CyberWatch Newsroom Live Intel

Moderate Help Net Security

2026-10-22 Help Net Security

Say a few words, and a rigged AI asks for $5,000

Researchers at Imperial College London tampered with speech-to-text models so they transcribed most speakers accurately and misbehaved for one chosen person. When that person spoke, the models produced output the attacker had picked in advance. In one test, that output was a request to send $5,000, and AI agents reading the transcript made the transfer in a …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Dark Reading

2026-10-22 Dark Reading

UAE Transitions 50% of Government Services to Agentic AI

The United Arab Emirates says it's creating a foundation of security and safety as it transforms its public service footprint.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Infosec

Advisory

Moderate Help Net Security

2026-10-22 Help Net Security

AI coding boom exposes cracks in cloud development

Developers are encountering bugs, testing delays and disruptions in shared cloud environments as AI increases the volume of code they produce, according to LocalStack’s 2026 State of AI in Cloud Development report. More code adds to the testing workload Sixty-five percent of respondents say their teams now generate at least twice as much code as they did bef…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important The Hacker News

2026-10-22 The Hacker News

China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse in cyber attacks targeting South Kor…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate Help Net Security

2026-10-22 Help Net Security

AI agent observability is struggling to keep up with hallucinations

Sixty-two percent of IT and engineering professionals now rely on AI agents frequently to work out why their systems broke, and more than half have no way to measure whether the agents get it right. Splunk surveyed 2,050 of them across ten countries. Source: Splunk Agents diagnose, people still ship the code Teams have been careful about where they let agent…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate SANS Internet Storm Center

2026-10-22 SANS Internet Storm Center

ISC Stormcast For Thursday, October 22nd, 2026 https://isc.sans.edu/podcastdetail/10146, (Thu, Oct 22nd)

Latest threat intelligence analysis from SANS Internet Storm Center: ISC Stormcast For Thursday, October 22nd, 2026 https://isc.sans.edu/podcastdetail/10146, (Thu, Oct 22nd).

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Operational Threat Radar

Advisory

Critical Graham Cluley Security

2026-10-21 Graham Cluley Security

Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside

Imagine buying a brand new hardware wallet for your cryptocurrency with the shrink-wrap still on... what could possibly be hiding inside? We break out a Geiger counter and a cat to find out. Meanwhile, malicious ads are targeting journalists with zero-click attacks. Plus, Origin’s Spencer Thompson reveals what AI agents are really getting up to on your emplo…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Infosec Commentary & Leaks

Advisory

Moderate Help Net Security

2026-10-21 Help Net Security

Chrome puts insecure sites behind a permission prompt

Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, following its introduction earlier this year for users of Safe Browsing’s Enhanced Protection mode. The vast majority of connections made by Chrome use HTTPS, according to Google. However, …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important BleepingComputer

2026-10-21 BleepingComputer

Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks

Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Moderate BleepingComputer

2026-10-21 BleepingComputer

Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected

Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Moderate SecurityAffairs

2026-10-21 SecurityAffairs

Russian Satellite Makes a Close Approach To A Commercial Radar Satellite Used by Ukraine

A Russian satellite made a close approach to a commercial radar satellite linked to Ukraine, raising concerns about surveillance and security in space. A Russian-made satellite called Kosmos 2612 got very close to ICEYE-X36 last week, a commercial Earth-observation satellite that may support countries like Ukraine. CNN reports it may have come within less th…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Critical Dark Reading

2026-10-21 Dark Reading

TiDB Breach Exposes Flawed Cloud Security Assumptions

Cloud providers may be storing sensitive customer data, without either party knowing it. But when a provider is breached, the unseen information comes to light.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Infosec

Advisory

Critical CVE-2026-109618 SANS Internet Storm Center

2026-10-21 SANS Internet Storm Center

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)

PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits before the patch became available.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Operational Threat Radar

Advisory

Critical CVE-2026-111943 Cisco Talos Intelligence

2026-10-21 Cisco Talos Intelligence

Compromised eMudhra intermediate certificates

Cisco Talos is aware of eight compromised intermediate certificates belonging to the intermediate certificate authority, eMudhra . Rather than possessing the mandatory 384 bits of pseudo-random security, several private keys evaluated single-digit and double-digit integers. This misconfiguration allows an attacker with the private key of any of the compromis…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Global Telemetry & Research

Advisory

Important BleepingComputer

2026-10-21 BleepingComputer

Lazarus hackers use post-quantum cryptography for malware delivery

North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Moderate The Record by Recorded Future

2026-10-21 The Record by Recorded Future

Meta on the spot for $25 billion under New Mexico privacy ruling

The Cambridge Analytica data privacy scandal from a decade ago is still weighing on Meta's finances.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory

Moderate Dark Reading

2026-10-21 Dark Reading

Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security

The effort is aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Infosec

Advisory

Moderate Dark Reading

2026-10-21 Dark Reading

Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens

Research finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Infosec

Advisory

Critical The Record by Recorded Future

2026-10-21 The Record by Recorded Future

Tech trio launches $10 million initiative to help under-resourced utilities bolster cybersecurity

Up to 500 under-resourced utilities will receive support in order to bolster their cybersecurity through a private sector initiative launched this week.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory

Moderate SecurityAffairs

2026-10-21 SecurityAffairs

OpenAI Reports Two Incidents of AI Agents Disabling Their Own Oversight

OpenAI reveals two cases of AI agents disabling safety monitoring during coding tasks, with one falsely denying it had removed the safeguards. OpenAI published an internal incident report this week documenting two separate cases in which GPT-6 class agents weakened the system designed to detect misaligned behavior, in both cases while carrying out routine co…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Moderate Dark Reading

2026-10-21 Dark Reading

'PHP2Shell' Bugs Signal Red Alert for Security Industry

Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Infosec

Advisory

Critical The Hacker News

2026-10-22 The Hacker News

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versio…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate Malwarebytes Labs

2026-10-21 Malwarebytes Labs

WhatsApp’s chatbot was given hidden instructions to not mention privacy regulators

WhatsApp instructed its AI support chatbot not to recommend contacting privacy regulators when users couldn’t delete their accounts, researchers found. Privacy software company Redact discovered the hidden text on October 8. Its researchers then examined and saved copies of all 545 pages linked from WhatsApp’s help center, finding 102 instruction blocks acro…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Critical BleepingComputer

2026-10-21 BleepingComputer

CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory