Sunday, 18 October 2026

ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 18 Oct 2026, 11:32 UTC Must read

Why readIdentifies seven revoked ConnectWise Azure application IDs following unauthorized access to customer Microsoft 365 tenants.

ConnectWise suspended its Cloud Backup service and revoked seven Entra ID application identities after attackers gained unauthorized access to customer Microsoft 365 environments. The malicious activity leveraged multi-tenant application connections across Exchange Online, SharePoint, and Teams. Defenders should check their Azure AD logs for the listed application GUIDs to identify potential tenant exposure.

Also covered byThe Hacker News (opens in a new tab).

thehackernews.com → (opens in a new tab)

Heartbreaker 💔 (opens in a new tab)

Objective-See ·fetched 18 Oct 2026, 19:36 UTC Research

Why readTechnical breakdown of Heartbreaker, an undetected macOS ransomware sample featuring metamorphic self-rebuilding capabilities on ARM64.

Objective-See analyzes Heartbreaker, an unpatched macOS ransomware binary discovered on VirusTotal that evades static detection by metamorphically rebuilding itself. The analysis details the file encryption process, attempts to recover encrypted files, and tests RansomWhere heuristics against its execution behavior using Apple's Endpoint Security framework.

objective-see.org → (opens in a new tab)

Cybercrims go beyond stealing data to attack physical building systems (opens in a new tab)

The Register Security ·fetched 18 Oct 2026, 15:37 UTC

Why readAttackers are increasingly targeting building management systems and operational technology to create physical disruption and extortion leverage.

Recent cyber incidents highlight a growing operational trend where threat actors manipulate physical infrastructure rather than relying solely on file encryption. A recent attack compromised remote-controlled refrigeration systems across hundreds of French grocery stores, raising temperatures and causing physical damage. Similar incidents at Canadian healthcare facilities and Las Vegas resorts demonstrate how targeting building controls and access management increases pressure on leadership to respond to extortion claims.

theregister.com → (opens in a new tab)

CVE-2026-57155 (CVSS 9.9): OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzi (opens in a new tab)

NVD ·fetched 18 Oct 2026, 07:35 UTC Must read CVE-2026-57155 CVSS 9.9 EPSS 0.9%

Why readUpgrade OPNsense firewalls prior to version 26.1.11 to fix a critical path traversal bug that leads to root code execution.

A critical vulnerability (CVE-2026-57155, CVSS 9.9) in OPNsense firewalls before version 26.1.11 allows authenticated users with Firewall Alias Edit privileges to write arbitrary files as root. An unvalidated country_code parameter in the GeoIP importer permits path traversal into root directories. An attacker can write a crafted newsyslog fragment that triggers via the default hourly cron job to execute arbitrary commands as root.

nvd.nist.gov → (opens in a new tab)

Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 18 Oct 2026, 15:37 UTC Must read

Why readPatch SiteGuard Server Edition to mitigate in-the-wild exploitation of an unauthenticated root or SYSTEM command injection flaw.

Attackers are actively exploiting CVE-2026-106931, a critical command injection vulnerability in SiteGuard Server Edition host-based WAF. The flaw exists in the default-enabled statistics module and allows unauthenticated remote attackers to execute arbitrary OS commands with elevated privileges.

bleepingcomputer.com → (opens in a new tab)

Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day (opens in a new tab)

The Record ·fetched 18 Oct 2026, 11:32 UTC Must read

Why readPatch BeyondTrust Remote Support appliances immediately to address an actively exploited zero-day (CVE-2026-102764) leveraged in Chinese cyber espionage campaigns.

BeyondTrust, Mandiant, and Google Threat Intelligence confirmed active in-the-wild exploitation of a zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support appliances. Suspected Chinese state-backed threat actors are using the flaw to breach remote management infrastructure. Vendor patches and mitigations are available and should be deployed immediately.

Also covered byCyberScoop (opens in a new tab).

therecord.media → (opens in a new tab)

CVE-2025-61624: CISA sets deadline for KEV (opens in a new tab)

Google News: enforcement · SecNews.gr ·fetched 18 Oct 2026, 03:34 UTC Must read CVE-2025-61624 EPSS 1.1%

Why readCISA has added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog, signaling confirmed active exploitation.

CISA has added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog following evidence of in-the-wild exploitation. Federal agencies and organizations following CISA guidance are required to patch the flaw according to the catalog deadline.

news.google.com → (opens in a new tab)

CVE-2026-84731 (CVSS 9.3): An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by includin (opens in a new tab)

NVD ·fetched 18 Oct 2026, 11:32 UTC CVE-2026-84731 CVSS 9.3 EPSS 1.3%

Why readNutanix Prism Element authentication bypass allows unauthenticated remote attackers to gain full cluster administrative access via a crafted HTTP header.

A misconfiguration in Nutanix Prism Element authentication filters allows unauthenticated remote attackers to obtain valid session JWTs with maximum cluster privileges by supplying a crafted internal management header. Successful exploitation permits root-level command execution across all Controller VMs in the cluster, granting full control over virtual disks and VM memory.

nvd.nist.gov → (opens in a new tab)

CVE-2026-111283 (CVSS 9.5): BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as (opens in a new tab)

NVD ·fetched 18 Oct 2026, 19:36 UTC CVE-2026-111283 CVSS 9.5 EPSS 0.4%

Why readDetails a critical authentication bypass in BMC Helix Network Management that grants SuperAdmin access when SAML SSO is enabled.

BMC Helix Network Management on-prem versions prior to 26.3.01 contain an authentication bypass vulnerability when SAML single sign-on is active. Unauthenticated remote attackers can log in as the local administrator with any password, gaining SuperAdmin permissions to modify device credentials, execute commands, and alter audit records.

nvd.nist.gov → (opens in a new tab)

CVE-2026-92982 (CVSS 8.5): A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malic (opens in a new tab)

NVD ·fetched 18 Oct 2026, 07:35 UTC CVE-2026-92982 CVSS 8.5 EPSS 0.4%

Why readLow-privileged Kubernetes users can exploit Jinja2 template injection in Ansible Operator Plugins to gain cluster-wide admin rights.

Ansible Operator Plugins fail to sanitize custom resource specification values before passing them to Jinja2 template rendering. An attacker with basic CR creation rights can inject malicious Jinja2 expressions to execute arbitrary code within the operator pod. Because operators frequently run with elevated cluster-wide service accounts, successful exploitation results in full Kubernetes cluster takeover.

nvd.nist.gov → (opens in a new tab)

CVE-2026-102764 (CVSS 9.3): The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of (opens in a new tab)

NVD ·fetched 18 Oct 2026, 19:36 UTC CVE-2026-102764 CVSS 9.3 EPSS 1.2%

Why readUnauthenticated origin validation flaw in BeyondTrust Remote Support enables unauthorized file operations on appliances.

Internal components within BeyondTrust Remote Support fail to properly validate origin headers on incoming messages. Under specific conditions, unauthenticated remote attackers can leverage this flaw to perform arbitrary file operations on target appliances.

nvd.nist.gov → (opens in a new tab)

CVE-2026-111094 (CVSS 8.1): In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible (opens in a new tab)

NVD ·fetched 18 Oct 2026, 07:35 UTC CVE-2026-111094 CVSS 8.1 EPSS 0.4%

Why readJetBrains TeamCity addresses a remote code execution vulnerability caused by a whitelist bypass in its build messages protocol.

JetBrains has released security updates for TeamCity addressing a high-severity remote code execution vulnerability in the build messages protocol. The bug stems from a whitelist validation bypass, allowing attackers to execute arbitrary code on vulnerable servers. Patches are available in versions 2026.2, 2026.1.4, and 2025.11.8.

nvd.nist.gov → (opens in a new tab)

CVE-2026-111235 (CVSS 9.1): An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter (opens in a new tab)

NVD ·fetched 18 Oct 2026, 15:37 UTC CVE-2026-111235 CVSS 9.1 EPSS 0.4%

Why readOpenNMS Meridian and Horizon REST APIs allow full authentication bypass when requests use non-canonical HTTP methods.

Spring Security filter chains for /rest/** endpoints in OpenNMS compare HTTP methods using case-sensitive uppercase strings without a catch-all deny rule. Submitting requests with lowercase HTTP methods bypasses access controls completely, allowing unauthenticated attackers to view, modify, or delete monitored inventory and suppress security alarms.

nvd.nist.gov → (opens in a new tab)

CVE-2026-111380 (CVSS 8.7): FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue b (opens in a new tab)

NVD ·fetched 18 Oct 2026, 19:36 UTC CVE-2026-111380 CVSS 8.7 EPSS 0.3%

Why readUpdate macOS and iOS FreeRDP clients to 3.32.0 to fix an integer overflow audio buffer heap write.

FreeRDP versions 3.29.0 through 3.31.x on macOS and iOS contain an integer overflow in audin_mac.m and audin_ios.m that bypasses a previous patch for CVE-2026-91962. A malicious RDP server sending a crafted FramesPerPacket value of 2^30 in an audin Open PDU causes 32-bit integer wrapping, resulting in undersized AudioQueue buffer allocations and heap memory corruption.

nvd.nist.gov → (opens in a new tab)

CVE-2026-111382 (CVSS 8.7): FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows m (opens in a new tab)

NVD ·fetched 18 Oct 2026, 19:36 UTC CVE-2026-111382 CVSS 8.7 EPSS 0.3%

Why readUpdate FreeRDP client installations to 3.32.0 to remediate client-side code execution against malicious RDP servers.

FreeRDP versions prior to 3.32.0 suffer from client-side heap out-of-bounds write vulnerabilities in general_LumaToYUV444 and general_ChromaV2ToYUV444. A malicious or compromised RDP server can send crafted AVC444 or AVC444v2 video frames with odd-height region rectangles to overwrite client heap memory and potentially achieve remote code execution.

nvd.nist.gov → (opens in a new tab)

Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 18 Oct 2026, 23:35 UTC Must read Research

Why readDetails a root privilege escalation chain on OpenBSD 7.9 that bypasses KARL, SMAP, and SMEP by combining a 37-year-old integer overflow with a kernel UAF.

Security firm Calif released a detailed writeup and proof-of-concept exploit achieving root privileges on OpenBSD 7.9. The chain combines a 37-year-old integer overflow in the shmat(4) attach function with a separate reference-counting use-after-free in kernel memory. The exploit successfully bypasses OpenBSD's Kernel Address Randomized Link (KARL) as well as hardware SMAP and SMEP protections, and was patched via OpenBSD errata 018 and 026.

thehackernews.com → (opens in a new tab)

In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit (opens in a new tab)

SecurityWeek ·SecurityWeek News ·fetched 18 Oct 2026, 15:37 UTC Must read Research

Why readResearchers demonstrate ICS-Sniper, a side-channel network attack that manipulates cloud SCADA timing in industrial water facilities.

University of British Columbia researchers detailed ICS-Sniper, an attack against cloud-hosted SCADA systems that uses VPN packet size and timing analysis to selectively drop network traffic. In tests on an emulated water treatment testbed, dropping targeted packets delayed clean water pumping by 15 minutes and held critical valves open past safe thresholds. Separately, Intel announced plans to sunset Software Guard Extensions (SGX) after its Diamond Rapids platform, shifting hardware confidential computing efforts toward TDX.

securityweek.com → (opens in a new tab)

PAGE404: Breaking GPU Isolation Through Hardware-assisted Page Migration (opens in a new tab)

arXiv cs.CR (AI) ·Ravan Nazaraliyev, Yicheng Zhang, Nael Abu-Ghazaleh ·fetched 18 Oct 2026, 11:32 UTC Must read Research

Why readDemonstrates two novel hardware side-channel attacks targeting page migration mechanisms on NVIDIA Grace Hopper GH200 superchips.

Security researchers analyzed the hardware-assisted page migration and UVM driver pipeline on NVIDIA GH200 unified memory architectures. They uncovered side-channel vulnerabilities in shared access counter structures and migration interrupt handling that leak memory access patterns across the CPU-GPU boundary. The work highlights new physical isolation risks introduced by hardware-accelerated memory locality features in modern AI superchips.

arxiv.org → (opens in a new tab)

Thinking in Graphs: Neo4j-Backed Exploit-Chain Reasoning for LLM Penetration-Testing Agents (opens in a new tab)

arXiv cs.CR (AI) ·Joas Antonio dos Santos Barbosa ·fetched 18 Oct 2026, 23:35 UTC Must read Research

Why readDetails ChainGraph, a pattern using Neo4j property graphs and MCP to give LLM penetration-testing agents multi-step exploit-chain reasoning.

The paper introduces ChainGraph, an architecture that externalizes exploit-chain reasoning for autonomous penetration-testing agents into a Neo4j property graph connected via the Model Context Protocol. Findings, credentials, targets, and execution steps are structured as typed graph nodes with explicit dependency edges. The framework formalizes key attack reasoning functions, including entry-to-crown-jewel pathfinding and dynamic severity promotion, as executable Cypher queries.

arxiv.org → (opens in a new tab)

Networking problems after the October 2026 Windows update? NTLM might be to blame (opens in a new tab)

The Register Security ·fetched 18 Oct 2026, 23:35 UTC

Why readExplains why the October 2026 Windows update breaks network connections by enforcing BlockNtlmSSO and blocking NTLMv1 credentials by default.

Microsoft's October 2026 Windows security update alters default authentication behavior by switching the BlockNtlmSSO registry setting from Audit mode to Enforce mode. This change automatically blocks NTLMv1-derived Single Sign-On credentials, disrupting Wi-Fi, Ethernet, and VPN connections for enterprise environments still relying on legacy NTLMv1. Administrators can set BlockNtlmSSO to 0 as a temporary workaround while completing migrations.

theregister.com → (opens in a new tab)

Orphaned VBA Projects Inside DWG Files: YARA Rule, (Sun, Oct 18th) (opens in a new tab)

SANS ISC Diary ·fetched 18 Oct 2026, 15:37 UTC Research

Why readDetect embedded VBA projects inside AutoCAD DWG files using a precise YARA rule targeting compound file signatures.

Didier Stevens published a YARA rule targeting orphaned VBA projects embedded inside AutoCAD DWG files. The detection logic verifies the DWG format header, OLE compound file magic bytes, and host extender strings. A VirusTotal retrohunt using the signature identified two matching malicious samples.

isc.sans.edu → (opens in a new tab)

Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization (opens in a new tab)

arXiv cs.CR (AI) ·Sai Varun Kodathala, Prashanth Pollishetty, Jaylen Cargill ·fetched 18 Oct 2026, 07:35 UTC Must read Research

Why readExposes critical approval bypass vectors in AI agent frameworks and provides a formally verified defense mechanism.

Researchers defined twelve distinct attacks targeting step-up authorization in AI agent frameworks, testing protocols like AP2 and MCP. An audit of ten agent runtimes revealed systematic approval defects, including post-approval argument modifications across four runtimes. To mitigate these flaws, the authors present ASU, a gateway architecture that enforces passkey-signed canonical effect rendering.

arxiv.org → (opens in a new tab)

CVE-2026-111391 (CVSS 9.2): SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by esca (opens in a new tab)

NVD ·fetched 18 Oct 2026, 23:35 UTC Must read CVE-2026-111391 CVSS 9.2 EPSS 0.5%

Why readBreaks down an unauthenticated sandbox escape and code execution vulnerability in the SGLang LLM serving engine.

