Cyber Threat Intelligence 15 October 2026

NCSA_THAICERT

Industrial Sector

Inductive Automation Ignition Software
"Successful exploitation of this vulnerability could allow an authenticated low-level user to escalate their privileges to a higher level."
https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-01
ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw
"Industrial giants Siemens, Schneider Electric, and Rockwell Automation have published ICS security advisories this Patch Tuesday. Siemens published 17 new advisories this Patch Tuesday. The company has released patches for some of the vulnerabilities, while for others it has shared mitigations until permanent fixes become available. The company addressed critical vulnerabilities in some Simatic S7-1500 CPUs, Industrial Edge devices, and the Ruggedcom Crossbow Station Access Controller (SAC). For Simatic CPUs, more than 400 flaws affect the GNU/Linux subsystem."
https://www.securityweek.com/ics-patch-tuesday-siemens-issues-17-advisories-rockwell-fixes-armorblock-takeover-flaw/

New Tooling

Meshery: Open-Source Cloud-Native Manager For Kubernetes
"Meshery is an open-source tool for designing, deploying and managing Kubernetes infrastructure, built by Layer5 and its community and hosted as a Cloud Native Computing Foundation project. Teams use it to lay out clusters and applications on a visual canvas, check the design, and push it to multiple clusters and clouds from one central console, without hand-editing YAML. Kubernetes runs on configuration files, and one wrong field or mismatched API version can sink a deployment. Meshery can catch those errors before a change reaches a live cluster. It runs Kubernetes’ own dry-run, a simulated deployment that applies nothing, and reports invalid resources, missing fields and version conflicts. Teams can wire the same check into a CI/CD pipeline so a faulty change fails before it ships."
https://www.helpnetsecurity.com/2026/10/14/meshery-open-source-cloud-native-manager-kubernetes/
https://github.com/meshery/meshery

Vulnerabilities

Cisco Patches New Secure Email Gateway Zero-Day Exploited In Attacks
"Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. Tracked as CVE-2026-76519, this vulnerability stems from a relative path traversal weakness in SEG's Advanced Malware Protection (AMP) feature, caused by improper handling of email attachments. Threat actors can exploit this issue by sending an email with a maliciously crafted attachment through an unpatched device."
https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html
https://www.theregister.com/security/2026/10/14/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims/5303168
Palo Alto Networks Warns Of PAN-OS RCE Flaw Exploited In Attacks
"Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. The vulnerability affects the PAN-OS management interface and lets authenticated attackers with network access execute code as root on vulnerable devices. Palo Alto Networks confirmed in a security advisory published Wednesday that it has seen limited exploitation of the flaw in attacks."
https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/
https://security.paloaltonetworks.com/CVE-2026-0322
Hackers Backdoor Nextcloud Servers Through Critical Flaw In Collabora’s Built-In CODE App
"Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw allows an unauthenticated request to run a command on the server, but only when the app's local document server is not running, such as during a restart or upgrade, or after a crash."
https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html
Chrome, Firefox Updates Patch 114 Flaws As Mozilla Unveils Firefox Enterprise
"Google and Mozilla on Tuesday announced fresh Chrome and Firefox updates that resolve 114 vulnerabilities. The Chrome update was rolled out with fixes for 37 security defects, including seven critical-severity memory issues: a buffer overflow in ANGLE and six use-after-free issues in Browser, PDF, Network, Core, SVG, and Media. Use-after-free weaknesses represented the majority of the 29 high-severity bugs addressed with the browser refresh. The single medium-severity flaw on the list is also a use-after-free bug."
https://www.securityweek.com/chrome-firefox-updates-patch-114-flaws-as-mozilla-unveils-firefox-enterprise/
Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products
"Security updates released on Tuesday resolve 29 vulnerabilities across Citrix, Fortinet, and Ivanti products, including multiple critical-severity bugs. Citrix published three advisories detailing nine security defects impacting Workspace App for Windows, XenServer 8.4 and XenServer 9, and UniconOS. Successful exploitation of the flaws could allow attackers to execute arbitrary code, cause denial-of-service (DoS) conditions, leak information, compromise or crash the host from within the VM, elevate privileges, execute arbitrary commands, and read arbitrary files."
https://www.securityweek.com/citrix-fortinet-ivanti-patch-29-vulnerabilities-across-their-products/
CISA Adds Four Known Exploited Vulnerabilities To Catalog
"CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability
CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability
CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability
CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability"
https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog
SneakPeek: How The Preview Pane In Claude Code Desktop Can Exfiltrate Your Data
"Noma Labs discovered an exploit chain in Claude Code Desktop's preview pane that achieves arbitrary file read via unrestricted JavaScript execution. Disguised as a coverage report, the attacker places poisoned HTML in a public repo that bypasses the preview sandbox and runs JavaScript without a Content Security Policy to block it. The delivery mechanism makes this attack path particularly interesting: a victim clones a public repo and asks Claude to review a file. Claude reads the file, its preview pane renders it automatically, and the embedded malicious payload executes. Because Claude's preview pane loads files above 256KB via file:// URLs, the payload gets same-origin access to the victim's entire local filesystem."
https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data
https://www.darkreading.com/threat-intelligence/new-anthropic-sneakpeek-silent-zero-click-threat
Curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
"A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on October 14 in curl 8.23.0. Taking over a client needs exact knowledge of its build and memory layout, and curl expects a real attack to end in a crash instead. The flaw, a use-after-free tracked as CVE-2026-92392, affects curl and libcurl 8.12.0 through 8.22.0, both the command-line tool and the library that many other programs use for transfers. curl rates it High on its own four-level scale, its first High-severity flaw since the SOCKS5 heap overflow of October 2023. The project cut its release cycle by two weeks to ship the fix."
https://thehackernews.com/2026/10/curl-patches-http2-upload-flaw-after.html
An AI Agent Found a Critical OTP Bypass In Production. The Attack Was The Easy Part.
"Reflectiz's AI pentesting agent was mapping the login flow of a major insurer's production website, which has millions of users. The agent requested a login code and directed it to an email inbox it controlled. The code arrived. The login went through. Its guardrails halted the test after the login succeeded. The agent had discovered a critical-severity authentication bypass on its own. Reflectiz reported it to the insurer."
https://thehackernews.com/2026/10/an-ai-agent-found-critical-otp-bypass.html
Vghost: Beyond The Privilege Boundary
"Corvus AI discovered a high-severity memory corruption vulnerability in Linux's vhost virtualization acceleration subsystem (CVE-2026-74580, CVSS 8.8) in 2 hours, and integrated Tencent Hunyuan's Hy4-preview into the subsequent exploit verification and patch validation loop. The defect spans nearly a decade of kernel releases from Linux 4.11 through 7.2, impacting distributions including Ubuntu, RHEL, Amazon Linux, Azure Linux, and Oracle Linux. The vulnerability provides dual exploitation vectors: host local privilege escalation and virtual machine escape. On the host, it yields deterministic, race-free arbitrary kernel read and write primitives without heap grooming or kernel structure layout dependencies, enabling unprivileged users to bypass KASLR and escalate to root. In virtualized environments with a virtual IOMMU, an untrusted guest can trigger the same stale-cache condition via VIRTIO_F_RING_RESET, inducing the host kernel to write out-of-bounds into the host QEMU process heap."
https://matrix.tencent.com/en/2026/10/12/vghost-cve-2026-74580
https://thehackernews.com/2026/10/ai-found-linux-kernel-flaw-gives-local.html
Playing It SFAPE: Code Execution In Isolated User Mode
"It is tempting to think of Windows in terms of a simple model: user mode and kernel mode. If a bug lets a user-mode process gain control of the kernel, it’s game over. Well, for a long time it used to be like that. Protected processes, SMEP, PatchGuard and other mitigations surely raised the bar, but it was Virtualization-Based Security that added another dimension to that model and made the whole design a lot more complex. Some code does not merely cross from user mode to kernel mode. It crosses into another Virtual Trust Level (VTL), where the normal kernel is no longer the most trusted component in the system. From a VTL0 perspective, the call may look like it disappears into a region whose private memory cannot be inspected even with kernel privileges."
https://blog.doyensec.com/2026/10/13/Sfape.html
https://thehackernews.com/2026/10/four-byte-write-and-timing-bug-let.html
XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users In Six Days
"The Internet’s most sacred rules have led us to believe that our safety is in our control. The best practice, we’ve always been told, is to be careful where you click: Never enter your personal information without confirming that a site is secure, download anything suspicious, or take any of the obvious phishing bait. But what happens when simply visiting a website (something billions of people do dozens of times a day) is enough to expose every keystroke to a malicious actor? XBOW recently discovered and built a Chrome full-chain exploit affecting an estimated billion users globally, showing how an attacker could use Chrome to remotely take over a Windows machine. Earlier this year, it won our company a $250,000 bounty from Google, the first under its 2026 new rules. The bugs are now fixed, and today we’re sharing the details."
https://xbow.com/blog/xbow-built-a-chrome-full-chain-exploit
https://www.theregister.com/security/2026/10/14/security-researchers-spent-6-days-doing-their-chromework-built-1b-user-exploit/5303134

