleases.googleblog.com\/2026\/10\/stable-channel-update-for-desktop_01668083673.html\" target=\"_blank\">CVE-2026-110152, CVE-2026-110149, CVE-2026-110136, CVE-2026-110161, CVE-2026-110165, CVE-2026-110148, CVE-2026-110151<\/a>, <a href=\"https:\/\/chromereleases.googleblog.com\/2026\/10\/stable-channel-update-for-desktop_01886704284.html\" target=\"_blank\">CVE-2026-110922<\/a> (Google Chrome), <a href=\"https:\/\/www.mozilla.org\/en-US\/security\/advisories\/mfsa2026-106\/\" target=\"_blank\">from CVE-2026-109704 through CVE-2026-109733<\/a> (Mozilla Firefox), <a href=\"https:\/\/support.citrix.com\/support-home\/kbsearch\/article?articleNumber=CTX697187&amp;articleURL=Citrix_UniconOS_Security_Bulletin_CVE_2026_53562_CVE_2026_53563_and_CVE_2026_53564\" target=\"_blank\">CVE-2026-84419, CVE-2026-84420, CVE-2026-53562, CVE-2026-53563, CVE-2026-53564<\/a> (Citrix), <a href=\"https:\/\/www.rapid7.com\/blog\/post\/ve-breaking-zimbra-identity-boundaries-part-1\/\" target=\"_blank\">CVE-2026-93637, CVE-2026-93635, CVE-2026-73571, CVE-2026-10631, CVE-2026-50055<\/a> (Zimbra Collaboration Suite), <a href=\"https:\/\/security.paloaltonetworks.com\/CVE-2026-0322\" target=\"_blank\">CVE-2026-0322<\/a> (Palo Alto Networks PAN-OS), <a href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-esa-afw-zqYJkjxp\" target=\"_blank\">CVE-2026-76519<\/a> (Cisco Secure Email Gateway), <a href=\"https:\/\/github.com\/CollaboraOnline\/online\/security\/advisories\/GHSA-g3vx-3m76-fghh\" target=\"_blank\">CVE-2026-110447<\/a> (Collabora Online &#8211; Built-in CODE Server app), <a href=\"https:\/\/previdian.com\/CVE-2026-39949\" target=\"_blank\">CVE-2026-39949<\/a> (Cacti), <a href=\"https:\/\/previdian.com\/CVE-2026-0702\" target=\"_blank\">CVE-2026-0702<\/a> (VidShop \u2013 Shoppable Videos for WooCommerce WordPress plugin), <a href=\"https:\/\/www.tenable.com\/security\/tns-2026-27\" target=\"_blank\">CVE-2026-106126<\/a> (Tenable Identity Exposure), <a href=\"https:\/\/www.tenable.com\/security\/tns-2026-26\" target=\"_blank\">CVE-2026-103947, CVE-2026-103946<\/a> (Tenable Nessus), <a href=\"https:\/\/www.tp-link.com\/us\/support\/faq\/5333\/\" target=\"_blank\">CVE-2026-105672, CVE-2026-105673, CVE-2026-105674<\/a> (TP-Link Tapo C325WB), <a href=\"https:\/\/curl.se\/docs\/CVE-2026-92392.html\" target=\"_blank\">CVE-2026-92392<\/a>, <a href=\"https:\/\/aisle.com\/blog\/one-aisle-curl-audit-produced-24-cves-18-ship-today\" target=\"_blank\">from CVE-2026-86409 through CVE-2026-86415, from CVE-2026-87862 through CVE-2026-87866, from CVE-2026-92387 through CVE-2026-92391<\/a> (curl), <a href=\"https:\/\/my.f5.com\/manage\/s\/article\/K000163408\" target=\"_blank\">CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-95101, CVE-2026-97629<\/a> (F5 NGINX), <a href=\"https:\/\/kb.cert.org\/vuls\/id\/166125\" target=\"_blank\">CVE-2026-100156, CVE-2026-96679, CVE-2026-96681<\/a> (Bisheng), <a href=\"https:\/\/kb.cert.org\/vuls\/id\/948176\" target=\"_blank\">CVE-2026-34073<\/a> (multiple TLS libraries), <a href=\"https:\/\/github.com\/advisories\/GHSA-qhr7-h655-pw6r\" target=\"_blank\">CVE-2026-44825<\/a> (Apache Solr), <a href=\"https:\/\/www.ibm.com\/support\/pages\/node\/7290694\" target=\"_blank\">CVE-2026-104334, CVE-2026-97676, CVE-2026-97678, CVE-2026-97673, CVE-2026-97655, CVE-2026-97679, CVE-2026-88962, CVE-2026-93674, CVE-2026-93675 CVE-2026-104335<\/a>, <a href=\"https:\/\/www.ibm.com\/support\/pages\/node\/7286666\" target=\"_blank\">CVE-2026-85025, CVE-2026-79724, CVE-2026-81941, CVE-2026-81204, CVE-2026-81211, CVE-2026-81940, CVE-2026-78569, CVE-2026-78575, CVE-2026-76059, CVE-2026-79742, CVE-2026-78571<\/a>, <a href=\"https:\/\/github.com\/langflow-ai\/langflow\/security\/advisories\/GHSA-7w94-79vh-5mr2\" target=\"_blank\">CVE-2026-105740<\/a> (Langflow), <a href=\"https:\/\/www.ox.security\/blog\/by-default-insecure-apache-airflow-disables-ssh-host-key-verification\/\" target=\"_blank\">CVE-2026-94134, CVE-2026-94135<\/a> (Apache Airflow), <a href=\"https:\/\/remedio.io\/blog\/cve-2026-81983-integer-overflow-vulnerability-enables-out-of-bounds-write-in-adobe-acrobat\/\" target=\"_blank\">CVE-2026-81983<\/a> (Adobe Acrobat), CVE-2026-79610, CVE-2026-102700, CVE-2026-102701, CVE-2026-79611 (<a href=\"https:\/\/xenbits.xen.org\/xsa\/\" target=\"_blank\">Xen Project<\/a>\/<a href=\"https:\/\/support.citrix.com\/support-home\/kbsearch\/article?articleNumber=CTX697170&amp;articleURL=XenServer_Security_Update_for_CVE_2026_79610_CVE_2026_79610_CVE_2026_102700_and_CVE_2026_102701\" target=\"_blank\">Citrix XenServer<\/a>), <a href=\"https:\/\/corelight.com\/blog\/cve-2026-70111-microsoft-distributed-file-system-0-day\" target=\"_blank\">CVE-2026-70111<\/a> (Microsoft Windows Server), <a href=\"https:\/\/simonkoeck.com\/writeups\/react-rsc-formdata-event-loop-dos\" target=\"_blank\">CVE-2026-23870<\/a> (React Server Components), <a href=\"https:\/\/blog.gitea.com\/release-of-28.0.0\/\" target=\"_blank\">CVE-2026-103059, CVE-2026-70357, CVE-2026-101027, CVE-2026-89430, CVE-2026-104632, CVE-2026-94205<\/a> (Gitea), <a href=\"https:\/\/github.com\/wolfSSL\/wolfssh\/releases\/tag\/v1.6.0-stable\" target=\"_blank\">CVE-2026-16516, CVE-2026-83540, CVE-2026-84897, CVE-2026-83540<\/a> (WolfSSH), <a href=\"https:\/\/nextjs.org\/blog\/nextjs-security-update-october-14-2026\" target=\"_blank\">GHSA-673q-mjm6-r5xr, CVE-2026-96889, GHSA-p3m5-59mp-jv5r<\/a> (Next.js), <a href=\"https:\/\/www.drupal.org\/psa-2026-10-12\" target=\"_blank\">CVE-2026-108097, CVE-2026-108099<\/a> (Drupal), <a href=\"https:\/\/support.confluent.io\/hc\/en-us\/articles\/54133146724244-CONFSA-2026-22-CVE-2026-15911-Confluent-Kafka-Python-Client-Vulnerability-TLS-Certificate-verification-disabled-by-default-in-HashiCorp-Vault-KMS-Integration\" target=\"_blank\">CVE-2026-15911<\/a> (<a href=\"https:\/\/github.com\/rahulreddykarne\/CVE-2026-15911-Confluent_Kafka\" target=\"_blank\">confluent-kafka<\/a>), <a href=\"https:\/\/www.beyondtrust.com\/trust-center\/security-advisories\/bt26-05\" target=\"_blank\">CVE-2026-102764<\/a> (BeyondTrust Remote Support), <a href=\"https:\/\/unit42.paloaltonetworks.com\/fortimanager-cve-2024-47575-peerstitch-malware\/\" target=\"_blank\">CVE-2025-61624<\/a> (Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager), <a href=\"https:\/\/www.ivanti.com\/en-gb\/blog\/october-2026-security-update\" target=\"_blank\">CVE-2026-104935<\/a> (Ivanti Connect Secure), and <a href=\"https:\/\/kb.cert.org\/vuls\/id\/410595\" target=\"_blank\">multiple vulnerabilities<\/a> in Google BoringSSL. <\/p>\n<h2 style=\"text-align: left;\"><strong>\ud83c\udfa5 Cybersecurity Webinars<\/strong><\/h2>\n<ul>\n<li><strong><a href=\"https:\/\/thehacker.news\/ai-insider-threat\" target=\"_blank\">How to Find Hidden AI Agents on Employee Devices and Bring Them Under Control<\/a> <\/strong>\u2192 AI agents are quietly becoming a new insider threat, gaining access to company data, credentials, and internal systems without adequate security oversight. Join this webinar to learn how to uncover hidden AI agents on employee devices, detect malicious agent skills, identify risky permissions, and put practical controls in place before they lead to a security incident.<\/li>\n<li><strong><a href=\"https:\/\/thehacker.news\/ai-threat-readiness\" target=\"_blank\">How to Find Security Gaps and Build Faster Defenses Against AI-Powered Cyberattacks<\/a><\/strong> \u2192 AI-powered cyberattacks are evolving faster than traditional defenses can keep up. Join this webinar to learn how to assess your organization&#8217;s AI threat readiness, uncover critical security gaps, strengthen detection and response capabilities, and build a practical defense strategy against emerging AI-driven threats.