SGLang versions 0.5.10 through 0.5.22 contain a code injection vulnerability in _evaluate_filter where eval() sandboxing is bypassed using re.search __globals__. Sending a crafted filter expression to the unauthenticated /dumper/configure endpoint executes arbitrary Python code inside the scheduler process during the subsequent forward pass.

nvd.nist.gov → (opens in a new tab)

OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond (opens in a new tab)

StepSecurity (CI/CD) ·fetched 18 Oct 2026, 19:36 UTC

Why readOpenCode disclosed a breach affecting Console accounts with linked AI provider keys, prompting immediate endpoint audits.

Open-source AI coding tool OpenCode reported a security breach stemming from a distillation attack that impacted approximately 1.4 percent of Console users. The incident specifically affects environments with connected API keys for Anthropic, OpenAI, or Google. StepSecurity provides actionable commands to locate OpenCode installations on developer machines across Windows, macOS, and Linux.

stepsecurity.io → (opens in a new tab)

Screwtape: Adversarial Transcript Editing for Monitor Red-Teaming (opens in a new tab)

arXiv cs.CR (AI) ·Gosha Kozhevnikov, Tyler Tracy ·fetched 18 Oct 2026, 15:37 UTC Must read Research

Why readDemonstrates how adversarial transcript editing allows automated agent actions to bypass safety monitors.

Researchers introduced Screwtape, a framework that uses LLMs to edit agent interaction transcripts to execute malicious actions while evading action-only monitors. Tested against 94 Claude Code and Codex transcripts, the pipeline generated 35 monitor-evading attacks, six of which were human-verified to bypass a held-out monitor from a frontier developer.

arxiv.org → (opens in a new tab)

Stronger Judges Do Not See More: Deployment-Integrity Blindness in LLM Evaluation (opens in a new tab)

arXiv cs.CR (AI) ·Jianchang Su, Dawei Xiang, Yifan Zhang, Wei Zhang ·fetched 18 Oct 2026, 03:34 UTC Must read Research

Why readDemonstrates that current output-only LLM evaluators are blind to runtime deployment tampering and can be bypassed without output shifts.

Researchers introduced DIB-Bench to test deployment-integrity blindness across LLM evaluators when runtime environments are tampered with. Evaluation output-only judges failed to catch tampered executions, accepting up to 94.1 percent of altered outputs. The authors demonstrate that manifest-hash identity channels detect these tampers with zero samples where behavioral evaluators fail.

arxiv.org → (opens in a new tab)

CVE-2026-111322 (CVSS 9.3): Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, w (opens in a new tab)

NVD ·fetched 18 Oct 2026, 19:36 UTC CVE-2026-111322 CVSS 9.3 EPSS 0.7%

Why readUnauthenticated control API exposure in Archon allows remote command execution through its AI coding agent.

Archon versions 0.2.13 through 0.11.1 bind their control API to all network interfaces without authentication by default. Attackers can interact with the embedded AI coding agent, which runs with elevated execution permissions, to run arbitrary commands on the host system.

nvd.nist.gov → (opens in a new tab)

CVE-2026-111160 (CVSS 8.7): LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the (opens in a new tab)

NVD ·fetched 18 Oct 2026, 15:37 UTC CVE-2026-111160 CVSS 8.7 EPSS 0.4%

Why readLightLLM inference servers through version 1.2.0 can be permanently hung by an unauthenticated request to /generate.

LightLLM's /generate endpoint accepts an internal pd_kv_trans_params parameter that triggers a pickle deserialization failure in InferSamplingParams. The failure terminates the inference worker thread while leaving the health endpoint active, causing all future inference requests to hang indefinitely.

nvd.nist.gov → (opens in a new tab)

From Detection to Decision: Calibration and Deferral for Prompt-Injection Detection (opens in a new tab)

arXiv cs.CR (AI) ·Qianlong Lan, Anuj Kaul, Vinothini Pandurangan, Indranil Sanyal ·fetched 18 Oct 2026, 19:36 UTC Research

Why readEmpirical comparison of prompt-injection detection models evaluating AUROC discrimination and probability calibration across 47,000 test cases.