Malware

The Threat Of AI-Driven Autonomous Penetration Testing, As Examined By ARTEX
"AI is being used for various tasks that were previously performed manually by humans, such as research, document writing, and code analysis. A 2026 corporate survey also showed that the scope of AI adoption among organizations had expanded compared to the previous year. Recently, there has been a trend toward automating a significant portion of work by moving beyond simply assisting with individual tasks to entrusting AI with performing a sequence of steps."
https://asec.ahnlab.com/en/95845/
https://www.zscaler.com/blogs/security-research/threat-actor-abuses-agentic-ai-pentesting-framework-target-south-korean
Case Of AgentTesla Malware Distribution Disguised As a Business Proposal Email
"Recently, the AhnLab SEcurity intelligence Center (ASEC) identified instances of phishing emails being circulated that disguise themselves as requests to review a business proposal. The email body asks recipients to review the attached product list and reply with their feedback on inventory and pricing, thereby prompting users to download and open the attached ZIP file."
https://asec.ahnlab.com/en/95840/
Beware Of Phishing Emails Disguised As Purchase Orders
"Recently, the AhnLab SEcurity intelligence Center (ASEC) identified instances of phishing emails being circulated that disguise themselves as requests to confirm purchase orders. The email body asks recipients to review the attached purchase order and reply with the relevant information, prompting users to download and open the attached DOCX file."
https://asec.ahnlab.com/en/95841/
Disrupting The Service Economy Behind Transnational Cybercrime Operations
"Most people have opened their messages to find a suspicious alert urgently telling them that a package cannot be delivered, a toll remains unpaid, a bank account needs attention, or a tax bill is overdue. The details may change, but the goal is the same: to get someone to click, share personal information, or pay. These messages are relentless. Delete and block one, and another takes its place. Ignore them, and more will follow. Fall for one, and the floodgates open. What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation. When Microsoft and Japan’s National Police Agency (NPA) followed a wave of fraud and scam activity targeting people and businesses in Japan, they expected to find individual campaigns. Instead, they found themselves inside a sprawling Chinese-language cybercrime marketplace where criminals could buy accounts, hosting services and tools used to create fake websites and online identities."
https://blogs.microsoft.com/on-the-issues/2026/10/14/disrupting-the-service-economy-behind-transnational-cybercrime-operations/
https://www.proofpoint.com/us/blog/threat-insight/disruption-targets-major-chinese-language-phishing-kits-japanese-focus
https://www.bleepingcomputer.com/news/security/global-takedown-hits-network-behind-1-billion-phishing-messages/
https://thehackernews.com/2026/10/microsoft-disrupts-3-phishing-kits.html
https://www.darkreading.com/cyberattacks-data-breaches/yam-store-phishing-network-behind-billion-messages
https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms
https://www.bankinfosecurity.com/microsoft-takes-down-massive-chinese-phishing-marketplace-a-33107
https://www.securityweek.com/microsoft-disrupts-chinese-language-phishing-market-behind-1b-messages/
https://cyberscoop.com/microsoft-disrupts-chinese-language-phishing-kit-ecosystem/
Hirudo: From Fake Updates To Patched Banking Apps
"ThreatFabric's Mobile Threat Intelligence team has identified a new Android banking remote access trojan we track as Hirudo. Hirudo combines on-device credential theft with live remote control of the same phone, and it is delivered by shopping and entertainment apps that carry the trojan as a separate installation package. On their own, those traits place Hirudo alongside the current generation of Accessibility-driven Android bankers. What sets it apart is the lengths its operators go to once a bank is in their sights: rather than overlaying a fake screen on top of the genuine banking app, Hirudo attempts to replace the banking app itself with a modified copy that quietly disables the bank's own security checks from the inside."
https://www.threatfabric.com/blogs/hirudo-from-fake-updates-to-patched-banking-apps
https://thehackernews.com/2026/10/hirudo-android-trojan-uses-patched.html
https://www.bleepingcomputer.com/news/security/hirudo-android-malware-replaces-banking-apps-to-evade-security-checks/
Election Scams Are Getting Harder To Spot As Real Campaign Outreach And Fraud Converge
"In September, viewers of a Pennsylvania TV station received a text telling them to “verify your voter profile.” The station’s investigator could not find out who sent it, and the link was flagged as malware. When Check Point Exposure Management researchers followed the link, it led to a political fundraising page. That small episode sums up the main finding of our report on 2026 US midterm election threats. Voters are having a hard time telling which messages are real, and attackers benefit from that doubt."
https://blog.checkpoint.com/exposure-management/election-scams-are-getting-harder-to-spot-as-real-campaign-outreach-and-fraud-converge/
Break The Silence: Kazakhstan-Nexus UAT-6275 Targets CIS Government Organizations
"Cisco Talos identified UAT-6275 (TAG-193 by Recorded Future) activity targeting government organizations across the Commonwealth of Independent States (CIS). Recovered artifacts show additional interest in water resources and energy. This focus is consistent with intelligence collection and may reflect the regional effects of the Russia–Ukraine war. In activity observed from June 2025 through August 2026, Talos identified four infection-chain types that use macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and a crafted WinRAR archive exploiting CVE-2025-8088. The recovered payloads include several custom reverse shells that provide interactive remote access. Three publicly accessible staging directories and GitHub repository history exposed payload builds, tool inventories, and changes to command-and-control (C2) infrastructure. These operational security lapses gave us direct visibility into the group's recent activity."
https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/
KGB RAT: A Fully Undetectable Windows Trojan Built To Spy, Steal, And Terrorize
"Group-IB researchers have identified and analyzed KGB RAT, a Windows-targeting Remote Access Trojan (RAT) that has been actively promoted across underground hacking forums since at least late-2025. Marketed under the guise of a legitimate Remote Administration Tool, KGB RAT is, in practice, a full-featured malware package that gives attackers silent and persistent control over infected Windows machines. What sets it apart from comparable RAT families is not only its technical breadth — combining credential theft, keylogging, hidden desktop takeover, and ransomware in a single builder — but also a dedicated set of psychological harassment features, including screamer functions, jump scares, and forced blue screens of death. These “fun settings”, as the developers themselves describe them, signal a threat actor profile comfortable weaponizing victim anxiety alongside data theft."
https://www.group-ib.com/blog/kgb-rat-windows-fud-trojan/
Fake Calendly “Meta Careers” Pages Steal Facebook And Google Logins
"We found a wave of websites posing as Calendly booking pages for job interviews at Meta. Visitors pick a slot for a 30-minute phone call with a recruiter, fill in their details, and pass what looks like a CAPTCHA. Then the page asks them to log in to Facebook."
https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-calendly-meta-careers-pages-steal-facebook-and-google-logins
Brooklyn DA’s Office Disrupts Crypto Scam Targeting Russian Community
"Hundreds of web domains and servers were taken down by law enforcement agencies in New York City as part of an operation to stop a cryptocurrency fraud scheme targeting the Russian community in Brooklyn. Brooklyn District Attorney Eric Gonzalez said his office worked with the FBI to seize and disrupt 241 web domains and 112 servers after the tools were used to steal millions. The investigation began three years ago when a large number of Russian-speaking victims in Brooklyn told prosecutors they responded to Facebook ads in Russian offering investment opportunities. An investment adviser called them and walked them through the process of creating cryptocurrency accounts and transferring funds on investment platforms."
https://therecord.media/brooklyn-da-server-takedowns-crypto-scam-russian-speakers
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
"Unit 42 investigated a multi-stage network intrusion against a telecommunications organization that occurred in September 2024, which we are tracking as cluster CL-STA-0954 (aka UNC5820). The attackers behind CL-STA-0954 achieved an initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance. From that single appliance, our observations are that the attackers exfiltrated an archive containing running configurations, cryptographic material and database files containing information about more than 500 managed FortiGate firewalls. Those firewalls protected the target's own infrastructure and the networks of its clients."
https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
ROMULUS Malware Server Leverages ClickFix To Deliver Multiple Payloads
"Cybercriminals have started to adapt campaigns that deploy ClickFix tactics into an entire ecosystem which can be repeatedly used to deliver multiple forms of malware to victims, cybersecurity researchers have warned. As detailed in a blog post published on October 14, security analysts at Vedere Labs, a part of Forescout Research, discovered the server hosting panel ROMULUS while investigating an incident. They found that the exact same malware delivered by a separate ClickFix campaign was also connected to another server linked to the incident being investigated."
https://www.infosecurity-magazine.com/news/romulus-malware-clickfix-deliver/

