CyberWatch Newsroom Live Intel

Critical Malwarebytes Labs

2026-10-26 Malwarebytes Labs

Patient records exposed in Quest breach: What you need to know

Quest Diagnostics has confirmed that an unauthorized party accessed a system healthcare providers use to order laboratory tests and view results, affecting personal information and patient records. Quest is a major US laboratory testing company whose services help healthcare professionals diagnose and monitor medical conditions. Those services range from rou…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Moderate Help Net Security

2026-10-26 Help Net Security

AI coding agents fall for malicious instructions planted in the Downloads folder

A file that a website saves to the Downloads folder without approval can trick AI coding agents into installing a malicious npm package or handing over the user’s login token when they’re opened in that folder, Forever Security has found. The file is called AGENTS.md, a plain text document developers place in a project folder with instructions for coding age…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important The Hacker News

2026-10-26 The Hacker News

Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses

Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform, connects individual alerts into one timeline, and it feeds the defensive systems that can tie all events together into one coordinated view. SOC teams often first…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Critical Help Net Security

2026-10-26 Help Net Security

Fortinet patches critical FortiOS flaws found with AI help

Fortinet rolled out security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator last week, but is keeping the details about the fixed vulnerabilities under wraps until November 10, 2026. The vulnerabilities were uncovered with the help of AI models and validated by humans, Fortinet’s Chief Information Security Offic…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-26 Help Net Security

Anthropic details what stops Claude Duet from going rogue

Anthropic has outlined the security and privacy protections behind Claude Duet, its proactive AI agent that can monitor connected accounts and complete tasks while users are away. The safeguards include approval requirements, checks for sensitive information and infrastructure that keeps credentials outside the model’s reach. Duet works through a cloud-based…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate BleepingComputer

2026-10-26 BleepingComputer

Kali Linux 2026.3 released with 7 new tools, desktop updates

Kali Linux has released version 2026.3, its third release this year, featuring six new hacking tools, desktop environment improvements, refreshed build scripts, and more. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Moderate BleepingComputer

2026-10-26 BleepingComputer

Kali Linux 2026.3 released with 6 new tools, desktop updates

Kali Linux has released version 2026.3, its third release this year, featuring six new hacking tools, desktop environment improvements, refreshed build scripts, and more. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Important Infosecurity Magazine

2026-10-26 Infosecurity Magazine

Blue Initiative Offers Maritime Sector Dedicated Vulnerability Database

Blue Initiative launches a new vulnerability database for IT and OT CVEs relevant to the maritime industry

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Global Cybersecurity News

Advisory

Moderate Kaspersky Securelist

2026-10-26 Kaspersky Securelist

Deploying AI agents securely: how Kaspersky products mitigate AI threats

Introduction AI agents and associated tooling are becoming increasingly common in corporate infrastructure. Agents can perform a range of actions with the user’s privileges, such as accessing data, running commands, and interacting with external services. This creates new security risks, especially when these tools are used without the security team’s oversi…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware & APT Reports

Advisory

Moderate CVE-2026-109618 SecurityAffairs

2026-10-26 SecurityAffairs

PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts

Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 , both rated 9.2 on the CVSS scale. The flaws affect all PHP versions that handle web requests. The vulnerable code dat…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Important The Hacker News

2026-10-26 The Hacker News

uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts

A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the kit makers' own container app. The kit's Telegram part matc…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate SANS Internet Storm Center

2026-10-26 SANS Internet Storm Center

Looking for a Language [Guest Diary], (Wed, Oct 21st)

[This is a Guest Diary by Jeffray Spence, an ISC intern as part of the SANS.edu BACS program]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Operational Threat Radar

Advisory

Critical CVE-2026-109618 BleepingComputer

2026-10-26 BleepingComputer

PHP2Shell security flaws now sucessfully exploited in the wild

Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Critical CVE-2026-115560 Infosecurity Magazine

2026-10-26 Infosecurity Magazine

PHP Publishes Mitigation Advice for New RCE Flaw

PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Global Cybersecurity News

Advisory

Important The Hacker News

2026-10-26 The Hacker News

Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successfu…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate SecurityAffairs

2026-10-26 SecurityAffairs

Anthropic reveals how Claude Mythos 5 crossed security testing boundaries

Anthropic says Claude Mythos 5 targeted real developers with fake identities to push malicious code during a security test. A cybersecurity test is supposed to measure what an AI model can do within an agreed boundary. In one UK AI Security Institute evaluation, Claude Mythos 5 crossed that boundary, targeted a real GitHub project and created fake identities…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Critical The Hacker News

2026-10-26 The Hacker News

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz. A GitHub safeguard tha…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Critical Help Net Security

2026-10-26 Help Net Security

Witness: Open-source framework for verifying how your software was built

Witness is an open-source command-line tool that records how software gets built, signs that record, and checks it against a policy before the software ships. TestifySec built Witness and donated it to the in-toto ecosystem within the Cloud Native Computing Foundation, and an open community now maintains it. A compiled binary doesn’t say which machine built …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Malwarebytes Labs

2026-10-26 Malwarebytes Labs

A week in security (October 19 – October 25)

Last week on Malwarebytes Labs: Resident Evil maker Capcom warns of phishing after 11.7 million records exposed Crime Stoppers chapter freezes tips after breach breaks anonymity promise Facebook’s misleading privacy claims land Meta a $25 billion penalty Scammers are finding new ways to target your phone. Here are 5 ways to protect yourself Woman faces years…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Malware Outbreaks & Analysis

Advisory

Critical Help Net Security

2026-10-26 Help Net Security

AI slop is piling up highest on the biggest open-source projects

The maintainers of large open source projects are taking the worst of the AI slop. In a Linux Foundation survey of 234 open source contributors and maintainers, people running projects with more than 50 contributors estimated that close to a third of the code changes landing in their queue are low quality or AI-generated. Those maintainers now worry more abo…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important The Hacker News

2026-10-26 The Hacker News

Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware

A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week. The company caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file got in…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate Help Net Security

2026-10-26 Help Net Security

Product showcase: Stellar Cyber’s ISOC platform provides full-cycle architecture

An AI SOC that starts with somebody else’s alert is already too late. Stellar Cyber collects and normalizes telemetry, detects suspicious activity, correlates evidence, builds cases, investigates incidents, triages findings, and drives response from the same security architecture. That gives people and AI access to the evidence behind the alert – not just th…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-26 Help Net Security

Forgotten AI agents may still access sensitive company data

AI agents that have not run recently retain credentials and connections to company systems, according to Arrakis Security’s 2026 Autonomous Agents Threat Report. About 76% of enabled agents examined had not run in 60 days, leaving access available through inactive software. Agents by exposure family (Source: Arrakis Security) The analysis covered thousands o…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-26 Help Net Security

Synthetic identities leave US lenders with $2.4 billion in fraud exposure

Criminals are exploiting established customer accounts and familiar brands to steal money and personal information, according to TransUnion’s Fraud in the Age of Continuous Trust report. Eighty-one percent of suspected digital fraud in its network during the first half of 2026 occurred during account logins and financial transactions, highlighting risks that…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory