• Bearer CLI: Free, Source-Available Code Security Scanning Tool (SAST)
  "Bearer CLI is a free static application security testing (SAST) tool that scans source code for vulnerabilities and prioritizes them by the sensitive data they touch. SAST means the tool reads code without running it. Organizations can use it freely, with a license restriction covered below. Bearer’s complaint is that SAST tools can hand developers hundreds of findings with no sense of which to fix first. Its fix is to follow sensitive data through the code and put the flaws on those paths first, so whoever is triaging can start with the findings that can expose that data."
  https://www.helpnetsecurity.com/2026/10/19/bearer-cli-free-code-security-scanning-tool-sast/
  https://github.com/Bearer/bearer

Vulnerabilities

• Active Exploitation Of CVE-2026-110936 In Siemens Software Center
  "Siemens has validated that there is an active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center. Siemens fixed the weakness in version 4.0.9.8 and published advisory SSA-580366 on 15 October. Existing installations update automatically the next time they start. No Siemens system, product or update channel was breached to our knowledge. EDR vendors and authorities have been engaged for intelligence sharing, enabling broader detection coverage and coordinated defensive actions."
  https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/
  https://productcert.siemens.com/productcert/html/ssa-580366.html
  https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/

Malware

• PSA: Malware Found In Some Rank Math SEO PRO 3.0.123 Downloads
  "Rank Math has disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware. According to Rank Math, the affected version was downloaded or installed through an update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. If an affected copy of Rank Math SEO PRO 3.0.123 was active on your website, you should treat the website as compromised. Simply updating the plugin is not enough because the malware may have placed additional files, administrator accounts, or scheduled tasks elsewhere on the server."
  https://www.wordfence.com/blog/2026/10/rank-math-seo-pro-3-0-123-malware/
  https://rankmath.com/kb/pro-3-0-123-security-incident/
  https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html
  https://www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-math-compromised-to-backdoor-websites/
  https://www.securityweek.com/rank-math-pro-wordpress-plugin-compromised-in-supply-chain-attack/
• Targeting Democracy: Pegasus And Mercenary Spyware Attacks On Serbian Pro-Democracy Figures
  "In collaboration with the SHARE Foundation, we found with high confidence that Professor Vladan Đokić, Rector of the University of Belgrade, and prominent supporter of the Serbian student movement, was hacked with NSO Group’s Pegasus spyware in 2026. Additionally, we note that Rade Bajić, who, as a prosecutor, investigated official corruption in a failed project in Belgrade, received an Apple Threat Notification. These notifications are high-confidence indicators of targeting with mercenary spyware such as Pegasus. Our investigations into these cases are ongoing."
  https://citizenlab.ca/research/pegasus-spyware-serbian-pro-democracy/
  https://therecord.media/serbia-spyware-pegasus-elections
  https://cyberscoop.com/pegasus-spyware-serbia-critics-elections/
• Plex Vulnerabilities Being Exploited In The Wild To Drop a Cryptominer
  "If you see weird fonts and spacing, blame Blogger. Skip to "In the wild exploitation" if you just care about that part. It's just a cryptominer. On one hand that's not a big deal for victims on the other hand, I don't get interesting c o n t e n t to write about. I wouldn't be surprised if threat actors deploy more sophisticated things. Plex may be hosted on residential IP and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails. (edit: see update at the bottom. i do see proxy being deployed now)"
  https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
  https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html
  https://www.securityweek.com/plex2shell-exploit-chain-weaponized-against-plex-servers-hours-after-disclosure/
  https://securityaffairs.com/201324/hacking/plex2shell-exploit-used-to-turn-vulnerable-plex-servers-into-crypto-miners.html
• GhostAction Attack Escalates By Targeting GitHub Users
  "OpenSourceMalware has identified a new stage in the ongoing "GhostAction" malicious campaign that GitGuardian originally identified in 2025. This latest evolution appears to be an escalation and used two new domains targeting GitHub and GitLab. The GhostAction campaign is a continuing supply-chain campaign in which attackers compromise GitHub accounts and inject malicious Actions workflows across every repository those accounts can modify. Triggered by pushes or manual execution, the workflows steal CI/CD secrets—including package-publishing, cloud, GitHub, and AI-service credentials—and exfiltrate them to attacker-controlled infrastructure. Later variants expanded collection by scanning repository contents and complete git history, recovering credentials that developers believed had been deleted. GitGuardian (https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack- returns/)"
  https://opensourcemalware.com/blog/ghostaction-attack-escalates
  https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html
• Auditing The Auditor: Unmasking Apex Accelerator
  "Elastic Security Labs identified a malicious npm package, @apexacc/cli, which led us to an operation posing as a Web3 accelerator. That operation had spent months building a public presence, targeting cryptocurrency start-ups and founders with offers of free AI credits and coding tools, along with security audits. The group also advertised an in-person event through a dedicated invitation page, adding to its efforts to appear legitimate. The tools delivered information-stealing malware and backdoors for macOS and Windows machines. The operation also repackaged a legitimate coding agent to send model requests through attacker-controlled services, while its audit tools generated fabricated security findings."
  https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages
  https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html
• Inside Cairn: Open Windows Into Massive AI-Driven Cyber Operations
  "An investigation by NorForge into publicly exposed AI-driven penetration-testing control panels has uncovered how they are extensively used in malicious cyber operations. One of these is Cairn. In this setting, Cairn is an AI-powered hacking system. Give it a target and an objective, and it can coordinate AI agents to investigate the target, search for security weaknesses, and attempt to break in. More than 20 exposed Cairn panels were identified as likely associated with malicious activity, providing an unusually detailed view of how threat actors select targets, direct autonomous agents, exploit vulnerabilities, and establish persistent access to compromised systems. In addition, a considerable number of apparently legitimate red team operations were also exposed this way, potentially placing clients at risk."
  https://norforge.com/blog/inside_cairn