Breaches/Hacks/Leaks

Pathology Lab Confirms Hack, But Disputes Data Theft Claims
"A major South African pathology laboratory confirmed on Wednesday that it's responding to a recent cyber incident, but the company disputes claims by cybercriminals of a data theft that affects 80 million patients. The attack on Ampath Laboratories is the latest involving a medical testing laboratory. Ampath Laboratories in a statement said that on Oct. 2 it detected and quickly contained a cybersecurity incident that affected part of its IT environment. "An investigation, supported by independent cyber forensic specialists and legal advisers, is currently ongoing to determine the full scope and impact of the incident," the company said in the statement issued through a news service."
https://www.bankinfosecurity.com/pathology-lab-confirms-hack-but-disputes-data-theft-claims-a-33106
Spyware Manufacturer Had Access To Data Harvested By Former Polish Government, Current PM Says
"Polish investigators said they found evidence showing a spyware manufacturer harvested data from Polish opposition leaders and other victims and transmitted it to Israel. Prime Minister Donald Tusk, who ordered the investigation, on Monday called the sprawling spyware operation spearheaded by the country’s previous ruling party “one of the biggest scandals in Polish history since the fall of communism.” He accused Israel-based NSO Group, the spyware manufacturer involved in the scandal, of collaborating with Israeli intelligence services."
https://therecord.media/spyware-manufacturer-had-access-to-data-harvested-by-previous-polish-government
Russian Travel Booking Platform Suspends Reservations After Cyberattack
"Russian online travel agency Anywayanyday has temporarily suspended new bookings after a cyberattack on its IT infrastructure, leaving customers unable to purchase airline and train tickets or book hotels through its platform, the company said on Wednesday. The agency's website remains unavailable as it works to restore its systems. Previously confirmed reservations remain valid, Anywayanyday said, without providing a timeline for resuming normal operations."
https://therecord.media/russia-anywayanyday-travel-website-cyberattack