<\/li>\n<\/ul>\n<h2 style=\"text-align: left;\"><strong>\ud83d\udcf0 Around the Cyber World<\/strong><\/h2>\n<ul>\n<li>Meta said it addressed an issue after reports emerged that some <strong>Ray-Ban Meta smart glasses<\/strong> were recording people&#8217;s conversations without the wearer knowing. The recordings occurred without users saying the \u00abHey, Meta\u00bb prompt phrase. \u00abThis issue has been resolved,\u00bb Meta <a href=\"https:\/\/www.androidauthority.com\/ray-ban-meta-glasses-listening-3722586\/\" target=\"_blank\">told<\/a> Android Authority. \u00abPeople can manage, review, and delete voice logs of their interactions with Meta AI via settings at any time.\u00bb Meta did not say what caused the smart glasses to record people without user consent, or how many of them were affected.<\/li>\n<li>Fortra said it&#8217;s tracking a <strong>12-fold increase in emails<\/strong> using requests for quotation, project invitations, and procurement inquiries as phishing lures from October 2025 to September 2026. \u00abThese messages impersonate prospective buyers seeking pricing, availability, or project participation,\u00bb Fortra <a href=\"https:\/\/www.fortra.com\/blog\/rise-rfq-and-project-invitation-scams\" target=\"_blank\">said<\/a>. \u00abTheir purpose is not to obtain a legitimate quote, but to persuade a recipient to access an attacker-controlled file-sharing, document-viewing, or procurement portal.\u00bb<\/li>\n<li>A <strong>fake download site<\/strong> for the WatchGuard Mobile VPN with SSL (\u00abwatchguard-vpn[.]net\u00bb) has been observed using a browser pop-up prompt to steal the victim&#8217;s VPN server address, username, and password. As of October 13, the domain was offline. \u00abIn a unique twist, after collecting credentials twice (the first attempt gets rejected as &#8216;incorrect&#8217; in a likely attempt to collect multiple credentials), the site then downloads the genuine, validly signed WatchGuard installer directly from WatchGuard&#8217;s own content delivery network (CDN), meaning there is no malicious file for endpoint security tools to flag,\u00bb Huntress <a href=\"https:\/\/www.huntress.com\/blog\/fake-watchguard-vpn-credential-phishing\" target=\"_blank\">said<\/a>. \u00abMeanwhile, unbeknownst to the victim, the threat actor now has access to their credentials, giving them access to victims&#8217; networks.\u00bb<\/li>\n<li>A set of <strong>42 malicious RubyGems packages<\/strong> has used typosquatting, brandjacking, and plausible utility names to target cryptocurrency and Web3 developers. The packages are designed to spawn a reverse shell and download a crypto theft kit capable of rerouting cryptocurrency transactions by replacing the destination address with an attacker-controlled wallet and harvesting wallet material, such as seed phrases and private keys. The names of some of the packages are: lightinng-invoice, cryoto-toolbox, etheremu.rb, bitcoin-rpc-lite, web3-sign-helper, and crypto-mnemonic-tools. The activity has been codenamed <a href=\"https:\/\/opensourcemalware.com\/blog\/malicious-crypto-shell\" target=\"_blank\">Ghost Dev<\/a> by Open Source Malware.<\/li>\n<li>GreyNoise said it has <a href=\"https:\/\/www.greynoise.io\/blog\/hikvision-camera-exploitation-attempts-ukraine\" target=\"_blank\">observed<\/a> a spike in scanning and exploitation attempts targeting Digital Video Recorders (DVRs) in Ukraine between September 21 and October 1, 2026. The majority of the activity attempts to exploit <strong><a href=\"https:\/\/www.hikvision.com\/en\/support\/cybersecurity\/security-advisory\/security-notification-command-injection-vulnerability-in-some-hikvision-products\/security-notification-command-injection-vulnerability-in-some-hikvision-products\/\" target=\"_blank\">CVE-2021-36260<\/a><\/strong>, which allows unauthenticated command injection against unpatched Hikvision products.<\/li>\n<li>A series of email campaigns have been targeting the <strong>accommodation industry<\/strong> with fake guest complaints or reviews that deliver blockchain technology-abusing malware. \u00abThese emails appear to likely be a continuation of a prior series of predominantly Booking.com-spoofing emails that were seen delivering various remote access trojans (RAT) via ClickFix fake CAPTCHA websites,\u00bb Cofense <a href=\"https:\/\/cofense.com\/blog\/from-guest-complaints-to-malware-blockchain-abuse-targets-hotels\" target=\"_blank\">said<\/a>. The activity leveraged the Ethereum and TON blockchains, a technique called EtherHiding, to deliver EtherRAT and TONResolver malware.<\/li>\n<li>As AI agents increasingly are being used to automate coding workflows, it increases the risk associated with <strong>credential exposure<\/strong>, Trellix warned. \u00abAgents constantly take credentials out of the safe places your operating system keeps them, and put them somewhere far more exposed,\u00bb Trellix <a href=\"https:\/\/www.trellix.com\/blogs\/research\/unseen-credential-surface-ai-agents-expose-secrets\/\" target=\"_blank\">said<\/a>. \u00abThis happens as a normal side effect of everyday work. And even good security telemetry has a hard time distinguishing this from a developer doing their job &#8212; or from an attacker who is already inside.\u00bb<\/li>\n<li>MITRE <a href=\"https:\/\/medium.com\/mitre-attack\/attack-v20-9701dd75ffb4\" target=\"_blank\">released<\/a> version 20 of its <strong>ATT&amp;CK framework<\/strong>, adding entries that cover AI abuse, MFA bypass, and recent attacks on water utilities. This includes <a href=\"https:\/\/attack.mitre.org\/resources\/updates\/updates-october-2026\/\" target=\"_blank\">nine new Techniques and Sub-Techniques<\/a> under the Enterprise domain for prompt injection, AI-enabled exfiltration, AI result poisoning, attacks on AI-assisted defenses, CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) evasion, and application-specific password theft. For Mobile, MITRE also un-deprecated a technique for delivering malicious apps outside official app stores, last included in v11.<\/li>\n<li><strong>Fake AI tool campaigns<\/strong> that impersonate Claude, ChatGPT, GitHub Copilot, Gemini, and other AI brands are being used to plant infostealers on compromised systems using ClickFix lures. Some of the prominent targets include the U.S. and India. \u00abThe attacks share one trait: the employee performs the decisive step,\u00bb ANY.RUN <a href=\"https:\/\/any.run\/cybersecurity-blog\/fake-ai-tools-us-companies\/\" target=\"_blank\">said<\/a>. \u00abThey paste an &#8216;install command,&#8217; run a convincing installer, or sign in to a fake window. That can put source code, cloud and AI API keys, active business sessions, ad accounts, and billing access at risk, turning a single user action into potential data exposure, account compromise, financial loss, or disruption to development and marketing operations.\u00bb<\/li>\n<li>An official OpenAI skill, <strong>render-deploy<\/strong>, suffered from a first-of-its-kind supply-chain vulnerability which instructed production apps to send their tokens to an unregistered domain (\u00abrender-internal[.]com\u00bb). \u00abIt builds apps that trust a domain nobody owns, so any attacker could register it and start receiving tokens from real production apps,\u00bb AIR Security said. \u00abVulnerable servers in the wild sent tokens to the domain, users are advised to update to the patched version of the skill.