Breaches/Hacks/Leaks

• Nikkei Discloses Third Data Breach In a Month, 1.8M Records Exposed
  "Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. The Japanese giant says subsets of the data contained personally identifiable information and other sensitive details, but most records contained no identifying info. The company said that 150,000 records contained at least one of the following data types: full names, email addresses, physical addresses, telephone numbers, and dates of birth. Email addresses appeared in 120,000 records."
  https://www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/
• Bullhorn Takes Staffing Platform Offline To Contain Cyberattack
  "Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. The company says it has isolated the issue and eradicated the immediate threat. Currently, its team is working to restore services following thorough security reviews conducted with help from CrowdStrike specialists. Bullhorn is an American software company specializing in cloud-based staffing and recruitment solutions. Its platform helps staffing firms manage the recruitment lifecycle, including candidate tracking, onboarding, and payroll."
  https://www.bleepingcomputer.com/news/security/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack/
• OpenCode Hack Exposes API Keys Amid AI Distillation Attacks
  "The open-source AI coding project OpenCode has notified some users that stored API keys they used with external providers were exposed in a security breach. Multiple users reported that the incident led to unauthorized API charges and suspended projects in Google Cloud. According to the project maintainer, the breach affected 1.4% of OpenCode Console users, with some reporting more than $1,700 in unauthorized charges overnight."
  https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/
  https://thehackernews.com/2026/10/opencode-console-breach-may-have.html
  https://www.infosecurity-magazine.com/news/opencode-breach-openai-anthropic/
• Millions Of California Students’ Sensitive Data Stolen In Breach
  "Personal information belonging to millions of current and former California public school students has been stolen from a system operated by Educational Testing Service (ETS). ETS is a nonprofit organization that helps run the state’s standardized tests under contract with the California Department of Education (CDE). It has begun notifying students and families after an unauthorized party accessed and copied student information from an ETS-operated secure file transfer protocol (SFTP) site. CDE is distributing the ETS breach notice to help affected individuals receive information about the incident and available resources."
  https://www.malwarebytes.com/blog/data-breaches/2026/10/millions-of-california-students-sensitive-data-stolen-in-breach
  https://www.securityweek.com/one-compromised-login-exposed-millions-of-california-students-records/
• Ahold Delhaize Confirms 'malicious Actions' Behind Cyber Outages Affecting Grocery Brands
  "Ahold Delhaize, the Dutch multinational grocery chain, said Monday that a cyberattack forced it to take systems offline across most of its U.S. and European brands, impacting shoppers on both sides of the Atlantic. The company confirmed that the suspicious activity it announced detecting in its IT systems last week was caused by malicious actors, adding that it filed a police report in the Netherlands on Monday. The incident disrupted online services in the U.S., Netherlands and Belgium, although stores remained open. Although the company said it had no evidence that sensitive customer, employee or partner data was stolen, it cautioned that the investigation into the hack remains ongoing."
  https://therecord.media/ahold-delhaize-cyberattack-grocery
  https://www.theregister.com/security/2026/10/19/grocery-giant-ahold-delhaize-confirms-cyberattack-forced-us-and-european-systems-offline/5303970
• Hackers Steal Customer Data From Major Russian Hosting Provider FirstVDS
  "Hackers have stolen passwords, access credentials and other sensitive data belonging to customers of Russian hosting provider FirstVDS after exploiting a vulnerability in software used to manage its servers, the company said over the weekend. The attack, discovered on Saturday, affected part of FirstVDS's infrastructure, allowing the hackers to access data stored on customers' virtual servers without disrupting their operations."
  https://therecord.media/russia-cyberattack-firstvds-cloud