General News

Q3 2026 Statistical Report On Malware Targeting Windows Web Servers
"The AhnLab SEcurity intelligence Center (ASEC) analyzed the attack status of Windows web servers in the third quarter of 2026 based on AhnLab Smart Defense (ASD) logs. The targets were Internet Information Services (IIS) web servers and Apache Tomcat web servers running in Windows environments, with attacks primarily exploiting unpatched vulnerabilities, misconfigurations, and inadequate management environments. Threat actors gained control of the servers by uploading web shells, exploiting remote code execution vulnerabilities, using proxy tools, and employing privilege escalation tools."
https://asec.ahnlab.com/en/95812/
North Macedonian Police Arrest Alleged Administrator Behind OLVX Cybercrime Market
"The administrator behind a cybercriminal marketplace called OLVX was arrested this week in North Macedonia in a joint operation between the Balkan country’s Ministry of Interior and the FBI. The suspect was not named, but the FBI and North Macedonia said a raid on the man’s home in the village of Golema Rečica was conducted after charges were filed. Since 2023, OLVX has become a popular market where cybercriminals share stolen personal data, login credentials and other tools to help with cybercrime."
https://therecord.media/olvx-cybercrime-marketplace-arrest-north-macedonia
https://cyberscoop.com/olvx-cybercrime-marketplace-operator-charged-north-macedonia/
Ransomware Gangs Embrace Physical Threats, Family Stalking?
"Ransomware actors have been threatening their victims with physical violence, according to new survey data. Many are reporting actual physical attacks being carried out in service of ransomware extortions, though hard data substantiating these claims is missing. A combined two out of every five organizations that participated in Semperis's newly released 2026 Ransomware Risk Report indicated they had faced intimidation and threats associated with their ransomware attacks, and often severe ones. Even more remarkably, more than half of respondents claimed that attackers "carried through on threats" they made."
https://www.darkreading.com/cybersecurity-analytics/ransomware-gangs-physical-threats-family-stalking
https://www.theregister.com/cyber-crime/2026/10/14/ransomware-gets-personal-we-know-where-you-are-kind-of-stuff/5302939
Patching And Preventing Issues: What Are The Lessons You Can Learn?
"In this Help Net Security interview, Kunal Modasiya, Senior VP & GM at Qualys, talks about why patching is still hard to get right. He explains how business pressure, revenue-critical systems, and patches that break things keep fixes from going out. Modasiya argues that speed alone has limits and that teams should look at the whole remediation workflow. He discusses how proactive teams judge risk, why the gap between exposure time and weaponization time matters more than MTTR, and when automated patching makes sense on production networks."
https://www.helpnetsecurity.com/2026/10/14/kunal-modasiya-qualys-vulnerability-remediation/
Most Companies Count AI Agents As Insiders, And CISOs Worry About Their Own Liability
"Software that works on an employee’s behalf is now turning up in incident reports. At 95% of the companies in a Trellix survey of 600 CISOs, an AI agent or other autonomous system was linked to an insider incident in the past 12 months. The agent logs in, reaches sensitive systems, and acts for a person using that person’s permissions. Most respondents already count it that way: 78% include AI agents and machine identities in their definition of insider risk. They work at companies with more than 1,000 employees in the Americas, Europe, the Middle East, and Asia-Pacific."
https://www.helpnetsecurity.com/2026/10/14/ciso-ai-agent-insider-risk/
Passkey Authentications Double But Adoption Remains Slow
"Passkeys are an increasingly common feature on log-in screens but widespread adoption remains relatively low, according to new data from Dashlane. The credential security specialist analyzed millions of aggregated, anonymized passkey authentications that it managed between July 2025 and June 2026 to compile its third annual Passkey Power 20 report. It revealed that passkey authentications by Dashlane users have nearly doubled year on year, reaching 2.5 million per month in 2026. Additionally, over half (57%) of its users now store at least one passkey, compared with 40% last year."
https://www.infosecurity-magazine.com/news/passkey-authentications-double/
Billion-Dollar Companies Twice As Likely To Leave Critical Vulnerabilities Unpatched
"Companies with revenue of over $1bn are more than twice as likely as those who generate under $250m to knowingly leave high or critical vulnerabilities unpatched, according to new research. In a study released during its Assemble London event on October 14, software supply chain security firm Chainguard found that 66% of security leaders working in companies with $1bn or more in revenue admitted leaving high or critical vulnerabilities unpatched “at least sometimes”, while 27% of respondents in companies with under $250m in revenue reported the same issue."
https://www.infosecurity-magazine.com/news/companies-leave-critical/
https://get.chainguard.dev/hubfs/Web Content Assets/Web Content/The AI Exploit Gap_Chainguard Report 2027.pdf
Saudi National Arrested For Installing Surreptitious Audio Recording Device At OpenAI
"An employee of OpenAI has been arrested for and charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications. Abdulrahman Alfozan, 35, a national of the Kingdom of Saudi Arabia, was arrested on Oct. 9, and made his initial appearance in federal court today. “This serious situation underscores why winning the global super intelligence race is a national security prerogative — and why President Trump’s leadership in creating the Super Intelligence Force is so important,” said Director of National Intelligence Jay Clayton. “I thank Director Patel and our FBI partners for their diligence and swift action. The intelligence community remains committed to safeguarding America’s cutting-edge intellectual property from foreign threats.”"
https://www.justice.gov/opa/pr/saudi-national-arrested-installing-surreptitious-audio-recording-device-openai
https://www.bleepingcomputer.com/news/artificial-intelligence/openai-engineer-arrested-for-allegedly-planting-spy-device-in-office/
https://thehackernews.com/2026/10/openai-employee-arrested-for-allegedly.html
https://therecord.media/saudi-national-charged-with-spy-device-openai
https://www.bankinfosecurity.com/saudi-man-bugged-openai-used-chatbot-to-plan-inept-op-a-33103
https://www.securityweek.com/employee-arrested-after-listening-device-found-in-openai-conference-room-fbi-and-the-company-say/
https://securityaffairs.com/200933/cyber-crime/hidden-audio-recorder-found-at-openai-as-employee-faces-federal-charges.html
https://www.theregister.com/security/2026/10/14/openai-engineer-charged-after-boardroom-bug-found-wrapped-in-toilet-paper/5303000
https://www.helpnetsecurity.com/2026/10/14/openai-engineer-arrested-hidden-recording-device/

อ้างอิง
Electronic Transactions Development Agency (ETDA)