Microsoft announced that Windows Server 2025 now supports quick machine recovery following the installation of the October 2026 security update. This update introduces a new feature aimed at improving recovery times for machines running this server version.
OVHcloud's open-source CLI tool was compromised on GitHub, with attacker-modified versions 0.11.0 through 0.15.0 containing malware designed to steal developer secrets. The compromise occurred via a hijacked developer GitHub account, allowing malicious releases to be published without CI/CD pipeline interference. The incident was detected and blocked within hours, and OVHcloud has enabled GitHub's release immutability feature to prevent recurrence. Users who downloaded affected versions are urged to revoke all secrets and perform system cleanup. The attack is linked to the GlassWorm threat actor group, known for targeting software development ecosystems. Source builds and Docker images were unaffected.
Microsoft announced new security controls to monitor and restrict AI agents operating within enterprise environments, treating them as insiders rather than trusted software. These controls include Dynamic Permissions that grant minimal access initially and adjust permissions per task, Dynamic Agent Risk scoring that continuously evaluates agent risk based on multiple signals, and Dynamic Conditional Access that scales permissions or requires human approval based on risk. The system also includes Playbooks and Guardian Agents to enforce security responses. This approach aims to mitigate risks from AI agents that may be overprivileged, make mistakes, be manipulated, or be compromised.
Ahold Delhaize, a major global food retail chain, experienced a cyberattack that disrupted services in stores across Europe and the United States. The incident affected operational capabilities but specific technical details and attack vectors have not been disclosed. There is no information on exploited vulnerabilities or ongoing threats. No patch or remediation details are provided.
Revolut experienced a significant service outage affecting multiple online banking and financial services worldwide. The disruption impacted sign-ins, card payments, transfers, currency exchange, stock trading, and live support chat. The company confirmed that customer funds and data remain safe. This outage follows previous data breaches disclosed by Revolut in recent years. The incident is ongoing, with the company actively working to restore full service.
This content is an announcement for a new Reddit community, r/BreachArchive, intended as an archive for data breach reports and discussions. It encourages users to share links about data breaches and security incidents to centralize information. There is no specific security vulnerability or threat detailed in this content.
This entry is a daily update from the SANS Internet Storm Center (ISC) titled 'ISC Stormcast For Tuesday, October 20th, 2026.' It provides general information and links related to SANS ISC activities and classes but does not contain any specific security threat or vulnerability details.
Bullhorn, a cloud-based staffing software company, experienced a cyberattack that caused a system-wide outage, leading the company to disable access to its platform to contain the incident. The company has isolated the issue and eradicated the immediate threat, with ongoing efforts to restore services after security reviews with CrowdStrike. It is not yet confirmed whether customer data was exfiltrated. Several major services remain degraded or offline, while some continue to operate. Bullhorn requires non-SSO users to reset passwords and mandates API password rotations to protect integrations. The company will notify affected individuals if a data breach is confirmed.
The open-source AI coding project OpenCode experienced a security breach that exposed API keys used by a small number of its users with external providers. The incident involves unauthorized access to sensitive credentials, potentially impacting the security of those external services. No detailed technical information or exploit methods have been disclosed. There is no indication of active exploitation in the wild or a vendor patch. The affected versions are not specified.
Federal authorities arrested Edward Dubrovsky, a Canadian cybersecurity executive involved in ransomware negotiation, on charges related to assisting the ShinyHunters hacking group. ShinyHunters is known for stealing sensitive data, including from FBI servers, and extorting victims. Dubrovsky allegedly had knowledge of these breaches and did not inform the FBI prior to public threats by ShinyHunters. The case is part of a broader FBI investigation centralized in Texas, with other arrests and ongoing inquiries into ransomware negotiation firms. Dubrovsky's role as a negotiator raises concerns about conflicts of interest in ransomware response services.
Microsoft fixed a bug in the September 2026 Windows 11 preview update (KB5124010) that caused crashes in games and apps using AC-3 (Dolby Digital) audio decoding. The issue affected applications that rely on Windows' built-in audio decoding for AC-3, causing them to fail to launch or crash during audio playback. The problem was resolved in the October 2026 Patch Tuesday update (KB5127648), which is recommended for affected Windows 11 24H2 and later systems.
