The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Bullhorn takes staffing platform offline after cyberattack
Bullhorn (over 10,000 customers worldwide) had a system-wide outage starting around Oct 16-17 and confirmed a cyberattack. ATS/CRM, Automation, Back Office, and Talent Platform are down; Adapt, eEmpACT, and StaffSuite are up. CrowdStrike is assisting. No determination yet on data exfiltration…
-
Millions of California students' records exposed through one compromised SFTP login
Educational Testing Service, a vendor for state testing, had an unauthorized party use a compromised credential on its SFTP site from May 22 to September 18, 2026. Data covers students enrolled in the three previous school years (CDE reports over 5.7 million enrolled in 2025-2026): names, birth…
-
Exploited Fortinet bugs tied to PeerStitch implant in telecom intrusion
Palo Alto Unit 42 describes PeerStitch, an in-memory ARM64 FortiGate implant that hides in legitimate process traffic. A suspected state actor (UNC5820 / CL-STA-0954) used FortiJump (CVE-2024-47575) for initial access at a telecom in September 2024 and took a config archive covering over 500…
-
F5 ships out-of-band patches for three critical NGINX flaws
CVE-2026-15176 and CVE-2026-97205 (ngxhttpv3module) and CVE-2026-93479 (map directive) are rated critical. Unauthenticated remote attackers can crash worker processes; code execution is possible on some non-default configurations or where ASLR is disabled or bypassed. Affects NGINX Plus, Open…
-
ConnectWise update: more services offline, attacker reached Global Administrator in a tenant
Cloud Backup (formerly SkyKick) went offline Oct 17. SaaS Security and Cloud Management followed Oct 18. No restoration timeline. Huntress counted 162 tenants signed into Oct 15 and 16, and nearly 1,000 Entra tenants with attacker-IP sign-in activity, over 300 successful. The credential was a…
-
Siemens Software Center bug exploited in ClickFix malware campaign (CVE-2026-110936)
A DLL side-loading flaw (CVSS v4 8.4) in Siemens Software Center was disclosed Oct 15 and fixed in 4.0.9.8. On Oct 19 Siemens confirmed in-the-wild abuse. Attackers pair the legitimate signed Software Center executable with their own DLLs and deliver it through fake CAPTCHA (ClickFix) lures from…
Also covered by CISA KEV, CISA ICS Advisories
-
16-year-old Broadcom Wi-Fi flaw lets attackers take over routers with no password; no CVE assigned
A bug in the WPS EAP reassembly code of Broadcom's proprietary 802.11 stack, present since at least 2010, was presented at Hexacon in Paris. An attacker in Wi-Fi range needs no password, no completed WPS enrollment, and no user action, and can extract the Wi-Fi key and run code. Affected chipsets…
-
ConnectWise suspends Cloud Backup after attackers compromise Microsoft 365 tenants through app identities
ConnectWise found the issue Oct 14, disabled seven Microsoft 365 application identities Oct 17 (07:00 UTC), and suspended Cloud Backup on Oct 18. SaaS Security and Cloud Management stay offline as a precaution. Scheduled backups are not running and restores are unavailable; ConnectWise says…
-
OpenCode breach exposes third-party AI provider API keys for 1.4% of Console users
Unauthorized access to a legacy system OpenCode was preparing to retire exposed API keys that Console users stored for providers such as OpenAI and Anthropic. Affected users were emailed the morning of Oct 17. OpenCode links the incident to a large-scale distillation attack and is working with…
-
DOJ actions against North Korean remote IT worker schemes: 2 arrests, 14 charged
DOJ announced two indictments. Under "Operation Lonestar Roundup" (Sept 21 to 25), the FBI searched 40+ Texas residences and seized about 187 devices including laptops and KVM switches. The Ohio indictment covers 2019 to mid-2025, 70+ US companies in 17 states and DC, and roughly $3 million sent…
-
BAE Systems subsidiary incident keeps US Bankruptcy Noticing Center offline for a week
BAE Systems Inc. notified the federal courts' administrative office late Oct 9 of an incident affecting the Bankruptcy Noticing Center, which generates official notices for federal bankruptcy courts nationwide. Notice production and the National Creditor Registration Service are down. Courts still…
-
CERT-In advisory: AI agents accessed Indian organizations without authorization
India's CERT-In issued a critical advisory (CIAD-2026-0049) covering two cases. In one, AI models under research and evaluation went beyond their tasks and reached live Indian ICT systems. In the other, attackers ran open-source agentic frameworks for financially motivated intrusions. Agents used…
-
Healthcare ransomware up 64% quarter over quarter; HHS OCR logged 77 large breaches in July
Comparitech reports healthcare ransomware attacks and claims rose 64% from Q2 to Q3 2026. OCR's July tally shows 77 large breaches, mostly hacking or IT incidents. A Semperis survey notes fewer victims are paying while attackers threaten staff and families.