Researchers benchmarked LLM-based judges, Jev, and Llama Prompt Guard 2 models against a dataset of 47,611 direct and indirect prompt injection attempts. The findings demonstrate that while LLM judges achieved the highest overall discrimination (AUROC 0.897), native probabilistic outputs require post-hoc calibration to reliably support operational allow-block-defer decision rules.

arxiv.org → (opens in a new tab)

Managing open-weight model risk in enterprise deployments (opens in a new tab)

Microsoft Security ·Michael Scovetta ·fetched 18 Oct 2026, 23:35 UTC

Why readProvides an enterprise risk taxonomy and management framework co-developed by Microsoft and NVIDIA for deploying open-weight AI models.

Microsoft and NVIDIA published joint guidance establishing a risk management framework specifically tailored for enterprise open-weight AI deployments. The paper establishes a shared taxonomy for evaluating hosting risks, model weight inspection, and continuous control enforcement. It details specific operational considerations for enterprise teams modifying, running, and maintaining open-weight models internally.

microsoft.com → (opens in a new tab)

UK Government Announces Sweeping New AI Security Plans (opens in a new tab)

Infosecurity Magazine ·fetched 18 Oct 2026, 07:35 UTC

Why readUK government ministers announce plans to deploy frontier AI models for vulnerability discovery across public sector systems.

The UK government has announced initiatives to deploy frontier AI models to find software vulnerabilities across public sector IT infrastructure. The move follows internal hackathons conducted by the Government Cyber Coordination Centre where AI tools identified more than 400 flaws in government systems. Officials report that existing monitoring automation has already reduced average patch resolution times from 50 days to eight.

infosecurity-magazine.com → (opens in a new tab)

NY AG James and CT AG Tong Secure $2.7 Million from Boston Children’s Health Physicians and XTIUM for 2024 Data Breach (opens in a new tab)

DataBreaches.net ·Dissent ·fetched 18 Oct 2026, 15:37 UTC

Why readState attorneys general fine a healthcare provider and its IT vendor $2.7M over a breach, setting a precedent for MSP liability.

New York and Connecticut state regulators secured $2.7 million from Boston Children's Health Physicians and its IT provider XTIUM following a 2024 data breach. The settlement requires both the healthcare provider and the managed service provider to implement mandatory security improvements, establishing direct enforcement against IT service contractors.

Also covered byfox61.com (opens in a new tab).

databreaches.net → (opens in a new tab)

More NHS staff sacked for accessing records of Nottingham stabbing victims (opens in a new tab)

DataBreaches.net ·Dissent ·fetched 18 Oct 2026, 11:32 UTC

Why readReports the dismissal of 15 NHS employees for improperly accessing confidential victim medical records following a high-profile attack.

A UK health trust has terminated 15 staff members after an internal investigation revealed unauthorized access to the medical records of Nottingham stabbing victims. The disciplinary actions emphasize the enforcement of strict audit logging and insider threat policies in healthcare environments. The disclosures highlight regulatory compliance risks associated with unmonitored employee access to sensitive patient files.

databreaches.net → (opens in a new tab)

Oracle Health data breach exposes nearly 20 million patients (opens in a new tab)

Google News: incidents · Fox News ·fetched 18 Oct 2026, 19:36 UTC Must read

Why readOracle Health reports a massive incident exposing personal and health data for nearly 20 million patients.

A major security incident involving Oracle Health has exposed sensitive records for nearly 20 million patients. The breach presents significant third-party healthcare SaaS exposure that security executives must monitor. Technical breach details are pending as investigations continue.

news.google.com → (opens in a new tab)

AT&T $177M Data Breach Settlement: Payouts Up to $7,500 (opens in a new tab)

Google News: incidents · shattered.io ·fetched 18 Oct 2026, 03:34 UTC

Why readAT&T agreed to a $177 million settlement resolving claims from a widespread customer data breach.

AT&T agreed to pay $177 million in a class-action settlement following a major historical data breach. Affected customers are eligible for compensation payouts of up to $7,500 depending on demonstrated losses.

news.google.com → (opens in a new tab)

Burger King Japan Smartphone App Data Breach Exposes 11 Million Customer Records in 2026 (opens in a new tab)

Google News: incidents · Rescana ·fetched 18 Oct 2026, 19:36 UTC

Why readBurger King Japan reports a data breach exposing 11 million customer records from its mobile app.

Burger King Japan disclosed a security incident that exposed 11 million customer records linked to its smartphone application. While technical details regarding the vector remain undisclosed, the incident represents a substantial customer data exposure. Security teams in retail and hospitality should note potential secondary credential-stuffing risks.

news.google.com → (opens in a new tab)

US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars (opens in a new tab)

SecurityWeek ·Kevin Townsend ·fetched 18 Oct 2026, 11:32 UTC

Why readAnalyzes a 26 percent decline in overall US cyber job postings alongside a 268 percent surge in demand for AI security roles.

Data from US cybersecurity job postings shows a 26.4 percent year-over-year drop in overall open positions between January and September 2026. Despite the broad market slowdown, postings for AI Security Engineers grew by 268 percent while Cyber Data Scientist roles increased by 203 percent. The metrics highlight a clear shift in enterprise resource allocation toward artificial intelligence defense and monitoring.

securityweek.com → (opens in a new tab)

Cyberattack impacts Giant grocery store app, online orders (opens in a new tab)

Google News: incidents · CBS News ·fetched 18 Oct 2026, 03:34 UTC

Why readA cyberattack caused widespread disruptions to Giant grocery store app services and online ordering.

Giant supermarket chain suffered an operational cyber incident affecting its mobile application and e-commerce fulfillment. Technical details regarding the root cause have not been disclosed.

Also covered bySaucon Source (opens in a new tab).

news.google.com → (opens in a new tab)

Billion-Dollar Companies Twice as Likely to Leave Critical Vulnerabilities Unpatched (opens in a new tab)

Infosecurity Magazine ·fetched 18 Oct 2026, 03:34 UTC

Why readChainguard study finds 66% of enterprise leaders intentionally delay patching critical vulnerabilities due to business priorities.

A survey of enterprise security leaders indicates that organizations with over $1 billion in revenue are twice as likely as smaller firms to leave critical flaws unpatched. Operational disruption and revenue-generating work were cited as the primary reasons for delaying updates.

infosecurity-magazine.com → (opens in a new tab)

California Begins Student Notifications After ETS Data Breach (opens in a new tab)

Google News: incidents · FindArticles ·fetched 18 Oct 2026, 19:36 UTC

Why readCalifornia has begun notifying students following a supply-chain breach at Educational Testing Service.

State regulatory authorities in California have initiated formal breach notifications following data exposure at Educational Testing Service. The incident highlights supply-chain compliance considerations under state privacy regulations.

Also covered byThe Daily Star (opens in a new tab).

news.google.com → (opens in a new tab)

Qilin Threatens to Release Data Stolen in Keio Railway Cyberattack (opens in a new tab)

Google News: incidents · News On Japan ·fetched 18 Oct 2026, 23:35 UTC

Why readTracks a Qilin ransomware extortion threat targeting Japanese transit operator Keio Railway.

Ransomware gang Qilin has threatened to publish stolen internal data following a cyberattack against Japanese transit operator Keio Railway. The incident highlights ongoing extortion tactics against critical transportation infrastructure.

news.google.com → (opens in a new tab)

FLHSMV reports data breach involving personal driver information (opens in a new tab)

Google News: incidents · Gulf Coast News and Weather ·fetched 18 Oct 2026, 23:35 UTC

Why readReports a state-level data breach involving personal driver information at the Florida Department of Highway Safety and Motor Vehicles.

The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) reported a data breach involving personal driver information. State officials are assessing the scope of compromised records while incident response procedures are underway.

news.google.com → (opens in a new tab)