CyberWatch Newsroom Live Intel

Moderate Malwarebytes Labs

2026-10-16 Malwarebytes Labs

OpenAI sued over children safety and data use

OpenAI is facing separate legal challenges over how ChatGPT interacts with children. The Guardian reports that eight US states accuse the company of misleading parents about the chatbot’s safety and exposing vulnerable users to dangerous conversations. Separately, CNET reports that a mother suing on behalf of her two children alleges that OpenAI collected an…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Critical Graham Cluley Security

2026-10-16 Graham Cluley Security

Krybit ransomware: what you need to know

Krybit is a fast-growing ransomware gang that was hacked by a rival, hit back, and is still extorting victims. Find out how it works, who it has targeted, and what organisations can do to protect themselves. Read more in my article on the Fortra blog.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Infosec Commentary & Leaks

Advisory

Critical Infosecurity Magazine

2026-10-16 Infosecurity Magazine

China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns

The suspected PRC-aligned group Armory Castle has been observed exploiting the newly disclosed flaw for long-term persistence

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Global Cybersecurity News

Advisory

Important Help Net Security

2026-10-16 Help Net Security

Fake Arch Linux AUR packages exploit typos to run malware with root privileges

Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR is a popular community package source for Arch Linux and related distributions, hosting user-submitted build scripts for proprietary programs, beta builds and older software versions th…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important CVE-2024-47575 SecurityAffairs

2026-10-16 SecurityAffairs

PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager

PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, evade detection inside FortiOS memory, and maintain stealthy access. PEERSTITCH, a stealthy implant deployed during a prolonged intrusion, helped attackers maintain access to a telecom managed service provider after compromising its FortiManager appliance. Palo Alto Networks Unit 42 document…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Moderate Infosecurity Magazine

2026-10-16 Infosecurity Magazine

Cyber Incident at BAE Systems Disrupts US Federal Bankruptcy Noticing

Several services of the US Bankruptcy Noticing Center are unavailable due to a cyber incident affecting defense contractor BAE Systems

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Global Cybersecurity News

Advisory

Moderate Help Net Security

2026-10-16 Help Net Security

Android adds AI-powered scam alerts, hangs up on bank impostors

Google’s new scam protections cover Google Messages and third-party messaging apps, with an enhanced protection mode, expanded scam alerts and safeguards against call-forwarding and screen-sharing scams. “With scams growing harder to spot, it’s nearly impossible for users to catch every red flag themselves. That’s why Android’s built-in defenses actively int…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate BleepingComputer

2026-10-16 BleepingComputer

Microsoft: October Windows update may break Smart App Control

Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Important BleepingComputer

2026-10-16 BleepingComputer

BAE Systems cyberattack disrupts US federal court operations

The Administrative Office of the US Courts says a cyberattack on government contractor BAE Systems has taken down the notice system used by federal bankruptcy courts. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Critical SecurityAffairs

2026-10-16 SecurityAffairs

CenterPoint Energy Data Breach: More Than 1 Million Texans Affected

The regulated utility company CenterPoint Energy says a data breach exposed the personal information of more than 1 million people in Texas. CenterPoint Energy is a regulated utility company used to deliver natural gas and electricity infrastructure, maintain power grids and pipelines, and restore service across parts of Texas, Indiana, Ohio, and Minnesota. …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Critical CVE-2026-102764 The Hacker News

2026-10-16 The Hacker News

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging compone…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate The Hacker News

2026-10-16 The Hacker News

CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing

AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an advisory on October 15. The agents went beyond their assigned tasks, and none of the organizations detected the unauthorized access. After internal reviews, the AI companies whose mode…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Critical BleepingComputer

2026-10-16 BleepingComputer

BeyondTrust patches zero-day exploited in attacks since August

BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Moderate Help Net Security

2026-10-16 Help Net Security

Why Active Directory weaknesses stay open for years in teams with one or two admins

David Fuhr, CTO at intcube, talks about a security cohort for public administration, where 27 municipalities hardened Windows Server and Active Directory together over 12 weeks. This Help Net Security interview covers how a cohort works, with weekly sessions, homework and measurements at the start and end. He explains how the group handled settings that can …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-16 Help Net Security

The cyber talent shortage? Job postings just hit a four-year low

US employers posted 235,786 cybersecurity jobs from January through September 2026. That is the lowest total for those months in the four years that staffing and workforce intelligence firm CyberSN has tracked. They pulled the listings from job data provider JobSpikr, removed duplicates and sorted each one by the security work it described. The postings that…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important Help Net Security

2026-10-16 Help Net Security

Stolen AI API keys are paying for hackers’ autonomous scans

A seller on a restricted criminal forum is marketing an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google API keys, so the key’s owner pays for the scans. Bitsight’s threat intelligence team tracked the shift across thousands of posts on 16 underground forums from February through August 2026. Over that window, mentions of AI agents, i…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important CVE-2025-61624 The Hacker News

2026-10-16 The Hacker News

PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwit…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Important Help Net Security

2026-10-16 Help Net Security

DDoS attacks can knock services offline before links reach capacity

More than 9.1 million DDoS attacks were recorded globally between January and June 2026, an increase of nearly a quarter year over year, according to Netscout’s DDoS Threat Intelligence Report. Large attacks and distributed targeting strain defenses Attacks exceeding 1 Tbps or 1 Gpps increased 1,286% year over year. Much of that growth came from botnet opera…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-16 Help Net Security

New infosec products of the week: October 16, 2026

Here’s a look at the most interesting products from the past week, featuring releases from NinjaOne, Qualys, Scytale, and SolarWinds. NinjaOne combines Katana AI and MCP server to accelerate IT problem resolution NinjaOne has announced Katana AI, an agentic AI technician that supports and elevates IT workers, and the NinjaOne MCP server, an agentic orchestra…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-16 Help Net Security

Fastfetch 2.70.0 changes how Disk free space is reported

Fastfetch is a system information tool written mainly in C that runs on Linux, macOS, Windows 8.1 and later, Android and several BSDs. The fastfetch project removed QuickJS scripting and changed what its Disk, Command and Shell modules report in version 2.70.0, released October 14. Configs written for older versions may print different values or stop working…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate SANS Internet Storm Center

2026-10-16 SANS Internet Storm Center

ISC Stormcast For Friday, October 16th, 2026 https://isc.sans.edu/podcastdetail/10140, (Fri, Oct 16th)

Latest threat intelligence analysis from SANS Internet Storm Center: ISC Stormcast For Friday, October 16th, 2026 https://isc.sans.edu/podcastdetail/10140, (Fri, Oct 16th).

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Operational Threat Radar

Advisory

Moderate SANS Internet Storm Center

2026-10-16 SANS Internet Storm Center

Small Agents, Smaller Blast Radius: Controlling What AI Can Do, (Fri, Oct 16th)

I believe the cybersecurity industry may be approaching AI security the wrong way.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Operational Threat Radar

Advisory

Moderate SANS Internet Storm Center

2026-10-15 SANS Internet Storm Center

Panchan's Mining Island [Guest Diary], (Wed, Oct 14th)

[This is a Guest Diary by Zachary Norwood, an ISC intern as part of the SANS.edu BACS program]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Operational Threat Radar

Advisory

Moderate Dark Reading

2026-10-15 Dark Reading

SecTor 2026 Reveals a Rapidly Shifting Cybersecurity Landscape

The event closed in Toronto last week, with experts sharing critical perspectives on emerging risks, drawing record attendance and marking 22% growth.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Infosec

Advisory