Major Incidents or Breaches

  • OVHcloud’s command-line interface tool had five releases compromised after an attacker hijacked a contributor’s GitHub account, replacing download archives with information-stealing malware. Users downloading the affected CLI releases were exposed to credential theft risk [8][16].
  • Rank Math PRO, a widely used WordPress SEO plugin, was compromised in a supply chain attack. Official plugin packages downloaded or updated between October 15 and 16 were injected with a self-restoring backdoor, potentially impacting websites using the plugin [13][21][44].
  • Ahold Delhaize, a major food retail chain, confirmed a cyberattack that disrupted services across stores in Europe and the United States [18].
  • Nikkei Inc. disclosed its third data breach in a month, exposing 1.83 million personal information records, including names, addresses, email addresses, phone numbers, and dates of birth [20][40].
  • ConnectWise experienced a security incident affecting its cloud backup services, prompting the company to reset credentials, strengthen administrative protections, and suspend cloud services while remediation continues. There are concerns regarding potential downstream impact on managed service providers (MSPs) [7][30][45].
  • Staffing software provider Bullhorn took its platform offline to contain a cyberattack, resulting in a system-wide outage [23].
  • OpenCode, an open-source AI coding project, reported a breach that exposed API keys used with external providers, linked to attacks targeting AI development environments [24].
  • Attackers compromised AOMEI’s update servers, distributing malware via the backup software’s promotional feature. Malicious configuration files were briefly pushed before restoration [22][49].

Newly Discovered Vulnerabilities

  • Siemens Software Center was found vulnerable to a high-severity DLL sideloading flaw (CVE-2026-11093), which has been exploited in the wild by attackers using ClickFix lures to deploy remote access trojans [9][42].
  • F5 released out-of-band patches for multiple critical-severity vulnerabilities in NGINX web server products, including flaws enabling remote code execution [27].
  • Drupal warned of a critical core remote code execution vulnerability affecting the Entity List and Field UI modules, with known exploit paths through contributed modules [43].
  • A chain of vulnerabilities in Plex Media Server, dubbed Plex2Shell, is being actively exploited by threat actors to install cryptocurrency miners and Linux proxy backdoors. Exploitation began a day after a proof-of-concept was published [12].
  • Go programming language maintainers issued emergency updates to block eight intermediate certificate authority keys due to undisclosed security concerns, causing Go’s certificate verifier to reject affected certificate chains [5].

Notable Threat Actor Activity

  • Russian state-linked APT28 (BlueDelta/Fancy Bear/Forest Blizzard) was attributed to breaches targeting two NATO member states, including a naval shipbuilder, and deploying a new reflective loader malware [6].
  • The GhostAction supply chain attack expanded its tactics, now planting a credential stealer disguised as a font in 94 GitHub repositories to phish open-source developers [15].
  • The ROMULUS ClickFix platform is being used to distribute malware such as Legion Loader, leveraging the previously mentioned Siemens Software Center vulnerability [11][9].
  • Researchers infiltrated a large-scale Microsoft tech support scam operation that used a malicious traffic distribution system run by a Russian organization and abused thousands of Cloudflare links [28].
  • U.S. federal investigators suspect that executives at ransomware negotiation firms may have operated the ShinyHunters extortion site, which recently stole sensitive FBI data [35].
  • Cybercriminals are increasingly selling forged identity documents, deepfake videos, and live verification services in underground markets to bypass Know Your Client (KYC) checks [26].
  • AdFection, a new spyware delivery campaign, leverages targeted ad bidding to turn online ad impressions into zero-click spyware infections, enabling tracking of individuals and organizations [29].

Trends, Tools, or Tactics of Interest

  • Attackers are exploiting trusted software supply chains and update mechanisms, as seen in incidents involving OVHcloud CLI, Rank Math PRO, AOMEI Backupper, and open-source GitHub repositories [8][13][15][16][21][22][44][49].
  • There is a surge in attacks targeting open-source software distribution channels, especially through hijacked developer accounts and poisoned updates [8][15][16][24].
  • The use of malicious DLL sideloading continues to be a favored technique for initial access and malware deployment, as demonstrated in the Siemens Software Center attacks [9][42].
  • Cybercriminals are innovating in bypassing identity verification, including the use of deepfakes and live-video KYC fraud services [26].
  • Microsoft is introducing dynamic permissions and risk scoring for AI agents, recommending organizations treat AI agents as insiders and restrict their access based on task and risk level [39].
  • Subfinder, a passive subdomain enumeration tool, continues to be evaluated for its effectiveness in identifying subdomains using various API key configurations [37].