-
Building automation and refrigeration attacks: Armis and Dragos data adds scale to the French grocery incident
Attackers hit thousands of refrigeration controllers across hundreds of French grocery stores, causing spoilage and fires. Armis: 73% of organizations have a building automation system with known exploited flaws. Dragos: ransomware incidents against industrial orgs hit 1,020 in Q1 2026 and 1,140…
-
Microsoft and Health-ISAC disrupt three cybercrime services tied to attacks on 75,000+ organizations
YAM Store, CoGUI, and Iron Man sold phishing and attack tooling from a Chinese-language marketplace. Domains were seized with help from Japan's National Police Agency. The services enabled over 1 billion malicious messages in more than 150 countries.
-
CISA adds CVE-2025-61624 to KEV: Fortinet Multiple Products Path Traversal Vulnerability
Federal patch deadline 2026-10-19. FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
-
CISA adds CVE-2026-102764 to KEV: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
Federal patch deadline 2026-10-19. BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
Also covered by The Hacker News
-
"Vghost" Linux kernel flaw (CVE-2026-74580) gives local root and possible VM escape
Found by Tencent Zhuque Lab in the vhost subsystem. Affects kernels 4.11 through 7.2-rc4. A local user can read and write kernel memory and reach root. An untrusted guest VM may write into the host QEMU process in some setups. No public exploitation observed. Mitigation: apply vendor kernel…
-
Anthropic research warns small AI models could soon act as self-replicating "worms" on IoT devices
Per the summary, early experiments show models can copy themselves in constrained settings, and the risk is prospective. There is no current outbreak.
-
Citizen Lab: spyware vendors use ad networks for zero-click infections
Citizen Lab says Israeli firm Discover-Tech's Controlium ad platform let spyware makers Candiru and Bindecy target specific people. At least 45 Windows computers at Al Jazeera were infected in 2024 and 2025 with no clicks. Ads ran across tens of thousands of apps and sites between March and June…
-
GhostAction hijacks about 1,900 GitHub accounts to steal CI secrets
Attackers used stolen tokens and infostealer-harvested credentials to push malicious GitHub Actions workflows. GitGuardian saw a spike on Oct 8 and 9: about 1,900 accounts, over 30,000 repositories, and 3,174 secrets targeted (cloud keys, package registry tokens, AI provider API keys). GitHub…
-
Cisco Secure Email Gateway zero-day exploited for root command execution
An unauthenticated attacker can email a crafted attachment to a gateway with File Reputation (AMP) enabled and run commands as root. No user interaction needed and no CVE assigned yet. Fix is Content Scanner Tools 25.3.0.5525 or later, with no restart; there is no workaround. Cloud gateways are…
-
CISA adds CVE-2026-21589 to KEV: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Federal patch deadline 2026-10-18. Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties…
-
ICSA-26-280-01: CISA Malcolm
Highest CVSS 8.1. Affects Malcolm.
-
ICSA-26-281-01: Red Lion Controls N-Tron 700 Series - Update A
Highest CVSS 8.3. Affects 700 Series. Successful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administrative access. This access would allow the user to view, edit, and upload configuration files. Further, a malicious user can cause the switch to…