\u00bb<\/li>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh8_TGtUOPnmsiRmjCh7VXzOxk_McJg87GFb-uKjrJIUKHpsv9cot2NBj_lmsNRoYws0ic9zJTyYHOC6lb-WpzCWgTsjT3dDeHFA3gZc-UbeMZ9f3fZeyF2ArTqH2Z9JE6URGuYCZYZ4EJdxfG93Y-l4tcZgrxuwBJEnRTeyZONNO0OnzrN1HH3s8ZF4BK_\/s1700-nu-rw-lo-l85-e365\/domain-air.jpg\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh8_TGtUOPnmsiRmjCh7VXzOxk_McJg87GFb-uKjrJIUKHpsv9cot2NBj_lmsNRoYws0ic9zJTyYHOC6lb-WpzCWgTsjT3dDeHFA3gZc-UbeMZ9f3fZeyF2ArTqH2Z9JE6URGuYCZYZ4EJdxfG93Y-l4tcZgrxuwBJEnRTeyZONNO0OnzrN1HH3s8ZF4BK_\/s1700-nu-rw-lo-l85-e365\/domain-air.jpg\" alt=\"\" border=\"0\" data-original-height=\"1908\" data-original-width=\"3840\"\/><\/a><\/div>\n<li>The U.S. Federal Bureau of Investigation (FBI) warned that scammers could exploit the <strong>2026 U.S. midterm election<\/strong> to perpetrate financial fraud schemes. \u00abAs previously reported, scammers use the names, images, logos, and slogans of candidates to fraudulently solicit campaign contributions, sell merchandise that is never delivered, or steal personally identifiable information (PII) that can be used for other fraud,\u00bb the FBI <a href=\"https:\/\/www.ic3.gov\/PSA\/2026\/PSA261015-3\" target=\"_blank\">said<\/a>. \u00abScammers also exploit artificial intelligence (AI) tools to generate highly realistic voices, images, and written messages that impersonate candidates, campaigns, government entities, and trusted contacts.\u00bb<\/li>\n<li>A new study from Semperis revealed that ransomware actors are threatening their victims with <strong>physical violence<\/strong> as part of triple extortion schemes. In all, 40% of attacks in the past 12 months involved psychological or physical threats against staff. \u00abBad actors are threatening victims with psychological intimidation in nearly 25% of all attacks in the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada and Australia,\u00bb Semperis <a href=\"https:\/\/www.semperis.com\/press-release\/semperis-2026-ransomware-report-reveals-increases-in-ai-driven-attacks-and-a-rise-in-physical-threats-against-executives-and-their-families\/\" target=\"_blank\">said<\/a>. \u00abIn 53% of cases, the victims reported that the hackers followed through on their threats; 24% of victims or family members were swatted; 25% of victims sought psychological and medical treatment because of the ransomware attack; and 24% of victims or families hired personal security.\u00bb<\/li>\n<\/ul>\n<h2 style=\"text-align: left;\"><strong>Conclusion<\/strong><\/h2>\n<p>If there&#8217;s one thing this week made clear, it&#8217;s that small gaps can lead to big problems. A weak password, an old bug, a trusted connection, or a device that wasn&#8217;t checked properly. None of these sounds unusual on its own. But attackers keep finding ways to turn them into something much worse.<\/p>\n<p>The lesson isn&#8217;t to worry about every new threat. It&#8217;s to pay closer attention to the things we already know can go wrong. Check what&#8217;s exposed, question what you trust, fix what you can, and don&#8217;t assume something is safe just because it&#8217;s been working fine. Sometimes the simplest checks prevent the biggest headaches.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The worst problems don&#8217;t always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3608,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[3838,335,143,434,699,3839,526,53],"class_list":["post-3607","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-100m","tag-agents","tag-crypto","tag-hit","tag-rogue","tag-supermarkets","tag-theft","tag-zerodays"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3607","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3607"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3607\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3608"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3607"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3607"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3607"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}