246 casos · pág. 4/13
OpenCode, the open-source AI agent framework developed by Anomaly, confirmed on October 17 a security breach that occurred the night before and affected its Console service. Console stores each workspace's third-party AI provider credentials centrally. About 1.4% of Console users, those with external providers linked, may have had OpenAI,…
Siemens warned customers that attackers are actively exploiting CVE-2026-110936 (CVSS 8.4), a DLL side-loading vulnerability in Siemens Software Center, to distribute malware. The activity is attributed to the Romulus multi-platform ClickFix campaign. Romulus is a server hosting panel identified by Forescout researchers on October 14 that…
Pillar Security researcher Eilon Cohen disclosed on October 19 a critical remote code execution flaw in the open-source agentic AI coding tool OpenCode (developed by Anomaly), affecting versions 1.0.137 to 1.18.32 on Windows and WSL. A malicious remote MCP server can execute arbitrary code on a developer's machine during the MCP OAuth aut…
Flashpoint's weekly Middle East brief for October 9-15 describes sustained kinetic escalation alongside cyber and information operations. Ansarallah (Houthis) ran a multi-day missile, drone and cruise-missile campaign against King Khalid International Airport in Riyadh. It killed at least 14 people and closed the airport through at least …
The Wiz Customer Incident Response Team (CIRT) reports a growing number of intrusions in which an AI agent system ran the entire operation: finding entry points, harvesting credentials, pivoting across platforms and debugging its own scripts in real time. In one investigated case, the agent compromised a large multi-cloud organization (GC…
Recorded Future's Insikt Group tracks the actor behind the October 2026 AI-assisted intrusions into South Korean financial institutions as TAG-217. The group was testing infrastructure and assembling attack tools as early as August 2026, weeks before the campaign became public. South Korea's Financial Services Commission (FSC) disclosed t…
Recorded Future's Insikt Group reports on TAG-193, a cluster that ran a sustained intelligence-collection campaign against government bodies from early 2025 through May 2026. Targets include diplomacy, economic development, agriculture and environmental agencies in Russia, Tajikistan, Belarus, Armenia and Uzbekistan. Lure documents and im…
Huntress analyzed an active credential-phishing campaign in which the lookalike domain watchguard-vpn.net harvests WatchGuard SSL VPN credentials. On October 7, 2026, an administrator at a managed service provider searched Bing for "watchguard vpn sll download" and clicked through to the fake page, which Huntress classifies as SEO poisoni…
A Chinese-speaking operator used the open-source AI agent framework Cairn to run autonomous attacks against more than 1,200 sites, reaching websites of over 100 companies, including Deere, SharkNinja and Cummins. Researcher Snorre Fagerland of NorForge found the operation around 2 October 2026 by scanning for about two dozen exposed Cairn…
Yokai Research (Hakai Security) published an analysis and a public proof-of-concept for GHSA-f9x3-7vq9-cph6, a critical authentication bypass (CVSS v4 9.2) in the Laravel framework's built-in TokenGuard, which backs auth:api. The flaw was discovered by KIKOmanasijev and reported via the GitHub Security Advisory program. When the user tabl…
Bullhorn, a US-based recruitment software provider serving more than 10,000 customers, disabled access to its platform after detecting a cyber incident on October 16-17, 2026. The company engaged CrowdStrike to investigate and restore services. Systems are back online in the UK, US and Australia, but as of October 20 some users still had …
Threat actors are abusing the open source AI platform Cairn, an agent-coordination engine usable as an autonomous penetration testing tool, to automate attacks on hundreds of websites worldwide. AI security firm Norforge found the activity after threat actors left their Cairn panels exposed, following a Gambit Security report on attackers…
Between April and July 2026, the threat actor UNC7017 tampered with the AOMEI Backupper update infrastructure several times to deliver the CrossRoad downloader and the ShinyRoad modular backdoor. Each tampering window lasted only five to ten minutes before reverting to authentic files. This made the campaign hard to detect and suggests it…
ConnectWise said it is still responding to a security incident involving unauthorized access to application identities tied to Cloud Backup. The incident was identified on October 14, 2026, and mitigations began rolling out on October 17. The company has disabled the affected application connections, suspended Cloud Backup, and suspended …
Germany's Alternative für Deutschland (AfD) confirmed on 19 October 2026 that a hosting provider used by the party was hacked in September and that mailboxes were copied. The anonymous site hexane.cc went online claiming to index 421,179 internal party emails. It does not publish the emails. It shows AI-generated summaries sorted into cat…
Ahold Delhaize, one of the world's largest food retailers, confirmed that a cyberattack discovered last week forced it to take systems offline, including brand websites and apps, in Europe and the United States. Affected brands include Albert Heijn, Etos and Gall & Gall in the Netherlands, Delhaize in Belgium, and Stop & Shop in the US, w…
An attacker pushed forged commits to the default branches of two unrelated GitHub projects, hugo-paper and mevn-cli. The commits add a preinstall hook (scripts/preinstall.js) that downloads and silently runs a second-stage script from buildwithknexus.xyz during npm install or bun install. The commits copy the author, date and message of t…
Zscaler ThreatLabz's 2026 Ransomware Report describes ransomware operators using generative AI to sharpen phishing, speed up reconnaissance and pick out the most sensitive corporate data to steal. The report records 896.2 TB exfiltrated by the top 10 ransomware groups between April 2025 and March 2026. The article cites a 275.8% annual in…
Paradigm Healthcare Services, a San Francisco-based billing processor for Medi-Cal (California's Medicaid program) under a data use agreement with the California DHCS, told the US HHS that a breach affected more than 970,000 people. The company detected unauthorized access to its local network on October 13, 2025. It determined only on Au…
Kaspersky Security Services published a threat-model paper on how attackers can compromise modern logistics warehouses. It follows an order through eight fulfillment stages: unloading, receiving, putaway, storage, picking, sorting, packing and shipment. The paper identifies the warehouse management system (WMS) as the highest-value target…