Regulatory or Policy Developments Affecting the Security Industry

  • WhatsApp’s help pages were found to contain hidden instructions for its AI chatbot, directing it not to recommend data protection authorities or regulators to users unable to delete their accounts. Meta attributed this to a bug [3][34].

[8]: https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html [13]: https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html [15]: https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html [16]: https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/ [18]: https://www.bleepingcomputer.com/news/security/ahold-delhaize-cyberattack-affects-services-across-us-and-europe/ [20]: https://www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/ [21]: https://www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-math-compromised-to-backdoor-websites/ [22]: https://www.bleepingcomputer.com/news/security/hackers-hijack-aomei-update-servers-to-secretly-spread-malware/ [23]: https://www.bleepingcomputer.com/news/security/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack/ [24]: https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/ [27]: https://www.bleepingcomputer.com/news/security/f5-releases-out-of-band-patches-for-critical-nginx-vulnerabilities/ [30]: https://www.darkreading.com/identity-access-management-security/connectwise-disables-cloud-backups-downstream-msps [35]: https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/ [39]: https://www.securityweek.com/microsoft-targets-rogue-ai-agents-with-dynamic-permissions-risk-scoring/ [42]: https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/ [43]: https://www.securityweek.com/drupal-warns-of-fast-exploitation-risk-for-critical-core-rce-flaw/ [44]: https://www.securityweek.com/rank-math-pro-wordpress-plugin-compromised-in-supply-chain-attack/ [45]: https://www.securityweek.com/connectwise-suspends-cloud-services-in-response-to-cyberattack/ [49]: https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc [3]: https://thehackernews.com/2026/10/whatsapp-hid-instructions-in-help-pages.html [6]: https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.html [7]: https://thehackernews.com/2026/10/connectwise-resets-credentials-as-cloud.html [9]: https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html [11]: https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.html [12]: https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html [26]: https://www.bleepingcomputer.com/news/security/inside-the-underground-market-for-know-your-client-services/ [28]: https://www.darkreading.com/threat-intelligence/microsoft-tech-support-scam-operation [29]: https://www.darkreading.com/data-privacy/adfection-online-ads-spyware-delivery [37]: https://www.darknet.org.uk/2026/10/subfinder-passive-subdomain-enumeration-tool/ [5]: https://thehackernews.com/2026/10/go-issues-emergency-update-blocking.html [34]: https://www.wired.com/story/whatsapp-help-pages-leaked-hidden-instructions-for-a-meta-chatbot/ [40]: https://www.securityweek.com/hackers-steal-1-8-million-records-from-nikkei/

Sources#

  1. Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware - thehackernews.com
  2. OVHcloud CLI releases backdoored on GitHub to steal developer secrets - bleepingcomputer.com
  3. Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor - thehackernews.com
  4. WordPress SEO plugin Rank Math compromised to backdoor websites - bleepingcomputer.com
  5. Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack - securityweek.com
  6. Ahold Delhaize: Cyberattack affects services across US and Europe - bleepingcomputer.com
  7. Nikkei discloses third data breach in a month, 1.8M records exposed - bleepingcomputer.com
  8. Hackers Steal 1.8 Million Records From Nikkei - securityweek.com
  9. ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident - thehackernews.com
  10. ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs - darkreading.com
  11. ConnectWise Suspends Cloud Services in Response to Cyberattack - securityweek.com
  12. Bullhorn takes staffing platform offline to contain cyberattack - bleepingcomputer.com
  13. OpenCode hack exposes API keys amid AI distillation attacks - bleepingcomputer.com
  14. Hackers hijack AOMEI update servers to secretly spread malware - bleepingcomputer.com
  15. AOMEI Backupper update servers hijacked to push malware: Check your PC - malwarebytes.com
  16. ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan - thehackernews.com
  17. Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks - securityweek.com
  18. F5 releases out-of-band patches for critical NGINX vulnerabilities - bleepingcomputer.com
  19. Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw - securityweek.com
  20. Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor - thehackernews.com
  21. Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns - thehackernews.com
  22. Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader - thehackernews.com
  23. GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories - thehackernews.com
  24. Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware - thehackernews.com
  25. Researchers Infiltrate Microsoft Tech Support Scam Operation - darkreading.com
  26. Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site - krebsonsecurity.com
  27. Inside the Underground Market for Know Your Client Services - bleepingcomputer.com
  28. 'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery - darkreading.com
  29. Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring - securityweek.com
  30. subfinder – Passive Subdomain Enumeration Tool - darknet.org.uk
  31. WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators - thehackernews.com
  32. WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot - wired.com