General News

• OnlyFans Copyright Takedowns Expose Compromised Websites
  "A university website gets hacked and, suddenly, its search results are promoting adult content. It sounds like an embarrassing but isolated incident. But according to research from UpGuard, these cases may be part of a much larger and growing problem — one that reveals how attackers exploit vulnerable websites and the digital footprints of legitimate organizations, exposing them to a variety of potential risks, including reputational damage. In an interview with Dark Reading associate editor Kristina Beek, Greg Pollock, UpGuard's director of research and insights, explains how an investigation into search engine spam led him to an unexpected source of threat intelligence: copyright takedown requests filed by OnlyFans and other adult content creators."
  https://www.darkreading.com/vulnerabilities-threats/onlyfans-copyright-takedowns-expose-compromised-websites
• The Evolving Cybersecurity Lexicon: Vulnerability Discovery To Resilience
  "Every year, the lexicographers at Merriam-Webster officially add new words or word usage to the dictionary. It's a fascinating process, outlined here. In 2009, a new usage of the word "tweet" was added to describe a social media post from the microblogging site then known as Twitter. "App" was added in 2010 to describe application software. And, in 2025, the word "slop" was amended to include AI slop, mass quantities of content created using generative AI. Watching our language and usage evolve gives us a glimpse into the zeitgeist."
  https://www.darkreading.com/vulnerabilities-threats/cybersecurity-lexicon-vulnerability-discovery-resilience
• Managing Open-Weight Model Risk In Enterprise Deployments
  "The growing AI landscape is giving enterprises more choice in how they build, customize, and deploy increasingly capable models. Open-weight models are an important part of that landscape. They give enterprises access to model weights and greater flexibility to inspect, evaluate, modify, and run models within their own environments. While that flexibility can be valuable, it also affects how enterprises evaluate models, where they implement safeguards, and who is responsible for maintaining those safeguards over time."
  https://www.microsoft.com/en-us/security/blog/2026/10/16/managing-open-weight-model-risk-in-enterprise-deployments/
  https://www.helpnetsecurity.com/2026/10/19/open-weight-ai-model-risks-microsoft-nvidia/
• Half The AI Bot Traffic Hammering Your Website Comes From Meta
  "AI agent traffic across DataDome’s network grew 41.5% quarter over quarter to nearly 25 billion requests in Q3 2026, according to the company’s AI Traffic Report Q3 2026. Meta’s Muse generated 29.1 million requests between September 22 and October 3, its first 12 days of full availability. In a sample of Muse traffic, 99.3% of requests came from cloud and CDN infrastructure. Nearly half of the AI agent traffic recorded in 2026 through September occurred in Q3. The growth had left capacity plans and bot-management policies based on the previous quarter’s averages out of date."
  https://www.helpnetsecurity.com/2026/10/19/datadome-ai-agent-traffic-report/
• Exploited Vulnerabilities Typically Take Three Months To Patch, Moody’s Finds
  "A new Moody’s report found that known exploited vulnerabilities take a median time of 87 days to be patched. This leaves half of these flaws unremediated after three months of their disclosures. This gap is even larger for vulnerabilities with no known exploitation evidence, for which median time to patch is at 107 days, the report showed."
  https://www.infosecurity-magazine.com/news/exploited-vulnerabilities-three/
• ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use And Abuse Of AI, & Iranian Cyber Espionage
  "ATT&CK v20 brings more critical infrastructure and cross-domain activity into the framework, with Campaigns for attacks on U.S. water utilities and an AI-assisted breach of Mexican government infrastructure that reached both IT and OT, along with new and updated Groups and Software tied to Iranian cyber espionage, Chinese and North Korean operations, and ransomware. Enterprise gains AI-focused and AI-enabled Techniques, ICS added Techniques for command and script execution and command and control over protocols industrial networks already use, and Mobile un-deprecated a Technique for delivering malicious apps outside official stores. On the defensive side, ICS Detection Strategies (DETs) now carry platform and Asset context, tying behaviors to the operational role of each system, and Mobile DETs reflect the visibility limits of Android and iOS."
  https://medium.com/mitre-attack/attack-v20-9701dd75ffb4
  https://www.securityweek.com/mitre-attck-v20-catalogs-ai-abuse-mfa-bypass-water-utility-attacks/
• PatchSlop: How Security Patches Became Maps For Attackers
  "Software security fixes are both bug closers and maps: they show where a given bug used to live and how the developer chose to close it. Narrowing down the fix so that it only blocks the reported case can point the next attacker toward undefended gaps around the repair. Terra Security noticed this in our own work this past year: a fix would ship, a bypass would be found, and another fix would go out. Worried this was sample bias, we looked at every published CVE record and every GitHub-reviewed advisory for one pattern: a fix ships, and a later advisory says it was incomplete or could be bypassed."
  https://www.terra.security/blog/how-security-patches-became-maps-for-attackers
  https://www.theregister.com/patches/2026/10/19/security-patches-need-patches-now-that-attackers-have-ai/5303927

อ้างอิง
Electronic Transactions Development Agency (ETDA)