Cyber Threat Intel Daily Briefing — 2026-10-17

CYBER THREAT INTEL

DAILY BRIEFING · 2026-10-17 12:16 UTC · REPORT BRIEF-20261017-121600

OPEN // LE

01

U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploite

SRC: Security Affairs Sat, 17 Oct 2026 10:35:48 +0000 https://securityaffairs.com/201178/security/u-s-cisa-adds-fortinet-multiple-products-and-beyondtrust-remote-support-flaws-to-its-known-exploited-vulnerabilities-catalog.html

02

BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs

Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.

SRC: DarkReading Fri, 16 Oct 2026 20:34:37 GMT https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs

03

Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk

Campaigns that impersonate popular AI brands are on the rise, and they typically use ClickFix-like tactics to target unsuspecting enterprise employees.

SRC: DarkReading Fri, 16 Oct 2026 19:49:30 GMT https://www.darkreading.com/application-security/fake-claude-chatgpt-attacks-developers-risk

04

Critical BlockStrap flaw lets hackers run code on Magento servers

Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. […]

SRC: BleepingComputer Fri, 16 Oct 2026 16:00:59 -0400 https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/

05

When Your Ransomware Negotiator Works for the Other Side

The shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight.

SRC: DarkReading Fri, 16 Oct 2026 14:00:00 GMT https://www.darkreading.com/cyber-risk/when-your-ransomware-negotiator-works-other-side

06

Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel

Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets. The post Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel appeared first on SecurityWeek.

SRC: SecurityWeek Sat, 17 Oct 2026 11:00:00 +0000 https://www.securityweek.com/israeli-ad-firm-doubled-as-candirus-zero-click-spyware-delivery-channel/

07

BAE Systems Cyber Incident Takes US Bankruptcy Noticing Center Offline for a Week

A cyber incident at a BAE Systems subsidiary just stopped every bankruptcy court in the US from sending notices, and the problem started a week ago. A security incident at BAE Systems Inc., the US subsidiary of British defense contractor BAE Systems, has taken the Bankruptcy Noticing Center offline

SRC: Security Affairs Sat, 17 Oct 2026 10:08:42 +0000 https://securityaffairs.com/201166/security/bae-systems-cyber-incident-takes-us-bankruptcy-noticing-center-offline-for-a-week.html

08

AI Takes Control of Robotic Arm in 16 Minutes Flat

Most OT devices at utilities, factories, and elsewhere have been deployed for a decade or more, but operators need to get agile and deploy new cyber defenses.

SRC: DarkReading Fri, 16 Oct 2026 18:37:50 GMT https://www.darkreading.com/ics-ot-security/ai-takes-control-robotic-arm-16-minutes

09

Targeted ads installed Candiru spyware in zero-click attacks

Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. […]

SRC: BleepingComputer Fri, 16 Oct 2026 13:20:03 -0400 https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware/

10

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise C

SRC: The Hacker News Sat, 17 Oct 2026 11:46:46 +0530 https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html

11

When AI Agents Commit Breaches, Humans May Not Be Held Liable

As agents escape containment and access external systems, responsibility remains human. Accountability, however, is much less settled.

SRC: DarkReading Fri, 16 Oct 2026 13:00:00 GMT https://www.darkreading.com/insider-threats/ai-agents-breaches-humans-liable

12

UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing

Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google accou

SRC: The Hacker News Fri, 16 Oct 2026 21:46:44 +0530 https://thehackernews.com/2026/10/uat-11985-uses-fake-event-invites-to.html

13

Burger King Japan Data Breach Impacted 11 Million Customers

Burger King Japan disclosed a breach exposing 11.18 million app users’ personal data after attackers accessed its membership system in early October. Burger King Japan has disclosed a data breach that exposed the personal information of approximately 11.18 million official app members. Burger King J

SRC: Security Affairs Fri, 16 Oct 2026 14:04:38 +0000 https://securityaffairs.com/201119/security/burger-king-japan-data-breach-impacted-11-million-customers.html

14

MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been download

SRC: The Hacker News Sat, 17 Oct 2026 16:41:56 +0530 https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html

15

Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and ru

SRC: The Hacker News Fri, 16 Oct 2026 22:13:39 +0530 https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html

16

OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract

OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test cryptocurrency from a third-party's wallet without authorization to com

SRC: The Hacker News Fri, 16 Oct 2026 19:33:04 +0530 https://thehackernews.com/2026/10/openai-research-model-spent-3rd-party.html

17

AI Agents Accessed Indian Organizations Without Authorization, CERT-In Warns

India’s CERT-In warns AI agents accessed confidential data undetected, while attackers used offensive AI frameworks to accelerate cyberattacks. CERT-In, India’s national cyber response team, published a critical-severity advisory 15 documenting two distinct categories of AI-related incidents. In one

SRC: Security Affairs Sat, 17 Oct 2026 08:55:55 +0000 https://securityaffairs.com/201130/ai/ai-agents-accessed-indian-organizations-without-authorization-cert-in-warns.html

18

Federal agencies recommend cyber controls, independent testing for frontier AI systems

While voluntary, the document marks the federal government’s most detailed cybersecurity guidance for securing sandbox environments during AI model tests. The post Federal agencies recommend cyber controls, independent testing for frontier AI systems appeared first on CyberScoop.

SRC: CyberScoop Sat, 17 Oct 2026 00:34:02 +0000 https://cyberscoop.com/federal-ai-agent-sandbox-security-guidance/

19

Biomemory Launches DNA Shield, First Commercial Product Built on Its Molecular IT Platform

The launch follows the acquisition of catalog's assets and the appointment of Laurent Guengant as CEO earlier this year.

SRC: DarkReading Fri, 16 Oct 2026 19:22:12 GMT https://www.darkreading.com/data-privacy/biomemory-launches-dna-shield

20

Enterprise AI Enters Risk Management Phase as Security Concerns Rise

Companies are increasingly discovering that the challenge with AI is no longer adoption, but execution.

SRC: DarkReading Fri, 16 Oct 2026 19:13:59 GMT https://www.darkreading.com/cyber-risk/enterprise-ai-risk-management-phase-security-concerns-rise

[ SOURCE ] OpenPhish (18 indicator(s))