A user on Reddit's r/cybersecurity subreddit describes a custom hardware device built with a Raspberry Pi Pico and fingerprint sensor that outputs passwords as an HID device. The device employs encrypted password storage, signed firmware with secure boot, and fused read-only keys and debug ports to enhance security. The user seeks external analysis of the firmware repository for potential vulnerabilities, mentioning that the firmware was developed with assistance from an AI tool (claude.ai). No specific vulnerabilities or exploits are reported.
Cybercriminals operate an underground market offering forged identity documents, deepfake videos, and live verification services to bypass Know Your Client (KYC) checks used by financial institutions. These services include generating fake passports, driver’s licenses, social security cards, and manipulated biometric verification to create fraudulent verified accounts. The market also provides ongoing support to maintain access to these accounts. Financial institutions are advised to use combined detection methods, including document and facial image integrity checks, unpredictable live verification prompts, and device fingerprinting to detect such fraud.
ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services following a cyberattack involving compromised credentials that allowed unauthorized access to Microsoft 365 tenants. The attacker used a stolen Cloud Backup credential to sign into numerous tenants, with evidence of scripted access attempts and privilege escalations. ConnectWise shut down affected services to contain the incident and continues remediation and security validation. Customers' backups remain encrypted and protected, with no evidence of unauthorized access to backup data. The company has not provided a timeline for service restoration.
The Plex2Shell exploit chain is a combination of four vulnerabilities in Plex Media Server that allows attackers to execute arbitrary code without valid credentials. These vulnerabilities were disclosed publicly on October 16, 2026, with proof-of-concept code. Attackers began exploiting the flaws within hours, delivering cryptocurrency miners and proxy software to compromised servers. Plex released fixes on September 1, 2026, and urged users to upgrade immediately. The exploit runs with the same privileges as the Plex service, enabling attackers to deploy malicious payloads such as XMRig miners and proxy tools that could be used to route traffic through residential IPs. The attack was confirmed by a researcher monitoring a vulnerable honeypot. Server owners are strongly advised to apply the official patches released by Plex.
MITRE ATT&CK version 20 introduces new techniques and detection strategies addressing AI abuse, multi-factor authentication (MFA) bypass, and attacks on water utilities. The update includes 15 new detection strategies for Enterprise and ICS environments, supported by 38 analytics. Notable additions cover prompt injection attacks on large language models, theft of application-specific passwords to bypass MFA, CAPTCHA bypass methods, and attacks on internet-exposed programmable logic controllers (PLCs) at water utilities. The update also documents threat actor activities, including espionage groups and ransomware operators. These enhancements reflect recent adversary tactics and tradecraft without confirming active exploitation or specific vulnerabilities.
Microsoft's October Windows Server security updates have been confirmed to cause issues with Outlook Web Access (OWA) sign-in and mail delivery on some Exchange Server systems. This disruption affects the normal operation of Exchange Server mail flow and user access via OWA.
Anthropic has acquired Opaque Systems, a startup specializing in confidential AI technology that enables AI systems to use sensitive data securely by leveraging hardware-based protections. Opaque Systems also expanded its work to verifiable AI, providing cryptographic evidence of AI system behavior to replace trust assumptions. The acquisition includes Opaque's team joining Anthropic, with Opaque winding down its operations. The impact on existing customers has not been disclosed. This announcement is a security-industry news event rather than a vulnerability or exploit.
A user on Reddit's r/cybersecurity subreddit reported that the SSL/TLS certificate for the website ic3.gov appears to be expired when accessed via Chrome on two different networks. No further technical details or vendor advisories are provided regarding this certificate expiration.
A YARA rule has been published to detect orphaned VBA projects inside DWG files. The rule identifies specific signatures related to these orphaned VBA projects. A VirusTotal retrohunt using this rule found only two detections, indicating limited prevalence. No specific vulnerability or exploit details are provided.